mijasvillasandpenthouses.com Open in urlscan Pro
2606:4700:30::681c:1252 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/index.php
Submission: On April 19 via automatic, source openphish (April 19th 2019, 11:37:10 pm UTC)

Summary HTTP 14 Redirects Links 8 Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 14 HTTP transactions. The main IP is 2606:4700:30::681c:1252, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is mijasvillasandpenthouses.com.
TLS certificate: Issued by COMODO ECC Domain Validation Secure S... on April 17th 2019. Valid for: 6 months.

This is the only time mijasvillasandpenthouses.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online) Generic (Online)

Domain & IP information

	IP Address	AS Autonomous System
6	2606:4700:30:... 2606:4700:30::681c:1252	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
7	2a02:26f0:6c0... 2a02:26f0:6c00:286::33c4	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 2	91.235.133.103 91.235.133.103	30286 (THM) (THM - ThreatMetrix Inc.)
14	3

6 2606:4700:30::681c:1252 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

mijasvillasandpenthouses.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a02:26f0:6c00:286::33c4 (European Union)

ASN20940 (AKAMAI-ASN1, US)

assets.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 91.235.133.103 (Netherlands) 1 redirects

ASN30286 (THM - ThreatMetrix Inc., US)

secured.netflix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	nflxext.com assets.nflxext.com	93 KB
6	mijasvillasandpenthouses.com mijasvillasandpenthouses.com	21 KB
2	netflix.com 1 redirects secured.netflix.com	884 B
14	3

	Domain	Requested by
7	assets.nflxext.com	mijasvillasandpenthouses.com
6	mijasvillasandpenthouses.com	mijasvillasandpenthouses.com
2	secured.netflix.com	1 redirects mijasvillasandpenthouses.com
14	3

This site contains links to these domains. Also see Links.

Domain
www.netflix.com
www.verisign.com
help.netflix.com

Subject Issuer	Validity	Valid
sni137803.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-04-17` - `2019-10-24`	6 months	crt.sh
assets.nflxext.com DigiCert SHA2 Secure Server CA	`2018-03-09` - `2020-03-09`	2 years	crt.sh
secured.netflix.com DigiCert SHA2 Secure Server CA	`2018-02-04` - `2020-02-04`	2 years	crt.sh

This page contains 1 frames:

Primary Page: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/index.php
Frame ID: 4228A68FD9192C751D20FB3D2DB15B25
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<[^>]+data-react/i

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /cloudflare/i

Page Statistics

14
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

114 kB
Transfer

211 kB
Size

1
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: https://www.netflix.com/
Title: Netflix

Search URL Search Domain Scan URL

URL: https://www.netflix.com/SignOut
Title: Desconectar

Search URL Search Domain Scan URL

URL: https://www.netflix.com/youraccount
Title: Su cuenta

Search URL Search Domain Scan URL

URL: https://www.verisign.com/verisign-trust-seal
Title: ABOUT TRUST ONLINE

Search URL Search Domain Scan URL

URL: https://help.netflix.com/contactus
Title: Preguntas? Contáctenos.

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/termsofuse
Title: Términos de Uso

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/privacy
Title: Intimidad

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/privacy#cookies
Title: Preferencias de Cookie

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 11

https://secured.netflix.com/fp/clear.png?org_id=lg9m47ph&session_id=060FE70C-23F7-45C7-0DA7-6CAAF3A3D8C7&m=1 HTTP 302
https://secured.netflix.com/fp/clear.png?org_id=lg9m47ph&session_id=060fe70c-23f7-45c7-0da7-6caaf3a3d8c7&k=1

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request index.php Show response
mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/ 20 KB
5 KB 93ms
50ms Document
text/html 2606:4700:30::681c:1252
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/index.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681c:1252 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare / PHP/7.0.33 PleskLin
Resource Hash: 259516724015495009cd74406e7fba238c74e3f36774cbf61fa3a00f976e2762

