ams-business-7.hostwindsdns.com
Open in
urlscan Pro
192.236.176.147
Malicious Activity!
Public Scan
Submission: On April 22 via automatic, source openphish
Summary
TLS certificate: Issued by COMODO RSA Domain Validation Secure S... on July 8th 2017. Valid for: 3 years.
This is the only time ams-business-7.hostwindsdns.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Netflix (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
9 | 192.236.176.147 192.236.176.147 | 54290 (HOSTWINDS) (HOSTWINDS) | |
6 | 2a00:86c0:209... 2a00:86c0:2091::1 | 40027 (NETFLIX-ASN) (NETFLIX-ASN) | |
2 | 2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3 | 32934 (FACEBOOK) (FACEBOOK) | |
1 | 2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de | 32934 (FACEBOOK) (FACEBOOK) | |
18 | 4 |
ASN54290 (HOSTWINDS, US)
PTR: amsbs13.hostwindsdns.com
ams-business-7.hostwindsdns.com |
ASN40027 (NETFLIX-ASN, US)
codex.nflxext.com | |
assets.nflxext.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
hostwindsdns.com
ams-business-7.hostwindsdns.com |
108 KB |
6 |
nflxext.com
codex.nflxext.com assets.nflxext.com |
654 KB |
2 |
facebook.net
connect.facebook.net |
117 KB |
1 |
facebook.com
www.facebook.com |
|
18 | 4 |
Domain | Requested by | |
---|---|---|
9 | ams-business-7.hostwindsdns.com |
ams-business-7.hostwindsdns.com
codex.nflxext.com |
3 | assets.nflxext.com |
ams-business-7.hostwindsdns.com
|
3 | codex.nflxext.com |
ams-business-7.hostwindsdns.com
|
2 | connect.facebook.net |
codex.nflxext.com
connect.facebook.net |
1 | www.facebook.com |
connect.facebook.net
|
18 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
help.netflix.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.hostwindsdns.com COMODO RSA Domain Validation Secure Server CA |
2017-07-08 - 2020-07-07 |
3 years | crt.sh |
*.1.nflxso.net DigiCert SHA2 Secure Server CA |
2020-04-01 - 2020-05-03 |
a month | crt.sh |
*.facebook.com DigiCert SHA2 High Assurance Server CA |
2020-03-01 - 2020-05-30 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://ams-business-7.hostwindsdns.com/~tupxyyaq/netflix/
Frame ID: 877DD8684838398E5F407C00E1977285
Requests: 18 HTTP requests in this frame
2 Outgoing links
These are links going to different origins than the main page.
Title: Nutzungsbedingungen
Search URL Search Domain Scan URL
Title: Datenschutzerklärung
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
ams-business-7.hostwindsdns.com/~tupxyyaq/netflix/ |
315 KB 73 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
none
codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-js-v8a213ece/js/js/bootstrap.js,common%7Cbootstrap.js/2/4N024p4o4a4r0b4d464w4M050q004O4u4j4y4s4H4e4x4m4A090X014J/bck/true/ |
9 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
none
codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-js-v8a213ece/js/js/components%7Clogin%7CloginControllerClient.js/2/4N024p4o4a4r0b4d464w4M050q004O4u4j4y4s4H4e4x4m4A090X014J/l/true/ |
720 KB 222 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WebsiteDetect
ams-business-7.hostwindsdns.com/personalization/cl2/freeform/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
none
codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-css-v8a213ece/css/css/less%7Clogin%7CloginBase.less,less%7Cpages%7Clogin%7CLogin.less/1/PBIasD3zCh9HNO/none/true/ |
158 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
AT-de-20190916-popsignuptwoweeks-perspective_alpha_website_large.jpg
assets.nflxext.com/ffe/siteui/vlv3/296ad965-b50d-4897-b294-2bc6b56246d8/0fddbd1b-9cdf-4963-9578-bd36f321b65c/ |
329 KB 329 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
FB-f-Logo__blue_57.png
assets.nflxext.com/ffe/siteui/login/images/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WebsiteDetect
ams-business-7.hostwindsdns.com/personalization/cl2/freeform/ |
10 KB 5 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WebsiteScreen
ams-business-7.hostwindsdns.com/personalization/cl2/freeform/ |
10 KB 5 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nf-icon-v1-93.woff
assets.nflxext.com/ffe/siteui/fonts/ |
72 KB 72 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sdk.js
connect.facebook.net/de_AT/ |
3 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
log
ams-business-7.hostwindsdns.com/personalization/ |
10 KB 5 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sdk.js
connect.facebook.net/en_US/ |
394 KB 115 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
status
www.facebook.com/x/oauth/ |
0 0 |
Fetch
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
cl2
ams-business-7.hostwindsdns.com/personalization/ |
10 KB 5 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
cl2
ams-business-7.hostwindsdns.com/personalization/ |
10 KB 5 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
cl2
ams-business-7.hostwindsdns.com/personalization/ |
10 KB 5 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
cl2
ams-business-7.hostwindsdns.com/personalization/ |
10 KB 5 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Netflix (Online)12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate object| netflix object| Codex object| C object| global object| process object| util function| jQuery object| jQuery111108015442137553803 function| fbAsyncInit object| FB2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.ams-business-7.hostwindsdns.com/ | Name: cL Value: 1587560507682%7C158756050743404373%7C158756050783555972%7C%7C4%7Cnull |
|
ams-business-7.hostwindsdns.com/ | Name: PHPSESSID Value: 88tb2fbdjom9faqfhfguhjm715 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ams-business-7.hostwindsdns.com
assets.nflxext.com
codex.nflxext.com
connect.facebook.net
www.facebook.com
192.236.176.147
2a00:86c0:2091::1
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
0e86b2c3bcf6be3136e91476eb811ea5a09b2b6d78b5125dbe9fabd04bbf24fa
1246bfed219745de85cc6ac9c38394f3e017de00a112b64a4aa0664a9468880a
1e078504e5db4aa0cbe60b1b01bab963a9eda506618a343a02c60b2711099d3d
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
45e32bd8adb153a0ecc4b0e37323924856d45d8e228cfa84063904333775400b
5de45d2ff1e3fd873234fa24a3b4c942909dd1a4ebdfa626bb02d1dff934c04f
5f708b4e7f04b9b363af88fb47e3fc2307ab7139b7212c670d71e232835cf6ee
6d39f7691d2f0376d314315eb4b408c2c4abc250f875837226abb432c6ed5c23
7ce1f8f6e443d599093a4e181bb5e5e8cf7ba37968a10941f595a57d3db29918
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
9c9ef87e2010a7807d0feac8198d8516829d0ea1498ef1694d4f1d039d73b464
c8ee96e2e7390a2f2e3b8a4465a47b4fb64786e69b6aafb0fac82007c3c6830c
dfd3751ae3b1e1ad0daf621265db930a88bf952d09ff7ac8f87d6a2f82163a6d
f1c613c48b89e74edec48c9caf417aab528e9f13b8386c5675c462fa0c1370c5