netflix-prom.biz Open in urlscan Pro
2606:4700:3035::ac43:b8c2 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://netflix-prom.biz/
Submission: On March 04 via api (March 4th 2022, 8:06:51 am UTC) from JP — Scanned from JP

Summary HTTP 19 Redirects Links 16 Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 19 HTTP transactions. The main IP is 2606:4700:3035::ac43:b8c2, located in United States and belongs to CLOUDFLARENET, US. The main domain is netflix-prom.biz.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on March 2nd 2022. Valid for: a year.

This is the only time netflix-prom.biz was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address	AS Autonomous System
2	2606:4700:303... 2606:4700:3035::ac43:b8c2	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a00:86c0:209... 2a00:86c0:2090::1	40027 (NETFLIX-ASN) (NETFLIX-ASN)
11	2a00:86c0:209... 2a00:86c0:2091::1	40027 (NETFLIX-ASN) (NETFLIX-ASN)
1	2a02:2d8:1:50... 2a02:2d8:1:500a:232a::1	9002 (RETN-AS) (RETN-AS)
19	5

2 2606:4700:3035::ac43:b8c2 (United States)

ASN13335 (CLOUDFLARENET, US)

netflix-prom.biz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:86c0:2090::1 (United States)

ASN40027 (NETFLIX-ASN, US)

codex.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:86c0:2091::1 (United States)

ASN40027 (NETFLIX-ASN, US)

assets.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:2d8:1:500a:232a::1 (United Kingdom)

ASN9002 (RETN-AS, GB)

occ-0-3428-41.1.nflxso.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	nflxext.com codex.nflxext.com — Cisco Umbrella Rank: 11586 assets.nflxext.com — Cisco Umbrella Rank: 4950	2 MB
2	netflix-prom.biz netflix-prom.biz	8 KB
1	nflxso.net occ-0-3428-41.1.nflxso.net	257 KB
0	netflix.com Failed www.netflix.com Failed
19	4

	Domain	Requested by
11	assets.nflxext.com	netflix-prom.biz codex.nflxext.com
4	codex.nflxext.com	netflix-prom.biz
2	netflix-prom.biz	codex.nflxext.com
1	occ-0-3428-41.1.nflxso.net	netflix-prom.biz
0	www.netflix.com Failed	netflix-prom.biz
19	5

This site contains links to these domains. Also see Links.

Domain
help.netflix.com
www.netflix.com
media.netflix.com
ir.netflix.com
jobs.netflix.com
fast.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-03-02` - `2023-03-01`	a year	crt.sh
*.1.nflxso.net DigiCert TLS RSA SHA256 2020 CA1	`2022-02-03` - `2022-03-11`	a month	crt.sh

This page contains 1 frames:

Primary Page: https://netflix-prom.biz/
Frame ID: 53ECD3B9F0E0BB5EC6693B3CB9479F24
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Netflix - Watch TV Shows Online, Watch Movies Online

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Page Statistics

19
Requests

95 %
HTTPS

100 %
IPv6

4
Domains

5
Subdomains

5
IPs

2
Countries

1903 kB
Transfer

2965 kB
Size

1
Cookies

16 Outgoing links

These are links going to different origins than the main page.

URL: https://help.netflix.com/en/legal/privacy#cookies
Title: cookies and similar technologies

Search URL Search Domain Scan URL

URL: https://www.netflix.com/login
Title: Sign In

Search URL Search Domain Scan URL

URL: https://help.netflix.com/support/412
Title: FAQ

Search URL Search Domain Scan URL

URL: https://help.netflix.com/
Title: Help Center

Search URL Search Domain Scan URL

URL: https://www.netflix.com/youraccount
Title: Account

Search URL Search Domain Scan URL

URL: https://media.netflix.com/
Title: Media Center

Search URL Search Domain Scan URL

URL: https://ir.netflix.com/
Title: Investor Relations

Search URL Search Domain Scan URL

URL: https://jobs.netflix.com/jobs
Title: Jobs

Search URL Search Domain Scan URL

URL: https://www.netflix.com/watch
Title: Ways to Watch

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/termsofuse
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/privacy
Title: Privacy

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/corpinfo
Title: Corporate Information

Search URL Search Domain Scan URL

URL: https://help.netflix.com/contactus
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://fast.com/
Title: Speed Test

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/notices
Title: Legal Notices

