![](/screenshots/158c2b57-89fc-4a1e-b9bc-aa6f0a27184f.png)
z4z2m-jiaaa-aaaad-qfo6a-cai.raw.icp0.io
Open in
urlscan Pro
2a00:fb01:400:200:5000:5aff:fef2:9428
Malicious Activity!
Public Scan
Submission: On July 18 via api from US — Scanned from DE
Summary
TLS certificate: Issued by R3 on June 19th 2023. Valid for: 3 months.
This is the only time z4z2m-jiaaa-aaaad-qfo6a-cai.raw.icp0.io was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Netflix (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 2a00:fb01:400... 2a00:fb01:400:200:5000:5aff:fef2:9428 | 24951 (EVERYWARE...) (EVERYWARE-NET) | |
12 | 2a00:86c0:209... 2a00:86c0:2090::1 | 40027 (NETFLIX-ASN) (NETFLIX-ASN) | |
1 | 2a00:86c0:4:4... 2a00:86c0:4:4::149 | 2906 (AS-SSI) (AS-SSI) | |
1 | 2a00:1450:400... 2a00:1450:4001:827::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:82b::2003 | 15169 (GOOGLE) (GOOGLE) | |
18 | 5 |
ASN24951 (EVERYWARE-NET, CH)
z4z2m-jiaaa-aaaad-qfo6a-cai.raw.icp0.io |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
nflxext.com
assets.nflxext.com — Cisco Umbrella Rank: 4129 |
814 KB |
2 |
gstatic.com
fonts.gstatic.com |
31 KB |
2 |
icp0.io
z4z2m-jiaaa-aaaad-qfo6a-cai.raw.icp0.io |
11 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 88 |
1 KB |
1 |
nflxso.net
occ-0-299-2773.1.nflxso.net |
263 KB |
18 | 5 |
Domain | Requested by | |
---|---|---|
12 | assets.nflxext.com |
z4z2m-jiaaa-aaaad-qfo6a-cai.raw.icp0.io
|
2 | fonts.gstatic.com |
fonts.googleapis.com
|
2 | z4z2m-jiaaa-aaaad-qfo6a-cai.raw.icp0.io |
z4z2m-jiaaa-aaaad-qfo6a-cai.raw.icp0.io
|
1 | fonts.googleapis.com |
z4z2m-jiaaa-aaaad-qfo6a-cai.raw.icp0.io
|
1 | occ-0-299-2773.1.nflxso.net |
z4z2m-jiaaa-aaaad-qfo6a-cai.raw.icp0.io
|
18 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
boundary.dfinity.network R3 |
2023-06-19 - 2023-09-17 |
3 months | crt.sh |
*.1.nflxso.net DigiCert Secure Site ECC CA-1 |
2023-06-28 - 2023-07-31 |
a month | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-07-03 - 2023-09-25 |
3 months | crt.sh |
*.gstatic.com GTS CA 1C3 |
2023-07-03 - 2023-09-25 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://z4z2m-jiaaa-aaaad-qfo6a-cai.raw.icp0.io/
Frame ID: 0C0923A233E1FF24F87C0AE44D927E85
Requests: 18 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
z4z2m-jiaaa-aaaad-qfo6a-cai.raw.icp0.io/ |
21 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
z4z2m-jiaaa-aaaad-qfo6a-cai.raw.icp0.io/ |
8 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tv.png
assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/ |
11 KB 11 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
device-pile.png
assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/ |
134 KB 134 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
AAAABYjXrxZKtrzxQRVQNn2aIByoomnlbXmJ-uBy7du8a5Si3xqIsgerTlwJZG1vMpqer2kvcILy0UJQnjfRUQ5cEr7gQlYqXfxUg7bz.png
occ-0-299-2773.1.nflxso.net/dnm/api/v6/19OhWN2dO19C9txTON9tvTFtefw/ |
263 KB 263 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mobile-0819.jpg
assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/ |
48 KB 49 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
boxshot.png
assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/ |
20 KB 20 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
video-tv-0819.m4v
assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/ |
79 KB 0 |
Media
video/x-m4v |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
video-devices.m4v
assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/ |
47 KB 0 |
Media
video/x-m4v |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
7 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
video-devices.m4v
assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/ |
4 KB 4 KB |
Media
video/x-m4v |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
video-tv-0819.m4v
assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/ |
8 KB 8 KB |
Media
video/x-m4v |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
video-tv-0819.m4v
assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/ |
232 KB 232 KB |
Media
video/x-m4v |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
video-devices.m4v
assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/ |
228 KB 0 |
Media
video/x-m4v |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
US-en-20230213-popsignuptwoweeks-perspective_alpha_website_large.jpg
assets.nflxext.com/ffe/siteui/vlv3/83e8c151-107d-4e8f-b95a-d2ba99d49bb9/7a0bd648-8238-4134-b486-e7ff5cbaa56e/ |
332 KB 333 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
download-icon.gif
assets.nflxext.com/ffe/siteui/acquisition/ourStory/fuji/desktop/ |
22 KB 22 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ |
15 KB 16 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ |
15 KB 15 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Netflix (Online)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| onbeforetoggle object| onscrollend0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
assets.nflxext.com
fonts.googleapis.com
fonts.gstatic.com
occ-0-299-2773.1.nflxso.net
z4z2m-jiaaa-aaaad-qfo6a-cai.raw.icp0.io
2a00:1450:4001:827::200a
2a00:1450:4001:82b::2003
2a00:86c0:2090::1
2a00:86c0:4:4::149
2a00:fb01:400:200:5000:5aff:fef2:9428
1539d357b1c2f6d1e95d9f3c568c0f694e9040bcee32f87f3ffa24f18d4b865d
216ee415e27391e75247a6e31acb1bcfc0b6a749176eb2a46dfceba38192516a
24ede00b4b90af99c4404eb7973d00fa14155db9d94e82235db5a22d7739b9f1
492fdebd363e40cbba153a244bcfe2a7f5f7cf20aff0805fe45d5c7e2180b875
4f99e4c2ed1c2b7de72f47102c64d601567f8efaad5944a08c86786cad4050e6
6b0ed1e5929282bbcc0a27f1405bad6f3606b81ff133614feed11dc5d588ffd4
81cf64888a7b3f6848b09695b034026d9ad685665b91d54597ecbb6197c6acbb
b68ea2c7bea397aa11fadb189ce7d83862baebaf03ece643eb5aa9fb5f755056
cb7a7577edde43b408524419fcd2c0e668dca10d2440252b88821b567fc1674d
d5e4168c549beeeb7946e688c11e8ebec9ae7d2d53fd20a1992660551b7b3668
e1ec9fb767c9d0a79492bea9c9ff79ebc44cf7d1862d6a013987b42aa2d649fa
e1fa26cc34fda574edc01d09e374d6f10735a3fa621bdde87c104ee15453d4b6
e26418c2785de6fc3d733095ede30ca4ff20f812d3da5232e09b59956e04786a
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615