demo2.cloudwp.dev Open in urlscan Pro
151.139.128.10  Malicious Activity! Public Scan

Submitted URL: https://ilnetraceflix.b-cdn.net/traces.html
Effective URL: https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login?netflix_id=&country=&iso=
Submission: On December 28 via manual from IL — Scanned from DE

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 14 HTTP transactions. The main IP is 151.139.128.10, located in United States and belongs to STACKPATH-CDN, US. The main domain is demo2.cloudwp.dev.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on March 22nd 2022. Valid for: a year.
This is the only time demo2.cloudwp.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

IP Address AS Autonomous System
1 2400:52e0:1e0... 200325 (BUNNYCDN)
1 1 46.101.22.196 14061 (DIGITALOC...)
1 13 151.139.128.10 20446 (STACKPATH...)
14 3
Apex Domain
Subdomains
Transfer
13 cloudwp.dev
demo2.cloudwp.dev
174 KB
1 tanzaniaprinters.co.tz
tanzaniaprinters.co.tz
214 B
1 b-cdn.net
ilnetraceflix.b-cdn.net
585 B
14 3
Domain Requested by
13 demo2.cloudwp.dev 1 redirects ilnetraceflix.b-cdn.net
demo2.cloudwp.dev
1 tanzaniaprinters.co.tz 1 redirects
1 ilnetraceflix.b-cdn.net
14 3

This site contains no links.

Subject Issuer Validity Valid
*.b-cdn.net
Sectigo RSA Domain Validation Secure Server CA
2022-11-07 -
2023-11-11
a year crt.sh
*.cloudwp.dev
Sectigo RSA Domain Validation Secure Server CA
2022-03-22 -
2023-04-22
a year crt.sh

This page contains 2 frames:

Primary Page: https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login?netflix_id=&country=&iso=
Frame ID: 272F72E9E0E72CBE8F79125EB443E3EA
Requests: 11 HTTP requests in this frame

Frame: https://demo2.cloudwp.dev/sbbi/?sbbpg=sbbShell&gprid=BK
Frame ID: A432AF7F224A41E5E0B749D7BA3B0464
Requests: 3 HTTP requests in this frame

Screenshot

Page Title

Netflix

Page URL History Show full URLs

  1. https://ilnetraceflix.b-cdn.net/traces.html Page URL
  2. https://tanzaniaprinters.co.tz//Bunny// HTTP 302
    https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/ HTTP 302
    https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login?netflix_id=&country=&iso= Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Page Statistics

14
Requests

93 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

174 kB
Transfer

201 kB
Size

8
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://ilnetraceflix.b-cdn.net/traces.html Page URL
  2. https://tanzaniaprinters.co.tz//Bunny// HTTP 302
    https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/ HTTP 302
    https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login?netflix_id=&country=&iso= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
traces.html
ilnetraceflix.b-cdn.net/
133 B
585 B
Document
General
Full URL
https://ilnetraceflix.b-cdn.net/traces.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2400:52e0:1e00::713:1 , Slovenia, ASN200325 (BUNNYCDN, SI),
Reverse DNS
Software
BunnyCDN-DE1-713 /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
public, max-age=2592000
cdn-cache
HIT
cdn-cachedat
12/28/2022 01:16:06
cdn-edgestorageid
1055
cdn-fileserver
383
cdn-proxyver
1.03
cdn-pullzone
1116623
cdn-requestcountrycode
DE
cdn-requestid
5bb0c0aa4eaa119063a796c21d016c4a
cdn-requestpullcode
206
cdn-requestpullsuccess
True
cdn-status
200
cdn-storageserver
DE-169
cdn-uid
ad069e6d-4753-448a-ab27-12dc73ccae1d
content-encoding
gzip
content-type
text/html
date
Wed, 28 Dec 2022 07:05:39 GMT
last-modified
Tue, 27 Dec 2022 23:30:34 GMT
server
BunnyCDN-DE1-713
vary
Accept-Encoding
Primary Request login
demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/
Redirect Chain
  • https://tanzaniaprinters.co.tz//Bunny//
  • https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/
  • https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login?netflix_id=&country=&iso=
11 KB
5 KB
Document
General
Full URL
https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login?netflix_id=&country=&iso=
Requested by
Host: ilnetraceflix.b-cdn.net
URL: https://ilnetraceflix.b-cdn.net/traces.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
fbs / PHP/7.4.33
Resource Hash
00cfa0d9a72b1bf33c19c297f417151148cf18fe987326811ca1dc0cf0d952be
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://ilnetraceflix.b-cdn.net/traces.html
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Wed, 28 Dec 2022 07:05:45 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
link
<https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login>; rel="canonical"
pragma
no-cache
server
fbs
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
x-hw
1672211140.cds146.am5.hn,1672211140.cds280.am5.sc,1672211145.cdn2-redis02-ams1.stackpath.systems.-.wx,1672211145.cds280.am5.p
x-powered-by
PHP/7.4.33
x-proxy-cache
MISS
x-robots-tag
noindex, nofollow, noarchive, nosnippet
x-sp-metadata
HS256.CNnxr50GEooBCiRkNWVhMDBmZC04YjRlLTQ4NDMtOGExYy1jZWZiMjhjMWRkMzEQ2J+KgafZ+wIaBgjE1a+dBiIPMTg1LjIxMy4xNTUuMTY4KIq2AzADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGiYSJGQ0ODQ3OTI2LTE2NDEtNDZlOC1iMDQ3LTYxYjYwNmY5ZGUyYiIaCAISFGNkczI4MC5hbTUuaHdjZG4ubmV0GAg=.gMORi8AV15vqB1tmW2k1VuwP6PXBjrGQSPclEjjkmTo=