Request headers

:method: GET
:authority: mijasvillasandpenthouses.com
:scheme: https
:path: /wp-content/plugins/freedom/3.php/NET-FLIX/index.php
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status: 200
date: Fri, 19 Apr 2019 23:36:53 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=ddc48793d46ece35bc245fdc08b55330e1555717013; expires=Sat, 18-Apr-20 23:36:53 GMT; path=/; domain=.mijasvillasandpenthouses.com; HttpOnly; Secure
x-powered-by: PHP/7.0.33 PleskLin
vary: X-Forwarded-Proto,Accept-Encoding
cache-control: max-age=0
expires: Fri, 19 Apr 2019 23:36:53 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 4ca2b407fdbfc288-FRA
content-encoding: br

GET
H2 200 z.css
mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/js/ 98 KB
15 KB 12ms
11ms Stylesheet
text/css 2606:4700:30::681c:1252
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/js/z.css
Requested by: Host: mijasvillasandpenthouses.com
URL: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/index.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681c:1252 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 89600f34c7033ed7ecf8d5163def92f40ff5c01c64732bc303d05f5f088bf821

Request headers

:path: /wp-content/plugins/freedom/3.php/NET-FLIX/js/z.css
pragma: no-cache
cookie: __cfduid=ddc48793d46ece35bc245fdc08b55330e1555717013
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: mijasvillasandpenthouses.com
referer: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/index.php
:scheme: https
:method: GET
Referer: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/index.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 19 Apr 2019 23:36:53 GMT
content-encoding: br
cf-cache-status: HIT
x-powered-by: PleskLin
status: 200
last-modified: Fri, 19 Apr 2019 15:23:33 GMT
server: cloudflare
etag: W/"5cb9e7f5-18a48"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
expires: Sat, 18 Apr 2020 23:36:53 GMT
cache-control: public, max-age=31536000
cf-polished: origSize=100936
cf-ray: 4ca2b4084e4dc288-FRA
cf-bgj: minify

GET
H2 404 clear_003.png
mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/js/ 0
0 798ms
797ms Script
text/html 2606:4700:30::681c:1252
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/js/clear_003.png
Requested by: Host: mijasvillasandpenthouses.com
URL: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/index.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681c:1252 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare / PHP/7.0.33
Resource Hash

Request headers

:path: /wp-content/plugins/freedom/3.php/NET-FLIX/js/clear_003.png
pragma: no-cache
cookie: __cfduid=ddc48793d46ece35bc245fdc08b55330e1555717013
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: */*
cache-control: no-cache
:authority: mijasvillasandpenthouses.com
referer: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/index.php
:scheme: https
:method: GET
Referer: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/index.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 19 Apr 2019 23:36:54 GMT
content-encoding: br
cf-cache-status: MISS
server: cloudflare
x-powered-by: PHP/7.0.33
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: X-Forwarded-Proto,Accept-Encoding
content-type: text/html; charset=UTF-8
status: 404
cache-control: no-cache, must-revalidate, max-age=0
x-cf-powered-by: WP Rocket 3.1.4
cf-ray: 4ca2b4084e4ec288-FRA
link: <https://mijasvillasandpenthouses.com/wp-json/>; rel="https://api.w.org/"
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 200 clear_002.png
mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/js/ 81 B
143 B 13ms
12ms Image
image/png 2606:4700:30::681c:1252
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/js/clear_002.png
Requested by: Host: mijasvillasandpenthouses.com
URL: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/index.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681c:1252 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Request headers

:path: /wp-content/plugins/freedom/3.php/NET-FLIX/js/clear_002.png
pragma: no-cache
cookie: __cfduid=ddc48793d46ece35bc245fdc08b55330e1555717013
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: mijasvillasandpenthouses.com
referer: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/index.php
:scheme: https
:method: GET
Referer: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/index.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 19 Apr 2019 23:36:53 GMT
cf-cache-status: HIT
last-modified: Fri, 19 Apr 2019 15:23:33 GMT
x-accel-version: 0.01
x-powered-by: PleskLin
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: X-Forwarded-Proto,Accept-Encoding
content-type: image/png
status: 200
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 4ca2b4084e50c288-FRA
content-length: 81
server: cloudflare
expires: Sun, 19 May 2019 23:36:53 GMT

GET
H2 200 question_mark.png
mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/js/ 564 B
736 B 10ms
9ms Image
image/png 2606:4700:30::681c:1252
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/js/question_mark.png
Requested by: Host: mijasvillasandpenthouses.com
URL: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/index.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681c:1252 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 973576ba6483c6c75d1d55339c1cac5d742abef700ede0903341ab222a2ee7c2