Search URL Search Domain Scan URL

URL: https://www.netflix.com/ru-en/browse/genre/839338
Title: Only on Netflix

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
netflix-prom.biz/ 37 KB
8 KB 632ms
613ms Document
text/html 2606:4700:3035::ac43:b8c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://netflix-prom.biz/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::ac43:b8c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1811e8a92e011d07568a112dd5fb42178414e0b40346b8ecad48fd9334f27e67

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: jp-JP,jp;q=0.9

Response headers

date: Fri, 04 Mar 2022 08:06:45 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oXUWEVCF5o%2Bl16ax2dvaOSX1%2FO5l0Ti%2FUTLE6zNTqQ%2F5Kqq66e2L842Bb0SK6IxFnKoAE9smmlsZvyFSvMVzu8wgYGkF98EGM1IbDG7FUOVe7qYeI6MlHS%2Fg73XVS%2FDjmcKgMP%2FO0MLKoqqKdHnq"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6e691d405cd134b1-NRT
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H/1.1 200
OK none Show response
codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-js-v21459f15/js/js/bootstrap.js,common%7Cbootstrap.js/2/0c3c022S2L052J2X3b070m003d2W37092P2Z2U362M2Y2-2N2G01380O/bck/true/ 9 KB
4 KB 36ms
15ms Script
application/javascript 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-js-v21459f15/js/js/bootstrap.js,common%7Cbootstrap.js/2/0c3c022S2L052J2X3b070m003d2W37092P2Z2U362M2Y2-2N2G01380O/bck/true/none

Requested by

Host: netflix-prom.biz
URL: https://netflix-prom.biz/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

8511aecb4665df668d73013b57a19c9c062d2b35c2a47dcef7d9d0fb361efeec

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: https://netflix-prom.biz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 04 Mar 2022 08:06:45 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Content-Type: application/javascript; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=16070400
req_id: 6511b191-85b4-45c4-accc-c6b6d164897a
Connection: keep-alive
Timing-Allow-Origin: https://www.netflix.com
Content-Length: 3630
Expires: Tue, 06 Sep 2022 08:06:45 GMT

GET
H/1.1 200
OK none Show response
codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-js-v21459f15/js/js/signup%7Cnmhp%7CnmhpFrameworkClient.js/2/0c3c022S2L052J2X3b070m003d2W37092P2Z2U362M2Y2-2N2G01380O/l/true/ 1 MB
368 KB 86ms
49ms Script
application/javascript 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-js-v21459f15/js/js/signup%7Cnmhp%7CnmhpFrameworkClient.js/2/0c3c022S2L052J2X3b070m003d2W37092P2Z2U362M2Y2-2N2G01380O/l/true/none

Requested by

Host: netflix-prom.biz
URL: https://netflix-prom.biz/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

d0aada84bc3a741d8a6f3834b2ca492d80f9430b442faf04927d6db11db44cfc

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: https://netflix-prom.biz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 04 Mar 2022 08:06:45 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Content-Type: application/javascript; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=16070400
req_id: ca89f83a-0a1c-4731-a34b-0a7ab1ad75f0
Connection: keep-alive
Timing-Allow-Origin: https://www.netflix.com
Content-Length: 376199
Expires: Tue, 06 Sep 2022 08:06:45 GMT

GET WebsiteDetect
www.netflix.com/personalization/cl2/freeform/ 0
0

GET
H/1.1 200
OK none
codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-v21459f15/css/css/less%7Ccore%7Cerror-page.less/1/burxtD4BpszgawAC/none/true/ 11 KB
3 KB 40ms
30ms Stylesheet
text/css 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-v21459f15/css/css/less%7Ccore%7Cerror-page.less/1/burxtD4BpszgawAC/none/true/none

Requested by

Host: netflix-prom.biz
URL: https://netflix-prom.biz/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

d9bac1aefff045998fd064ed279defcd96c37a53ee0ee3816d1ebab19c1ff739

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: https://netflix-prom.biz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 04 Mar 2022 08:06:45 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Content-Type: text/css; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=16070400
req_id: 4718e043-29a6-4eec-84a2-955b7fc2c533
Connection: keep-alive
Timing-Allow-Origin: https://www.netflix.com
Content-Length: 2595
Expires: Tue, 06 Sep 2022 08:06:45 GMT