Redirect headers

access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
date
Wed, 28 Dec 2022 07:05:40 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
link
<https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/>; rel="canonical"
location
login?netflix_id=&country=&iso=
pragma
no-cache
server
fbs
strict-transport-security
max-age=31536000; includeSubDomains
x-hw
1672211139.cds146.am5.hn,1672211139.cds273.am5.sc,1672211140.cdn2-redis02-ams1.stackpath.systems.-.wx,1672211140.cds273.am5.p
x-powered-by
PHP/7.4.33
x-proxy-cache
MISS
x-robots-tag
noindex, nofollow, noarchive, nosnippet
x-sp-metadata
HS256.CNTxr50GEooBCiRlMDY3NjcyYi1kOGU5LTRkMmMtYTYwMy0xYmRlMzNmZGNiMDIQ2J+KgafZ+wIaBgjD1a+dBiIPMTg1LjIxMy4xNTUuMTY4KIq2AzADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGiYSJDA2MjAxODZiLWQzZjMtNGYwOC04MDk2LTFiNTcyNDNhMDg3OCIaCAISFGNkczI3My5hbTUuaHdjZG4ubmV0GAg=.H7HOWSCcBQG0dEH6mfARwLWME3CpMbFxN/GyrnNvrE0=
Spox1.css
demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/css/
7 KB
2 KB
Stylesheet
General
Full URL
https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/css/Spox1.css?rand=1108237871
Requested by
Host: demo2.cloudwp.dev
URL: https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login?netflix_id=&country=&iso=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
fbs /
Resource Hash
765725db20ac648c0843fe777c4ca7619c812db6df2eca0faefbed3fc6107faa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login?netflix_id=&country=&iso=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Wed, 28 Dec 2022 07:05:46 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
x-sp-metadata
HS256.CNrxr50GEooBCiQwNjk3ZmZkMC0zZjExLTRiMzktYmM1Yi1iODRhOGQ0NWFmMzUQ2J+KgafZ+wIaBgjJ1a+dBiIPMTg1LjIxMy4xNTUuMTY4KIq2AzADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGikSJGEyNTE4M2JiLTNiYmYtNGQ4Zi05NGU3LTI3ZjI2MjhlZGQxYhjRDiIaCAISFGNkczEyNC5hbTUuaHdjZG4ubmV0GAg=.QkEnqFRpPOQO+kGRvoK7h3P1m+iih/5fQHADYHXiEWE=
last-modified
Tue, 27 Dec 2022 15:22:35 GMT
server
fbs
etag
"1672154555"
vary
Accept-Encoding
x-hw
1672211145.cds146.am5.hn,1672211145.cds124.am5.sc,1672211146.cds124.am5.sc,1672211146.cdn2-redis01-ams1.stackpath.systems.-.wx,1672211146.cds124.am5.p
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=30
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noarchive, nosnippet
link
<https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/css/Spox1.css>; rel="canonical"
x-proxy-cache
HIT
icon.ico
demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/img/
17 KB
17 KB
Stylesheet
General
Full URL
https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/img/icon.ico
Requested by
Host: demo2.cloudwp.dev
URL: https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login?netflix_id=&country=&iso=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
fbs /
Resource Hash
c8d904d2bb3904ebc2e3e6dfe37872553e2b5b41642111b9c97906b0c8b82386
