185.234.216.211 Open in urlscan Pro
185.234.216.211 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://185.234.216.211/netbill/Login.php?sslchannel=true&sessionid=4wceHNNwF399OJSQlPXGYvSBIym2rKJ11ZlytpsNc2SrL2rZXVZL...
Submission: On April 10 via automatic, source openphish (April 10th 2018, 3:01:27 am UTC)

Summary HTTP 12 Redirects Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 6 IPs in 4 countries across 3 domains to perform 12 HTTP transactions. The main IP is 185.234.216.211, located in and belongs to SPRINT-SDC, PL. The main domain is 185.234.216.211.

This is the only time 185.234.216.211 was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address		AS Autonomous System
5	185.234.216.211 185.234.216.211		197226 (SPRINT-SDC) (SPRINT-SDC)
2	94.31.29.54 94.31.29.54		54104 (AS-STACKPATH) (AS-STACKPATH - netDNA)
1	64.13.192.166 64.13.192.166		31815 (MEDIATEMPLE) (MEDIATEMPLE - Media Temple)
1	52.212.136.196 52.212.136.196		16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	52.209.236.203 52.209.236.203		16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
12	6

5 185.234.216.211 (None, )

ASN197226 (SPRINT-SDC, PL)

185.234.216.211	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 94.31.29.54 (United Kingdom)

ASN54104 (AS-STACKPATH - netDNA, US)
PTR: 94.31.29.54.IPYX-077437-ZYO.above.net

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.13.192.166 (Culver City, United States)

ASN31815 (MEDIATEMPLE - Media Temple, Inc., US)
PTR: acmkokeaac.gs01.gridserver.com

swip.codylindley.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.212.136.196 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-212-136-196.eu-west-1.compute.amazonaws.com

www.netflix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.209.236.203 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-209-236-203.eu-west-1.compute.amazonaws.com

www.netflix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	netflix.com www.netflix.com Failed	3 KB
2	jquery.com code.jquery.com	42 KB
1	codylindley.com swip.codylindley.com	3 KB
12	3

	Domain	Requested by
2	www.netflix.com	185.234.216.211
2	code.jquery.com	185.234.216.211
1	swip.codylindley.com	185.234.216.211
12	3

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://185.234.216.211/netbill/Login.php?sslchannel=true&sessionid=4wceHNNwF399OJSQlPXGYvSBIym2rKJ11ZlytpsNc2SrL2rZXVZLVshVPlP6qxbbNdmJXukSNmMIu04GMuvA54wtxblZEvujc2SokDYb6lAIqmgWytk5Ex8dlB4CgRiV9J
Frame ID: EE9D38DD9FDB394D50918630FD2A73AB
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i
headers server /php\/?([\d.]+)?/i

Windows Server (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Win32|Win64/i

OpenSSL (Web Server Extensions) Expand

Overall confidence: 100%
Detected patterns

headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<[^>]+data-react/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js/i
env /^jQuery$/i

Page Statistics

12
Requests

0 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

6
IPs

4
Countries

364 kB
Transfer

419 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set Login.php Show response
185.234.216.211/netbill/ 40 KB
40 KB 415ms
369ms Document
text/html 185.234.216.211
SPRINT-SDC

General

Check archive.org

Show headers Download Go to

Full URL: http://185.234.216.211/netbill/Login.php?sslchannel=true&sessionid=4wceHNNwF399OJSQlPXGYvSBIym2rKJ11ZlytpsNc2SrL2rZXVZLVshVPlP6qxbbNdmJXukSNmMIu04GMuvA54wtxblZEvujc2SokDYb6lAIqmgWytk5Ex8dlB4CgRiV9J
Protocol: HTTP/1.1
Server: 185.234.216.211 -, , ASN197226 (SPRINT-SDC, PL),
Reverse DNS
Software: Apache/2.4.29 (Win32) OpenSSL/1.1.0g PHP/7.2.2 / PHP/7.2.2
Resource Hash: 88cb74149bc19a9751661dcf0c4b572f7a549fb56d4d6b8946ad95040f4fe889