GET
H/1.1 200
OK none
codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-v21459f15/css/css/less%7Csignup%7Cnmhp%7Cnmhp.less/1/burxtD4BpszgawAC/none/true/ 107 KB
17 KB 31ms
17ms Stylesheet
text/css 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-v21459f15/css/css/less%7Csignup%7Cnmhp%7Cnmhp.less/1/burxtD4BpszgawAC/none/true/none

Requested by

Host: netflix-prom.biz
URL: https://netflix-prom.biz/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

147040745ab7ac084f9a66e9eec872d02bb6f351dd108b985a3f3ef165aadf0a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: https://netflix-prom.biz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 04 Mar 2022 08:06:45 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Content-Type: text/css; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=16070400
req_id: 76dbd2eb-b23a-4f82-aa2c-71c8e95e1039
Connection: keep-alive
Timing-Allow-Origin: https://www.netflix.com
Content-Length: 17023
Expires: Tue, 06 Sep 2022 08:06:45 GMT

GET
H/1.1 200
OK RU-en-20220111-popsignuptwoweeks-perspective_alpha_website_large.jpg
assets.nflxext.com/ffe/siteui/vlv3/9737377e-a430-4d13-ad6c-874c54837c49/8a139c07-7a66-4d31-bbe6-06934787d415/ 307 KB
307 KB 487ms
461ms Image
image/jpeg 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.nflxext.com/ffe/siteui/vlv3/9737377e-a430-4d13-ad6c-874c54837c49/8a139c07-7a66-4d31-bbe6-06934787d415/RU-en-20220111-popsignuptwoweeks-perspective_alpha_website_large.jpg
Requested by: Host: netflix-prom.biz
URL: https://netflix-prom.biz/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 512a465cb3a51de34cb8ea2af6296529eb3103e01e8ac0fb5bcbf44c434a926e

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: https://netflix-prom.biz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 04 Mar 2022 08:06:45 GMT
Last-Modified: Thu, 13 Jan 2022 21:03:54 GMT
Server: nginx
Content-MD5: p/sY9EaCEAxV9+PwHuVOmw==
Content-Type: image/jpeg
Cache-Control: max-age=604801
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 314102
Expires: Fri, 11 Mar 2022 08:06:46 GMT

GET
H/1.1 200
OK tv.png
assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/ 11 KB
11 KB 6ms
1ms Image
image/png 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/tv.png
Requested by: Host: netflix-prom.biz
URL: https://netflix-prom.biz/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: b68ea2c7bea397aa11fadb189ce7d83862baebaf03ece643eb5aa9fb5f755056

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: https://netflix-prom.biz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 04 Mar 2022 08:06:45 GMT
Last-Modified: Wed, 14 Nov 2018 18:20:41 GMT
Server: nginx
Content-MD5: d5lKZzJ7qVff2IDjOpHwQQ==
Content-Type: image/png
Cache-Control: max-age=604801
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 11418
Expires: Fri, 11 Mar 2022 08:06:46 GMT

GET
H/1.1 200
OK mobile-0819.jpg
assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/ 48 KB
49 KB 6ms
2ms Image
image/jpeg 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/mobile-0819.jpg
Requested by: Host: netflix-prom.biz
URL: https://netflix-prom.biz/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 492fdebd363e40cbba153a244bcfe2a7f5f7cf20aff0805fe45d5c7e2180b875

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: https://netflix-prom.biz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 04 Mar 2022 08:06:45 GMT
Last-Modified: Wed, 14 Aug 2019 17:59:05 GMT
Server: nginx
Content-MD5: pIMz1DwZYS7WGYf6Xb/zxQ==
Content-Type: image/jpeg
Cache-Control: max-age=604801
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 49614
Expires: Fri, 11 Mar 2022 08:06:46 GMT

GET
H/1.1 200
OK boxshot.png
assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/ 20 KB
20 KB 7ms
1ms Image
image/png 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/boxshot.png
Requested by: Host: netflix-prom.biz
URL: https://netflix-prom.biz/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: e1fa26cc34fda574edc01d09e374d6f10735a3fa621bdde87c104ee15453d4b6

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: https://netflix-prom.biz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 04 Mar 2022 08:06:45 GMT
Last-Modified: Wed, 14 Nov 2018 18:48:14 GMT
Server: nginx
Content-MD5: WH4EDyAll5IJSQHKlzlmng==
Content-Type: image/png
Cache-Control: max-age=604801
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 20506
Expires: Fri, 11 Mar 2022 08:06:46 GMT