Request headers

:path: /wp-content/plugins/freedom/3.php/NET-FLIX/js/question_mark.png
pragma: no-cache
cookie: __cfduid=ddc48793d46ece35bc245fdc08b55330e1555717013
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: mijasvillasandpenthouses.com
referer: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/index.php
:scheme: https
:method: GET
Referer: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/index.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 19 Apr 2019 23:36:53 GMT
cf-cache-status: HIT
last-modified: Fri, 19 Apr 2019 15:23:33 GMT
x-accel-version: 0.01
x-powered-by: PleskLin
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: X-Forwarded-Proto,Accept-Encoding
content-type: image/png
status: 200
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 4ca2b4084e51c288-FRA
content-length: 564
server: cloudflare
expires: Sun, 19 May 2019 23:36:53 GMT

GET
H2 200 clear.png
mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/js/ 81 B
140 B 11ms
11ms Image
image/png 2606:4700:30::681c:1252
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/js/clear.png
Requested by: Host: mijasvillasandpenthouses.com
URL: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/index.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681c:1252 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Request headers

:path: /wp-content/plugins/freedom/3.php/NET-FLIX/js/clear.png
pragma: no-cache
cookie: __cfduid=ddc48793d46ece35bc245fdc08b55330e1555717013
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept: image/webp,image/apng,image/*,*/*;q=0.8
cache-control: no-cache
:authority: mijasvillasandpenthouses.com
referer: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/index.php
:scheme: https
:method: GET
Referer: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/index.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 19 Apr 2019 23:36:53 GMT
cf-cache-status: HIT
last-modified: Fri, 19 Apr 2019 15:23:33 GMT
x-accel-version: 0.01
x-powered-by: PleskLin
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: X-Forwarded-Proto,Accept-Encoding
content-type: image/png
status: 200
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 4ca2b4085e6ac288-FRA
content-length: 81
server: cloudflare
expires: Sun, 19 May 2019 23:36:53 GMT

GET
H2 200 carrot_sprite_16x33.png
assets.nflxext.com/en_us/layout/ecweb/common/ 1 KB
2 KB 49ms
10ms Image
image/png 2a02:26f0:6c00:286::33c4
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.nflxext.com/en_us/layout/ecweb/common/carrot_sprite_16x33.png
Requested by: Host: mijasvillasandpenthouses.com
URL: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/index.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:286::33c4 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: Apache /
Resource Hash: a47661d7ad003fe7df9ac30d1ce3b984dd9186b676f77b41e0d53f2f4ce4ac8b

Request headers

Referer: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/js/z.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 19 Apr 2019 23:36:54 GMT
last-modified: Wed, 17 Dec 2014 02:28:11 GMT
server: Apache
content-md5: S5zo1aDe9OUlKAAcIeVx8w==
etag: "4b9ce8d5a0def4e52528001c21e571f3:1418785349"
content-type: image/png
status: 200
cache-control: max-age=10692
accept-ranges: bytes
content-length: 1449
expires: Sat, 20 Apr 2019 02:35:06 GMT

GET
H2 200 12_11_2014_icon_visa_37x25.png
assets.nflxext.com/ffe/siteui/acquisition/payment/ 2 KB
2 KB 50ms
11ms Image
image/png 2a02:26f0:6c00:286::33c4
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.nflxext.com/ffe/siteui/acquisition/payment/12_11_2014_icon_visa_37x25.png
Requested by: Host: mijasvillasandpenthouses.com
URL: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/index.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:286::33c4 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: Apache /
Resource Hash: 7334c16dc04df9eef7152086d519c011301cdbf891aacff4dd28db3d09d32e42

Request headers

Referer: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/js/z.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 19 Apr 2019 23:36:54 GMT
last-modified: Thu, 11 Dec 2014 21:58:16 GMT
server: Apache
content-md5: AlPW3H84IVL0lrk4tEXlHQ==
content-type: image/png
status: 200
cache-control: public, max-age=31263786
accept-ranges: bytes
content-length: 1947
expires: Wed, 15 Apr 2020 20:00:00 GMT