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: 185.234.216.211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Cache-Control: no-cache
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 10 Apr 2018 03:01:19 GMT
Server: Apache/2.4.29 (Win32) OpenSSL/1.1.0g PHP/7.2.2
X-Powered-By: PHP/7.2.2
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Set-Cookie: PHPSESSID=lrs4pp3kukc38levnpaohvdhrc; path=/
Cache-Control: no-store, no-cache, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H/1.1 200
OK jquery-1.11.0.min.js Show response
code.jquery.com/ 94 KB
39 KB 13ms
7ms Script
application/javascript 94.31.29.54
netDNA

General

Check archive.org

Show headers Download Go to

Full URL: http://code.jquery.com/jquery-1.11.0.min.js
Requested by: Host: 185.234.216.211
URL: http://185.234.216.211/netbill/Login.php?sslchannel=true&sessionid=4wceHNNwF399OJSQlPXGYvSBIym2rKJ11ZlytpsNc2SrL2rZXVZLVshVPlP6qxbbNdmJXukSNmMIu04GMuvA54wtxblZEvujc2SokDYb6lAIqmgWytk5Ex8dlB4CgRiV9J
Protocol: HTTP/1.1
Server: 94.31.29.54 , United Kingdom, ASN54104 (AS-STACKPATH - netDNA, US),
Reverse DNS: 94.31.29.54.IPYX-077437-ZYO.above.net
Software: NetDNA-cache/2.2 /
Resource Hash: b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682

Request headers

Referer: http://185.234.216.211/netbill/Login.php?sslchannel=true&sessionid=4wceHNNwF399OJSQlPXGYvSBIym2rKJ11ZlytpsNc2SrL2rZXVZLVshVPlP6qxbbNdmJXukSNmMIu04GMuvA54wtxblZEvujc2SokDYb6lAIqmgWytk5Ex8dlB4CgRiV9J
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Tue, 10 Apr 2018 03:01:16 GMT
Content-Encoding: gzip
Last-Modified: Fri, 24 Oct 2014 00:16:07 GMT
Server: NetDNA-cache/2.2
ETag: W/"54499a47-1787d"
Vary: Accept-Encoding
X-Cache: HIT
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000, public
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK jquery-migrate-1.2.1.min.js Show response
code.jquery.com/ 7 KB
4 KB 11ms
6ms Script
application/javascript 94.31.29.54
netDNA

General

Check archive.org

Show headers Download Go to

Full URL: http://code.jquery.com/jquery-migrate-1.2.1.min.js
Requested by: Host: 185.234.216.211
URL: http://185.234.216.211/netbill/Login.php?sslchannel=true&sessionid=4wceHNNwF399OJSQlPXGYvSBIym2rKJ11ZlytpsNc2SrL2rZXVZLVshVPlP6qxbbNdmJXukSNmMIu04GMuvA54wtxblZEvujc2SokDYb6lAIqmgWytk5Ex8dlB4CgRiV9J
Protocol: HTTP/1.1
Server: 94.31.29.54 , United Kingdom, ASN54104 (AS-STACKPATH - netDNA, US),
Reverse DNS: 94.31.29.54.IPYX-077437-ZYO.above.net
Software: NetDNA-cache/2.2 /
Resource Hash: 1e67d8dbcca1f6fd94e077c85c2fb40fa1c2756c99238daa8da882144260a68d

Request headers

Referer: http://185.234.216.211/netbill/Login.php?sslchannel=true&sessionid=4wceHNNwF399OJSQlPXGYvSBIym2rKJ11ZlytpsNc2SrL2rZXVZLVshVPlP6qxbbNdmJXukSNmMIu04GMuvA54wtxblZEvujc2SokDYb6lAIqmgWytk5Ex8dlB4CgRiV9J
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Tue, 10 Apr 2018 03:01:16 GMT
Content-Encoding: gzip
Last-Modified: Fri, 24 Oct 2014 00:16:08 GMT
Server: NetDNA-cache/2.2
ETag: W/"54499a48-1c1f"
Vary: Accept-Encoding
X-Cache: HIT
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=315360000, public
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK jquery.popupWindow.js Show response
swip.codylindley.com/ 3 KB
3 KB 486ms
157ms Script
application/javascript 64.13.192.166
Media Temple