GET
H/1.1 200
OK device-pile.png
assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/ 134 KB
134 KB 11ms
2ms Image
image/png 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/device-pile.png
Requested by: Host: netflix-prom.biz
URL: https://netflix-prom.biz/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 81cf64888a7b3f6848b09695b034026d9ad685665b91d54597ecbb6197c6acbb

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: https://netflix-prom.biz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 04 Mar 2022 08:06:45 GMT
Last-Modified: Wed, 23 Jan 2019 00:35:07 GMT
Server: nginx
Content-MD5: Cz2CFJPVdI2CnIUrvW0pLQ==
Content-Type: image/png
Cache-Control: max-age=604801
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 137040
Expires: Fri, 11 Mar 2022 08:06:46 GMT

GET
H/1.1 200
OK AAAABdFTpLmANuJpYneLq8L5m7CunMCi8e8Nl4y7xaPVWzG3IeoDoq17egTQAthApKg_4sdRWdwuR8KadWu1frjL3JQImpwq.png
occ-0-3428-41.1.nflxso.net/dnm/api/v6/19OhWN2dO19C9txTON9tvTFtefw/ 257 KB
257 KB 520ms
174ms Image
image/png 2a02:2d8:1:500a:232a::1
RETN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://occ-0-3428-41.1.nflxso.net/dnm/api/v6/19OhWN2dO19C9txTON9tvTFtefw/AAAABdFTpLmANuJpYneLq8L5m7CunMCi8e8Nl4y7xaPVWzG3IeoDoq17egTQAthApKg_4sdRWdwuR8KadWu1frjL3JQImpwq.png?r=fcd
Requested by: Host: netflix-prom.biz
URL: https://netflix-prom.biz/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a02:2d8:1:500a:232a::1 , United Kingdom, ASN9002 (RETN-AS, GB),
Reverse DNS
Software: nginx /
Resource Hash: e4078b5b28c333b260a5b250e9a252b9394f106371a5abcf243c9a0fa3337b6d

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: https://netflix-prom.biz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 04 Mar 2022 08:06:45 GMT
Last-Modified: Wed, 05 May 2021 17:05:51 GMT
Server: nginx
ETag: "6effc28c582a9b64154f76608b82a977"
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: max-age=2592000
Connection: keep-alive
Content-Length: 263266

GET
H/1.1 200
OK NetflixSans_W_Rg.woff2
assets.nflxext.com/ffe/siteui/fonts/netflix-sans/v3/ 52 KB
52 KB 19ms
4ms Font
font/woff2 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.nflxext.com/ffe/siteui/fonts/netflix-sans/v3/NetflixSans_W_Rg.woff2
Requested by: Host: codex.nflxext.com
URL: https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-v21459f15/css/css/less%7Ccore%7Cerror-page.less/1/burxtD4BpszgawAC/none/true/none
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: c0bceb927c506dce9f6e6f5f570e641ad580b9554be06f61508a4aee32380167

Request headers

Referer: https://codex.nflxext.com/
Origin: https://netflix-prom.biz
Accept-Language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 04 Mar 2022 08:06:45 GMT
Last-Modified: Thu, 17 Jan 2019 20:16:30 GMT
Server: nginx
Content-MD5: C/MXfx/tbZUxeCIfukPH6A==
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=604801
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 53304
Expires: Fri, 11 Mar 2022 08:06:46 GMT

GET
H/1.1 200
OK NetflixSans_W_Md.woff2
assets.nflxext.com/ffe/siteui/fonts/netflix-sans/v3/ 53 KB
53 KB 33ms
2ms Font
font/woff2 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.nflxext.com/ffe/siteui/fonts/netflix-sans/v3/NetflixSans_W_Md.woff2
Requested by: Host: codex.nflxext.com
URL: https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-v21459f15/css/css/less%7Ccore%7Cerror-page.less/1/burxtD4BpszgawAC/none/true/none
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 9ac2bd03fcde501b3f30f47ab1fae62161f87808ea6411f38e8feaa4bbddc42e

Request headers

Referer: https://codex.nflxext.com/
Origin: https://netflix-prom.biz
Accept-Language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 04 Mar 2022 08:06:45 GMT
Last-Modified: Thu, 17 Jan 2019 20:16:30 GMT
Server: nginx
Content-MD5: 6naZIbDPpPxtTRouCx+l/w==
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=604801
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 53940
Expires: Fri, 11 Mar 2022 08:06:46 GMT

