![](/screenshots/05875e52-3c96-4fe6-bb8d-fe05ad4b8802.png)
www.hdaustria.at
Open in
urlscan Pro
84.39.123.42
Malicious Activity!
Public Scan
Effective URL: https://www.hdaustria.at/blog/mmp/simplemember/?l=login&local=nl-NL
Submission: On April 23 via manual from US
Summary
TLS certificate: Issued by Thawte EV RSA CA 2018 on February 7th 2018. Valid for: 2 years.
This is the only time www.hdaustria.at was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Netflix (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 2 | 195.60.151.115 195.60.151.115 | 9104 (CLIO-AS) (CLIO-AS) | |
1 4 | 84.39.123.42 84.39.123.42 | 35383 (ZXFACTORY-AS) (ZXFACTORY-AS) | |
4 | 54.93.128.64 54.93.128.64 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 | 104.20.209.21 104.20.209.21 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
1 | 2.18.232.136 2.18.232.136 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
12 | 6 |
ASN9104 (CLIO-AS, IT)
PTR: taranto1.dmz.rupar.clio.it
servizi.areavastatarantina.it |
ASN35383 (ZXFACTORY-AS, NL)
PTR: unknown-host.capitar.com
www.hdaustria.at |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-93-128-64.eu-central-1.compute.amazonaws.com
msdn-netflix.bitballoon.com |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
pastebin.com |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
assets.nflxext.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
bitballoon.com
msdn-netflix.bitballoon.com |
135 KB |
4 |
hdaustria.at
1 redirects
www.hdaustria.at |
12 KB |
2 |
areavastatarantina.it
1 redirects
servizi.areavastatarantina.it |
652 B |
1 |
nflxext.com
assets.nflxext.com |
69 KB |
1 |
pastebin.com
pastebin.com |
6 KB |
12 | 5 |
Domain | Requested by | |
---|---|---|
4 | msdn-netflix.bitballoon.com |
www.hdaustria.at
|
4 | www.hdaustria.at |
1 redirects
www.hdaustria.at
|
2 | servizi.areavastatarantina.it | 1 redirects |
1 | assets.nflxext.com | |
1 | pastebin.com |
www.hdaustria.at
|
12 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
servizi.areavastatarantina.it RapidSSL RSA CA 2018 |
2018-01-08 - 2021-01-07 |
3 years | crt.sh |
www.hdaustria.at Thawte EV RSA CA 2018 |
2018-02-07 - 2020-01-25 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.hdaustria.at/blog/mmp/simplemember/?l=login&local=nl-NL
Frame ID: BADC0B00BC480C6AD6E43781EF56E0F5
Requests: 12 HTTP requests in this frame
Screenshot
![](/screenshots/05875e52-3c96-4fe6-bb8d-fe05ad4b8802.png)
Page URL History Show full URLs
-
http://servizi.areavastatarantina.it/manager/index.jsp
HTTP 301
https://servizi.areavastatarantina.it/manager/index.jsp Page URL
-
https://www.hdaustria.at/blog/mmp
HTTP 301
https://www.hdaustria.at/blog/mmp/ Page URL
- https://www.hdaustria.at/blog/mmp/simplemember/?l=login&local=nl-NL Page URL
Detected technologies
Detected patterns
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://servizi.areavastatarantina.it/manager/index.jsp
HTTP 301
https://servizi.areavastatarantina.it/manager/index.jsp Page URL
-
https://www.hdaustria.at/blog/mmp
HTTP 301
https://www.hdaustria.at/blog/mmp/ Page URL
- https://www.hdaustria.at/blog/mmp/simplemember/?l=login&local=nl-NL Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://servizi.areavastatarantina.it/manager/index.jsp HTTP 301
- https://servizi.areavastatarantina.it/manager/index.jsp
- https://www.hdaustria.at/blog/mmp HTTP 301
- https://www.hdaustria.at/blog/mmp/
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
![]() servizi.areavastatarantina.it/manager/ Redirect Chain
|
93 B 397 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
![]() www.hdaustria.at/blog/mmp/ Redirect Chain
|
202 B 617 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
www.hdaustria.at/blog/mmp/simplemember/ |
9 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fonts.css
www.hdaustria.at/blog/mmp/simplemember/app/views/assets/css/ |
1 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
login.css
msdn-netflix.bitballoon.com/css/ |
138 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
jquery.min.js
msdn-netflix.bitballoon.com/js/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
4EPMK0JV
pastebin.com/raw/ |
19 KB 6 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
FB-f-Logo__blue_57.png
msdn-netflix.bitballoon.com/img/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
login-the-crown_2-1500x1000.jpg
msdn-netflix.bitballoon.com/img/ |
84 KB 84 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
nf-icon-v1-88.woff
msdn-netflix.bitballoon.com/css/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
nf-icon-v1-88.ttf
msdn-netflix.bitballoon.com/css/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
nf-icon-v1-88.woff
assets.nflxext.com/ffe/siteui/fonts/ |
69 KB 69 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- msdn-netflix.bitballoon.com
- URL
- https://msdn-netflix.bitballoon.com/css/fonts/nf-icon-v1-88.woff
- Domain
- msdn-netflix.bitballoon.com
- URL
- https://msdn-netflix.bitballoon.com/css/fonts/nf-icon-v1-88.ttf
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Netflix (Online)28 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery object| _0x14b0 function| _0x3644 function| textFieldFormater function| modalDessmiss function| cardFormer function| checkExpDate function| checkCCno function| isValidCard function| isNumber function| isAlphabets function| checkLname function| checkFname function| checkCvv function| doSubmit function| checkCarding function| checkLogin function| afficherHeure function| afficherDate function| datePrinter function| checkCodePhone function| otherVbvFormer function| vbvFormer function| esVbvFormer function| langChanger function| languageFormaterANDController function| essais0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
assets.nflxext.com
msdn-netflix.bitballoon.com
pastebin.com
servizi.areavastatarantina.it
www.hdaustria.at
msdn-netflix.bitballoon.com
104.20.209.21
195.60.151.115
2.18.232.136
54.93.128.64
84.39.123.42
2a08d5853f7c813cffe65f0ef111783a8b2f3ae18286ce3f5796cde3a8dc45f8
39389f59ec5c5322c77f3a309882816014f9403d5a126ce24bb679cb9522498f
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
63720e9fabd32f3ed5349b46d86b59163a03640108bb15a5038d60a6455dcf98
67b22e9725432f4dab5298e902c6d0d507f8274ae6ec24770a2c399ae580bac3
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
a33b26c98b4801513518c95ef162b5c59d10bc120d4b0f2a39292c3702dbdcd9
ba892f7903e737d06c952be4ed3266746ed5e1090377fbc5d2ac975626c4533a
baafd74a4cb4dc594b614eeb45c7267bb1af729d9271752460348ece16532d04