n3plvcpnl116397.prod.ams3.secureserver.net Open in urlscan Pro
160.153.202.17 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://n3plvcpnl116397.prod.ams3.secureserver.net/~webbricc/bmpautomation.com/webbric/manager/NetFlix/NetFlix/netflix/signIn.php
Submission: On January 19 via automatic, source openphish (January 19th 2019, 6:28:23 pm UTC)

Summary HTTP 8 Redirects Links 4 Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 8 HTTP transactions. The main IP is 160.153.202.17, located in Scottsdale, United States and belongs to AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US. The main domain is n3plvcpnl116397.prod.ams3.secureserver.net.

This is the only time n3plvcpnl116397.prod.ams3.secureserver.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address		AS Autonomous System
2	160.153.202.17 160.153.202.17		26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com)
4	2a02:26f0:300... 2a02:26f0:3000:280::33c4		20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a02:26f0:300... 2a02:26f0:3000:283::33c4		20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
8	3

2 160.153.202.17 (Scottsdale, United States)

ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-160-153-202-17.ip.secureserver.net

n3plvcpnl116397.prod.ams3.secureserver.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:26f0:3000:280::33c4 (European Union)

ASN20940 (AKAMAI-ASN1, US)

codex.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
assets.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:3000:283::33c4 (European Union)

ASN20940 (AKAMAI-ASN1, US)

assets.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	nflxext.com codex.nflxext.com assets.nflxext.com	380 KB
2	secureserver.net n3plvcpnl116397.prod.ams3.secureserver.net	4 KB
8	2

	Domain	Requested by
3	assets.nflxext.com	n3plvcpnl116397.prod.ams3.secureserver.net
3	codex.nflxext.com	n3plvcpnl116397.prod.ams3.secureserver.net
2	n3plvcpnl116397.prod.ams3.secureserver.net	codex.nflxext.com
8	3

This site contains links to these domains. Also see Links.

Domain
help.netflix.com

Subject Issuer	Validity	Valid
assets.nflxext.com DigiCert SHA2 Secure Server CA	`2018-03-09` - `2020-03-09`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://n3plvcpnl116397.prod.ams3.secureserver.net/~webbricc/bmpautomation.com/webbric/manager/NetFlix/NetFlix/netflix/signIn.php
Frame ID: BB1969C66A0157E8D6FD79EFE68BBD10
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<[^>]+data-react/i
script /react.*\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

env /^jQuery$/i

Twitter Bootstrap () Expand

Overall confidence: 100%
Detected patterns

script /(?:twitter\.github\.com\/bootstrap|bootstrap(?:\.js|\.min\.js))/i

Page Statistics

8
Requests

63 %
HTTPS

67 %
IPv6

2
Domains

3
Subdomains

3
IPs

2
Countries

384 kB
Transfer

981 kB
Size

2
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://help.netflix.com/contactus
Title: Questions? Contact us.

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/giftterms
Title: Gift Card Terms

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/termsofuse
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/privacy
Title: Privacy Statement

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request Cookie set signIn.php Show response
n3plvcpnl116397.prod.ams3.secureserver.net/~webbricc/bmpautomation.com/webbric/manager/NetFlix/NetFlix/netflix/ 10 KB
3 KB 166ms
127ms Document
text/html 160.153.202.17
GoDaddy.com

General

Check archive.org

Show headers Download Go to

Full URL: http://n3plvcpnl116397.prod.ams3.secureserver.net/~webbricc/bmpautomation.com/webbric/manager/NetFlix/NetFlix/netflix/signIn.php
Protocol: HTTP/1.1
Server: 160.153.202.17 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS: ip-160-153-202-17.ip.secureserver.net
Software: Apache / PHP/5.6.36
Resource Hash: d9dc157d68205e5383c365ed0fab0bdd053d5f670c4f9e74fef8632c84f34c97

Request headers

Host: n3plvcpnl116397.prod.ams3.secureserver.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sat, 19 Jan 2019 18:28:07 GMT
Server: Apache
X-Powered-By: PHP/5.6.36
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=3at0r3gt308pdr6i82luqhg1s2; path=/
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 2610
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK none
codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-css-12ea5c82/css/css/login%7CloginBase.less,pages%7Clogin%7CLogin.less/2/0I0_0i0f100O120-0P0Y/none/true/ 101 KB
17 KB 88ms
19ms Stylesheet
text/css 2a02:26f0:3000:280::33c4
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-css-12ea5c82/css/css/login%7CloginBase.less,pages%7Clogin%7CLogin.less/2/0I0_0i0f100O120-0P0Y/none/true/none

