opendoorauctions.com Open in urlscan Pro
2606:4700:30::681b:819a Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://wadirumdesert.com/new/wp-content/themes/neve/gutenberg/blocks/contact/
Effective URL:
http://opendoorauctions.com/myaccount/NETFLIX/netflix/Login/login.php?code=DE&id=21855920&country=Germany
Submission: On December 30 via manual (December 30th 2019, 4:57:52 pm UTC) from US

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 10 HTTP transactions. The main IP is 2606:4700:30::681b:819a, located in United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is opendoorauctions.com.

This is the only time opendoorauctions.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	160.153.75.70 160.153.75.70	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com)
3 11	2606:4700:30:... 2606:4700:30::681b:819a	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	2a00:86c0:209... 2a00:86c0:2090::1	40027 (NETFLIX-ASN) (NETFLIX-ASN - Netflix Streaming Services Inc.)
10	3

1 160.153.75.70 (Scottsdale, United States)

ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US)
PTR: ip-160-153-75-70.ip.secureserver.net

wadirumdesert.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2606:4700:30::681b:819a (United States) 3 redirects

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

opendoorauctions.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:86c0:2090::1 (United Kingdom)

ASN40027 (NETFLIX-ASN - Netflix Streaming Services Inc., US)

assets.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	opendoorauctions.com 3 redirects opendoorauctions.com	140 KB
1	nflxext.com assets.nflxext.com	78 KB
1	wadirumdesert.com wadirumdesert.com	587 B
10	3

	Domain	Requested by
11	opendoorauctions.com	3 redirects wadirumdesert.com opendoorauctions.com
1	assets.nflxext.com
1	wadirumdesert.com
10	3

This site contains no links.

Subject Issuer	Validity	Valid
*.1.nflxso.net DigiCert SHA2 Secure Server CA	`2019-12-09` - `2020-01-13`	a month	crt.sh

This page contains 1 frames:

Primary Page: http://opendoorauctions.com/myaccount/NETFLIX/netflix/Login/login.php?code=DE&id=21855920&country=Germany
Frame ID: 42042B92339AEAC37CA5C98522C4A497
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://wadirumdesert.com/new/wp-content/themes/neve/gutenberg/blocks/contact/ Page URL
https://opendoorauctions.com/myaccount/NETFLIX/ HTTP 302
https://opendoorauctions.com/myaccount/NETFLIX/netflix HTTP 301
http://opendoorauctions.com/myaccount/NETFLIX/netflix/ Page URL
http://opendoorauctions.com/myaccount/NETFLIX/netflix/Login HTTP 301
http://opendoorauctions.com/myaccount/NETFLIX/netflix/Login/ Page URL
http://opendoorauctions.com/myaccount/NETFLIX/netflix/Login/login.php?code=DE&id=21855920&country=Germany Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

10
Requests

10 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

217 kB
Transfer

285 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://wadirumdesert.com/new/wp-content/themes/neve/gutenberg/blocks/contact/ Page URL
https://opendoorauctions.com/myaccount/NETFLIX/ HTTP 302
https://opendoorauctions.com/myaccount/NETFLIX/netflix HTTP 301
http://opendoorauctions.com/myaccount/NETFLIX/netflix/ Page URL
http://opendoorauctions.com/myaccount/NETFLIX/netflix/Login HTTP 301
http://opendoorauctions.com/myaccount/NETFLIX/netflix/Login/ Page URL
http://opendoorauctions.com/myaccount/NETFLIX/netflix/Login/login.php?code=DE&id=21855920&country=Germany Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

https://opendoorauctions.com/myaccount/NETFLIX/ HTTP 302
https://opendoorauctions.com/myaccount/NETFLIX/netflix HTTP 301
http://opendoorauctions.com/myaccount/NETFLIX/netflix/

Request Chain 2

http://opendoorauctions.com/myaccount/NETFLIX/netflix/Login HTTP 301
http://opendoorauctions.com/myaccount/NETFLIX/netflix/Login/

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK / Show response
wadirumdesert.com/new/wp-content/themes/neve/gutenberg/blocks/contact/ 400 B
587 B 2582ms
295ms Document
text/html 160.153.75.70
GoDaddy.com

General

Check archive.org

Show headers Download Go to

Full URL

http://wadirumdesert.com/new/wp-content/themes/neve/gutenberg/blocks/contact/

Protocol

HTTP/1.1

Server

160.153.75.70 Scottsdale, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC - GoDaddy.com, LLC, US),

Reverse DNS

ip-160-153-75-70.ip.secureserver.net

Software

Apache / PHP/5.6.40

Resource Hash

8ad66670fd96d38332f0fd6dacf8af7d4fe47e48fe5501cdeafe8c65b58cab79

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Host: wadirumdesert.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 30 Dec 2019 16:57:31 GMT
Server: Apache
X-Powered-By: PHP/5.6.40
X-Content-Type-Options: nosniff
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Vary: Accept-Encoding,User-Agent
Content-Encoding: gzip
Content-Length: 264
Keep-Alive: timeout=5
Content-Type: text/html; charset=UTF-8