GET
H/1.1 200
OK nf-icon-v1-93.woff
assets.nflxext.com/ffe/siteui/fonts/ 72 KB
72 KB 36ms
3ms Font
font/woff 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-93.woff
Requested by: Host: codex.nflxext.com
URL: https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-v21459f15/css/css/less%7Csignup%7Cnmhp%7Cnmhp.less/1/burxtD4BpszgawAC/none/true/none
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d

Request headers

Referer: https://codex.nflxext.com/
Origin: https://netflix-prom.biz
Accept-Language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 04 Mar 2022 08:06:45 GMT
Last-Modified: Mon, 29 Jan 2018 01:50:51 GMT
Server: nginx
Content-MD5: fPYVbMSBJEtaJUNi17c/AA==
Content-Type: font/woff
Access-Control-Allow-Origin: *
Cache-Control: max-age=604801
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 73572
Expires: Fri, 11 Mar 2022 08:06:46 GMT

GET
H/1.1 206
Partial Content video-tv-0819.m4v
assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/ 264 KB
264 KB 2ms
1ms Media
video/x-m4v 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/video-tv-0819.m4v
Requested by: Host: netflix-prom.biz
URL: https://netflix-prom.biz/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 4c7a552d219146985961bf78d9083b7e2c1a82c4ada5d959f48b3e53754c9049

Request headers

Referer: https://netflix-prom.biz/
Accept-Encoding: identity;q=1, *;q=0
Accept-Language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Range: bytes=0-

Response headers

Date: Fri, 04 Mar 2022 08:06:45 GMT
Last-Modified: Mon, 12 Aug 2019 20:49:12 GMT
Server: nginx
Content-MD5: PLEtt8Zyszc1AGSApFXscg==
Content-Type: video/x-m4v
Content-Range: bytes 0-270045/270046
Cache-Control: max-age=604801
Connection: keep-alive
Content-Length: 270046
Expires: Fri, 11 Mar 2022 08:06:46 GMT

GET
H/1.1 206
Partial Content video-devices.m4v
assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/ 260 KB
260 KB 4ms
4ms Media
video/x-m4v 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/video-devices.m4v
Requested by: Host: netflix-prom.biz
URL: https://netflix-prom.biz/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 3eec290a7f7da9abb00b49ca84f5f16e6d45ca33d40fd8ede4380835d6161d71

Request headers

Referer: https://netflix-prom.biz/
Accept-Encoding: identity;q=1, *;q=0
Accept-Language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Range: bytes=0-

Response headers

Date: Fri, 04 Mar 2022 08:06:45 GMT
Last-Modified: Wed, 09 Jan 2019 20:47:49 GMT
Server: nginx
Content-MD5: PlXFYgWonIWf7QBa4XKfqg==
Content-Type: video/x-m4v
Content-Range: bytes 0-266159/266160
Cache-Control: max-age=604801
Connection: keep-alive
Content-Length: 266160
Expires: Fri, 11 Mar 2022 08:06:46 GMT

GET
H/1.1 200
OK download-icon.gif
assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/ 22 KB
22 KB 10ms
10ms Image
image/gif 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/download-icon.gif
Requested by: Host: codex.nflxext.com
URL: https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-v21459f15/css/css/less%7Csignup%7Cnmhp%7Cnmhp.less/1/burxtD4BpszgawAC/none/true/none
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 4f99e4c2ed1c2b7de72f47102c64d601567f8efaad5944a08c86786cad4050e6

Request headers

Accept-Language: jp-JP,jp;q=0.9
Referer: https://codex.nflxext.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 04 Mar 2022 08:06:45 GMT
Last-Modified: Mon, 12 Nov 2018 22:40:57 GMT
Server: nginx
Content-MD5: 3Ty3jbeMPgoTybd+4Z3u5g==
Content-Type: image/gif
Cache-Control: max-age=604801
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 22171
Expires: Fri, 11 Mar 2022 08:06:46 GMT

POST
H2 404 log Show response
netflix-prom.biz/personalization/ 278 B
539 B 310ms
309ms XHR
text/html 2606:4700:3035::ac43:b8c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://netflix-prom.biz/personalization/log
Requested by: Host: codex.nflxext.com
URL: https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-js-v21459f15/js/js/signup%7Cnmhp%7CnmhpFrameworkClient.js/2/0c3c022S2L052J2X3b070m003d2W37092P2Z2U362M2Y2-2N2G01380O/l/true/none
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::ac43:b8c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3f5f4891d45a82f4f671403a5ff25b8ea2ec9cead5958013437ad99213ca287d

