b867amcgu.myraidbox.de

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 7 HTTP transactions. The main IP is 159.69.18.65, located in Nuremberg, Germany and belongs to HETZNER-AS, DE. The main domain is b867amcgu.myraidbox.de.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on April 13th 2023. Valid for: a year.

This is the only time b867amcgu.myraidbox.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address	AS Autonomous System
2 8	159.69.18.65 159.69.18.65	24940 (HETZNER-AS) (HETZNER-AS)
1	2a00:86c0:209... 2a00:86c0:2091::1	40027 (NETFLIX-ASN) (NETFLIX-ASN)
7	2

8 159.69.18.65 (Nuremberg, Germany) 2 redirects

ASN24940 (HETZNER-AS, DE)
PTR: b867amcgu.myraidbox.de

b867amcgu.myraidbox.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:86c0:2091::1 (United States)

ASN40027 (NETFLIX-ASN, US)

assets.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	myraidbox.de 2 redirects b867amcgu.myraidbox.de	663 KB
1	nflxext.com assets.nflxext.com — Cisco Umbrella Rank: 4129	72 KB
7	2

	Domain	Requested by
8	b867amcgu.myraidbox.de	2 redirects b867amcgu.myraidbox.de
1	assets.nflxext.com	b867amcgu.myraidbox.de
7	2

This site contains no links.

Subject Issuer	Validity	Valid
*.myraidbox.de Sectigo RSA Domain Validation Secure Server CA	`2023-04-13` - `2024-05-13`	a year	crt.sh
*.1.nflxso.net DigiCert Secure Site ECC CA-1	`2023-06-15` - `2023-07-18`	a month	crt.sh

This page contains 1 frames:

Primary Page: https://b867amcgu.myraidbox.de/kw/mainwebapp/account.php
Frame ID: B8EACBC2544EF8571A4E877DF6B33602
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Netflix

Page URL History Show full URLs

https://b867amcgu.myraidbox.de/kw/mainwebapp HTTP 301
https://b867amcgu.myraidbox.de/kw/mainwebapp/ HTTP 302
https://b867amcgu.myraidbox.de/kw/mainwebapp/account.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

7
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

735 kB
Transfer

2304 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://b867amcgu.myraidbox.de/kw/mainwebapp HTTP 301
https://b867amcgu.myraidbox.de/kw/mainwebapp/ HTTP 302
https://b867amcgu.myraidbox.de/kw/mainwebapp/account.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request account.php Show response
b867amcgu.myraidbox.de/kw/mainwebapp/
Redirect Chain

https://b867amcgu.myraidbox.de/kw/mainwebapp
https://b867amcgu.myraidbox.de/kw/mainwebapp/
https://b867amcgu.myraidbox.de/kw/mainwebapp/account.php

12 KB
3 KB

52ms
52ms

Document
text/html

159.69.18.65
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://b867amcgu.myraidbox.de/kw/mainwebapp/account.php

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

159.69.18.65 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

b867amcgu.myraidbox.de

Software

nginx /

Resource Hash

185a75736c5baf10694213720fbcef748c373410b4c57a4eb7879f43dc37defd

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate
content-encoding: br
content-type: text/html; charset=UTF-8
date: Sat, 01 Jul 2023 23:34:58 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: nginx
strict-transport-security: max-age=63072000
vary: Accept-Encoding
x-cache: HIT
x-cache-device-type: responsive
x-cache-type: NGINX
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

Redirect headers

content-type: text/html; charset=UTF-8
date: Sat, 01 Jul 2023 23:34:58 GMT
location: account.php
server: nginx
strict-transport-security: max-age=63072000
x-cache: HIT
x-cache-device-type: responsive
x-cache-type: NGINX
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 style.css
b867amcgu.myraidbox.de/kw/mainwebapp/css/ 107 KB
15 KB 95ms
94ms Stylesheet
text/css 159.69.18.65
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://b867amcgu.myraidbox.de/kw/mainwebapp/css/style.css

