berryevents.com Open in urlscan Pro
35.214.181.85  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response berryevents.com/wp-includes/N%c3%aatfl%c3%acx.c%c3%b8m/Confirm-Y%c3%b5ur-N%c3%aatfl%c3%acx-Account-Information/S%c3%bcspended-Acc%c5%8dunt/LogIn/Netflix812/	5 KB 5 KB	29301ms 29195ms	Document text/html	35.214.181.85 GOOGLE-2
General Check archive.org Show headers Download Go to Full URL https://berryevents.com/wp-includes/N%c3%aatfl%c3%acx.c%c3%b8m/Confirm-Y%c3%b5ur-N%c3%aatfl%c3%acx-Account-Information/S%c3%bcspended-Acc%c5%8dunt/LogIn/Netflix812/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.214.181.85 Mountain View, United States, ASN19527 (GOOGLE-2, US), Reverse DNS 85.181.214.35.bc.googleusercontent.com Software nginx / Resource Hash c92aa2400c71ef8437d9a8cb7fd5580f4dee6a28f85c5202dd3373c327eb68ea Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers :method GET :authority berryevents.com :scheme https :path /wp-includes/N%c3%aatfl%c3%acx.c%c3%b8m/Confirm-Y%c3%b5ur-N%c3%aatfl%c3%acx-Account-Information/S%c3%bcspended-Acc%c5%8dunt/LogIn/Netflix812/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 200 server nginx date Fri, 17 Apr 2020 16:53:14 GMT content-type text/html; charset=UTF-8 expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 pragma no-cache set-cookie PHPSESSID=cprjhfars69q6j2k576qu3ng62; path=/ content-security-policy upgrade-insecure-requests alt-svc quic=":443"; ma=86400; v="43,39" host-header b7440e60b07ee7b8044761568fab26e8 x-proxy-cache MISS
GET H2	200	style.css berryevents.com/wp-includes/N%c3%aatfl%c3%acx.c%c3%b8m/Confirm-Y%c3%b5ur-N%c3%aatfl%c3%acx-Account-Information/S%c3%bcspended-Acc%c5%8dunt/LogIn/Netflix812/css/	21 KB 4 KB	96ms 95ms	Stylesheet text/css	35.214.181.85 GOOGLE-2
General Check archive.org Show headers Download Go to Full URL https://berryevents.com/wp-includes/N%c3%aatfl%c3%acx.c%c3%b8m/Confirm-Y%c3%b5ur-N%c3%aatfl%c3%acx-Account-Information/S%c3%bcspended-Acc%c5%8dunt/LogIn/Netflix812/css/style.css Requested by Host: berryevents.com URL: https://berryevents.com/wp-includes/N%c3%aatfl%c3%acx.c%c3%b8m/Confirm-Y%c3%b5ur-N%c3%aatfl%c3%acx-Account-Information/S%c3%bcspended-Acc%c5%8dunt/LogIn/Netflix812/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.214.181.85 Mountain View, United States, ASN19527 (GOOGLE-2, US), Reverse DNS 85.181.214.35.bc.googleusercontent.com Software nginx / Resource Hash 2f085a84cb00b9b35b5125231a1accae74aba455992b2b21c28380345ba52c53 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers Referer https://berryevents.com/wp-includes/N%c3%aatfl%c3%acx.c%c3%b8m/Confirm-Y%c3%b5ur-N%c3%aatfl%c3%acx-Account-Information/S%c3%bcspended-Acc%c5%8dunt/LogIn/Netflix812/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 17 Apr 2020 16:53:14 GMT content-encoding gzip last-modified Tue, 14 Apr 2020 21:16:10 GMT server nginx etag "5283-5a346b575ce34-gzip" vary Accept-Encoding content-type text/css status 200 content-security-policy upgrade-insecure-requests host-header b7440e60b07ee7b8044761568fab26e8 alt-svc quic=":443"; ma=86400; v="43,39" x-proxy-cache MISS