General

Check archive.org

Show headers Download Go to

Full URL: http://swip.codylindley.com/jquery.popupWindow.js
Requested by: Host: 185.234.216.211
URL: http://185.234.216.211/netbill/Login.php?sslchannel=true&sessionid=4wceHNNwF399OJSQlPXGYvSBIym2rKJ11ZlytpsNc2SrL2rZXVZLVshVPlP6qxbbNdmJXukSNmMIu04GMuvA54wtxblZEvujc2SokDYb6lAIqmgWytk5Ex8dlB4CgRiV9J
Protocol: HTTP/1.1
Server: 64.13.192.166 Culver City, United States, ASN31815 (MEDIATEMPLE - Media Temple, Inc., US),
Reverse DNS: acmkokeaac.gs01.gridserver.com
Software: Apache/2.2.22 /
Resource Hash: 2d27d0ee0936df3f59ad1566125b5b5a3bef7111105198904a51077f9d7986a6

Request headers

Referer: http://185.234.216.211/netbill/Login.php?sslchannel=true&sessionid=4wceHNNwF399OJSQlPXGYvSBIym2rKJ11ZlytpsNc2SrL2rZXVZLVshVPlP6qxbbNdmJXukSNmMIu04GMuvA54wtxblZEvujc2SokDYb6lAIqmgWytk5Ex8dlB4CgRiV9J
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Tue, 10 Apr 2018 03:01:16 GMT
Last-Modified: Sat, 28 Feb 2009 17:35:18 GMT
Server: Apache/2.2.22
ETag: "36857f5-bdc-463fe0248a180"
Vary: User-Agent
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 3036

GET
H/1.1 200
OK none.css
185.234.216.211/netbill/css/ 120 KB
121 KB 79ms
42ms Stylesheet
text/css 185.234.216.211
SPRINT-SDC

General

Check archive.org

Show headers Download Go to

Full URL: http://185.234.216.211/netbill/css/none.css
Requested by: Host: 185.234.216.211
URL: http://185.234.216.211/netbill/Login.php?sslchannel=true&sessionid=4wceHNNwF399OJSQlPXGYvSBIym2rKJ11ZlytpsNc2SrL2rZXVZLVshVPlP6qxbbNdmJXukSNmMIu04GMuvA54wtxblZEvujc2SokDYb6lAIqmgWytk5Ex8dlB4CgRiV9J
Protocol: HTTP/1.1
Server: 185.234.216.211 -, , ASN197226 (SPRINT-SDC, PL),
Reverse DNS
Software: Apache/2.4.29 (Win32) OpenSSL/1.1.0g PHP/7.2.2 /
Resource Hash: 320107e4f89a18b757b55101c4d9014c879c7a7be24ce41bee3bf6ed609ca5c7

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: 185.234.216.211
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://185.234.216.211/netbill/Login.php?sslchannel=true&sessionid=4wceHNNwF399OJSQlPXGYvSBIym2rKJ11ZlytpsNc2SrL2rZXVZLVshVPlP6qxbbNdmJXukSNmMIu04GMuvA54wtxblZEvujc2SokDYb6lAIqmgWytk5Ex8dlB4CgRiV9J
Cookie: PHPSESSID=lrs4pp3kukc38levnpaohvdhrc
Connection: keep-alive
Cache-Control: no-cache
Referer: http://185.234.216.211/netbill/Login.php?sslchannel=true&sessionid=4wceHNNwF399OJSQlPXGYvSBIym2rKJ11ZlytpsNc2SrL2rZXVZLVshVPlP6qxbbNdmJXukSNmMIu04GMuvA54wtxblZEvujc2SokDYb6lAIqmgWytk5Ex8dlB4CgRiV9J
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Tue, 10 Apr 2018 03:01:19 GMT
Last-Modified: Fri, 20 Oct 2017 21:25:22 GMT
Server: Apache/2.4.29 (Win32) OpenSSL/1.1.0g PHP/7.2.2
ETag: "1e1d6-55c011c3c7480"
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 123350