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login?netflix_id=&country=&iso=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Wed, 28 Dec 2022 07:05:46 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-sp-metadata
HS256.CNrxr50GEooBCiQ5NDA2Y2NkZi1hYjVhLTRhNTktODNhNi04NjAxZDQ2ZjIyYmQQ2J+KgafZ+wIaBgjJ1a+dBiIPMTg1LjIxMy4xNTUuMTY4KIq2AzADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGioSJGI5YTVkNGViLWM4ZTItNDJkYi1iZjFjLTBkYmU4ODczZjIzZRi+hAEiGggCEhRjZHMwMDQuYW01Lmh3Y2RuLm5ldBgI.U8+SyudzWG5rgwCYTBGX1TalxiB7nx0eKAzISMmqlvI=
last-modified
Tue, 27 Dec 2022 15:22:28 GMT
server
fbs
etag
"1672154548"
x-hw
1672211145.cds146.am5.hn,1672211145.cds004.am5.sc,1672211146.cds004.am5.pr
content-type
image/x-icon
access-control-allow-origin
*
cache-control
max-age=30
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noarchive, nosnippet
link
<https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/img/icon.ico>; rel="canonical"
content-length
16958
x-proxy-cache
MISS
Spox1_EN.js
demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/js/
5 KB
1 KB
Script
General
Full URL
https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/js/Spox1_EN.js
Requested by
Host: demo2.cloudwp.dev
URL: https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login?netflix_id=&country=&iso=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
fbs /
Resource Hash
c0556a2849c196ec2db60e944d17ea626dd96db83e2b2ffcb2d2a7a76aba2eac
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login?netflix_id=&country=&iso=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Wed, 28 Dec 2022 07:05:46 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
content-length
816
x-sp-metadata
HS256.CNrxr50GEooBCiRhNzQ3YmEzNC04YmRjLTQ3MTYtYmU0YS1kYzc3NTRhZWJjMjEQ2J+KgafZ+wIaBgjJ1a+dBiIPMTg1LjIxMy4xNTUuMTY4KIq2AzADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGikSJDNkY2ZjOTIwLWY2MGUtNDFkNC04NTg2LTdhYjI5YzQxYmUyMBiwBiIaCAISFGNkczIwNS5hbTUuaHdjZG4ubmV0GAg=.zLXrAz3ZYgnn7AAMUnSj1SZy7W+5MlrOmpVwVVtjC1M=
last-modified
Tue, 27 Dec 2022 15:22:32 GMT
server
fbs
etag
"1672154552"
vary
Accept-Encoding
x-hw
1672211145.cds146.am5.hn,1672211145.cds205.am5.sc,1672211146.cds205.am5.pr
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=30
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noarchive, nosnippet
link
<https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/js/Spox1_EN.js>; rel="canonical"
x-proxy-cache
MISS
/
demo2.cloudwp.dev/sbbi/ Frame A432
25 KB
11 KB
Document
General
Full URL
https://demo2.cloudwp.dev/sbbi/?sbbpg=sbbShell&gprid=BK&sbbgs=h47aa674ff4409af95915e823ebfece61216&ddl=7
Requested by
Host: demo2.cloudwp.dev
URL: https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login?netflix_id=&country=&iso=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
fbs /
Resource Hash
e649f450cf678d0bcb02e613d71f91c9bb21c588d7ad5c66f9b948dc38308899

