netflix-lush.onrender.com
Open in
urlscan Pro
216.24.57.3
Malicious Activity!
Public Scan
Submission: On June 04 via automatic, source certstream-suspicious — Scanned from SE
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on June 4th 2023. Valid for: a year.
This is the only time netflix-lush.onrender.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Netflix (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 216.24.57.3 216.24.57.3 | 397273 (RENDER) (RENDER) | |
7 | 52.219.158.19 52.219.158.19 | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 104.17.25.14 104.17.25.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
10 | 3 |
ASN16509 (AMAZON-02, US)
PTR: s3-w.ap-south-1.amazonaws.com
om-netflix-clone.s3.amazonaws.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
amazonaws.com
om-netflix-clone.s3.amazonaws.com |
785 KB |
2 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 249 |
82 KB |
1 |
onrender.com
netflix-lush.onrender.com |
3 KB |
10 | 3 |
Domain | Requested by | |
---|---|---|
7 | om-netflix-clone.s3.amazonaws.com |
netflix-lush.onrender.com
|
2 | cdnjs.cloudflare.com |
netflix-lush.onrender.com
cdnjs.cloudflare.com |
1 | netflix-lush.onrender.com | |
10 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-06-04 - 2024-06-02 |
a year | crt.sh |
*.s3.amazonaws.com Amazon RSA 2048 M01 |
2023-03-21 - 2023-12-19 |
9 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://netflix-lush.onrender.com/
Frame ID: F9C9DB9937E63F57F463968D13D71987
Requests: 10 HTTP requests in this frame
Screenshot
Page Title
Netflix India - Watch TV Shows Online, Watch Movies OnlineDetected technologies
Font Awesome (Font Scripts) ExpandDetected patterns
- <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
netflix-lush.onrender.com/ |
12 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
output.css
om-netflix-clone.s3.amazonaws.com/static/ |
18 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ |
30 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
netflix.png
om-netflix-clone.s3.amazonaws.com/static/ |
6 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tv.png
om-netflix-clone.s3.amazonaws.com/static/ |
11 KB 12 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mobile-0819.jpg
om-netflix-clone.s3.amazonaws.com/static/ |
48 KB 49 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
device-pile-in.png
om-netflix-clone.s3.amazonaws.com/static/ |
148 KB 149 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
netflix-kid.png
om-netflix-clone.s3.amazonaws.com/static/ |
257 KB 257 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg.jpg
om-netflix-clone.s3.amazonaws.com/static/ |
294 KB 294 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
fontawesome-webfont.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/fonts/ |
75 KB 76 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Netflix (Online)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| onbeforetoggle object| onscrollend0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Content-Type-Options | nosniff |
X-Frame-Options | DENY |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
netflix-lush.onrender.com
om-netflix-clone.s3.amazonaws.com
104.17.25.14
216.24.57.3
52.219.158.19
492fdebd363e40cbba153a244bcfe2a7f5f7cf20aff0805fe45d5c7e2180b875
4a3bfdf68de04166878c6bfa4c5b0f57a100cad45ab80939433e8f7aeef4b7a4
6d0433ab56d6ae25f0a88644eef6f35f551693847b64245220b9b24958fd7a4d
70f5b629acbab73f2276d89eb97f13824a4931fd1ce9ae3936f4724e3bda1598
785627ffcb5b0255edfe4a703177a34a1a1a520d1607c70f852afa0600505649
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
b68ea2c7bea397aa11fadb189ce7d83862baebaf03ece643eb5aa9fb5f755056
caf69067b53f840529b7cc3a2494e90878dc9f62307fc458dd893fac746d37a0
d792afdac7f7ae5de7c6964950c6c61dc6e3f3813180a59e141c7cb4ac4364dc
e4078b5b28c333b260a5b250e9a252b9394f106371a5abcf243c9a0fa3337b6d