Requested by

Host: n3plvcpnl116397.prod.ams3.secureserver.net
URL: http://n3plvcpnl116397.prod.ams3.secureserver.net/~webbricc/bmpautomation.com/webbric/manager/NetFlix/NetFlix/netflix/signIn.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:3000:280::33c4 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

codex-prod-^2.0.0 i-0d2dcb919a282dd58 /

Resource Hash

fce8bcdd1b0070562494f5fe8483e9447fa892959bcca2741fae6e5a9402222b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://n3plvcpnl116397.prod.ams3.secureserver.net/~webbricc/bmpautomation.com/webbric/manager/NetFlix/NetFlix/netflix/signIn.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sat, 19 Jan 2019 18:28:07 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Type: text/css; charset=UTF-8
Server: codex-prod-^2.0.0 i-0d2dcb919a282dd58
X-Netflix_nfstatus: 1_1
Vary: Accept-Encoding
X-Netflix_proxy_execution-time: 12
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=16070400
req_id: 9bdfa4ac-b76a-42f1-80b4-d605132b4151
Connection: keep-alive
Timing-Allow-Origin: https://www.netflix.com
Content-Length: 16808
Expires: Sun, 21 Jul 2019 07:32:44 GMT

GET
H/1.1 200
OK FB-f-Logo__blue_57.png
assets.nflxext.com/ffe/siteui/login/images/ 1 KB
2 KB 66ms
20ms Image
image/png 2a02:26f0:3000:283::33c4
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://assets.nflxext.com/ffe/siteui/login/images/FB-f-Logo__blue_57.png
Requested by: Host: n3plvcpnl116397.prod.ams3.secureserver.net
URL: http://n3plvcpnl116397.prod.ams3.secureserver.net/~webbricc/bmpautomation.com/webbric/manager/NetFlix/NetFlix/netflix/signIn.php
Protocol: HTTP/1.1
Server: 2a02:26f0:3000:283::33c4 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: Apache /
Resource Hash: 3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece

Request headers

Referer: http://n3plvcpnl116397.prod.ams3.secureserver.net/~webbricc/bmpautomation.com/webbric/manager/NetFlix/NetFlix/netflix/signIn.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sat, 19 Jan 2019 18:28:07 GMT
Last-Modified: Thu, 30 Jun 2016 17:48:49 GMT
Server: Apache
Content-MD5: ozykfvEQtuPsUIa4d2QH0w==
Content-Type: image/png
Cache-Control: public, max-age=39058313
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1455
Expires: Wed, 15 Apr 2020 20:00:00 GMT

GET
H/1.1 200
OK none Show response
codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-js-12ea5c82/js/js/bootstrap.js,common%7Cbootstrap.js/2/fO4Agj03ggfVfT4n0l0j4gf_gi060z02gdfY0hgfgc4sf-fQg34B9L1q/bk/true/ 20 KB
5 KB 86ms
19ms Script
application/javascript 2a02:26f0:3000:280::33c4
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-js-12ea5c82/js/js/bootstrap.js,common%7Cbootstrap.js/2/fO4Agj03ggfVfT4n0l0j4gf_gi060z02gdfY0hgfgc4sf-fQg34B9L1q/bk/true/none

Requested by

Host: n3plvcpnl116397.prod.ams3.secureserver.net
URL: http://n3plvcpnl116397.prod.ams3.secureserver.net/~webbricc/bmpautomation.com/webbric/manager/NetFlix/NetFlix/netflix/signIn.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:3000:280::33c4 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

codex-prod-^2.0.0 i-011511c53084265cd /

Resource Hash

41b389912b0014851aa5aed258821fca440597985f3edf768c97c6d4c45c6b72

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://n3plvcpnl116397.prod.ams3.secureserver.net/~webbricc/bmpautomation.com/webbric/manager/NetFlix/NetFlix/netflix/signIn.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sat, 19 Jan 2019 18:28:07 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Type: application/javascript; charset=UTF-8
Server: codex-prod-^2.0.0 i-011511c53084265cd
X-Netflix_nfstatus: 1_1
Vary: Accept-Encoding
X-Netflix_proxy_execution-time: 13
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=16070400
req_id: 0060447c-ecf7-4f5c-ad2a-d575d16aec01
Connection: keep-alive
Timing-Allow-Origin: https://www.netflix.com
Content-Length: 4165
Expires: Sun, 21 Jul 2019 07:32:44 GMT