GET WebsiteDetect
www.netflix.com/ichnaea/cl2/freeform/ 0
0

GET
H/1.1 200
OK fb.png
185.234.216.211/netbill/img/ 1 KB
2 KB 42ms
42ms Image
image/png 185.234.216.211
SPRINT-SDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://185.234.216.211/netbill/img/fb.png
Requested by: Host: 185.234.216.211
URL: http://185.234.216.211/netbill/Login.php?sslchannel=true&sessionid=4wceHNNwF399OJSQlPXGYvSBIym2rKJ11ZlytpsNc2SrL2rZXVZLVshVPlP6qxbbNdmJXukSNmMIu04GMuvA54wtxblZEvujc2SokDYb6lAIqmgWytk5Ex8dlB4CgRiV9J
Protocol: HTTP/1.1
Server: 185.234.216.211 -, , ASN197226 (SPRINT-SDC, PL),
Reverse DNS
Software: Apache/2.4.29 (Win32) OpenSSL/1.1.0g PHP/7.2.2 /
Resource Hash: 3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: 185.234.216.211
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://185.234.216.211/netbill/Login.php?sslchannel=true&sessionid=4wceHNNwF399OJSQlPXGYvSBIym2rKJ11ZlytpsNc2SrL2rZXVZLVshVPlP6qxbbNdmJXukSNmMIu04GMuvA54wtxblZEvujc2SokDYb6lAIqmgWytk5Ex8dlB4CgRiV9J
Cookie: PHPSESSID=lrs4pp3kukc38levnpaohvdhrc
Connection: keep-alive
Cache-Control: no-cache
Referer: http://185.234.216.211/netbill/Login.php?sslchannel=true&sessionid=4wceHNNwF399OJSQlPXGYvSBIym2rKJ11ZlytpsNc2SrL2rZXVZLVshVPlP6qxbbNdmJXukSNmMIu04GMuvA54wtxblZEvujc2SokDYb6lAIqmgWytk5Ex8dlB4CgRiV9J
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Tue, 10 Apr 2018 03:01:19 GMT
Last-Modified: Thu, 31 Aug 2017 20:51:02 GMT
Server: Apache/2.4.29 (Win32) OpenSSL/1.1.0g PHP/7.2.2
ETag: "5af-55812cd629980"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 1455

GET WebsiteDetect
www.netflix.com/ichnaea/cl2/freeform/ 0
0

GET
H/1.1 200
OK WebsiteDetect Show response
www.netflix.com/ichnaea/cl2/freeform/ 0
1 KB 121ms
34ms XHR
text/plain 52.212.136.196
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://www.netflix.com/ichnaea/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=js&modalView=login

Requested by

Host: 185.234.216.211
URL: http://185.234.216.211/netbill/Login.php?sslchannel=true&sessionid=4wceHNNwF399OJSQlPXGYvSBIym2rKJ11ZlytpsNc2SrL2rZXVZLVshVPlP6qxbbNdmJXukSNmMIu04GMuvA54wtxblZEvujc2SokDYb6lAIqmgWytk5Ex8dlB4CgRiV9J

Protocol

HTTP/1.1

Server

52.212.136.196 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-52-212-136-196.eu-west-1.compute.amazonaws.com

Software

ichnaea i-0de0944409684c6cc /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block; report=https://ichnaea.netflix.com/log/freeform/xssreport

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer: http://185.234.216.211/netbill/Login.php?sslchannel=true&sessionid=4wceHNNwF399OJSQlPXGYvSBIym2rKJ11ZlytpsNc2SrL2rZXVZLVshVPlP6qxbbNdmJXukSNmMIu04GMuvA54wtxblZEvujc2SokDYb6lAIqmgWytk5Ex8dlB4CgRiV9J
Origin: http://185.234.216.211