GET H2	200	app.css berryevents.com/wp-includes/N%c3%aatfl%c3%acx.c%c3%b8m/Confirm-Y%c3%b5ur-N%c3%aatfl%c3%acx-Account-Information/S%c3%bcspended-Acc%c5%8dunt/LogIn/Netflix812/css/	2 KB 974 B	105ms 104ms	Stylesheet text/css	35.214.181.85 GOOGLE-2
General Check archive.org Show headers Download Go to Full URL https://berryevents.com/wp-includes/N%c3%aatfl%c3%acx.c%c3%b8m/Confirm-Y%c3%b5ur-N%c3%aatfl%c3%acx-Account-Information/S%c3%bcspended-Acc%c5%8dunt/LogIn/Netflix812/css/app.css Requested by Host: berryevents.com URL: https://berryevents.com/wp-includes/N%c3%aatfl%c3%acx.c%c3%b8m/Confirm-Y%c3%b5ur-N%c3%aatfl%c3%acx-Account-Information/S%c3%bcspended-Acc%c5%8dunt/LogIn/Netflix812/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.214.181.85 Mountain View, United States, ASN19527 (GOOGLE-2, US), Reverse DNS 85.181.214.35.bc.googleusercontent.com Software nginx / Resource Hash 5efb393cf10db7ee157dcd3109179e7619633c7e8d17c5ab3eab1ea1278f6dd1 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers Referer https://berryevents.com/wp-includes/N%c3%aatfl%c3%acx.c%c3%b8m/Confirm-Y%c3%b5ur-N%c3%aatfl%c3%acx-Account-Information/S%c3%bcspended-Acc%c5%8dunt/LogIn/Netflix812/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy upgrade-insecure-requests content-encoding gzip last-modified Tue, 14 Apr 2020 21:16:10 GMT server nginx etag "9e2-5a346b575ce34-gzip" vary Accept-Encoding content-type text/css status 200 date Fri, 17 Apr 2020 16:53:14 GMT accept-ranges bytes alt-svc quic=":443"; ma=86400; v="43,39" content-length 670 host-header b7440e60b07ee7b8044761568fab26e8 x-proxy-cache MISS
GET H2	200	jquery.min.js Show response berryevents.com/wp-includes/N%c3%aatfl%c3%acx.c%c3%b8m/Confirm-Y%c3%b5ur-N%c3%aatfl%c3%acx-Account-Information/S%c3%bcspended-Acc%c5%8dunt/LogIn/Netflix812/js/	152 KB 44 KB	121ms 120ms	Script application/javascript	35.214.181.85 GOOGLE-2
General Check archive.org Show headers Download Go to Full URL https://berryevents.com/wp-includes/N%c3%aatfl%c3%acx.c%c3%b8m/Confirm-Y%c3%b5ur-N%c3%aatfl%c3%acx-Account-Information/S%c3%bcspended-Acc%c5%8dunt/LogIn/Netflix812/js/jquery.min.js Requested by Host: berryevents.com URL: https://berryevents.com/wp-includes/N%c3%aatfl%c3%acx.c%c3%b8m/Confirm-Y%c3%b5ur-N%c3%aatfl%c3%acx-Account-Information/S%c3%bcspended-Acc%c5%8dunt/LogIn/Netflix812/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.214.181.85 Mountain View, United States, ASN19527 (GOOGLE-2, US), Reverse DNS 85.181.214.35.bc.googleusercontent.com Software nginx / Resource Hash 7aa387f2db11236e0a3d6e4124c33bbf9f588dff926a1454a92ce694fc84c620 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers Referer https://berryevents.com/wp-includes/N%c3%aatfl%c3%acx.c%c3%b8m/Confirm-Y%c3%b5ur-N%c3%aatfl%c3%acx-Account-Information/S%c3%bcspended-Acc%c5%8dunt/LogIn/Netflix812/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy upgrade-insecure-requests content-encoding gzip last-modified Tue, 14 Apr 2020 21:16:10 GMT server nginx etag "261cf-5a346b575d604-gzip" vary Accept-Encoding content-type application/javascript status 200 date Fri, 17 Apr 2020 16:53:14 GMT accept-ranges bytes alt-svc quic=":443"; ma=86400; v="43,39" content-length 44410 host-header b7440e60b07ee7b8044761568fab26e8 x-proxy-cache MISS
