netflixfatura.homeip.net Open in urlscan Pro
54.180.151.250  Malicious Activity! Public Scan

URL: https://netflixfatura.homeip.net/br/login/pt/index.php
Submission: On September 20 via manual from IN — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 5 HTTP transactions. The main IP is 54.180.151.250, located in Incheon, Korea, Republic Of and belongs to AMAZON-02, US. The main domain is netflixfatura.homeip.net.
TLS certificate: Issued by R3 on September 19th 2022. Valid for: 3 months.
This is the only time netflixfatura.homeip.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

IP Address AS Autonomous System
5 54.180.151.250 16509 (AMAZON-02)
5 1
Apex Domain
Subdomains
Transfer
5 homeip.net
netflixfatura.homeip.net
290 KB
5 1
Domain Requested by
5 netflixfatura.homeip.net netflixfatura.homeip.net
5 1

This site contains no links.

Subject Issuer Validity Valid
netflixfatura.from-vt.com
R3
2022-09-19 -
2022-12-18
3 months crt.sh

This page contains 1 frames:

Primary Page: https://netflixfatura.homeip.net/br/login/pt/index.php
Frame ID: CE51F938B4C2C30DC0D62E933E8AEDB8
Requests: 5 HTTP requests in this frame

Screenshot

Page Title

Netflix

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Overall confidence: 100%
Detected patterns
  • <[^>]+data-react

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

5
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

290 kB
Transfer

499 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request index.php
netflixfatura.homeip.net/br/login/pt/
99 KB
47 KB
Document
General
Full URL
https://netflixfatura.homeip.net/br/login/pt/index.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
54.180.151.250 Incheon, Korea, Republic Of, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-180-151-250.ap-northeast-2.compute.amazonaws.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
4ee12f0032583d1750f634ca4f2cf21a37e4c8d35b1925c3962583a6efc8fcf5

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
Keep-Alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Tue, 20 Sep 2022 07:31:33 GMT
Keep-Alive
timeout=5, max=100
Server
Apache/2.4.29 (Ubuntu)
Transfer-Encoding
chunked
Vary
Accept-Encoding
none.css
netflixfatura.homeip.net/br/login/css/
121 KB
19 KB
Stylesheet
General
Full URL
https://netflixfatura.homeip.net/br/login/css/none.css
Requested by
Host: netflixfatura.homeip.net
URL: https://netflixfatura.homeip.net/br/login/pt/index.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
54.180.151.250 Incheon, Korea, Republic Of, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-180-151-250.ap-northeast-2.compute.amazonaws.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
97cbcb589f20144bf1341648c985ecda690430106fe66541f4a2444f526747d2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://netflixfatura.homeip.net/br/login/pt/index.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date
Tue, 20 Sep 2022 07:31:33 GMT
Content-Encoding
gzip
Last-Modified
Thu, 05 May 2022 21:07:56 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"1e514-5de4a22c78300-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
19335
backgroud1.jpg
netflixfatura.homeip.net/br/login/images/
122 KB
122 KB
Image
General
Full URL
https://netflixfatura.homeip.net/br/login/images/backgroud1.jpg
Requested by
Host: netflixfatura.homeip.net
URL: https://netflixfatura.homeip.net/br/login/pt/index.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
54.180.151.250 Incheon, Korea, Republic Of, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-180-151-250.ap-northeast-2.compute.amazonaws.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
b3b17aa5cde5c3984773a46e522bb20f3ff30a0a97ef995c646f2fedd85f296e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://netflixfatura.homeip.net/br/login/pt/index.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date
Tue, 20 Sep 2022 07:31:34 GMT
Last-Modified
Fri, 05 Aug 2022 23:17:18 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"1e8da-5e586aad4bb80"
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
125146
jquery-3.3.1.min2b3b.js
netflixfatura.homeip.net/br/login/js/
85 KB
30 KB
Script
General
Full URL
https://netflixfatura.homeip.net/br/login/js/jquery-3.3.1.min2b3b.js?017de12dd4fff4aa8dd4b435113285c8
Requested by
Host: netflixfatura.homeip.net
URL: https://netflixfatura.homeip.net/br/login/pt/index.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
54.180.151.250 Incheon, Korea, Republic Of, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-180-151-250.ap-northeast-2.compute.amazonaws.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://netflixfatura.homeip.net/br/login/pt/index.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date
Tue, 20 Sep 2022 07:31:34 GMT
Content-Encoding
gzip
Last-Modified
Thu, 05 May 2022 21:07:56 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"1538f-5de4a22c78300-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
30307
nf-icon-v1-93.woff
netflixfatura.homeip.net/br/login/css/
72 KB
72 KB
Font
General
Full URL
https://netflixfatura.homeip.net/br/login/css/nf-icon-v1-93.woff
Requested by
Host: netflixfatura.homeip.net
URL: https://netflixfatura.homeip.net/br/login/css/none.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
54.180.151.250 Incheon, Korea, Republic Of, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-180-151-250.ap-northeast-2.compute.amazonaws.com
Software
Apache/2.4.29 (Ubuntu) /
Resource Hash
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d

Request headers

Referer
https://netflixfatura.homeip.net/br/login/css/none.css
Origin
https://netflixfatura.homeip.net
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36

Response headers

Date
Tue, 20 Sep 2022 07:31:34 GMT
Last-Modified
Thu, 05 May 2022 21:07:56 GMT
Server
Apache/2.4.29 (Ubuntu)
ETag
"11f64-5de4a22c78300"
Content-Type
application/font-woff
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
73572

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery

0 Cookies