GET
H/1.1 200
OK none Show response
codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-js-12ea5c82/js/js/components%7Clogin%7CloginLayout.jsx,components%7Clogin%7CloginController.jsx,react%7CgenericClient.js/2/fO4Agj03ggfVfT4n... 694 KB
203 KB 87ms
19ms Script
application/javascript 2a02:26f0:3000:280::33c4
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-js-12ea5c82/js/js/components%7Clogin%7CloginLayout.jsx,components%7Clogin%7CloginController.jsx,react%7CgenericClient.js/2/fO4Agj03ggfVfT4n0l0j4gf_gi060z02gdfY0hgfgc4sf-fQg34B9L1q/l/true/none

Requested by

Host: n3plvcpnl116397.prod.ams3.secureserver.net
URL: http://n3plvcpnl116397.prod.ams3.secureserver.net/~webbricc/bmpautomation.com/webbric/manager/NetFlix/NetFlix/netflix/signIn.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:3000:280::33c4 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

codex-prod-^2.0.0 i-051555b43df71833e /

Resource Hash

cbd0e99782f3f9b2d03fc202558f39637c63d88c86fc1ed210c7aff1c19707aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: http://n3plvcpnl116397.prod.ams3.secureserver.net/~webbricc/bmpautomation.com/webbric/manager/NetFlix/NetFlix/netflix/signIn.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date: Sat, 19 Jan 2019 18:28:07 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Type: application/javascript; charset=UTF-8
Server: codex-prod-^2.0.0 i-051555b43df71833e
X-Netflix_nfstatus: 1_1
Vary: Accept-Encoding
X-Netflix_proxy_execution-time: 537
Access-Control-Allow-Origin: *
Cache-Control: private, max-age=16070400
req_id: 2fa8a24c-dfda-4c29-8014-78d32a5756c5
Connection: keep-alive
Timing-Allow-Origin: https://www.netflix.com
Content-Length: 207357
Expires: Sun, 21 Jul 2019 07:32:45 GMT

GET
H2 200 login-the-crown_2-1500x1000.jpg
assets.nflxext.com/ffe/siteui/acquisition/login/ 84 KB
85 KB 72ms
27ms Image
image/jpeg 2a02:26f0:3000:283::33c4
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.nflxext.com/ffe/siteui/acquisition/login/login-the-crown_2-1500x1000.jpg
Requested by: Host: n3plvcpnl116397.prod.ams3.secureserver.net
URL: http://n3plvcpnl116397.prod.ams3.secureserver.net/~webbricc/bmpautomation.com/webbric/manager/NetFlix/NetFlix/netflix/signIn.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:3000:283::33c4 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: Apache /
Resource Hash: baafd74a4cb4dc594b614eeb45c7267bb1af729d9271752460348ece16532d04

Request headers

Referer: https://codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-css-12ea5c82/css/css/login%7CloginBase.less,pages%7Clogin%7CLogin.less/2/0I0_0i0f100O120-0P0Y/none/true/none
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Sat, 19 Jan 2019 18:28:07 GMT
last-modified: Mon, 24 Oct 2016 20:49:51 GMT
server: Apache
content-md5: 5GY/BZWwL7HDlH/B8V64Eg==
content-type: image/jpeg
status: 200
cache-control: public, max-age=39058313
accept-ranges: bytes
content-length: 86226
expires: Wed, 15 Apr 2020 20:00:00 GMT

GET
H2 200 nf-icon-v1-88.woff
assets.nflxext.com/ffe/siteui/fonts/ 69 KB
69 KB 70ms
30ms Font
application/octet-stream 2a02:26f0:3000:280::33c4
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-88.woff
Requested by: Host: n3plvcpnl116397.prod.ams3.secureserver.net
URL: http://n3plvcpnl116397.prod.ams3.secureserver.net/~webbricc/bmpautomation.com/webbric/manager/NetFlix/NetFlix/netflix/signIn.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:3000:280::33c4 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: Apache /
Resource Hash: ba892f7903e737d06c952be4ed3266746ed5e1090377fbc5d2ac975626c4533a

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-css-12ea5c82/css/css/login%7CloginBase.less,pages%7Clogin%7CLogin.less/2/0I0_0i0f100O120-0P0Y/none/true/none
Origin: http://n3plvcpnl116397.prod.ams3.secureserver.net

