sirwitcher.github.io

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 7 HTTP transactions. The main IP is 2606:50c0:8003::153, located in United States and belongs to FASTLY, US. The main domain is sirwitcher.github.io.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on March 15th 2024. Valid for: a year.

This is the only time sirwitcher.github.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address		AS Autonomous System
1 8	2606:50c0:800... 2606:50c0:8003::153		54113 (FASTLY) (FASTLY)
7	1

8 2606:50c0:8003::153 (United States) 1 redirects

ASN54113 (FASTLY, US)

sirwitcher.github.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	github.io 1 redirects sirwitcher.github.io	385 KB
7	1

	Domain	Requested by
8	sirwitcher.github.io	1 redirects sirwitcher.github.io
7	1

This site contains links to these domains. Also see Links.

Domain
www.netflix.com

Subject Issuer	Validity	Valid
*.github.io DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-03-15` - `2025-03-14`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://sirwitcher.github.io/loginetflix/
Frame ID: F9780876830A205D11440E0E9CAE194D
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Netflix

Page URL History Show full URLs

https://sirwitcher.github.io/loginetflix HTTP 301
https://sirwitcher.github.io/loginetflix/ Page URL

Detected technologies

GitHub Pages (CDN) Expand

Overall confidence: 100%
Detected patterns

^https?://[^/]+\.github\.io

Page Statistics

7
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

384 kB
Transfer

390 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.netflix.com/br/LoginHelp
Title: Precisa de ajuda?

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://sirwitcher.github.io/loginetflix HTTP 301
https://sirwitcher.github.io/loginetflix/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
sirwitcher.github.io/loginetflix/
Redirect Chain

https://sirwitcher.github.io/loginetflix
https://sirwitcher.github.io/loginetflix/

2 KB
1 KB

127ms
127ms

Document
text/html

2606:50c0:8003::153
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://sirwitcher.github.io/loginetflix/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:50c0:8003::153 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

GitHub.com /

Resource Hash

30f74fedf8fd4e6b644d7c13d0a553f5c00fbcc8b716e16e4369aba9fb688810

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556952

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.82 Safari/537.36

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 0
cache-control: max-age=600
content-encoding: gzip
content-length: 807
content-type: text/html; charset=utf-8
date: Thu, 21 Nov 2024 05:56:13 GMT
etag: W/"64bec820-906"
expires: Thu, 21 Nov 2024 06:06:13 GMT
last-modified: Mon, 24 Jul 2023 18:51:12 GMT
permissions-policy: interest-cohort=()
server: GitHub.com
strict-transport-security: max-age=31556952
vary: Accept-Encoding
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-fastly-request-id: fca45787fee0d4005a451bd374d848ce12f4ecc7
x-github-request-id: E014:40F2E:E6A76F:EC61C4:673ECB7C
x-proxy-cache: MISS
x-served-by: cache-fra-eddf8230080-FRA
x-timer: S1732168573.271009,VS0,VE105

Redirect headers

accept-ranges: bytes
age: 0
content-length: 162
content-type: text/html
date: Thu, 21 Nov 2024 05:56:13 GMT
location: https://sirwitcher.github.io/loginetflix/
permissions-policy: interest-cohort=()
server: GitHub.com
vary: Accept-Encoding
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-fastly-request-id: d983ebf45651a0fbf238f883c7ae958c7a233af4
x-github-request-id: 558E:82F5C:DC276A:E1E674:673ECB7D
x-served-by: cache-fra-eddf8230080-FRA
x-timer: S1732168573.152196,VS0,VE97

GET
H2 200 style.css
sirwitcher.github.io/loginetflix/assets/css/ 3 KB
1 KB 134ms
133ms Stylesheet
text/css 2606:50c0:8003::153
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://sirwitcher.github.io/loginetflix/assets/css/style.css

Requested by

Host: sirwitcher.github.io
URL: https://sirwitcher.github.io/loginetflix/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:50c0:8003::153 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

GitHub.com /

Resource Hash

e958f6331ddd5e97a49e2477f0da88cbc7417fbddd9f0e4bde50ab0371485167

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556952

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.82 Safari/537.36
Referer: https://sirwitcher.github.io/loginetflix/

Response headers

x-fastly-request-id: 3aa513994e082f295c48034bbb9e52b5279afc78
content-encoding: gzip
etag: W/"64bec820-aa2"
age: 0
x-github-request-id: EDC4:155C6B:DCAE25:E26D56:673ECB7D
expires: Thu, 21 Nov 2024 06:06:13 GMT
x-proxy-cache: MISS
x-cache: MISS
date: Thu, 21 Nov 2024 05:56:13 GMT
content-type: text/css; charset=utf-8
last-modified: Mon, 24 Jul 2023 18:51:12 GMT
x-served-by: cache-fra-eddf8230080-FRA
x-cache-hits: 0
vary: Accept-Encoding
strict-transport-security: max-age=31556952
cache-control: max-age=600
x-timer: S1732168573.405712,VS0,VE106
via: 1.1 varnish
permissions-policy: interest-cohort=()
accept-ranges: bytes
access-control-allow-origin: *
content-length: 767
server: GitHub.com