GET
H2 200 10_18_2014_icon_master_37x25.png
assets.nflxext.com/ffe/siteui/acquisition/payment/ 2 KB
2 KB 48ms
10ms Image
image/png 2a02:26f0:6c00:286::33c4
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.nflxext.com/ffe/siteui/acquisition/payment/10_18_2014_icon_master_37x25.png
Requested by: Host: mijasvillasandpenthouses.com
URL: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/index.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:286::33c4 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: Apache /
Resource Hash: ca624ad59b666d986f4afb39c166f2a82dad5ce0bbcc20156273150d42c90c7f

Request headers

Referer: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/js/z.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 19 Apr 2019 23:36:54 GMT
last-modified: Wed, 19 Nov 2014 17:18:37 GMT
server: Apache
content-md5: NWWYtWroGgnPoNP/d/01pg==
content-type: image/png
status: 200
cache-control: public, max-age=31263786
accept-ranges: bytes
content-length: 1969
expires: Wed, 15 Apr 2020 20:00:00 GMT

GET
H2 200 10_18_2014_icon_amex_37x25.png
assets.nflxext.com/ffe/siteui/acquisition/payment/ 2 KB
2 KB 50ms
12ms Image
image/png 2a02:26f0:6c00:286::33c4
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.nflxext.com/ffe/siteui/acquisition/payment/10_18_2014_icon_amex_37x25.png
Requested by: Host: mijasvillasandpenthouses.com
URL: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/index.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:286::33c4 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: Apache /
Resource Hash: 8ecdaac15d3a735629ac94ec194ea046e3387e8fb5315e043b093725bf21591a

Request headers

Referer: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/js/z.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 19 Apr 2019 23:36:54 GMT
last-modified: Wed, 19 Nov 2014 17:18:37 GMT
server: Apache
content-md5: K2OFuI6NBcXvqmodovelug==
content-type: image/png
status: 200
cache-control: public, max-age=31263786
accept-ranges: bytes
content-length: 1573
expires: Wed, 15 Apr 2020 20:00:00 GMT

GET
H2 200 10_18_2014_icon_discovery_37x25.png
assets.nflxext.com/ffe/siteui/acquisition/payment/ 2 KB
2 KB 49ms
11ms Image
image/png 2a02:26f0:6c00:286::33c4
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.nflxext.com/ffe/siteui/acquisition/payment/10_18_2014_icon_discovery_37x25.png
Requested by: Host: mijasvillasandpenthouses.com
URL: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/index.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:286::33c4 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: Apache /
Resource Hash: b1004d850a57ed3b94b18c7b7ef852b2641d91538a8e76192bb5ee7f2d52903d

Request headers

Referer: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/js/z.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 19 Apr 2019 23:36:54 GMT
last-modified: Wed, 19 Nov 2014 17:18:37 GMT
server: Apache
content-md5: Q5v8vUjU8uOwQvNuEqLYLw==
content-type: image/png
status: 200
cache-control: public, max-age=31263786
accept-ranges: bytes
content-length: 2001
expires: Wed, 15 Apr 2020 20:00:00 GMT

GET
H2 200 paypal.png
assets.nflxext.com/en_us/layout/ecweb/payment/icons/ 5 KB
5 KB 48ms
12ms Image
image/png 2a02:26f0:6c00:286::33c4
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.nflxext.com/en_us/layout/ecweb/payment/icons/paypal.png
Requested by: Host: mijasvillasandpenthouses.com
URL: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/index.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:286::33c4 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: Apache /
Resource Hash: f878f94a441977a2a0ec43492ea6a7c6910cfc773b38d2d71eb917e63ff8db98

Request headers

Referer: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/js/z.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date: Fri, 19 Apr 2019 23:36:54 GMT
last-modified: Wed, 17 Dec 2014 02:28:23 GMT
server: Apache
content-md5: kF4+MPURhpGq+YwNMNNscw==
etag: "905e3e30f5118691aaf98c0d30d36c73:1418785472"
content-type: image/png
status: 200
cache-control: max-age=6717
accept-ranges: bytes
content-length: 4833
expires: Sat, 20 Apr 2019 01:28:51 GMT