Request headers

Referer
https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login?netflix_id=&country=&iso=
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-origin
*
cache-control
no-store, no-cache, max-age=0, must-revalidate, private, max-stale=0, post-check=0, pre-check=0
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Wed, 28 Dec 2022 07:05:46 GMT
link
<https://demo2.cloudwp.dev/sbbi/>; rel="canonical"
server
fbs
x-accel-expires
0
x-hw
1672211146.cds146.am5.hn,1672211146.cds221.am5.sc,1672211146.cdn2-redis01-ams1.stackpath.systems.-.i,1672211146.cds221.am5.p
x-sp-metadata
HS256.CNrxr50GEooBCiQ0NTZkNmRhNy01NTU2LTQ4OGMtODkzMy0wNjJmOWIyMTIxZGEQ2J+KgafZ+wIaBgjK1a+dBiIPMTg1LjIxMy4xNTUuMTY4KIq2AzADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGiYSJGE1ZTk0YThmLTgxMjUtNGYwMS05YTRmLTI5MWZjNmI2Y2U1MyIaCAISFGNkczIyMS5hbTUuaHdjZG4ubmV0GAg=.yYwnpJ/qHHRuCIEs8AIFJ/zuGypePuNcZg2zhSXO9fQ=
/
demo2.cloudwp.dev/sbbi/
43 B
577 B
Image
General
Full URL
https://demo2.cloudwp.dev/sbbi/?sbbpg=utMedia&vii=6h84d7ca0aa6f7744f6f24e410096aafc9953911a56e081273fe1b8fce7caea6p1m2q1t6
Requested by
Host: demo2.cloudwp.dev
URL: https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login?netflix_id=&country=&iso=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
fbs /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login?netflix_id=&country=&iso=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-accel-expires
0
date
Wed, 28 Dec 2022 07:05:46 GMT
x-sp-metadata
HS256.CNrxr50GEooBCiQ1ZTIyMjUwZS0zMmM1LTRiMmYtOTI2Yy1jM2QzYjMxOTM2ZDcQ2J+KgafZ+wIaBgjK1a+dBiIPMTg1LjIxMy4xNTUuMTY4KIq2AzADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGiYSJDMzNDNiMWI5LTg1M2UtNDdkOC1hNjczLWVkMWIxZWRjYzkwMSIaCAISFGNkczMyNC5hbTUuaHdjZG4ubmV0GAg=.Ds3gy8Y0bZkTSFiLs6zBG6GpL4SLcUL38gk+TEunJis=
server
fbs
x-hw
1672211146.cds146.am5.hn,1672211146.cds324.am5.sc,1672211146.cdn2-wafbe04-ams1.stackpath.systems.-.i,1672211146.cds324.am5.p
content-type
image/gif
access-control-allow-origin
*
cache-control
no-store, no-cache, max-age=0, must-revalidate, private, max-stale=0, post-check=0, pre-check=0
link
<https://demo2.cloudwp.dev/sbbi/>; rel="canonical"
backgroundSpox.jpg
demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/img/
125 KB
126 KB
Image
General
Full URL
https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/img/backgroundSpox.jpg
Requested by
Host: demo2.cloudwp.dev
URL: https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/css/Spox1.css?rand=1108237871
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
fbs /
Resource Hash
4fcfc2d27556d71579bcf77290b19cb119a2cdd9f49ec6137da4641e6f7aa662
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/css/Spox1.css?rand=1108237871
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Wed, 28 Dec 2022 07:05:50 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-sp-metadata
HS256.CN7xr50GEooBCiQ3NTc1YzJjMy0wYjVmLTRhMDMtODYxMS1hODY3OTM4ZDAwN2UQ2J+KgafZ+wIaBgjK1a+dBiIPMTg1LjIxMy4xNTUuMTY4KIq2AzADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGioSJDcxOTQ5ZTg3LTE2N2YtNDk1MS1hZWI5LTA3NzI0OWQ1NDZmYhif6QciGggCEhRjZHMyNTAuYW01Lmh3Y2RuLm5ldBgI.cRWjxlXupo+xlsiC69Jn4f5E4o++hWiCLppELeKdffA=
last-modified
Tue, 27 Dec 2022 15:22:33 GMT
server
fbs
etag
"1672154553"
x-hw
1672211146.cds146.am5.hn,1672211146.cds250.am5.sc,1672211150.cds250.am5.pr
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=30
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noarchive, nosnippet
link
<https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/img/backgroundSpox.jpg>; rel="canonical"
content-length
128159
x-proxy-cache
MISS
check.png
demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/img/
577 B
1 KB
Image
General
Full URL
https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/img/check.png?s
Requested by
Host: demo2.cloudwp.dev
URL: https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/css/Spox1.css?rand=1108237871
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
