sankei.lastmessage.rip Open in urlscan Pro
35.74.34.154 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/main2.php
Submission: On January 22 via manual (January 22nd 2022, 5:21:24 pm UTC) from US — Scanned from DE

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 14 HTTP transactions. The main IP is 35.74.34.154, located in Tokyo, Japan and belongs to AMAZON-02, US. The main domain is sankei.lastmessage.rip.
TLS certificate: Issued by Amazon on December 26th 2021. Valid for: a year.

This is the only time sankei.lastmessage.rip was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address	AS Autonomous System
12	35.74.34.154 35.74.34.154	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:303... 2606:4700:3035::ac43:c763	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:86c0:209... 2a00:86c0:2090::1	40027 (NETFLIX-ASN) (NETFLIX-ASN)
14	3

12 35.74.34.154 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-74-34-154.ap-northeast-1.compute.amazonaws.com

sankei.lastmessage.rip	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3035::ac43:c763 (United States)

ASN13335 (CLOUDFLARENET, US)

js-codes.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:86c0:2090::1 (United States)

ASN40027 (NETFLIX-ASN, US)

assets.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	lastmessage.rip sankei.lastmessage.rip	651 KB
1	nflxext.com assets.nflxext.com — Cisco Umbrella Rank: 3613	72 KB
1	js-codes.com js-codes.com	2 KB
14	3

	Domain	Requested by
12	sankei.lastmessage.rip	sankei.lastmessage.rip
1	assets.nflxext.com	sankei.lastmessage.rip
1	js-codes.com	sankei.lastmessage.rip
14	3

This site contains no links.

Subject Issuer	Validity	Valid
lastmessage.rip Amazon	`2021-12-26` - `2023-01-24`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-03` - `2022-07-02`	a year	crt.sh
*.1.nflxso.net DigiCert TLS RSA SHA256 2020 CA1	`2022-01-16` - `2022-02-20`	a month	crt.sh

This page contains 1 frames:

Primary Page: https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/main2.php
Frame ID: 5D837820D1937D8FBB538F1230D36EC4
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Netflix