GET
H2 404 Script.js
sirwitcher.github.io/loginetflix/Js/ 0
0 206ms
205ms Script
text/html 2606:50c0:8003::153
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://sirwitcher.github.io/loginetflix/Js/Script.js

Requested by

Host: sirwitcher.github.io
URL: https://sirwitcher.github.io/loginetflix/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:50c0:8003::153 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

GitHub.com /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; img-src data:; connect-src 'self'
Strict-Transport-Security	max-age=31556952

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.82 Safari/537.36
Referer: https://sirwitcher.github.io/loginetflix/

Response headers

x-fastly-request-id: a640636bb801c8cb3c6e230c98e1f9413247da14
content-encoding: gzip
etag: W/"64d39a40-24a3"
age: 0
x-github-request-id: CC32:846CE:DF01DF:E4C205:673ECB7C
x-proxy-cache: MISS
x-cache: MISS
date: Thu, 21 Nov 2024 05:56:13 GMT
content-type: text/html; charset=utf-8
x-served-by: cache-fra-eddf8230080-FRA
x-cache-hits: 0
vary: Accept-Encoding
strict-transport-security: max-age=31556952
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; img-src data:; connect-src 'self'
x-timer: S1732168573.405694,VS0,VE183
via: 1.1 varnish
permissions-policy: interest-cohort=()
accept-ranges: bytes
access-control-allow-origin: *
content-length: 5254
server: GitHub.com

GET
H2 200 netflixlogo.png
sirwitcher.github.io/loginetflix/assets/img/ 22 KB
23 KB 126ms
126ms Image
image/png 2606:50c0:8003::153
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sirwitcher.github.io/loginetflix/assets/img/netflixlogo.png

Requested by

Host: sirwitcher.github.io
URL: https://sirwitcher.github.io/loginetflix/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:50c0:8003::153 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

GitHub.com /

Resource Hash

c336a88447070bf5848b5d59128413bc537ce8af31d91b1872e5173f01cc0d46

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556952

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.82 Safari/537.36
Referer: https://sirwitcher.github.io/loginetflix/

Response headers

x-fastly-request-id: 9c7e4c32dd3406f12fbc13d64adf5747b1835c6c
etag: "64bec820-59e5"
age: 0
x-github-request-id: 133A:40F2E:E6A77E:EC61DB:673ECB7D
expires: Thu, 21 Nov 2024 06:06:13 GMT
x-proxy-cache: MISS
x-cache: MISS
date: Thu, 21 Nov 2024 05:56:13 GMT
content-type: image/png
last-modified: Mon, 24 Jul 2023 18:51:12 GMT
x-served-by: cache-fra-eddf8230080-FRA
x-cache-hits: 0
vary: Accept-Encoding
strict-transport-security: max-age=31556952
cache-control: max-age=600
x-timer: S1732168573.405929,VS0,VE104
via: 1.1 varnish
permissions-policy: interest-cohort=()
accept-ranges: bytes
access-control-allow-origin: *
content-length: 23013
x-origin-cache: HIT
server: GitHub.com

GET
H2 200 Facebook_logo.png
sirwitcher.github.io/loginetflix/assets/img/ 20 KB
20 KB 207ms
206ms Image
image/png 2606:50c0:8003::153
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sirwitcher.github.io/loginetflix/assets/img/Facebook_logo.png

Requested by

Host: sirwitcher.github.io
URL: https://sirwitcher.github.io/loginetflix/

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:50c0:8003::153 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

GitHub.com /

Resource Hash

822cfb43f2b859633a2fbd61cceb6f4c925cb3c2966b3a3bc412daf5ae4ad389

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556952

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.82 Safari/537.36
Referer: https://sirwitcher.github.io/loginetflix/

Response headers

x-fastly-request-id: 7e27057850985cb24ccd4ea67c3f6257e0f6d699
etag: "64bec820-50de"
age: 0
x-github-request-id: D6EB:40F2E:E6A77E:EC61DA:673ECB7D
expires: Thu, 21 Nov 2024 06:06:13 GMT
x-proxy-cache: MISS
x-cache: MISS
date: Thu, 21 Nov 2024 05:56:13 GMT
content-type: image/png
last-modified: Mon, 24 Jul 2023 18:51:12 GMT
x-served-by: cache-fra-eddf8230080-FRA
x-cache-hits: 0
vary: Accept-Encoding
strict-transport-security: max-age=31556952
cache-control: max-age=600
x-timer: S1732168573.405888,VS0,VE185
via: 1.1 varnish
permissions-policy: interest-cohort=()
accept-ranges: bytes
access-control-allow-origin: *
content-length: 20702
server: GitHub.com