fbs /
Resource Hash
f556fb3c64c1e81e81311450d0993f90dd52484410c8b19f7fe25501a1fb56c4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/css/Spox1.css?rand=1108237871
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Wed, 28 Dec 2022 07:05:48 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-sp-metadata
HS256.CNzxr50GEooBCiQ0YjMwOWQwOC03NjE3LTQ2ZjMtOGYwMC01ZmNhMTUxMjlkNGMQ2J+KgafZ+wIaBgjK1a+dBiIPMTg1LjIxMy4xNTUuMTY4KIq2AzADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGikSJDVlZmJmZTBkLTIyZTItNDI0Yy04NDNmLTk2ZTMyMjNlNWRiNhjBBCIaCAISFGNkczIxOC5hbTUuaHdjZG4ubmV0GAg=.lKx/51ls5H2JcjqTeNwALmqWlv/bJNasPg+oAgUTl1I=
last-modified
Tue, 27 Dec 2022 15:22:33 GMT
server
fbs
etag
"1672154553"
x-hw
1672211146.cds146.am5.hn,1672211146.cds218.am5.sc,1672211148.cds218.am5.pr
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=30
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noarchive, nosnippet
link
<https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/img/check.png>; rel="canonical"
content-length
577
x-proxy-cache
MISS
FB-f-Logo__blue_57.png
demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/img/
1 KB
2 KB
Image
General
Full URL
https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/img/FB-f-Logo__blue_57.png
Requested by
Host: demo2.cloudwp.dev
URL: https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/css/Spox1.css?rand=1108237871
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
fbs /
Resource Hash
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/css/Spox1.css?rand=1108237871
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Wed, 28 Dec 2022 07:05:53 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-sp-metadata
HS256.COHxr50GEooBCiQzMTQ0MTAyNS0zNTI1LTQ5NWMtYjA2Ny1kMjNhMmQ0NzlkNWQQ2J+KgafZ+wIaBgjK1a+dBiIPMTg1LjIxMy4xNTUuMTY4KIq2AzADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGikSJDQ2ODg1OWY3LTZmMTctNDZmZS1hOWE5LTdlNzZhYTNmOWM4NRivCyIaCAISFGNkczExNi5hbTUuaHdjZG4ubmV0GAg=.1BaOsrd5TiOVJfcwYDhxewr11rlXsYV1t8qQuK2EitM=
last-modified
Tue, 27 Dec 2022 15:22:33 GMT
server
fbs
etag
"1672154553"
x-hw
1672211146.cds146.am5.hn,1672211146.cds116.am5.sc,1672211153.cds116.am5.pr
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=30
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noarchive, nosnippet
link
<https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/img/FB-f-Logo__blue_57.png>; rel="canonical"
content-length
1455
x-proxy-cache
MISS
globe.png
demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/img/
2 KB
3 KB
Image
General
Full URL
https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/img/globe.png?s
Requested by
Host: demo2.cloudwp.dev
URL: https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/css/Spox1.css?rand=1108237871
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
fbs /
Resource Hash
4442aacdd8b7f2368c235a92f6559b1d807231cb30c9409abe8a0f744dc9e8c5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/css/Spox1.css?rand=1108237871
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Wed, 28 Dec 2022 07:05:47 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-sp-metadata
HS256.CNvxr50GEooBCiRmYTg5ZWZjYi0xN2MwLTRlMGItOWE1ZC03NDlmNmRhNGEwZWQQ2J+KgafZ+wIaBgjK1a+dBiIPMTg1LjIxMy4xNTUuMTY4KIq2AzADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGikSJDEzNWE4NzdjLTI1Y2UtNGJjOS05YmVmLWM1YjQwNmVhZDRjNhjsEyIaCAISFGNkczIzMy5hbTUuaHdjZG4ubmV0GAg=.GbRGD0qmBMjQnPA0J4kSZp/S0jlox/KlWb/HiB7JE5E=
last-modified
Tue, 27 Dec 2022 15:22:28 GMT
server
fbs
etag
"1672154548"
x-hw
1672211146.cds146.am5.hn,1672211146.cds233.am5.sc,1672211147.cds233.am5.pr
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=30
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noarchive, nosnippet
link
<https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/img/globe.png>; rel="canonical"
content-length
2540
x-proxy-cache
MISS
down.png
demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/img/
0
0

