urlscan.io logo urlscan.io
SecurityTrails logo

soipsychpersconca.cf Open in urlscan Pro
2606:4700:3035::681f:5dab  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://soipsychpersconca.cf/WldyNXVVS3g=/index.php
Submission Tags: @jcybersec_
Submission: On July 20 via api from GB
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 17 HTTP transactions. The main IP is 2606:4700:3035::681f:5dab, located in United States and belongs to CLOUDFLARENET, US. The main domain is soipsychpersconca.cf.
This is the only time soipsychpersconca.cf was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

IP Address AS Autonomous System
11 2606:4700:303... 13335 (CLOUDFLAR...)
2 2a00:86c0:209... 40027 (NETFLIX-ASN)
3 3 2a03:2880:f01... 32934 (FACEBOOK)
3 2a03:2880:f11... 32934 (FACEBOOK)
1 2a01:578:3::3... 16509 (AMAZON-02)
17 4
11    2606:4700:3035::681f:5dab (United States)

ASN13335 (CLOUDFLARENET, US)
soipsychpersconca.cf
2    2a00:86c0:2091::1 (United Kingdom)

ASN40027 (NETFLIX-ASN, US)
assets.nflxext.com
3    2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)
staticxx.facebook.com
3    2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)
www.facebook.com
1    2a01:578:3::3433:d00d (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
www.netflix.com
Domain Requested by
11 soipsychpersconca.cf soipsychpersconca.cf
3 www.facebook.com soipsychpersconca.cf
3 staticxx.facebook.com 3 redirects
2 assets.nflxext.com soipsychpersconca.cf
1 www.netflix.com soipsychpersconca.cf
17 5

This site contains links to these domains. Also see Links.

Domain
www.netflix.com
help.netflix.com
Subject Issuer Validity Valid
*.1.nflxso.net
DigiCert SHA2 Secure Server CA		 2020-07-02 -
2020-08-04		 a month crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2020-05-14 -
2020-08-05		 3 months crt.sh
www.netflix.com
DigiCert SHA2 Secure Server CA		 2020-01-13 -
2022-01-13		 2 years crt.sh

This page contains 5 frames:

Primary Page: http://soipsychpersconca.cf/WldyNXVVS3g=/index.php
Frame ID: 0106C3368F2F939BE0FF98875C333219
Requests: 13 HTTP requests in this frame

Frame: http://soipsychpersconca.cf/WldyNXVVS3g=/Netflix_files/xaOI6zd9HW9.html
Frame ID: 750D0A32B3D3C1F9B6990DB855D0B3DA
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42
Frame ID: C11A70E48FE454CCF5C2AE229D89F197
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42
Frame ID: DB79DB0CC302EC686F6208C99395F4FA
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/connect/ping?client_id=163114453728333&domain=soipsychpersconca.cf&origin=1&redirect_uri=http%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter%2Fr%2FxaOI6zd9HW9.js%3Fversion%3D42%23cb%3Df485bca4cae568%26domain%3Dsoipsychpersconca.cf%26origin%3Dhttp%253A%252F%252Fsoipsychpersconca.cf%252Ff39d4cb59e8b50c%26relation%3Dparent&response_type=token%2Csigned_request%2Ccode&sdk=joey&version=v2.9
Frame ID: C00A4C816726CA462B4C32FFD07853C2
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i
Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Page Statistics

17
Requests

35 %
HTTPS

100 %
IPv6

4
Domains

5
Subdomains

4
IPs

3
Countries

521 kB
Transfer

1434 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 11
  • http://staticxx.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42 HTTP 302
  • https://staticxx.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42 HTTP 302
  • https://www.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42
Request Chain 12
  • https://staticxx.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42 HTTP 302
  • https://www.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42

17 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set index.php
soipsychpersconca.cf/WldyNXVVS3g=/ 		240 KB
67 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://soipsychpersconca.cf/WldyNXVVS3g=/index.php
Protocol
HTTP/1.1
Server
2606:4700:3035::681f:5dab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
029bd18cc547f1e733302ff47b60b38c0c6d461c883c5fef546b3596602dfdef

Request headers

Host
soipsychpersconca.cf
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 20 Jul 2020 01:50:01 GMT
Content-Type
text/html; charset=UTF-8
Transfer-Encoding
chunked
Connection
keep-alive
Set-Cookie
__cfduid=db7d98535e2a0cd6af887b3dd0f3f5c861595209797; expires=Wed, 19-Aug-20 01:49:57 GMT; path=/; domain=.soipsychpersconca.cf; HttpOnly; SameSite=Lax
Vary
Accept-Encoding
CF-Cache-Status
DYNAMIC
cf-request-id
040b82e7e300002fa57a962200000001
Server
cloudflare
CF-RAY
5b5907530c152fa5-FRA
Content-Encoding
gzip
none.js
soipsychpersconca.cf/WldyNXVVS3g=/Netflix_files/ 		24 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://soipsychpersconca.cf/WldyNXVVS3g=/Netflix_files/none.js
Requested by
Host: soipsychpersconca.cf
URL: http://soipsychpersconca.cf/WldyNXVVS3g=/index.php
Protocol
HTTP/1.1
Server
2606:4700:3035::681f:5dab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
36d6338e657cdef8022ef6782c4a709216a661166abaf141cd55e9286d774fda