GET H2	200	validet.js Show response berryevents.com/wp-includes/N%c3%aatfl%c3%acx.c%c3%b8m/Confirm-Y%c3%b5ur-N%c3%aatfl%c3%acx-Account-Information/S%c3%bcspended-Acc%c5%8dunt/LogIn/Netflix812/js/	7 KB 1 KB	92ms 92ms	Script application/javascript	35.214.181.85 GOOGLE-2
General Check archive.org Show headers Download Go to Full URL https://berryevents.com/wp-includes/N%c3%aatfl%c3%acx.c%c3%b8m/Confirm-Y%c3%b5ur-N%c3%aatfl%c3%acx-Account-Information/S%c3%bcspended-Acc%c5%8dunt/LogIn/Netflix812/js/validet.js Requested by Host: berryevents.com URL: https://berryevents.com/wp-includes/N%c3%aatfl%c3%acx.c%c3%b8m/Confirm-Y%c3%b5ur-N%c3%aatfl%c3%acx-Account-Information/S%c3%bcspended-Acc%c5%8dunt/LogIn/Netflix812/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.214.181.85 Mountain View, United States, ASN19527 (GOOGLE-2, US), Reverse DNS 85.181.214.35.bc.googleusercontent.com Software nginx / Resource Hash 3668352cee7c03431751e26e34aebf496fe874ae28a8b96c4481dc129b502822 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers Referer https://berryevents.com/wp-includes/N%c3%aatfl%c3%acx.c%c3%b8m/Confirm-Y%c3%b5ur-N%c3%aatfl%c3%acx-Account-Information/S%c3%bcspended-Acc%c5%8dunt/LogIn/Netflix812/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy upgrade-insecure-requests content-encoding gzip last-modified Tue, 14 Apr 2020 21:16:10 GMT server nginx etag "1c52-5a346b575d21c-gzip" vary Accept-Encoding content-type application/javascript status 200 date Fri, 17 Apr 2020 16:53:14 GMT accept-ranges bytes alt-svc quic=":443"; ma=86400; v="43,39" content-length 934 host-header b7440e60b07ee7b8044761568fab26e8 x-proxy-cache MISS
GET H2	200	bg-login-large.jpg berryevents.com/wp-includes/N%c3%aatfl%c3%acx.c%c3%b8m/Confirm-Y%c3%b5ur-N%c3%aatfl%c3%acx-Account-Information/S%c3%bcspended-Acc%c5%8dunt/LogIn/Netflix812/img/	342 KB 343 KB	109ms 109ms	Image image/jpeg	35.214.181.85 GOOGLE-2
General Check archive.org Show headers Download Go to Show image Full URL https://berryevents.com/wp-includes/N%c3%aatfl%c3%acx.c%c3%b8m/Confirm-Y%c3%b5ur-N%c3%aatfl%c3%acx-Account-Information/S%c3%bcspended-Acc%c5%8dunt/LogIn/Netflix812/img/bg-login-large.jpg Requested by Host: berryevents.com URL: https://berryevents.com/wp-includes/N%c3%aatfl%c3%acx.c%c3%b8m/Confirm-Y%c3%b5ur-N%c3%aatfl%c3%acx-Account-Information/S%c3%bcspended-Acc%c5%8dunt/LogIn/Netflix812/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.214.181.85 Mountain View, United States, ASN19527 (GOOGLE-2, US), Reverse DNS 85.181.214.35.bc.googleusercontent.com Software nginx / Resource Hash 