urlscan.io logo urlscan.io
SecurityTrails logo

wordpress-936039-3252145.cloudwaysapps.com Open in urlscan Pro
138.68.129.209  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://u1905824.ct.sendgrid.net/ls/click?upn=54Hp4iuwllg1SF-2FiPoWTj4ylxbBw9FpR79t5Z4gmYR4-3D7c4L_yXzaPU76wjOzEdaFPBxTiDOQFUC8O1...
Effective URL: https://wordpress-936039-3252145.cloudwaysapps.com/Add/so/netflix%20(8)/
Submission: On February 21 via api from JP — Scanned from JP
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 3 countries across 4 domains to perform 7 HTTP transactions. The main IP is 138.68.129.209, located in London, United Kingdom and belongs to DIGITALOCEAN-ASN, US. The main domain is wordpress-936039-3252145.cloudwaysapps.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on September 9th 2022. Valid for: a year.
This is the only time wordpress-936039-3252145.cloudwaysapps.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

IP Address AS Autonomous System
1 1 167.89.115.54 11377 (SENDGRID)
1 1 104.21.44.151 13335 (CLOUDFLAR...)
4 138.68.129.209 14061 (DIGITALOC...)
3 45.57.90.1 2906 (AS-SSI)
7 2
Apex Domain
Subdomains		 Transfer
4 cloudwaysapps.com
wordpress-936039-3252145.cloudwaysapps.com
72 KB
3 nflxext.com
assets.nflxext.com — Cisco Umbrella Rank: 5150
178 KB
1 bitly.lc
bitly.lc
1 KB
1 sendgrid.net
u1905824.ct.sendgrid.net
225 B
7 4
Domain Requested by
4 wordpress-936039-3252145.cloudwaysapps.com wordpress-936039-3252145.cloudwaysapps.com
3 assets.nflxext.com wordpress-936039-3252145.cloudwaysapps.com
1 bitly.lc 1 redirects
1 u1905824.ct.sendgrid.net 1 redirects
7 4

This site contains links to these domains. Also see Links.

Domain
help.netflix.com
Subject Issuer Validity Valid
*.cloudwaysapps.com
Sectigo RSA Domain Validation Secure Server CA		 2022-09-09 -
2023-10-10		 a year crt.sh
*.1.nflxso.net
DigiCert Secure Site ECC CA-1		 2023-02-19 -
2023-03-27		 a month crt.sh

This page contains 1 frames:

Primary Page: https://wordpress-936039-3252145.cloudwaysapps.com/Add/so/netflix%20(8)/
Frame ID: 92C5A24B54B48D890DDFD2F1E0FA6568
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Netflix

Page URL History Show full URLs

  1. https://u1905824.ct.sendgrid.net/ls/click?upn=54Hp4iuwllg1SF-2FiPoWTj4ylxbBw9FpR79t5Z4gmYR4-3D7c4L_yXzaPU76wj... HTTP 302
    https://bitly.lc/6dmnd HTTP 301
    https://wordpress-936039-3252145.cloudwaysapps.com/Add/so/netflix%20(8)/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

7
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

2
IPs

3
Countries

249 kB
Transfer

511 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://u1905824.ct.sendgrid.net/ls/click?upn=54Hp4iuwllg1SF-2FiPoWTj4ylxbBw9FpR79t5Z4gmYR4-3D7c4L_yXzaPU76wjOzEdaFPBxTiDOQFUC8O1Aoes6ho-2FAbf845uMWals0icY9UrprqEbKoQ2hvo0-2FUNTNWCindk-2FaoMv13MHQXaP1Gli0Ewl-2BghkKh1QCsiexiKblUE73QZkuF7xvlPzax5vWC-2BBP-2FNeUjIQq-2B59XC33WQ7qVqQUCX6yqdkI2KquwzJhzFFVyNhEJaM2jcs4iP3S3Sdtb2RaaiM2jaCJohlYhCQdbFWQmyGaF73ZdzxV8mhWhlnfTZtEn5kxpynlOtoyWc8PF83CNcvQ-3D-3D HTTP 302
    https://bitly.lc/6dmnd HTTP 301
    https://wordpress-936039-3252145.cloudwaysapps.com/Add/so/netflix%20(8)/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
wordpress-936039-3252145.cloudwaysapps.com/Add/so/netflix%20(8)/
Redirect Chain
  • https://u1905824.ct.sendgrid.net/ls/click?upn=54Hp4iuwllg1SF-2FiPoWTj4ylxbBw9FpR79t5Z4gmYR4-3D7c4L_yXzaPU76wjOzEdaFPBxTiDOQFUC8O1Aoes6ho-2FAbf845uMWals0icY9UrprqEbKoQ2hvo0-2FUNTNWCindk-2FaoMv13MHQX...
  • https://bitly.lc/6dmnd
  • https://wordpress-936039-3252145.cloudwaysapps.com/Add/so/netflix%20(8)/
11 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://wordpress-936039-3252145.cloudwaysapps.com/Add/so/netflix%20(8)/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
138.68.129.209 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
936039.cloudwaysapps.com
Software
nginx /
Resource Hash
054256f9b1f30e09e889e78e769837eb6698231db1e6a3af81243b1bb33e38bf