Request headers

Accept: */*
Referer: https://netflix-prom.biz/
X-Netflix.ichnaea.request.type: UiRequest
X-Requested-With: XMLHttpRequest
Accept-Language: jp-JP,jp;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 04 Mar 2022 08:06:46 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dKuhoz6TjgDqsZ3tQ8o445i0Cisqz9N%2Bv53FKfbQOiOiZ8ye8QhMZv3Ap6a2RTGLOxctmSgcVkaOXM4rhonkcrGmqvErUtNsQ%2B6xZWfWDxyhCX%2FxHvBX1dNziray6Ff6fXnVhO%2BYU1xwd%2FCcMBYF"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=iso-8859-1
cf-ray: 6e691d47bed634b1-NRT
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.netflix.com
URL: https://www.netflix.com/personalization/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=css&modalView=nmLanding

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.netflix-prom.biz/	1969-12-31 23:59:59	Name: cL Value: 1646381205653%7C164638120559039942%7C164638120561543998%7C%7C4%7Cundefined

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://netflix-prom.biz/ Message: Refused to apply style from 'https://www.netflix.com/personalization/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=css&modalView=nmLanding' because its MIME type ('') is not a supported stylesheet MIME type, and strict MIME checking is enabled.
network	error	URL: https://netflix-prom.biz/personalization/log Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.nflxext.com
codex.nflxext.com
netflix-prom.biz
occ-0-3428-41.1.nflxso.net
www.netflix.com
www.netflix.com
2606:4700:3035::ac43:b8c2
2a00:86c0:2090::1
2a00:86c0:2091::1
2a02:2d8:1:500a:232a::1
147040745ab7ac084f9a66e9eec872d02bb6f351dd108b985a3f3ef165aadf0a
1811e8a92e011d07568a112dd5fb42178414e0b40346b8ecad48fd9334f27e67
3eec290a7f7da9abb00b49ca84f5f16e6d45ca33d40fd8ede4380835d6161d71
3f5f4891d45a82f4f671403a5ff25b8ea2ec9cead5958013437ad99213ca287d
492fdebd363e40cbba153a244bcfe2a7f5f7cf20aff0805fe45d5c7e2180b875
4c7a552d219146985961bf78d9083b7e2c1a82c4ada5d959f48b3e53754c9049
4f99e4c2ed1c2b7de72f47102c64d601567f8efaad5944a08c86786cad4050e6
512a465cb3a51de34cb8ea2af6296529eb3103e01e8ac0fb5bcbf44c434a926e
81cf64888a7b3f6848b09695b034026d9ad685665b91d54597ecbb6197c6acbb
8511aecb4665df668d73013b57a19c9c062d2b35c2a47dcef7d9d0fb361efeec
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
9ac2bd03fcde501b3f30f47ab1fae62161f87808ea6411f38e8feaa4bbddc42e
b68ea2c7bea397aa11fadb189ce7d83862baebaf03ece643eb5aa9fb5f755056
c0bceb927c506dce9f6e6f5f570e641ad580b9554be06f61508a4aee32380167
d0aada84bc3a741d8a6f3834b2ca492d80f9430b442faf04927d6db11db44cfc
d9bac1aefff045998fd064ed279defcd96c37a53ee0ee3816d1ebab19c1ff739
e1fa26cc34fda574edc01d09e374d6f10735a3fa621bdde87c104ee15453d4b6
e4078b5b28c333b260a5b250e9a252b9394f106371a5abcf243c9a0fa3337b6d

netflix-prom.biz Open in urlscan Pro 2606:4700:3035::ac43:b8c2 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

19 Requests

95 %HTTPS

100 %IPv6

4 Domains

5 Subdomains

5 IPs

2 Countries

1903 kBTransfer

2965 kBSize

1 Cookies

16 Outgoing links

Redirected requests

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

1 Cookies

2 Console Messages

Indicators

netflix-prom.biz Open in urlscan Pro
2606:4700:3035::ac43:b8c2 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

19
Requests

95 %
HTTPS

100 %
IPv6

4
Domains

5
Subdomains

5
IPs

2
Countries

1903 kB
Transfer

2965 kB
Size

1
Cookies

19 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!