68a140f407da7acc8b00ae9eb2be5a09df4b046277a3bfe03881417a068da7e4 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers Referer https://berryevents.com/wp-includes/N%c3%aatfl%c3%acx.c%c3%b8m/Confirm-Y%c3%b5ur-N%c3%aatfl%c3%acx-Account-Information/S%c3%bcspended-Acc%c5%8dunt/LogIn/Netflix812/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy upgrade-insecure-requests last-modified Tue, 14 Apr 2020 21:16:10 GMT server nginx etag "55787-5a346b575ddd4" content-type image/jpeg status 200 date Fri, 17 Apr 2020 16:53:14 GMT accept-ranges bytes alt-svc quic=":443"; ma=86400; v="43,39" content-length 350087 host-header b7440e60b07ee7b8044761568fab26e8 x-proxy-cache MISS
GET H2	200	FB-logo.png berryevents.com/wp-includes/N%c3%aatfl%c3%acx.c%c3%b8m/Confirm-Y%c3%b5ur-N%c3%aatfl%c3%acx-Account-Information/S%c3%bcspended-Acc%c5%8dunt/LogIn/Netflix812/img/	1 KB 2 KB	114ms 113ms	Image image/png	35.214.181.85 GOOGLE-2
General Check archive.org Show headers Download Go to Show image Full URL https://berryevents.com/wp-includes/N%c3%aatfl%c3%acx.c%c3%b8m/Confirm-Y%c3%b5ur-N%c3%aatfl%c3%acx-Account-Information/S%c3%bcspended-Acc%c5%8dunt/LogIn/Netflix812/img/FB-logo.png Requested by Host: berryevents.com URL: https://berryevents.com/wp-includes/N%c3%aatfl%c3%acx.c%c3%b8m/Confirm-Y%c3%b5ur-N%c3%aatfl%c3%acx-Account-Information/S%c3%bcspended-Acc%c5%8dunt/LogIn/Netflix812/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.214.181.85 Mountain View, United States, ASN19527 (GOOGLE-2, US), Reverse DNS 85.181.214.35.bc.googleusercontent.com Software nginx / Resource Hash 3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers Referer https://berryevents.com/wp-includes/N%c3%aatfl%c3%acx.c%c3%b8m/Confirm-Y%c3%b5ur-N%c3%aatfl%c3%acx-Account-Information/S%c3%bcspended-Acc%c5%8dunt/LogIn/Netflix812/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy upgrade-insecure-requests last-modified Tue, 14 Apr 2020 21:16:10 GMT server nginx etag "5af-5a346b575f15d" content-type image/png status 200 date Fri, 17 Apr 2020 16:53:14 GMT accept-ranges bytes alt-svc quic=":443"; ma=86400; v="43,39" content-length 1455 host-header b7440e60b07ee7b8044761568fab26e8 x-proxy-cache MISS
GET H2	200	glob.png berryevents.com/wp-includes/N%c3%aatfl%c3%acx.c%c3%b8m/Confirm-Y%c3%b5ur-N%c3%aatfl%c3%acx-Account-Information/S%c3%bcspended-Acc%c5%8dunt/LogIn/Netflix812/img/	842 B 1 KB	92ms 92ms	Image image/png	35.214.181.85 GOOGLE-2
General Check archive.org Show headers Download Go to Show image Full URL https://berryevents.com/wp-includes/N%c3%aatfl%c3%acx.c%c3%b8m/Confirm-Y%c3%b5ur-N%c3%aatfl%c3%acx-Account-Information/S%c3%bcspended-Acc%c5%8dunt/LogIn/Netflix812/img/glob.png Requested by Host: berryevents.com URL: https://berryevents.com/wp-includes/N%c3%aatfl%c3%acx.c%c3%b8m/Confirm-Y%c3%b5ur-N%c3%aatfl%c3%acx-Account-Information/S%c3%bcspended-Acc%c5%8dunt/LogIn/Netflix812/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.214.181.85 Mountain View, United States, ASN19527 (GOOGLE-2, US), Reverse DNS 