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

accept-ranges
bytes
age
3122
content-encoding
gzip
content-length
3093
content-type
text/html; charset=UTF-8
date
Tue, 21 Feb 2023 08:22:11 GMT
server
nginx
vary
Accept-Encoding
x-cache
HIT
x-robots-tag
noindex, nofollow

Redirect headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
must-revalidate, no-cache, no-store, private
cf-cache-status
DYNAMIC
cf-ray
79ce12973aabc9ef-NRT
content-type
text/html; charset=UTF-8
date
Tue, 21 Feb 2023 08:22:10 GMT
location
https://wordpress-936039-3252145.cloudwaysapps.com/Add/so/netflix%20(8)/
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=w2EU2zDRkJ9mSdEgYWFzkAREDNJEFmZje2T%2FXABNBWMrfrm3kgy%2BQrZJiHj3SNOc23D2fRy6Zds%2FVHjp%2F756qfpT0By6UULIo1bOx%2FknjxedOloCKQF00vI0Ng%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
strict-transport-security
max-age=31536000
style.css
wordpress-936039-3252145.cloudwaysapps.com/Add/so/netflix%20(8)/assets/css/ 		217 KB
35 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://wordpress-936039-3252145.cloudwaysapps.com/Add/so/netflix%20(8)/assets/css/style.css
Requested by
Host: wordpress-936039-3252145.cloudwaysapps.com
URL: https://wordpress-936039-3252145.cloudwaysapps.com/Add/so/netflix%20(8)/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
138.68.129.209 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
936039.cloudwaysapps.com
Software
nginx /
Resource Hash
73ab9a0d44bf454ca0190571a80cce77d3292f47bd6d8e273a4a628cf304c6b1

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://wordpress-936039-3252145.cloudwaysapps.com/Add/so/netflix%20(8)/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Tue, 21 Feb 2023 08:22:11 GMT
content-encoding
gzip
last-modified
Fri, 03 Sep 2021 12:02:48 GMT
server
nginx
etag
W/"61320ee8-36268"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=31536000
x-robots-tag
noindex, nofollow
jquery.js
wordpress-936039-3252145.cloudwaysapps.com/Add/so/netflix%20(8)/assets/js/ 		87 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://wordpress-936039-3252145.cloudwaysapps.com/Add/so/netflix%20(8)/assets/js/jquery.js
Requested by
Host: wordpress-936039-3252145.cloudwaysapps.com
URL: https://wordpress-936039-3252145.cloudwaysapps.com/Add/so/netflix%20(8)/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
138.68.129.209 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
936039.cloudwaysapps.com
Software
nginx /
Resource Hash
ee11e902416a1d896f538103110337b39a0e2e2606bc1faf5cd0652914891127

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://wordpress-936039-3252145.cloudwaysapps.com/Add/so/netflix%20(8)/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Tue, 21 Feb 2023 08:22:11 GMT
content-encoding
gzip
last-modified
Fri, 03 Sep 2021 12:02:48 GMT
server
nginx
etag
W/"61320ee8-15d9d"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
x-robots-tag
noindex, nofollow
main.js
wordpress-936039-3252145.cloudwaysapps.com/Add/so/netflix%20(8)/assets/js/ 		19 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://wordpress-936039-3252145.cloudwaysapps.com/Add/so/netflix%20(8)/assets/js/main.js
Requested by
Host: wordpress-936039-3252145.cloudwaysapps.com
URL: https://wordpress-936039-3252145.cloudwaysapps.com/Add/so/netflix%20(8)/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
138.68.129.209 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
936039.cloudwaysapps.com
Software
nginx /
Resource Hash
e69fe58af35c0362191ab831ad708bd0ba946471fb0939b45ad10eba1ba368b4

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://wordpress-936039-3252145.cloudwaysapps.com/Add/so/netflix%20(8)/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Tue, 21 Feb 2023 08:22:11 GMT
content-encoding
gzip
last-modified
Fri, 03 Sep 2021 12:02:48 GMT
server
nginx
etag
W/"61320ee8-4ce3"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
x-robots-tag
noindex, nofollow
NetflixSans_W_Rg.woff2
assets.nflxext.com/ffe/siteui/fonts/netflix-sans/v3/ 		52 KB
52 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://assets.nflxext.com/ffe/siteui/fonts/netflix-sans/v3/NetflixSans_W_Rg.woff2
Requested by
Host: wordpress-936039-3252145.cloudwaysapps.com
URL: https://wordpress-936039-3252145.cloudwaysapps.com/Add/so/netflix%20(8)/assets/css/style.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
45.57.90.1 , United States, ASN2906 (AS-SSI, US),
Reverse DNS
Software
nginx /
Resource Hash
c0bceb927c506dce9f6e6f5f570e641ad580b9554be06f61508a4aee32380167