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

14
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

726 kB
Transfer

724 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request main2.php Show response sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/	18 KB 19 KB	1067ms 534ms	Document text/html	35.74.34.154 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/main2.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.74.34.154 Tokyo, Japan, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-74-34-154.ap-northeast-1.compute.amazonaws.com Software Apache/2.4.48 () / PHP/7.4.21 Resource Hash `267ed6533fdeb1175b9722cf68eb4a886d6e6aeb45f09ec591b98a0b75fcfa83` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers date Sat, 22 Jan 2022 17:21:18 GMT content-type text/html; charset=UTF-8 server Apache/2.4.48 () x-powered-by PHP/7.4.21
GET H2	200	none_p2.css sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/assets/css/	15 KB 15 KB	272ms 271ms	Stylesheet text/css	35.74.34.154 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/assets/css/none_p2.css Requested by Host: sankei.lastmessage.rip URL: https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/main2.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.74.34.154 Tokyo, Japan, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-74-34-154.ap-northeast-1.compute.amazonaws.com Software Apache/2.4.48 () / Resource Hash `b30650bcb993a63e2256cbcaa4f1c8179e04d23e95f997378c370ebf90d4a5b8` Request headers Accept-Language de-DE,de;q=0.9 Referer https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/main2.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Sat, 22 Jan 2022 17:21:19 GMT last-modified Mon, 17 Jan 2022 08:43:23 GMT server Apache/2.4.48 () accept-ranges bytes etag "3a34-5d5c3253e64b6" content-length 14900 content-type text/css
GET H2	200	none1_p2.css sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/assets/css/	282 KB 283 KB	531ms 530ms	Stylesheet text/css	35.74.34.154 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/assets/css/none1_p2.css Requested by Host: sankei.lastmessage.rip URL: https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/main2.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.74.34.154 Tokyo, Japan, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-74-34-154.ap-northeast-1.compute.amazonaws.com Software Apache/2.4.48 () / Resource Hash `35e8e34cc51b64d4428f2ed38704b5063c43d9cf531598347c50c0164e9d7dc0` Request headers Accept-Language de-DE,de;q=0.9 Referer https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/main2.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Sat, 22 Jan 2022 17:21:19 GMT last-modified Mon, 17 Jan 2022 08:43:23 GMT server Apache/2.4.48 () accept-ranges bytes etag "4687e-5d5c3253e7456" content-length 288894 content-type text/css
GET H2	200	styles__ltr.css sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/assets/css/	127 KB 127 KB	287ms 287ms	Stylesheet text/css	35.74.34.154 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/assets/css/styles__ltr.css Requested by Host: sankei.lastmessage.rip URL: https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/main2.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.74.34.154 Tokyo, Japan, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-74-34-154.ap-northeast-1.compute.amazonaws.com Software Apache/2.4.48 () / Resource Hash `162fa9bcda32ad3e483b06770fe20d14ce68d756d821ef68316f9891cb6f3cc6` Request headers Accept-Language de-DE,de;q=0.9 Referer https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/main2.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Sat, 22 Jan 2022 17:21:19 GMT last-modified Mon, 17 Jan 2022 08:43:23 GMT server Apache/2.4.48 () accept-ranges bytes etag "1fa89-5d5c3253e7456" content-length 129673 content-type text/css
GET H2	200	modernizr.min.js Show response js-codes.com/modernizr/2.8.7/	4 KB 2 KB	442ms 44ms	Script application/javascript	2606:4700:3035::ac43:c763 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://js-codes.com/modernizr/2.8.7/modernizr.min.js Requested by Host: sankei.lastmessage.rip URL: https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/main2.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::ac43:c763 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express, Phusion Passenger 6.0.6 Resource Hash `a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44` Request headers Accept-Language de-DE,de;q=0.9 Referer https://sankei.lastmessage.rip/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Sat, 22 Jan 2022 17:21:19 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 16463641 x-powered-by Express, Phusion Passenger 6.0.6 status 200 OK alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 last-modified Wed, 11 Oct 2017 07:04:24 GMT server cloudflare etag W/"edf-15f0a3fa4c0" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iIQo5QFp2xlka0lGN8xGI78dXWqWpbdX%2BXYGOxn%2BjBoFcTr79%2F6coA3cKPLs6OqYmBJdBDmjuNmKLyCklNZpdKvoWcp1sXz1uQ2jXi1x3xWwGjaSC7VgWEvIZLjd4sJ4tAzsphEELK3lOGc%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=UTF-8 cache-control public, max-age=31536000 cf-ray 6d1a754269ee406f-CDG expires Sat, 16 Jul 2022 04:07:18 GMT
