urlscan.io logo urlscan.io
SecurityTrails logo

netflixpayerror.com Open in urlscan Pro
185.61.152.72  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://netflixpayerror.com/
Effective URL: https://netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/
Submission Tags: 6851770
Submission: On November 17 via api from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 10 HTTP transactions. The main IP is 185.61.152.72, located in United Kingdom and belongs to NAMECHEAP-NET, US. The main domain is netflixpayerror.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on November 15th 2020. Valid for: a year.
This is the only time netflixpayerror.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

IP Address AS Autonomous System
3 12 185.61.152.72 22612 (NAMECHEAP...)
10 2
Apex Domain
Subdomains		 Transfer
12 netflixpayerror.com
netflixpayerror.com
273 KB
10 1
Domain Requested by
12 netflixpayerror.com 3 redirects netflixpayerror.com
10 1

This site contains no links.

Subject Issuer Validity Valid
netflixpayerror.com
Sectigo RSA Domain Validation Secure Server CA		 2020-11-15 -
2021-11-15		 a year crt.sh

This page contains 1 frames:

Primary Page: https://netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/
Frame ID: 9AFD6ECA24173397394B486FDF45FC13
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://netflixpayerror.com/ HTTP 301
    https://netflixpayerror.com/ HTTP 302
    https://netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1 HTTP 301
    https://netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

10
Requests

90 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

272 kB
Transfer

393 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://netflixpayerror.com/ HTTP 301
    https://netflixpayerror.com/ HTTP 302
    https://netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1 HTTP 301
    https://netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/
Redirect Chain
  • http://netflixpayerror.com/
  • https://netflixpayerror.com/
  • https://netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1
  • https://netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/
3 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.61.152.72 , United Kingdom, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
business36-4.web-hosting.com
Software
Apache / PHP/7.2.34
Resource Hash
a40f4ea9dd40675842c11f058a4000bc28d8ad27ed597c7feb44345fe7696bfd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
netflixpayerror.com
:scheme
https
:path
/bf4334a2421c544eaa17629e52029ca1/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Tue, 17 Nov 2020 02:15:51 GMT
server
Apache
x-powered-by
PHP/7.2.34
expires
Thu, 19 Nov 1981 08:52:00 GMT
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
set-cookie
PHPSESSID=2669434e59a66d90cb7c8c0e6476bf85; path=/
vary
Accept-Encoding
content-encoding
gzip
content-length
893
content-type
text/html; charset=UTF-8
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains; preload;
referrer-policy
no-referrer-when-downgrade