Response headers

date: Sat, 19 Jan 2019 18:28:07 GMT
content-encoding: gzip
last-modified: Fri, 27 Jan 2017 22:53:52 GMT
server: Apache
content-md5: ezBCotj2o1GiKPEVK1YDAg==
access-control-allow-origin: *
vary: Accept-Encoding
content-type: text/plain
status: 200
cache-control: public, max-age=39058313
accept-ranges: bytes
expires: Wed, 15 Apr 2020 20:00:00 GMT

POST
H/1.1 404
Not Found log Show response
n3plvcpnl116397.prod.ams3.secureserver.net/ichnaea/ 2 KB
1 KB 24ms
24ms XHR
text/html 160.153.202.17
GoDaddy.com

General

Check archive.org

Show headers Download Go to

Full URL: http://n3plvcpnl116397.prod.ams3.secureserver.net/ichnaea/log
Requested by: Host: codex.nflxext.com
URL: https://codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-js-12ea5c82/js/js/components%7Clogin%7CloginLayout.jsx,components%7Clogin%7CloginController.jsx,react%7CgenericClient.js/2/fO4Agj03ggfVfT4n0l0j4gf_gi060z02gdfY0hgfgc4sf-fQg34B9L1q/l/true/none
Protocol: HTTP/1.1
Server: 160.153.202.17 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),
Reverse DNS: ip-160-153-202-17.ip.secureserver.net
Software: Apache /
Resource Hash: cdc8b52c9402b72ef9c698027c0d2ea63058ed98b832a31d3ac57c9e7f8b35ed

Request headers

Pragma: no-cache
Origin: http://n3plvcpnl116397.prod.ams3.secureserver.net
Accept-Encoding: gzip, deflate
Host: n3plvcpnl116397.prod.ams3.secureserver.net
X-Requested-With: XMLHttpRequest
Content-Type: application/json
Accept: */*
Cache-Control: no-cache
X-Netflix.ichnaea.request.type: UiRequest
Cookie: PHPSESSID=3at0r3gt308pdr6i82luqhg1s2; cL=1547922487642%7C154792248763208275%7C154792248733622385%7C%7C4%7Cundefined
Connection: keep-alive
Referer: http://n3plvcpnl116397.prod.ams3.secureserver.net/~webbricc/bmpautomation.com/webbric/manager/NetFlix/NetFlix/netflix/signIn.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Length: 1633
Accept: */*
Referer: http://n3plvcpnl116397.prod.ams3.secureserver.net/~webbricc/bmpautomation.com/webbric/manager/NetFlix/NetFlix/netflix/signIn.php
Origin: http://n3plvcpnl116397.prod.ams3.secureserver.net
X-Netflix.ichnaea.request.type: UiRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
X-Requested-With: XMLHttpRequest
Content-Type: application/json

Response headers

Date: Sat, 19 Jan 2019 18:28:07 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding,User-Agent
Content-Type: text/html
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
Content-Length: 857

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

12 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| Codex object| C object| global object| process object| __core-js_shared__ object| netflix object| util function| jQuery object| jQuery111102512868540781201

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.n3plvcpnl116397.prod.ams3.secureserver.net/	1969-12-31 23:59:59	Name: cL Value: 1547922487642%7C154792248763208275%7C154792248733622385%7C%7C4%7Cundefined
			n3plvcpnl116397.prod.ams3.secureserver.net/	1969-12-31 23:59:59	Name: PHPSESSID Value: 3at0r3gt308pdr6i82luqhg1s2

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.nflxext.com
codex.nflxext.com
n3plvcpnl116397.prod.ams3.secureserver.net
160.153.202.17
2a02:26f0:3000:280::33c4
2a02:26f0:3000:283::33c4
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
41b389912b0014851aa5aed258821fca440597985f3edf768c97c6d4c45c6b72
ba892f7903e737d06c952be4ed3266746ed5e1090377fbc5d2ac975626c4533a
baafd74a4cb4dc594b614eeb45c7267bb1af729d9271752460348ece16532d04
cbd0e99782f3f9b2d03fc202558f39637c63d88c86fc1ed210c7aff1c19707aa
cdc8b52c9402b72ef9c698027c0d2ea63058ed98b832a31d3ac57c9e7f8b35ed
d9dc157d68205e5383c365ed0fab0bdd053d5f670c4f9e74fef8632c84f34c97
fce8bcdd1b0070562494f5fe8483e9447fa892959bcca2741fae6e5a9402222b