GET H2	200	jquery.js Show response sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/assets/js/	173 KB 173 KB	549ms 548ms	Script application/javascript	35.74.34.154 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/assets/js/jquery.js Requested by Host: sankei.lastmessage.rip URL: https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/main2.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.74.34.154 Tokyo, Japan, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-74-34-154.ap-northeast-1.compute.amazonaws.com Software Apache/2.4.48 () / Resource Hash `db23cdd0865ade174d9cd3efcca36d7b673c1ac509835459a8e57de1a602db9b` Request headers Accept-Language de-DE,de;q=0.9 Referer https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/main2.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Sat, 22 Jan 2022 17:21:19 GMT last-modified Mon, 17 Jan 2022 08:43:23 GMT server Apache/2.4.48 () accept-ranges bytes etag "2b2cb-5d5c3253e83f5" content-length 176843 content-type application/javascript
GET H2	200	jquery.val.js Show response sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/assets/js/	9 KB 10 KB	548ms 548ms	Script application/javascript	35.74.34.154 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/assets/js/jquery.val.js Requested by Host: sankei.lastmessage.rip URL: https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/main2.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.74.34.154 Tokyo, Japan, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-74-34-154.ap-northeast-1.compute.amazonaws.com Software Apache/2.4.48 () / Resource Hash `680a683f348909935ff7e1843d36fdb29995308668fa83f61f990ad518e38519` Request headers Accept-Language de-DE,de;q=0.9 Referer https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/main2.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Sat, 22 Jan 2022 17:21:19 GMT last-modified Mon, 17 Jan 2022 08:43:23 GMT server Apache/2.4.48 () accept-ranges bytes etag "25c8-5d5c3253e83f5" content-length 9672 content-type application/javascript
GET H2	200	jquery.mask.js Show response sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/assets/js/	16 KB 16 KB	547ms 546ms	Script application/javascript	35.74.34.154 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/assets/js/jquery.mask.js Requested by Host: sankei.lastmessage.rip URL: https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/main2.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.74.34.154 Tokyo, Japan, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-74-34-154.ap-northeast-1.compute.amazonaws.com Software Apache/2.4.48 () / Resource Hash `a45d589f4470fbca9f4047385d2bd6b9437969e4cb28b8625fcc532cb1c0b6e3` Request headers Accept-Language de-DE,de;q=0.9 Referer https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/main2.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Sat, 22 Jan 2022 17:21:19 GMT last-modified Mon, 17 Jan 2022 08:43:23 GMT server Apache/2.4.48 () accept-ranges bytes etag "3efe-5d5c3253e83f5" content-length 16126 content-type application/javascript
GET H2	200	visa-v3.svg sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/assets/img/	1 KB 1 KB	269ms 269ms	Image image/svg+xml	35.74.34.154 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/assets/img/visa-v3.svg Requested by Host: sankei.lastmessage.rip URL: https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/main2.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.74.34.154 Tokyo, Japan, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-74-34-154.ap-northeast-1.compute.amazonaws.com Software Apache/2.4.48 () / Resource Hash `d8dc942bdf04e43d4edb17c9d421f9f3a70bd62d5ec2fb502deb91b9b95fc064` Request headers Accept-Language de-DE,de;q=0.9 Referer https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/main2.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Sat, 22 Jan 2022 17:21:20 GMT last-modified Mon, 17 Jan 2022 08:43:23 GMT server Apache/2.4.48 () accept-ranges bytes etag "4b8-5d5c3253e7456" content-length 1208 content-type image/svg+xml
GET H2	200	mastercard-v2.svg sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/assets/img/	3 KB 3 KB	269ms 269ms	Image image/svg+xml	35.74.34.154 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/assets/img/mastercard-v2.svg Requested by Host: sankei.lastmessage.rip URL: https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/main2.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.74.34.154 Tokyo, Japan, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-74-34-154.ap-northeast-1.compute.amazonaws.com Software Apache/2.4.48 () / Resource Hash `9a4620a32974adc5764f26a8070cd432aa32ba8be3167320fd32bcd9cdcaed08` Request headers Accept-Language de-DE,de;q=0.9 Referer https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/main2.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Sat, 22 Jan 2022 17:21:20 GMT last-modified Mon, 17 Jan 2022 08:43:23 GMT server Apache/2.4.48 () accept-ranges bytes etag "c56-5d5c3253e7456" content-length 3158 content-type image/svg+xml