Redirect headers

status
301
date
Tue, 17 Nov 2020 02:15:51 GMT
server
Apache
location
https://netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/
content-length
269
content-type
text/html; charset=iso-8859-1
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains; preload;
referrer-policy
no-referrer-when-downgrade
main.css
netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/assets/css/ 		7 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/assets/css/main.css?rand=760602949
Requested by
Host: netflixpayerror.com
URL: https://netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.61.152.72 , United Kingdom, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
business36-4.web-hosting.com
Software
Apache /
Resource Hash
c69a818f75b13a1a14452fea83d4c25b1e8606ea34095b32dabdfa0dce255eae
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 17 Nov 2020 02:15:51 GMT
content-encoding
gzip
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 17 Nov 2020 02:15:51 GMT
server
Apache
x-frame-options
SAMEORIGIN
content-type
text/css
status
200
x-xss-protection
1; mode=block
strict-transport-security
max-age=31536000; includeSubDomains; preload;
accept-ranges
bytes
vary
Accept-Encoding
content-length
1727
x-content-type-options
nosniff
icon.ico
netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/assets/img/ 		0
0
main.js
netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/assets/js/ 		155 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/assets/js/main.js?rand=479235981
Requested by
Host: netflixpayerror.com
URL: https://netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.61.152.72 , United Kingdom, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
business36-4.web-hosting.com
Software
Apache /
Resource Hash
fcc734082c4b8100545648ad36ef145ee4d6197d9cdc95fdc9bc83a7eed7a54d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 17 Nov 2020 02:15:51 GMT
content-encoding
gzip
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 17 Nov 2020 02:15:51 GMT
server
Apache
x-frame-options
SAMEORIGIN
content-type
application/javascript
status
200
x-xss-protection
1; mode=block
strict-transport-security
max-age=31536000; includeSubDomains; preload;
accept-ranges
bytes
vary
Accept-Encoding
content-length
38013
x-content-type-options
nosniff
background-medium.jpg
netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/assets/img/ 		215 KB
216 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/assets/img/background-medium.jpg
Requested by
Host: netflixpayerror.com
URL: https://netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/assets/css/main.css?rand=760602949
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.61.152.72 , United Kingdom, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
business36-4.web-hosting.com
Software
Apache /
Resource Hash
847566a3fa53dae674a15ccd5dcb40087e2cf1935a1a9a6294702be812c0df53
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/assets/css/main.css?rand=760602949
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 17 Nov 2020 02:15:51 GMT
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 17 Nov 2020 02:15:51 GMT
server
Apache
x-frame-options
SAMEORIGIN
content-type
image/jpeg
status
200
x-xss-protection
1; mode=block
strict-transport-security
max-age=31536000; includeSubDomains; preload;
accept-ranges
bytes
content-length
220400
x-content-type-options
nosniff
logo.png
netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/assets/img/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/assets/img/logo.png
Requested by
Host: netflixpayerror.com
URL: https://netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/assets/css/main.css?rand=760602949
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.61.152.72 , United Kingdom, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
business36-4.web-hosting.com
Software
Apache /
Resource Hash
4d4054a533373a85d24d65f5290ca306133f3c22f0b2d7b71a742a277d0f7a49
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/assets/css/main.css?rand=760602949
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 17 Nov 2020 02:15:51 GMT
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 17 Nov 2020 02:15:51 GMT
server
Apache
x-frame-options
SAMEORIGIN
content-type
image/png
status
200
x-xss-protection
1; mode=block
strict-transport-security
max-age=31536000; includeSubDomains; preload;
accept-ranges
bytes
content-length
8717
x-content-type-options
nosniff
check.png
netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/assets/img/ 		577 B
881 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/assets/img/check.png?s
Requested by
Host: netflixpayerror.com
URL: https://netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/assets/css/main.css?rand=760602949
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.61.152.72 , United Kingdom, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
business36-4.web-hosting.com
Software
Apache /
Resource Hash
f556fb3c64c1e81e81311450d0993f90dd52484410c8b19f7fe25501a1fb56c4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/assets/css/main.css?rand=760602949
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 17 Nov 2020 02:15:51 GMT
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 17 Nov 2020 02:15:51 GMT
server
Apache
x-frame-options
SAMEORIGIN
content-type
image/png
status
200
x-xss-protection
1; mode=block
strict-transport-security
max-age=31536000; includeSubDomains; preload;
accept-ranges
bytes
content-length
577
x-content-type-options
nosniff
fb.png
netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/assets/img/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/assets/img/fb.png
Requested by
Host: netflixpayerror.com
URL: https://netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/assets/css/main.css?rand=760602949
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.61.152.72 , United Kingdom, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
business36-4.web-hosting.com
Software
Apache /
Resource Hash
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/assets/css/main.css?rand=760602949
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 17 Nov 2020 02:15:51 GMT
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 17 Nov 2020 02:15:51 GMT
server
Apache
x-frame-options
SAMEORIGIN
content-type
image/png
status
200
x-xss-protection
1; mode=block
strict-transport-security
max-age=31536000; includeSubDomains; preload;
accept-ranges
bytes
content-length
1455
x-content-type-options
nosniff
globe.png
netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/assets/img/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/assets/img/globe.png?s
Requested by
Host: netflixpayerror.com
URL: https://netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/assets/css/main.css?rand=760602949
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.61.152.72 , United Kingdom, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
business36-4.web-hosting.com
Software
Apache /
Resource Hash
4442aacdd8b7f2368c235a92f6559b1d807231cb30c9409abe8a0f744dc9e8c5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/assets/css/main.css?rand=760602949
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 17 Nov 2020 02:15:51 GMT
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 17 Nov 2020 02:15:51 GMT
server
Apache
x-frame-options
SAMEORIGIN
content-type
image/png
status
200
x-xss-protection
1; mode=block
strict-transport-security
max-age=31536000; includeSubDomains; preload;
accept-ranges
bytes
content-length
2540
x-content-type-options
nosniff
down.png
netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/assets/img/ 		634 B
938 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/assets/img/down.png
Requested by
Host: netflixpayerror.com
URL: https://netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/assets/css/main.css?rand=760602949
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.61.152.72 , United Kingdom, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS
business36-4.web-hosting.com
Software
Apache /
Resource Hash
76fda49610478440b5b123d15bb4d3510ab771ab27b0b881565887b7bcf6a0c6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/assets/css/main.css?rand=760602949
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 17 Nov 2020 02:15:51 GMT
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 17 Nov 2020 02:15:51 GMT
server
Apache
x-frame-options
SAMEORIGIN
content-type
image/png
status
200
x-xss-protection
1; mode=block
strict-transport-security
max-age=31536000; includeSubDomains; preload;
accept-ranges
bytes
content-length
634
x-content-type-options
nosniff

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
netflixpayerror.com
URL
https://netflixpayerror.com/bf4334a2421c544eaa17629e52029ca1/assets/img/icon.ico

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes function| serialize boolean| error_username boolean| error_password function| validateEmail function| validatePhoneNumber function| ValideRegion object| _0xfc4d function| $ function| jQuery

1 Cookies

Domain/Path Name / Value
netflixpayerror.com/ Name: PHPSESSID
Value: 2669434e59a66d90cb7c8c0e6476bf85

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block