Requested by

Host: b867amcgu.myraidbox.de
URL: https://b867amcgu.myraidbox.de/kw/mainwebapp/account.php

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

159.69.18.65 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

b867amcgu.myraidbox.de

Software

nginx /

Resource Hash

1c22371c656a4b87d3d6e46c4fa03573efc382782fbf74d67af2e7d00a402d1c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b867amcgu.myraidbox.de/kw/mainwebapp/account.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: public
date: Sat, 01 Jul 2023 23:34:58 GMT
strict-transport-security: max-age=63072000
x-content-type-options: nosniff
last-modified: Sat, 01 Jul 2023 16:18:21 GMT
server: nginx
content-encoding: br
etag: W/"64a051cd-1ad49"
x-cache-type: STATIC
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000, public
x-cache-device-type: responsive
x-xss-protection: 1; mode=block
expires: Sun, 30 Jun 2024 23:34:58 GMT

GET
H2 200 login.js Show response
b867amcgu.myraidbox.de/kw/mainwebapp/js/ 2 MB
308 KB 236ms
235ms Script
application/javascript 159.69.18.65
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://b867amcgu.myraidbox.de/kw/mainwebapp/js/login.js

Requested by

Host: b867amcgu.myraidbox.de
URL: https://b867amcgu.myraidbox.de/kw/mainwebapp/account.php

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

159.69.18.65 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

b867amcgu.myraidbox.de

Software

nginx /

Resource Hash

76b22adfdb4470bf90d43617d7c1bbf7466313745e8ee2882f721faf43f9dbb8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b867amcgu.myraidbox.de/kw/mainwebapp/account.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: public
date: Sat, 01 Jul 2023 23:34:58 GMT
strict-transport-security: max-age=63072000
x-content-type-options: nosniff
last-modified: Sat, 01 Jul 2023 16:18:21 GMT
server: nginx
content-encoding: br
etag: W/"64a051cd-1972c3"
x-cache-type: STATIC
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000, public
x-cache-device-type: responsive
x-xss-protection: 1; mode=block
expires: Sun, 30 Jun 2024 23:34:58 GMT

GET
H2 200 login2.css
b867amcgu.myraidbox.de/kw/mainwebapp/css/ 13 KB
3 KB 131ms
130ms Stylesheet
text/css 159.69.18.65
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://b867amcgu.myraidbox.de/kw/mainwebapp/css/login2.css

Requested by

Host: b867amcgu.myraidbox.de
URL: https://b867amcgu.myraidbox.de/kw/mainwebapp/account.php

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

159.69.18.65 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

b867amcgu.myraidbox.de

Software

nginx /

Resource Hash

d622e7c909d7ddd5d9b3a50f894114345c5b15898a430c5a2fe6928035852c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b867amcgu.myraidbox.de/kw/mainwebapp/account.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: public
date: Sat, 01 Jul 2023 23:34:58 GMT
strict-transport-security: max-age=63072000
x-content-type-options: nosniff
last-modified: Sat, 01 Jul 2023 16:18:21 GMT
server: nginx
content-encoding: br
etag: W/"64a051cd-35f5"
x-cache-type: STATIC
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000, public
x-cache-device-type: responsive
x-xss-protection: 1; mode=block
expires: Sun, 30 Jun 2024 23:34:58 GMT

GET
H2 200 login.css
b867amcgu.myraidbox.de/kw/mainwebapp/css/ 157 KB
19 KB 131ms
131ms Stylesheet
text/css 159.69.18.65
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://b867amcgu.myraidbox.de/kw/mainwebapp/css/login.css

Requested by

Host: b867amcgu.myraidbox.de
URL: https://b867amcgu.myraidbox.de/kw/mainwebapp/account.php