GET
H/1.1

200
OK

/ Show response
opendoorauctions.com/myaccount/NETFLIX/netflix/
Redirect Chain

https://opendoorauctions.com/myaccount/NETFLIX/
https://opendoorauctions.com/myaccount/NETFLIX/netflix
http://opendoorauctions.com/myaccount/NETFLIX/netflix/

206 B
451 B

348ms
340ms

Document
text/html

2606:4700:30::681b:819a
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: http://opendoorauctions.com/myaccount/NETFLIX/netflix/
Requested by: Host: wadirumdesert.com
URL: http://wadirumdesert.com/new/wp-content/themes/neve/gutenberg/blocks/contact/
Protocol: HTTP/1.1
Server: 2606:4700:30::681b:819a , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare / PHP/5.4.45
Resource Hash: 8c37e1ab9e0717e142fe6cb9d83de2cf43d59e987cd0af9404f279dae96dc49d

Request headers

Host: opendoorauctions.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: http://wadirumdesert.com/new/wp-content/themes/neve/gutenberg/blocks/contact/
Accept-Encoding: gzip, deflate
Cookie: __cfduid=d233eb3378c1d10454c148d31e4b701a81577725051; PHPSESSID=fb0816eee0667a857a7c4f378ebc9e30
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://wadirumdesert.com/new/wp-content/themes/neve/gutenberg/blocks/contact/

Response headers

Date: Mon, 30 Dec 2019 16:57:33 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.4.45
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 54d58dadb90cc2c7-FRA
Content-Encoding: gzip

Redirect headers

status: 301
date: Mon, 30 Dec 2019 16:57:33 GMT
content-type: text/html; charset=iso-8859-1
location: http://opendoorauctions.com/myaccount/NETFLIX/netflix/
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 54d58dab6dd39748-FRA

GET
H/1.1

200
OK

Cookie set / Show response
opendoorauctions.com/myaccount/NETFLIX/netflix/Login/
Redirect Chain

http://opendoorauctions.com/myaccount/NETFLIX/netflix/Login
http://opendoorauctions.com/myaccount/NETFLIX/netflix/Login/

240 B
863 B

963ms
962ms

Document
text/html

2606:4700:30::681b:819a
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: http://opendoorauctions.com/myaccount/NETFLIX/netflix/Login/
Requested by: Host: opendoorauctions.com
URL: http://opendoorauctions.com/myaccount/NETFLIX/netflix/
Protocol: HTTP/1.1
Server: 2606:4700:30::681b:819a , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare / PHP/5.4.45
Resource Hash: 57b55348811fd6eb4c733690c526fe0dd1a3f66d781b58cc4e79b80def0be491

Request headers

Host: opendoorauctions.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: http://opendoorauctions.com/myaccount/NETFLIX/netflix/
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://opendoorauctions.com/myaccount/NETFLIX/netflix/

Response headers

Date: Mon, 30 Dec 2019 16:57:34 GMT
Content-Type: text/html; charset-UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: __cfduid=d8b325858d6ff003d4e95f68e42ed6d1d1577725053; expires=Wed, 29-Jan-20 16:57:33 GMT; path=/; domain=.opendoorauctions.com; HttpOnly; SameSite=Lax PHPSESSID=079982e1305a14fb79662bc798623eb7; path=/
X-Powered-By: PHP/5.4.45
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 54d58db24ed9c2c7-FRA
Content-Encoding: gzip

Redirect headers

Date: Mon, 30 Dec 2019 16:57:33 GMT
Content-Type: text/html; charset=iso-8859-1
Transfer-Encoding: chunked
Connection: keep-alive
Location: http://opendoorauctions.com/myaccount/NETFLIX/netflix/Login/
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 54d58dafffbfc2c7-FRA

GET
H/1.1 200
OK Primary Request login.php Show response
opendoorauctions.com/myaccount/NETFLIX/netflix/Login/ 3 KB
2 KB 848ms
847ms Document
text/html 2606:4700:30::681b:819a
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: http://opendoorauctions.com/myaccount/NETFLIX/netflix/Login/login.php?code=DE&id=21855920&country=Germany
Requested by: Host: opendoorauctions.com
URL: http://opendoorauctions.com/myaccount/NETFLIX/netflix/Login/
Protocol: HTTP/1.1
Server: 2606:4700:30::681b:819a , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare / PHP/5.4.45
Resource Hash: 0fa34b1387198bf208f7a72c45141988669b8f37f03e4de8897010569b4aae94

