suedmuell.de
Open in
urlscan Pro
2a01:488:42:1000:5bfa:44c7:1b:b827
Malicious Activity!
Public Scan
Effective URL: http://suedmuell.de/tn-misc/978ab69321fd11c/login/
Submission: On March 31 via manual from IE
Summary
This is the only time suedmuell.de was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Netflix (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
4 10 | 2a01:488:42:1... 2a01:488:42:1000:5bfa:44c7:1b:b827 | 20773 (GODADDY) (GODADDY) | |
1 | 2a00:86c0:209... 2a00:86c0:2091::1 | 40027 (NETFLIX-ASN) (NETFLIX-ASN) | |
8 | 3 |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
suedmuell.de
4 redirects
suedmuell.de |
357 KB |
1 |
nflxext.com
assets.nflxext.com |
92 KB |
8 | 2 |
Domain | Requested by | |
---|---|---|
10 | suedmuell.de |
4 redirects
suedmuell.de
|
1 | assets.nflxext.com |
suedmuell.de
|
8 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.1.nflxso.net DigiCert SHA2 Secure Server CA |
2020-03-15 - 2020-04-14 |
a month | crt.sh |
This page contains 1 frames:
Primary Page:
http://suedmuell.de/tn-misc/978ab69321fd11c/login/
Frame ID: D2878919EB35C5FCB706F8C843E9E505
Requests: 8 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://suedmuell.de/tn-misc/
HTTP 302
http://suedmuell.de/tn-misc/978ab69321fd11c HTTP 301
http://suedmuell.de/tn-misc/978ab69321fd11c/ HTTP 302
http://suedmuell.de/tn-misc/978ab69321fd11c/login HTTP 301
http://suedmuell.de/tn-misc/978ab69321fd11c/login/ Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://suedmuell.de/tn-misc/
HTTP 302
http://suedmuell.de/tn-misc/978ab69321fd11c HTTP 301
http://suedmuell.de/tn-misc/978ab69321fd11c/ HTTP 302
http://suedmuell.de/tn-misc/978ab69321fd11c/login HTTP 301
http://suedmuell.de/tn-misc/978ab69321fd11c/login/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 5- http://suedmuell.de/tn-misc/978ab69321fd11c/login/Netflix_files/nf-icon-v1-93.woff HTTP 302
- https://suedmuell.de/tn-misc/978ab69321fd11c/login/Netflix_files/nf-icon-v1-93.woff
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Cookie set
/
suedmuell.de/tn-misc/978ab69321fd11c/login/ Redirect Chain
|
20 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
codex.login.css
suedmuell.de/tn-misc/978ab69321fd11c/login/Netflix_files/ |
143 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
signin.css
suedmuell.de/tn-misc/978ab69321fd11c/login/Netflix_files/ |
2 KB 849 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js.html
suedmuell.de/tn-misc/978ab69321fd11c/login/Netflix_files/ |
12 KB 4 KB |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
FB-f-Logo__blue_57.png
suedmuell.de/tn-misc/978ab69321fd11c/login/Netflix_files/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dz.jpg
suedmuell.de/tn-misc/978ab69321fd11c/login/assets/ |
324 KB 324 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
nf-icon-v1-93.woff
suedmuell.de/tn-misc/978ab69321fd11c/login/Netflix_files/ Redirect Chain
|
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nf-icon-v1-93.ttf
assets.nflxext.com/ffe/siteui/fonts/ |
92 KB 92 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- suedmuell.de
- URL
- https://suedmuell.de/tn-misc/978ab69321fd11c/login/Netflix_files/nf-icon-v1-93.woff
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Netflix (Online)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
suedmuell.de/ | Name: PHPSESSID Value: b1b90376de173cfd76db74b213a57c83 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
assets.nflxext.com
suedmuell.de
suedmuell.de
2a00:86c0:2091::1
2a01:488:42:1000:5bfa:44c7:1b:b827
1e80b19b635440a7b14582e1f2ca23d588546a5913f0a0a6a1297d96f1bbbdac
20b7b7b38ff7f01b7f93706492bcd3796502139d739821ab60cca75d8475d392
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
4ae58d47961137684b3aab1178b303d1afc30501da65087122dc59dd6d00ad44
b276f78e16684b9a430b082d9d0d018316c523590015631fb5ad15aa705a0f03
b98e58f0f2c62969d61ce2ec31043dacb8d378ecbbfcae138b6250d432e195dd
df9a8b117a4fd266818dee3d12d7080ebdc7d1e1802445d3584d2c7d78bd9725