Response headers

Date: Tue, 10 Apr 2018 03:01:16 GMT
Via: 1.1 i-04c08e5e84454e8f1 (eu-west-1)
X-Content-Type-Options: nosniff
X-Netflix-From-Zuul: true
X-Netflix_proxy_execution-time: 5
Connection: keep-alive
Content-Length: 0
X-XSS-Protection: 1; mode=block; report=https://ichnaea.netflix.com/log/freeform/xssreport
Pragma: no-cache
Allow: GET, POST, OPTIONS
Server: ichnaea i-0de0944409684c6cc
X-Netflix_nfstatus: 1_1
Strict-Transport-Security: max-age=31536000
Access-Control-Allow-Methods: GET, POST, OPTIONS
X-Originating-URL: https://www.netflix.com/ichnaea/cl2/freeform/WebsiteDetect?modalView=login&source=wwwhead&fetchType=js
Access-Control-Allow-Origin: http://185.234.216.211
Accept: text/plain, text/html
Cache-Control: no-cache, no-store, no-transform, max-age=0
Access-Control-Allow-Credentials: true
X-Ichnaea: ~O=true~RL=255
Content-Type: text/plain
Access-Control-Allow-Headers: Authorization,Content-Type,Accept,Cookie,X-Netflix.application.name,X-Netflix.application.version,X-Netflix.esn,X-Netflix.device.type,X-Netflix.certification.version,X-Netflix.request.uuid,X-Netflix.user.id,X-Netflix.oauth.consumer.key,X-Netflix.oauth.token,X-Netflix.ichnaea.request.type,debugRequest
Expires: Mon, 09 Apr 2018 03:01:16 GMT

GET
H/1.1 200
OK WebsiteScreen Show response
www.netflix.com/ichnaea/cl2/freeform/ 0
1 KB 161ms
74ms XHR
text/plain 52.209.236.203
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://www.netflix.com/ichnaea/cl2/freeform/WebsiteScreen?source=wwwhead&fetchType=js&winw=1600&winh=1200&screenw=1600&screenh=1200&ratio=1

Requested by

Host: 185.234.216.211
URL: http://185.234.216.211/netbill/Login.php?sslchannel=true&sessionid=4wceHNNwF399OJSQlPXGYvSBIym2rKJ11ZlytpsNc2SrL2rZXVZLVshVPlP6qxbbNdmJXukSNmMIu04GMuvA54wtxblZEvujc2SokDYb6lAIqmgWytk5Ex8dlB4CgRiV9J

Protocol

HTTP/1.1

Server

52.209.236.203 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-52-209-236-203.eu-west-1.compute.amazonaws.com

Software

ichnaea i-0b9d022f7cc676fb1 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block; report=https://ichnaea.netflix.com/log/freeform/xssreport

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer: http://185.234.216.211/netbill/Login.php?sslchannel=true&sessionid=4wceHNNwF399OJSQlPXGYvSBIym2rKJ11ZlytpsNc2SrL2rZXVZLVshVPlP6qxbbNdmJXukSNmMIu04GMuvA54wtxblZEvujc2SokDYb6lAIqmgWytk5Ex8dlB4CgRiV9J
Origin: http://185.234.216.211

Response headers

Date: Tue, 10 Apr 2018 03:01:16 GMT
Via: 1.1 i-0c16bc57d91d11446 (eu-west-1)
X-Content-Type-Options: nosniff
X-Netflix-From-Zuul: true
X-Netflix_proxy_execution-time: 45
Connection: keep-alive
Content-Length: 0
X-XSS-Protection: 1; mode=block; report=https://ichnaea.netflix.com/log/freeform/xssreport
Pragma: no-cache
Allow: GET, POST, OPTIONS
Server: ichnaea i-0b9d022f7cc676fb1
X-Netflix_nfstatus: 1_1
Strict-Transport-Security: max-age=31536000
Access-Control-Allow-Methods: GET, POST, OPTIONS
X-Originating-URL: https://www.netflix.com/ichnaea/cl2/freeform/WebsiteScreen?screenw=1600&source=wwwhead&fetchType=js&winh=1200&winw=1600&screenh=1200&ratio=1
Access-Control-Allow-Origin: http://185.234.216.211
Accept: text/plain, text/html
Cache-Control: no-cache, no-store, no-transform, max-age=0
Access-Control-Allow-Credentials: true
X-Ichnaea: ~O=true~RL=229
Content-Type: text/plain
Access-Control-Allow-Headers: Authorization,Content-Type,Accept,Cookie,X-Netflix.application.name,X-Netflix.application.version,X-Netflix.esn,X-Netflix.device.type,X-Netflix.certification.version,X-Netflix.request.uuid,X-Netflix.user.id,X-Netflix.oauth.consumer.key,X-Netflix.oauth.token,X-Netflix.ichnaea.request.type,debugRequest
Expires: Mon, 09 Apr 2018 03:01:16 GMT