GET
H/1.1

200
OK

clear.png
secured.netflix.com/fp/
Redirect Chain

https://secured.netflix.com/fp/clear.png?org_id=lg9m47ph&session_id=060FE70C-23F7-45C7-0DA7-6CAAF3A3D8C7&m=1
https://secured.netflix.com/fp/clear.png?org_id=lg9m47ph&session_id=060fe70c-23f7-45c7-0da7-6caaf3a3d8c7&k=1

81 B
429 B

20ms
17ms

Image
image/png

91.235.133.103
ThreatMetrix Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secured.netflix.com/fp/clear.png?org_id=lg9m47ph&session_id=060fe70c-23f7-45c7-0da7-6caaf3a3d8c7&k=1

Requested by

Host: mijasvillasandpenthouses.com
URL: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/index.php

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.103 , Netherlands, ASN30286 (THM - ThreatMetrix Inc., US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/index.php
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 19 Apr 2019 23:36:54 GMT
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=99
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Date: Fri, 19 Apr 2019 23:36:54 GMT
Server: Apache
P3P: CP=IVAa PSAa
Location: https://secured.netflix.com/fp/clear.png?org_id=lg9m47ph&session_id=060fe70c-23f7-45c7-0da7-6caaf3a3d8c7&k=1
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1
Keep-Alive: timeout=2, max=100
Content-Length: 300

GET
H2 200 nf-icon-v1-80.woff
assets.nflxext.com/ffe/siteui/fonts/ 78 KB
78 KB 41ms
6ms Font
font/woff 2a02:26f0:6c00:286::33c4
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-80.woff
Requested by: Host: mijasvillasandpenthouses.com
URL: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/index.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00:286::33c4 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: Apache /
Resource Hash: 2555364bdd6374d0c273c69322f2f78554c02fe630ee6582eeb2d2c9031d1a9d

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer: https://mijasvillasandpenthouses.com/wp-content/plugins/freedom/3.php/NET-FLIX/js/z.css
Origin: https://mijasvillasandpenthouses.com

Response headers

date: Fri, 19 Apr 2019 23:36:54 GMT
last-modified: Thu, 28 Jan 2016 20:46:04 GMT
server: Apache
content-md5: GkWpE2r/FESZk08OjSTsgQ==
access-control-allow-origin: *
content-type: font/woff
status: 200
cache-control: public, max-age=31263786
accept-ranges: bytes
content-length: 79392
expires: Wed, 15 Apr 2020 20:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online) Generic (Online)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| netflix

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.mijasvillasandpenthouses.com/	1970-01-19 08:54:13	Name: __cfduid Value: ddc48793d46ece35bc245fdc08b55330e1555717013

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.nflxext.com
mijasvillasandpenthouses.com
secured.netflix.com
2606:4700:30::681c:1252
2a02:26f0:6c00:286::33c4
91.235.133.103
2555364bdd6374d0c273c69322f2f78554c02fe630ee6582eeb2d2c9031d1a9d
259516724015495009cd74406e7fba238c74e3f36774cbf61fa3a00f976e2762
7334c16dc04df9eef7152086d519c011301cdbf891aacff4dd28db3d09d32e42
89600f34c7033ed7ecf8d5163def92f40ff5c01c64732bc303d05f5f088bf821
8ecdaac15d3a735629ac94ec194ea046e3387e8fb5315e043b093725bf21591a
95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743
973576ba6483c6c75d1d55339c1cac5d742abef700ede0903341ab222a2ee7c2
a47661d7ad003fe7df9ac30d1ce3b984dd9186b676f77b41e0d53f2f4ce4ac8b
b1004d850a57ed3b94b18c7b7ef852b2641d91538a8e76192bb5ee7f2d52903d
ca624ad59b666d986f4afb39c166f2a82dad5ce0bbcc20156273150d42c90c7f
f878f94a441977a2a0ec43492ea6a7c6910cfc773b38d2d71eb917e63ff8db98

mijasvillasandpenthouses.com Open in urlscan Pro 2606:4700:30::681c:1252 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

114 kBTransfer

211 kBSize

1 Cookies

8 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

1 Cookies

Indicators

mijasvillasandpenthouses.com Open in urlscan Pro
2606:4700:30::681c:1252 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

114 kB
Transfer

211 kB
Size

1
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!