Request headers

Host: opendoorauctions.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: http://opendoorauctions.com/myaccount/NETFLIX/netflix/Login/
Accept-Encoding: gzip, deflate
Cookie: __cfduid=d8b325858d6ff003d4e95f68e42ed6d1d1577725053; PHPSESSID=079982e1305a14fb79662bc798623eb7
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://opendoorauctions.com/myaccount/NETFLIX/netflix/Login/

Response headers

Date: Mon, 30 Dec 2019 16:57:35 GMT
Content-Type: text/html; charset-UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/5.4.45
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 54d58db85b1bc2c7-FRA
Content-Encoding: gzip

GET
H/1.1 200
OK HF_D.css
opendoorauctions.com/myaccount/NETFLIX/netflix/Login/doc/css/ 35 KB
7 KB 19ms
18ms Stylesheet
text/css 2606:4700:30::681b:819a
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: http://opendoorauctions.com/myaccount/NETFLIX/netflix/Login/doc/css/HF_D.css
Requested by: Host: opendoorauctions.com
URL: http://opendoorauctions.com/myaccount/NETFLIX/netflix/Login/login.php?code=DE&id=21855920&country=Germany
Protocol: HTTP/1.1
Server: 2606:4700:30::681b:819a , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: ecd28273fe2d6b48528e92a13a1c57504a0441f26310c4cc8d5ad054dddd35a2

Request headers

Referer: http://opendoorauctions.com/myaccount/NETFLIX/netflix/Login/login.php?code=DE&id=21855920&country=Germany
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 30 Dec 2019 16:57:35 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
Last-Modified: Thu, 30 Mar 2017 16:25:02 GMT
Server: cloudflare
Age: 14
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=14400
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 54d58dbdbc4bc2c7-FRA

GET
H/1.1 200
OK HF_A.css
opendoorauctions.com/myaccount/NETFLIX/netflix/Login/doc/css/ 49 KB
8 KB 32ms
26ms Stylesheet
text/css 2606:4700:30::681b:819a
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: http://opendoorauctions.com/myaccount/NETFLIX/netflix/Login/doc/css/HF_A.css
Requested by: Host: opendoorauctions.com
URL: http://opendoorauctions.com/myaccount/NETFLIX/netflix/Login/login.php?code=DE&id=21855920&country=Germany
Protocol: HTTP/1.1
Server: 2606:4700:30::681b:819a , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 46279f4f5c8950e379936d18d37c1af6d60eea37b7aa7d9f6a68a7322411c34b

Request headers

Referer: http://opendoorauctions.com/myaccount/NETFLIX/netflix/Login/login.php?code=DE&id=21855920&country=Germany
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 30 Dec 2019 16:57:35 GMT
Content-Encoding: gzip
CF-Cache-Status: HIT
Last-Modified: Thu, 30 Mar 2017 16:48:30 GMT
Server: cloudflare
Age: 14
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=14400
Transfer-Encoding: chunked
Connection: keep-alive
CF-RAY: 54d58dbdbd26c2fe-FRA

GET
H/1.1 200
OK logo.png
opendoorauctions.com/myaccount/NETFLIX/netflix/Login/doc/img/ 34 KB
34 KB 19ms
13ms Image
image/png 2606:4700:30::681b:819a
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://opendoorauctions.com/myaccount/NETFLIX/netflix/Login/doc/img/logo.png
Requested by: Host: opendoorauctions.com
URL: http://opendoorauctions.com/myaccount/NETFLIX/netflix/Login/login.php?code=DE&id=21855920&country=Germany
Protocol: HTTP/1.1
Server: 2606:4700:30::681b:819a , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: dd9b1c21a5e16ea328ffc4235d991babadf03be991ac4f7dbb11aac89966fcca

Request headers

Referer: http://opendoorauctions.com/myaccount/NETFLIX/netflix/Login/login.php?code=DE&id=21855920&country=Germany
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 30 Dec 2019 16:57:35 GMT
CF-Cache-Status: HIT
Last-Modified: Wed, 29 Mar 2017 03:13:52 GMT
Server: cloudflare
Age: 14
Vary: Accept-Encoding
Content-Type: image/png
Cache-Control: max-age=14400
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 54d58dbdba87c29a-FRA
Content-Length: 34504

GET
H/1.1 200
OK fb.png
opendoorauctions.com/myaccount/NETFLIX/netflix/Login/doc/img/ 1 KB
2 KB 23ms
18ms Image
image/png 2606:4700:30::681b:819a
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://opendoorauctions.com/myaccount/NETFLIX/netflix/Login/doc/img/fb.png
Requested by: Host: opendoorauctions.com
URL: http://opendoorauctions.com/myaccount/NETFLIX/netflix/Login/login.php?code=DE&id=21855920&country=Germany
Protocol: HTTP/1.1
Server: 2606:4700:30::681b:819a , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece

Request headers

Referer: http://opendoorauctions.com/myaccount/NETFLIX/netflix/Login/login.php?code=DE&id=21855920&country=Germany
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 30 Dec 2019 16:57:35 GMT
CF-Cache-Status: HIT
Last-Modified: Wed, 29 Mar 2017 02:47:34 GMT
Server: cloudflare
Age: 14
Vary: Accept-Encoding
Content-Type: image/png
Cache-Control: max-age=14400
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 54d58dbdbe5a9814-FRA
Content-Length: 1455

GET
H/1.1 200
OK login.jpg
opendoorauctions.com/myaccount/NETFLIX/netflix/Login/doc/img/ 84 KB
85 KB 24ms
24ms Image
image/jpeg 2606:4700:30::681b:819a
Cloudflare

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://opendoorauctions.com/myaccount/NETFLIX/netflix/Login/doc/img/login.jpg
Protocol: HTTP/1.1
Server: 2606:4700:30::681b:819a , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: baafd74a4cb4dc594b614eeb45c7267bb1af729d9271752460348ece16532d04

Request headers

Referer: http://opendoorauctions.com/myaccount/NETFLIX/netflix/Login/doc/css/HF_A.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 30 Dec 2019 16:57:35 GMT
CF-Cache-Status: HIT
Last-Modified: Wed, 29 Mar 2017 00:31:50 GMT
Server: cloudflare
Age: 13
Vary: Accept-Encoding
Content-Type: image/jpeg
Cache-Control: max-age=14400
Connection: keep-alive
Accept-Ranges: bytes
CF-RAY: 54d58dbdedcfc2fe-FRA
Content-Length: 86226

GET
H/1.1 200
OK nf-icon-v1-80.woff
assets.nflxext.com/ffe/siteui/fonts/ 78 KB
78 KB 7ms
7ms Font
font/woff 2a00:86c0:2090::1
Netflix Streaming...

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-80.woff
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a00:86c0:2090::1 , United Kingdom, ASN40027 (NETFLIX-ASN - Netflix Streaming Services Inc., US),
Reverse DNS
Software: nginx /
Resource Hash: 2555364bdd6374d0c273c69322f2f78554c02fe630ee6582eeb2d2c9031d1a9d

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: http://opendoorauctions.com/myaccount/NETFLIX/netflix/Login/doc/css/HF_D.css
Origin: http://opendoorauctions.com

Response headers

Date: Mon, 30 Dec 2019 16:57:35 GMT
Last-Modified: Thu, 28 Jan 2016 20:46:04 GMT
Server: nginx
Content-MD5: GkWpE2r/FESZk08OjSTsgQ==
Content-Type: font/woff
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=16744620
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 79392
Expires: Wed, 15 Apr 2020 20:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			opendoorauctions.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 079982e1305a14fb79662bc798623eb7
			.opendoorauctions.com/	1970-01-19 06:58:37	Name: __cfduid Value: d8b325858d6ff003d4e95f68e42ed6d1d1577725053

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.nflxext.com
opendoorauctions.com
wadirumdesert.com
160.153.75.70
2606:4700:30::681b:819a
2a00:86c0:2090::1
0fa34b1387198bf208f7a72c45141988669b8f37f03e4de8897010569b4aae94
2555364bdd6374d0c273c69322f2f78554c02fe630ee6582eeb2d2c9031d1a9d
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
46279f4f5c8950e379936d18d37c1af6d60eea37b7aa7d9f6a68a7322411c34b
57b55348811fd6eb4c733690c526fe0dd1a3f66d781b58cc4e79b80def0be491
8ad66670fd96d38332f0fd6dacf8af7d4fe47e48fe5501cdeafe8c65b58cab79
8c37e1ab9e0717e142fe6cb9d83de2cf43d59e987cd0af9404f279dae96dc49d
baafd74a4cb4dc594b614eeb45c7267bb1af729d9271752460348ece16532d04
dd9b1c21a5e16ea328ffc4235d991babadf03be991ac4f7dbb11aac89966fcca
ecd28273fe2d6b48528e92a13a1c57504a0441f26310c4cc8d5ad054dddd35a2

opendoorauctions.com Open in urlscan Pro 2606:4700:30::681b:819a Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

10 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

217 kBTransfer

285 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

2 Cookies

Security Headers

Indicators

opendoorauctions.com Open in urlscan Pro
2606:4700:30::681b:819a Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

10 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

217 kB
Transfer

285 kB
Size

2
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!