Request headers

Referer
https://wordpress-936039-3252145.cloudwaysapps.com/
Origin
https://wordpress-936039-3252145.cloudwaysapps.com
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Tue, 21 Feb 2023 08:22:12 GMT
Last-Modified
Thu, 17 Jan 2019 20:16:30 GMT
Server
nginx
Content-MD5
C/MXfx/tbZUxeCIfukPH6A==
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
max-age=604801
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
53304
Expires
Tue, 28 Feb 2023 08:22:13 GMT
NetflixSans_W_Md.woff2
assets.nflxext.com/ffe/siteui/fonts/netflix-sans/v3/ 		53 KB
53 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://assets.nflxext.com/ffe/siteui/fonts/netflix-sans/v3/NetflixSans_W_Md.woff2
Requested by
Host: wordpress-936039-3252145.cloudwaysapps.com
URL: https://wordpress-936039-3252145.cloudwaysapps.com/Add/so/netflix%20(8)/assets/css/style.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
45.57.90.1 , United States, ASN2906 (AS-SSI, US),
Reverse DNS
Software
nginx /
Resource Hash
9ac2bd03fcde501b3f30f47ab1fae62161f87808ea6411f38e8feaa4bbddc42e

Request headers

Referer
https://wordpress-936039-3252145.cloudwaysapps.com/
Origin
https://wordpress-936039-3252145.cloudwaysapps.com
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Tue, 21 Feb 2023 08:22:12 GMT
Last-Modified
Thu, 17 Jan 2019 20:16:30 GMT
Server
nginx
Content-MD5
6naZIbDPpPxtTRouCx+l/w==
Content-Type
font/woff2
Access-Control-Allow-Origin
*
Cache-Control
max-age=604801
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
53940
Expires
Tue, 28 Feb 2023 08:22:13 GMT
nf-icon-v1-93.woff
assets.nflxext.com/ffe/siteui/fonts/ 		72 KB
72 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-93.woff
Requested by
Host: wordpress-936039-3252145.cloudwaysapps.com
URL: https://wordpress-936039-3252145.cloudwaysapps.com/Add/so/netflix%20(8)/assets/css/style.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
45.57.90.1 , United States, ASN2906 (AS-SSI, US),
Reverse DNS
Software
nginx /
Resource Hash
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d

Request headers

Referer
https://wordpress-936039-3252145.cloudwaysapps.com/
Origin
https://wordpress-936039-3252145.cloudwaysapps.com
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

Date
Tue, 21 Feb 2023 08:22:12 GMT
Last-Modified
Mon, 29 Jan 2018 01:50:51 GMT
Server
nginx
Content-MD5
fPYVbMSBJEtaJUNi17c/AA==
Content-Type
font/woff
Access-Control-Allow-Origin
*
Cache-Control
max-age=604801
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
73572
Expires
Tue, 28 Feb 2023 08:22:13 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| oncontentvisibilityautostatechange function| $ function| jQuery object| filter

3 Cookies

Domain/Path Name / Value
bitly.lc/ Name: XSRF-TOKEN
Value: eyJpdiI6ImRzcXlcL2dqRnkxSFI1ZmM0aitndE1BPT0iLCJ2YWx1ZSI6IlRtaVNObFUwcFhmM1JURW15MzA1ZGRBbGk5MU9IbEo4SGtzbjBsTUtyb3lxRTRaVXhTR3dJck5cLzRVQ0xaSmlxTDMzQ2xxUXVSdDZzNmMzWEgyNE5uYndCRkhMVm5cL1hHbFFEWVJ0TXAzZHFFNWV1alR0eGRGaEJrM1NGMjhMMkQiLCJtYWMiOiJiZjAxYjc0YzFjYjMwZGNiZmMzODE3Y2ZlNmI1OWE5ZTY5YjFmZWVmMGE1YTRhNzI4ZjgzNDc4NGY1ZGEzM2RkIn0%3D
bitly.lc/ Name: phpshort_session
Value: eyJpdiI6Im1Pcjh5UjdmeFFJOGJcL3MzUGgwblJ3PT0iLCJ2YWx1ZSI6IkJsdlY5aUxBUSt6UEtZRVV4SVF3OXRReldcL2ZBN3dNZm85MXA2YmcwblRoeUtNZkk3UktmYjRiTTdYQVE5Nm5IWkRlZEgwY0VZU0dscmpPZ054VmJEcFdtc2NoWDlGc2dvaE41eXp0S2prYWNwMTNBWUpLSmZzNUVmS1wvRjlIVDMiLCJtYWMiOiI2NmJlOWZkNzUwMzFlYzRlOGQ3MTY4ZTZiYTI4MGE3OWI2MTA3N2M0YmM4YjdjZDYyZTVlMzJmMjkzMmEzNjhhIn0%3D
bitly.lc/ Name: dark_mode
Value: 0