000luw0.wcomhost.com
Open in
urlscan Pro
206.188.193.191
Malicious Activity!
Public Scan
Submission: On April 23 via automatic, source openphish
Summary
TLS certificate: Issued by COMODO RSA Domain Validation Secure S... on August 22nd 2017. Valid for: 3 years.
This is the only time 000luw0.wcomhost.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic (Online) Netflix (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
7 | 206.188.193.191 206.188.193.191 | 19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING - Network Solutions) | |
3 | 2.18.232.136 2.18.232.136 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
10 | 2 |
ASN19871 (NETWORK-SOLUTIONS-HOSTING - Network Solutions, LLC, US)
PTR: vux.netsolhost.com
000luw0.wcomhost.com |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
assets.nflxext.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
wcomhost.com
000luw0.wcomhost.com |
71 KB |
3 |
nflxext.com
assets.nflxext.com |
81 KB |
10 | 2 |
Domain | Requested by | |
---|---|---|
7 | 000luw0.wcomhost.com |
000luw0.wcomhost.com
|
3 | assets.nflxext.com | |
10 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.wcomhost.com COMODO RSA Domain Validation Secure Server CA |
2017-08-22 - 2020-08-21 |
3 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://000luw0.wcomhost.com/american-express-com-mx-mexico/myca/billing.php?3030306c7577302e77636f6d686f73742e636f6d
Frame ID: BEA25967B02401A42DB01E0A6B849207
Requests: 10 HTTP requests in this frame
Screenshot
Detected technologies
PHP (Programming Languages) ExpandDetected patterns
- url /\.php(?:$|\?)/i
Lua (Programming Languages) Expand
Detected patterns
- headers server /openresty(?:\/([\d.]+))?/i
Nginx (Web Servers) Expand
Detected patterns
- headers server /openresty(?:\/([\d.]+))?/i
OpenResty (Web Servers) Expand
Detected patterns
- headers server /openresty(?:\/([\d.]+))?/i
React (JavaScript Frameworks) Expand
Detected patterns
- html /<[^>]+data-react/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Cookie set
billing.php
000luw0.wcomhost.com/american-express-com-mx-mexico/myca/ |
9 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
b.css
000luw0.wcomhost.com/american-express-com-mx-mexico/myca/css/ |
47 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
c.css
000luw0.wcomhost.com/american-express-com-mx-mexico/myca/css/ |
45 KB 10 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
header.png
000luw0.wcomhost.com/american-express-com-mx-mexico/myca/img/ |
24 KB 24 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cvv2.png
000luw0.wcomhost.com/american-express-com-mx-mexico/myca/img/ |
18 KB 19 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cvv.png
000luw0.wcomhost.com/american-express-com-mx-mexico/myca/img/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
10_18_2014_icon_amex_37x25.png
assets.nflxext.com/ffe/siteui/acquisition/payment/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
carrot_sprite_16x33.png
assets.nflxext.com/en_us/layout/ecweb/common/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bkjhead.png
000luw0.wcomhost.com/american-express-com-mx-mexico/myca/img/ |
406 B 770 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
nf-icon-v1-80.woff
assets.nflxext.com/ffe/siteui/fonts/ |
78 KB 78 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic (Online) Netflix (Online)0 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
000luw0.wcomhost.com/ | Name: PHPSESSID Value: 36c151e9c5f87f26b2420d0b8d645561 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=63072000; includeSubDomains; preload |
X-Content-Type-Options | nosniff |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
000luw0.wcomhost.com
assets.nflxext.com
2.18.232.136
206.188.193.191
2555364bdd6374d0c273c69322f2f78554c02fe630ee6582eeb2d2c9031d1a9d
5c8b5f84969d674c6380758e44add41ef34b88b9d5dd7071b9edd0f0b97bd082
698b6be2d6d9c0302d13ff00cd503fd93c5a8ea57060626fefa013375efeb2ae
84672e084b974ee372846efe81b75e3aef2ac0981fa8612b6ffa41f4e8bff580
8ecdaac15d3a735629ac94ec194ea046e3387e8fb5315e043b093725bf21591a
a47661d7ad003fe7df9ac30d1ce3b984dd9186b676f77b41e0d53f2f4ce4ac8b
a85878d01246795c4203d9427cd4be97e50473b1957d7e02ae1b8a771b18ceb6
d2b5ebd6e59b7ee16d4a2a457234c17fb7ac4e42fa5b6dcef93459c3eccbf93c
d690f12f9e5095d804775a869123b967d0a624bf671ee9c82d0b95cebf55926b
e712a0ff78cb7e28f974af7380a47071cf7a2cd489cff7a598e7cbea558ff73a