GET
H2 200 background.jpg
sirwitcher.github.io/loginetflix/assets/css/img/ 333 KB
334 KB 137ms
137ms Image
image/jpeg 2606:50c0:8003::153
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sirwitcher.github.io/loginetflix/assets/css/img/background.jpg

Requested by

Host: sirwitcher.github.io
URL: https://sirwitcher.github.io/loginetflix/assets/css/style.css

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:50c0:8003::153 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

GitHub.com /

Resource Hash

dcac1a4d04ee7058f45a7fc17cb669b4b666e319697e357d0570e0d9c8c32378

Security Headers

Name	Value
Strict-Transport-Security	max-age=31556952

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.82 Safari/537.36
Referer: https://sirwitcher.github.io/loginetflix/assets/css/style.css

Response headers

x-fastly-request-id: 38c32690b37941d12086a7dbc2b28c152cb5b12a
etag: "64bec820-53540"
age: 0
x-github-request-id: 7CA0:121E7E:DF8207:E53990:673ECB7D
expires: Thu, 21 Nov 2024 06:06:13 GMT
x-proxy-cache: MISS
x-cache: MISS
date: Thu, 21 Nov 2024 05:56:13 GMT
content-type: image/jpeg
last-modified: Mon, 24 Jul 2023 18:51:12 GMT
x-served-by: cache-fra-eddf8230080-FRA
x-cache-hits: 0
vary: Accept-Encoding
strict-transport-security: max-age=31556952
cache-control: max-age=600
x-timer: S1732168574.614804,VS0,VE116
via: 1.1 varnish
permissions-policy: interest-cohort=()
accept-ranges: bytes
access-control-allow-origin: *
content-length: 341312
server: GitHub.com

GET
H2 404 favicon.ico
sirwitcher.github.io/ 9 KB
5 KB 113ms
112ms Other
text/html 2606:50c0:8003::153
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://sirwitcher.github.io/favicon.ico

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:50c0:8003::153 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

GitHub.com /

Resource Hash

70d613e3acfba24fd2876fcbacaf639e1e111ef4d54baf70761c47673f37d6a3

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; style-src 'unsafe-inline'; img-src data:; connect-src 'self'

Request headers

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.82 Safari/537.36
Referer: https://sirwitcher.github.io/loginetflix/

Response headers

x-fastly-request-id: eb46af85534f629e640d03cca8dfbbcb668ed721
content-encoding: gzip
etag: W/"672c11f8-239b"
age: 0
x-github-request-id: E746:186D94:E14EAB:E70EE2:673ECB7D
x-cache: MISS
date: Thu, 21 Nov 2024 05:56:13 GMT
content-type: text/html; charset=utf-8
x-served-by: cache-fra-eddf8230080-FRA
x-cache-hits: 0
vary: Accept-Encoding
content-security-policy: default-src 'none'; style-src 'unsafe-inline'; img-src data:; connect-src 'self'
x-timer: S1732168574.818763,VS0,VE90
via: 1.1 varnish
permissions-policy: interest-cohort=()
accept-ranges: bytes
content-length: 5142
server: GitHub.com

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://sirwitcher.github.io/loginetflix/Js/Script.js Message: Failed to load resource: the server responded with a status of 404 ()
recommendation	verbose	URL: https://sirwitcher.github.io/loginetflix/ Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
network	error	URL: https://sirwitcher.github.io/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31556952

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

sirwitcher.github.io
2606:50c0:8003::153
30f74fedf8fd4e6b644d7c13d0a553f5c00fbcc8b716e16e4369aba9fb688810
70d613e3acfba24fd2876fcbacaf639e1e111ef4d54baf70761c47673f37d6a3
822cfb43f2b859633a2fbd61cceb6f4c925cb3c2966b3a3bc412daf5ae4ad389
c336a88447070bf5848b5d59128413bc537ce8af31d91b1872e5173f01cc0d46
dcac1a4d04ee7058f45a7fc17cb669b4b666e319697e357d0570e0d9c8c32378
e958f6331ddd5e97a49e2477f0da88cbc7417fbddd9f0e4bde50ab0371485167

sirwitcher.github.io Open in urlscan Pro 2606:50c0:8003::153 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

7 Requests

100 %HTTPS

100 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

384 kBTransfer

390 kBSize

0 Cookies

1 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

3 Console Messages

Security Headers

Indicators

sirwitcher.github.io Open in urlscan Pro
2606:50c0:8003::153 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

384 kB
Transfer

390 kB
Size

0
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!