85.181.214.35.bc.googleusercontent.com Software nginx / Resource Hash 4f8072ca4cdc4412083462c38eebc18bb5a0b919fb4bb63ec98769f0b644306e Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Request headers Referer https://berryevents.com/wp-includes/N%c3%aatfl%c3%acx.c%c3%b8m/Confirm-Y%c3%b5ur-N%c3%aatfl%c3%acx-Account-Information/S%c3%bcspended-Acc%c5%8dunt/LogIn/Netflix812/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers content-security-policy upgrade-insecure-requests last-modified Tue, 14 Apr 2020 21:16:10 GMT server nginx etag "34a-5a346b575ed75" content-type image/png status 200 date Fri, 17 Apr 2020 16:53:14 GMT accept-ranges bytes alt-svc quic=":443"; ma=86400; v="43,39" content-length 842 host-header b7440e60b07ee7b8044761568fab26e8 x-proxy-cache MISS
GET H/1.1	403 Forbidden	json Show response ip-api.com/	107 B 291 B	63ms 15ms	XHR application/json	208.95.112.1 TUT-AS
General Check archive.org Show headers Download Go to Full URL https://ip-api.com/json Requested by Host: berryevents.com URL: https://berryevents.com/wp-includes/N%c3%aatfl%c3%acx.c%c3%b8m/Confirm-Y%c3%b5ur-N%c3%aatfl%c3%acx-Account-Information/S%c3%bcspended-Acc%c5%8dunt/LogIn/Netflix812/js/jquery.min.js Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_CBC Server 208.95.112.1 , United States, ASN53334 (TUT-AS, US), Reverse DNS ip-api.com Software / Resource Hash 61fd702060224daad1fa949b448fcbebb9d3bc8628ffb942b44e8fa63dbd4c87 Request headers Accept */* Referer https://berryevents.com/wp-includes/N%c3%aatfl%c3%acx.c%c3%b8m/Confirm-Y%c3%b5ur-N%c3%aatfl%c3%acx-Account-Information/S%c3%bcspended-Acc%c5%8dunt/LogIn/Netflix812/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Fri, 17 Apr 2020 16:53:14 GMT X-Rl 44 X-Ttl 60 Content-Length 107 Content-Type application/json; charset=utf-8

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| $ function| jQuery function| ipLookUp

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			berryevents.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: cprjhfars69q6j2k576qu3ng62

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://berryevents.com/wp-includes/N%c3%aatfl%c3%acx.c%c3%b8m/Confirm-Y%c3%b5ur-N%c3%aatfl%c3%acx-Account-Information/S%c3%bcspended-Acc%c5%8dunt/LogIn/Netflix812/(Line 63) Message: Request failed. Returned status of error

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

berryevents.com
ip-api.com
208.95.112.1
35.214.181.85
2f085a84cb00b9b35b5125231a1accae74aba455992b2b21c28380345ba52c53
3668352cee7c03431751e26e34aebf496fe874ae28a8b96c4481dc129b502822
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
4f8072ca4cdc4412083462c38eebc18bb5a0b919fb4bb63ec98769f0b644306e
5efb393cf10db7ee157dcd3109179e7619633c7e8d17c5ab3eab1ea1278f6dd1
61fd702060224daad1fa949b448fcbebb9d3bc8628ffb942b44e8fa63dbd4c87
68a140f407da7acc8b00ae9eb2be5a09df4b046277a3bfe03881417a068da7e4
7aa387f2db11236e0a3d6e4124c33bbf9f588dff926a1454a92ce694fc84c620
c92aa2400c71ef8437d9a8cb7fd5580f4dee6a28f85c5202dd3373c327eb68ea