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

159.69.18.65 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

b867amcgu.myraidbox.de

Software

nginx /

Resource Hash

dc6c504c324eb03c23b34b2c47e3152bffbf77f4f6a9ae5aa37d0b4dc67046ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b867amcgu.myraidbox.de/kw/mainwebapp/account.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

pragma: public
date: Sat, 01 Jul 2023 23:34:58 GMT
strict-transport-security: max-age=63072000
x-content-type-options: nosniff
last-modified: Sat, 01 Jul 2023 16:18:21 GMT
server: nginx
content-encoding: br
etag: W/"64a051cd-27433"
x-cache-type: STATIC
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=31536000, public
x-cache-device-type: responsive
x-xss-protection: 1; mode=block
expires: Sun, 30 Jun 2024 23:34:58 GMT

GET
H2 200 FR-fr-20211220-popsignuptwoweeks-perspective_alpha_website_large.jpg
b867amcgu.myraidbox.de/kw/mainwebapp/img/ 313 KB
314 KB 270ms
270ms Image
image/jpeg 159.69.18.65
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b867amcgu.myraidbox.de/kw/mainwebapp/img/FR-fr-20211220-popsignuptwoweeks-perspective_alpha_website_large.jpg

Requested by

Host: b867amcgu.myraidbox.de
URL: https://b867amcgu.myraidbox.de/kw/mainwebapp/account.php

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

159.69.18.65 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

b867amcgu.myraidbox.de

Software

nginx /

Resource Hash

e83673deb9aea659fb4449f8056ebdead1aac25226efb021ed5b5fbff1745f4f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b867amcgu.myraidbox.de/kw/mainwebapp/account.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Sat, 01 Jul 2023 23:34:58 GMT
strict-transport-security: max-age=63072000
x-content-type-options: nosniff
x-cache-type: STATIC
content-length: 320920
x-xss-protection: 1; mode=block
pragma: public
last-modified: Sat, 01 Jul 2023 16:18:21 GMT
server: nginx
etag: "64a051cd-4e598"
vary: Accept-Encoding, Accept
content-type: image/jpeg
cache-control: max-age=31536000, public
accept-ranges: bytes
x-cache-device-type: responsive
expires: Sun, 30 Jun 2024 23:34:58 GMT

GET
H/1.1 200
OK nf-icon-v1-93.woff
assets.nflxext.com/ffe/siteui/fonts/ 72 KB
72 KB 129ms
40ms Font
font/woff 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-93.woff
Requested by: Host: b867amcgu.myraidbox.de
URL: https://b867amcgu.myraidbox.de/kw/mainwebapp/css/login.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d

Request headers

Referer: https://b867amcgu.myraidbox.de/
Origin: https://b867amcgu.myraidbox.de
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date: Sat, 01 Jul 2023 23:34:58 GMT
Last-Modified: Mon, 29 Jan 2018 01:50:51 GMT
Server: nginx
Content-MD5: fPYVbMSBJEtaJUNi17c/AA==
Content-Type: font/woff
Access-Control-Allow-Origin: *
Cache-Control: max-age=604801
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 73572
Expires: Sat, 08 Jul 2023 23:34:59 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://b867amcgu.myraidbox.de/kw/mainwebapp/account.php Message: The resource https://b867amcgu.myraidbox.de/kw/mainwebapp/js/login.js was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.nflxext.com
b867amcgu.myraidbox.de
159.69.18.65
2a00:86c0:2091::1
185a75736c5baf10694213720fbcef748c373410b4c57a4eb7879f43dc37defd
1c22371c656a4b87d3d6e46c4fa03573efc382782fbf74d67af2e7d00a402d1c
76b22adfdb4470bf90d43617d7c1bbf7466313745e8ee2882f721faf43f9dbb8
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
d622e7c909d7ddd5d9b3a50f894114345c5b15898a430c5a2fe6928035852c37
dc6c504c324eb03c23b34b2c47e3152bffbf77f4f6a9ae5aa37d0b4dc67046ee
e83673deb9aea659fb4449f8056ebdead1aac25226efb021ed5b5fbff1745f4f

b867amcgu.myraidbox.de Open in urlscan Pro 159.69.18.65 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

7 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

735 kBTransfer

2304 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

1 Console Messages

Security Headers

Indicators

b867amcgu.myraidbox.de Open in urlscan Pro
159.69.18.65 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

735 kB
Transfer

2304 kB
Size

0
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!