GET
H/1.1 200
OK crown.jpg
185.234.216.211/netbill/img/ 84 KB
85 KB 44ms
44ms Image
image/jpeg 185.234.216.211
SPRINT-SDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://185.234.216.211/netbill/img/crown.jpg
Requested by: Host: code.jquery.com
URL: http://code.jquery.com/jquery-1.11.0.min.js
Protocol: HTTP/1.1
Server: 185.234.216.211 -, , ASN197226 (SPRINT-SDC, PL),
Reverse DNS
Software: Apache/2.4.29 (Win32) OpenSSL/1.1.0g PHP/7.2.2 /
Resource Hash: baafd74a4cb4dc594b614eeb45c7267bb1af729d9271752460348ece16532d04

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: 185.234.216.211
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://185.234.216.211/netbill/css/none.css
Cookie: PHPSESSID=lrs4pp3kukc38levnpaohvdhrc
Connection: keep-alive
Cache-Control: no-cache
Referer: http://185.234.216.211/netbill/css/none.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

Response headers

Date: Tue, 10 Apr 2018 03:01:20 GMT
Last-Modified: Fri, 20 Oct 2017 21:12:54 GMT
Server: Apache/2.4.29 (Win32) OpenSSL/1.1.0g PHP/7.2.2
ETag: "150d2-55c00efa6e180"
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 86226

GET
H/1.1 200
OK one.woff
185.234.216.211/netbill/fonts/ 69 KB
69 KB 320ms
320ms Font
font/woff 185.234.216.211
SPRINT-SDC

General

Check archive.org

Show headers Download Go to

Full URL: http://185.234.216.211/netbill/fonts/one.woff
Requested by: Host: code.jquery.com
URL: http://code.jquery.com/jquery-1.11.0.min.js
Protocol: HTTP/1.1
Server: 185.234.216.211 -, , ASN197226 (SPRINT-SDC, PL),
Reverse DNS
Software: Apache/2.4.29 (Win32) OpenSSL/1.1.0g PHP/7.2.2 /
Resource Hash: ba892f7903e737d06c952be4ed3266746ed5e1090377fbc5d2ac975626c4533a

Request headers

Pragma: no-cache
Origin: http://185.234.216.211
Accept-Encoding: gzip, deflate
Host: 185.234.216.211
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Accept: */*
Referer: http://185.234.216.211/netbill/css/none.css
Cookie: PHPSESSID=lrs4pp3kukc38levnpaohvdhrc
Connection: keep-alive
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36
Referer: http://185.234.216.211/netbill/css/none.css
Origin: http://185.234.216.211

Response headers

Date: Tue, 10 Apr 2018 03:01:20 GMT
Last-Modified: Fri, 20 Oct 2017 21:22:56 GMT
Server: Apache/2.4.29 (Win32) OpenSSL/1.1.0g PHP/7.2.2
ETag: "1123c-55c011388ac00"
Content-Type: font/woff
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=99
Content-Length: 70204

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.netflix.com
URL: https://www.netflix.com/ichnaea/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=css&modalView=login

Domain: www.netflix.com
URL: https://www.netflix.com/ichnaea/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=css&modalView=login

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery function| IsEmpty function| ShowPassOpt

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			185.234.216.211/	1969-12-31 23:59:59	Name: PHPSESSID Value: lrs4pp3kukc38levnpaohvdhrc

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
swip.codylindley.com
www.netflix.com
www.netflix.com
185.234.216.211
52.209.236.203
52.212.136.196
64.13.192.166
94.31.29.54
1e67d8dbcca1f6fd94e077c85c2fb40fa1c2756c99238daa8da882144260a68d
2d27d0ee0936df3f59ad1566125b5b5a3bef7111105198904a51077f9d7986a6
320107e4f89a18b757b55101c4d9014c879c7a7be24ce41bee3bf6ed609ca5c7
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
88cb74149bc19a9751661dcf0c4b572f7a549fb56d4d6b8946ad95040f4fe889
b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682
ba892f7903e737d06c952be4ed3266746ed5e1090377fbc5d2ac975626c4533a
baafd74a4cb4dc594b614eeb45c7267bb1af729d9271752460348ece16532d04
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855