/
demo2.cloudwp.dev/sbbi/ Frame A432
532 B
771 B
Document
General
Full URL
https://demo2.cloudwp.dev/sbbi/?sbbpg=sbbShell&gprid=BK&sbbgs=h47aa674ff4409af95915e823ebfece61216&ddl=7
Requested by
Host: demo2.cloudwp.dev
URL: https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login?netflix_id=&country=&iso=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
fbs /
Resource Hash
eebc1e16930f8c02d8df7b36daf1d89122876c974d5599cc37d6f6c4b6c7519d

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://demo2.cloudwp.dev
Referer
https://demo2.cloudwp.dev/sbbi/?sbbpg=sbbShell&gprid=BK&sbbgs=h47aa674ff4409af95915e823ebfece61216&ddl=7
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-origin
*
cache-control
no-store, no-cache, max-age=0, must-revalidate, private, max-stale=0, post-check=0, pre-check=0
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Wed, 28 Dec 2022 07:05:47 GMT
link
<https://demo2.cloudwp.dev/sbbi/>; rel="canonical"
server
fbs
x-accel-expires
0
x-hw
1672211147.cds146.am5.hn,1672211147.cds227.am5.sc,1672211147.cdn2-wafbe03-ams1.stackpath.systems.-.i,1672211147.cds227.am5.p
x-sp-metadata
HS256.CNvxr50GEooBCiQyZTgwM2U3OS00ODkyLTQ1MmEtYTIzOS1kZTk5NzVlZjU0NGMQ2J+KgafZ+wIaBgjL1a+dBiIPMTg1LjIxMy4xNTUuMTY4KIq2AzADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGiYSJDgzOWMxMjhmLTRiNWItNGIxZi1hYjllLWM1NmM2ZGUyYWM5NSIaCAISFGNkczIyNy5hbTUuaHdjZG4ubmV0GAg=.6bJBpqpKH9v8KhW07qHkArSfcHTUG6fPpHEN9WPbA+4=
/
demo2.cloudwp.dev/sbbi/ Frame A432
7 KB
3 KB
Document
General
Full URL
https://demo2.cloudwp.dev/sbbi/?sbbpg=sbbShell&gprid=BK
Requested by
Host: demo2.cloudwp.dev
URL: https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login?netflix_id=&country=&iso=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
fbs /
Resource Hash
86bed44b8e314b08f2be0e9848748c69d6b3b7a8fb0cee7a76e444dfe7485a05

Request headers

Referer
https://demo2.cloudwp.dev/sbbi/?sbbpg=sbbShell&gprid=BK&sbbgs=h47aa674ff4409af95915e823ebfece61216&ddl=7
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-origin
*
cache-control
no-store, no-cache, max-age=0, must-revalidate, private, max-stale=0, post-check=0, pre-check=0
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Wed, 28 Dec 2022 07:05:47 GMT
link
<https://demo2.cloudwp.dev/sbbi/>; rel="canonical"
server
fbs
x-accel-expires
0
x-hw
1672211147.cds146.am5.hn,1672211147.cds110.am5.sc,1672211147.cdn2-wafbe02-ams1.stackpath.systems.-.i,1672211147.cds110.am5.p
x-sp-metadata
HS256.CNvxr50GEooBCiQ2NDVmMzEwMS1lZjg0LTQ4NjYtYTUyZS01NWY4NDZlZjRkZDcQ2J+KgafZ+wIaBgjL1a+dBiIPMTg1LjIxMy4xNTUuMTY4KIq2AzADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGiYSJDAzOTZlZDI2LTZlMGMtNGUwNy05Y2QyLThiYWE3MjdiZjg4NCIaCAISFGNkczExMC5hbTUuaHdjZG4ubmV0GAg=.GzGsesWyXhpbCVVnNW31/CihnFpyWUMtMuYRv/ygPPA=

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
demo2.cloudwp.dev
URL
https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/img/down.png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| oncontentvisibilityautostatechange string| sbbvscc string| sbbgscc function| genPid function| nsbbfetch function| sbbgc function| addmg function| addprid function| sbbeccf function| m2vr function| sbbls string| y string| x string| gprid object| sbbeccfi string| sbbgs boolean| error_username boolean| error_password function| validateEmail function| validatePhoneNumber number| lX number| lY string| csr object| otr object| cnv string| lk__ function| setUGEvals number| tt boolean| sbrmp

8 Cookies

Domain/Path Name / Value
demo2.cloudwp.dev/ Name: SPSI
Value: 68dc0af7462e106ac931a6017f18c7aa
demo2.cloudwp.dev/ Name: SPSE
Value: FLWtP7FcTZ3nldllif8QCuGTV7TZO4kG7s9m3JYIYeH4/VfZHkZ6eVuyVPQnpJVKYWhGHcZ+ypOD/0SPH85r1g==
demo2.cloudwp.dev/ Name: PHPSESSID
Value: f595b04c18bdc9b65a266cf813346473
demo2.cloudwp.dev/ Name: spcsrf
Value: fef49aace6100acf986646dc7f6480de
demo2.cloudwp.dev/ Name: sp_lit
Value: 4OvodaM48haAlnN3u/QrKw==
demo2.cloudwp.dev/ Name: PRLST
Value: BK
demo2.cloudwp.dev/ Name: UTGv2
Value: h47aa674ff4409af95915e823ebfece61216
demo2.cloudwp.dev/ Name: adOtr
Value: 0c8a67d4f26