GET H2	200	amex-v2.svg sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/assets/img/	3 KB 3 KB	277ms 276ms	Image image/svg+xml	35.74.34.154 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/assets/img/amex-v2.svg Requested by Host: sankei.lastmessage.rip URL: https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/main2.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.74.34.154 Tokyo, Japan, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-74-34-154.ap-northeast-1.compute.amazonaws.com Software Apache/2.4.48 () / Resource Hash `7601455c0af7c3e0d8e64a288249c254b8fc1b257350613a6cdd1e1aaca9a3e4` Request headers Accept-Language de-DE,de;q=0.9 Referer https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/main2.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Sat, 22 Jan 2022 17:21:20 GMT last-modified Mon, 17 Jan 2022 08:43:23 GMT server Apache/2.4.48 () accept-ranges bytes etag "add-5d5c3253e7456" content-length 2781 content-type image/svg+xml
GET H2	200	icon_dinersclub_v2.png sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/assets/img/	1 KB 1 KB	270ms 269ms	Image image/png	35.74.34.154 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/assets/img/icon_dinersclub_v2.png Requested by Host: sankei.lastmessage.rip URL: https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/main2.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.74.34.154 Tokyo, Japan, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-74-34-154.ap-northeast-1.compute.amazonaws.com Software Apache/2.4.48 () / Resource Hash `eb40892e2786fabd6ac6cc3b2201947330a5f6ba577f9d5ae324191ff09c5ffe` Request headers Accept-Language de-DE,de;q=0.9 Referer https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/main2.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Sat, 22 Jan 2022 17:21:20 GMT last-modified Mon, 17 Jan 2022 08:43:23 GMT server Apache/2.4.48 () accept-ranges bytes etag "507-5d5c3253e7456" content-length 1287 content-type image/png
GET H2	200	queCircle.svg sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/assets/img/	1 KB 1 KB	270ms 270ms	Image image/svg+xml	35.74.34.154 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/assets/img/queCircle.svg Requested by Host: sankei.lastmessage.rip URL: https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/main2.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.74.34.154 Tokyo, Japan, ASN16509 (AMAZON-02, US), Reverse DNS ec2-35-74-34-154.ap-northeast-1.compute.amazonaws.com Software Apache/2.4.48 () / Resource Hash `809747554d0637b703de700a75d3b4047ad164c33916697bcf15960c7b6c2f30` Request headers Accept-Language de-DE,de;q=0.9 Referer https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/main2.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers date Sat, 22 Jan 2022 17:21:20 GMT last-modified Mon, 17 Jan 2022 08:43:23 GMT server Apache/2.4.48 () accept-ranges bytes etag "416-5d5c3253e7456" content-length 1046 content-type image/svg+xml
GET H/1.1	200 OK	nf-icon-v1-93.woff assets.nflxext.com/ffe/siteui/fonts/	72 KB 72 KB	115ms 41ms	Font font/woff	2a00:86c0:2090::1 NETFLIX-ASN
General Check archive.org Show headers Download Go to Full URL https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-93.woff Requested by Host: sankei.lastmessage.rip URL: https://sankei.lastmessage.rip/wp-includes/ID3/ID4/netfa/assets/css/none1_p2.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US), Reverse DNS Software nginx / Resource Hash `98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d` Request headers Referer https://sankei.lastmessage.rip/ Origin https://sankei.lastmessage.rip Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers Date Sat, 22 Jan 2022 17:21:20 GMT Last-Modified Mon, 29 Jan 2018 01:50:51 GMT Server nginx Content-MD5 fPYVbMSBJEtaJUNi17c/AA== Content-Type font/woff Access-Control-Allow-Origin * Cache-Control max-age=604801 Connection keep-alive Accept-Ranges bytes Content-Length 73572 Expires Sat, 29 Jan 2022 17:21:21 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.nflxext.com
js-codes.com
sankei.lastmessage.rip
2606:4700:3035::ac43:c763
2a00:86c0:2090::1
35.74.34.154
162fa9bcda32ad3e483b06770fe20d14ce68d756d821ef68316f9891cb6f3cc6
267ed6533fdeb1175b9722cf68eb4a886d6e6aeb45f09ec591b98a0b75fcfa83
35e8e34cc51b64d4428f2ed38704b5063c43d9cf531598347c50c0164e9d7dc0
680a683f348909935ff7e1843d36fdb29995308668fa83f61f990ad518e38519
7601455c0af7c3e0d8e64a288249c254b8fc1b257350613a6cdd1e1aaca9a3e4
809747554d0637b703de700a75d3b4047ad164c33916697bcf15960c7b6c2f30
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
9a4620a32974adc5764f26a8070cd432aa32ba8be3167320fd32bcd9cdcaed08
a45d589f4470fbca9f4047385d2bd6b9437969e4cb28b8625fcc532cb1c0b6e3
a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44
b30650bcb993a63e2256cbcaa4f1c8179e04d23e95f997378c370ebf90d4a5b8
d8dc942bdf04e43d4edb17c9d421f9f3a70bd62d5ec2fb502deb91b9b95fc064
db23cdd0865ade174d9cd3efcca36d7b673c1ac509835459a8e57de1a602db9b
eb40892e2786fabd6ac6cc3b2201947330a5f6ba577f9d5ae324191ff09c5ffe

sankei.lastmessage.rip Open in urlscan Pro 35.74.34.154 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

726 kBTransfer

724 kBSize

0 Cookies

0 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

0 Cookies

Indicators

sankei.lastmessage.rip Open in urlscan Pro
35.74.34.154 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

726 kB
Transfer

724 kB
Size

0
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!