Request headers

Referer
http://soipsychpersconca.cf/WldyNXVVS3g=/index.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 20 Jul 2020 01:50:01 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
Last-Modified
Sat, 18 Jul 2020 21:47:59 GMT
Server
cloudflare
Age
1546
ETag
W/"5f136e0f-6127"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=14400
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
5b590768db40c28b-FRA
cf-request-id
040b82f5830000c28b8f9f4200000001
none_002.js
soipsychpersconca.cf/WldyNXVVS3g=/Netflix_files/ 		655 KB
191 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://soipsychpersconca.cf/WldyNXVVS3g=/Netflix_files/none_002.js
Requested by
Host: soipsychpersconca.cf
URL: http://soipsychpersconca.cf/WldyNXVVS3g=/index.php
Protocol
HTTP/1.1
Server
2606:4700:3035::681f:5dab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
abfe0e1b195380596a8d28abb2d472cc1cc670ac7f8a9582ca45bf3fb1b0950f

Request headers

Referer
http://soipsychpersconca.cf/WldyNXVVS3g=/index.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 20 Jul 2020 01:50:01 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
Last-Modified
Sat, 18 Jul 2020 21:47:59 GMT
Server
cloudflare
Age
1546
ETag
W/"5f136e0f-a3a3b"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=14400
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
5b590768cc4b0621-FRA
cf-request-id
040b82f58000000621faad1200000001
WebsiteDetect.asc
soipsychpersconca.cf/WldyNXVVS3g=/Netflix_files/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://soipsychpersconca.cf/WldyNXVVS3g=/Netflix_files/WebsiteDetect.asc
Requested by
Host: soipsychpersconca.cf
URL: http://soipsychpersconca.cf/WldyNXVVS3g=/index.php
Protocol
HTTP/1.1
Server
2606:4700:3035::681f:5dab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
http://soipsychpersconca.cf/WldyNXVVS3g=/index.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 20 Jul 2020 01:50:06 GMT
Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
Server
cloudflare
Transfer-Encoding
chunked
Content-Type
text/html; charset=iso-8859-1
Connection
keep-alive
CF-RAY
5b590768ce18dfff-FRA
cf-request-id
040b82f57f0000dfff53266200000001
sdk.js
soipsychpersconca.cf/WldyNXVVS3g=/Netflix_files/ 		213 KB
64 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://soipsychpersconca.cf/WldyNXVVS3g=/Netflix_files/sdk.js
Requested by
Host: soipsychpersconca.cf
URL: http://soipsychpersconca.cf/WldyNXVVS3g=/index.php
Protocol
HTTP/1.1
Server
2606:4700:3035::681f:5dab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d69b388d3d3c136484970f6ee5e1ebb2dfe51fbd4af2ea731d8de40cfce3816e

Request headers

Referer
http://soipsychpersconca.cf/WldyNXVVS3g=/index.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 20 Jul 2020 01:50:01 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
Last-Modified
Sat, 18 Jul 2020 21:47:59 GMT
Server
cloudflare
Age
1546
ETag
W/"5f136e0f-35525"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=14400
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
5b590768cb78324c-FRA
cf-request-id
040b82f5800000324cdd35c200000001
none.css
soipsychpersconca.cf/WldyNXVVS3g=/Netflix_files/ 		101 KB
17 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://soipsychpersconca.cf/WldyNXVVS3g=/Netflix_files/none.css
Requested by
Host: soipsychpersconca.cf
URL: http://soipsychpersconca.cf/WldyNXVVS3g=/index.php
Protocol
HTTP/1.1
Server
2606:4700:3035::681f:5dab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
601553a598f6c89f43b5f373d84fdf182db3af0acd6df215f9e4f62ee6c4dcb6

Request headers

Referer
http://soipsychpersconca.cf/WldyNXVVS3g=/index.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 20 Jul 2020 01:50:01 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
Last-Modified
Sat, 18 Jul 2020 21:47:59 GMT
Server
cloudflare
Age
1546
ETag
W/"5f136e0f-19503"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
max-age=14400
Transfer-Encoding
chunked
Connection
keep-alive
CF-RAY
5b590768cde6977e-FRA
cf-request-id
040b82f5800000977e66afd200000001
FB-f-Logo__blue_57.png
soipsychpersconca.cf/WldyNXVVS3g=/Netflix_files/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://soipsychpersconca.cf/WldyNXVVS3g=/Netflix_files/FB-f-Logo__blue_57.png
Requested by
Host: soipsychpersconca.cf
URL: http://soipsychpersconca.cf/WldyNXVVS3g=/index.php
Protocol
HTTP/1.1
Server
2606:4700:3035::681f:5dab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece

Request headers

Referer
http://soipsychpersconca.cf/WldyNXVVS3g=/index.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 20 Jul 2020 01:50:01 GMT
CF-Cache-Status
HIT
Last-Modified
Sat, 18 Jul 2020 21:47:59 GMT
Server
cloudflare
Age
1545
ETag
"5f136e0f-5af"
Vary
Accept-Encoding
Content-Type
image/png
Cache-Control
max-age=14400
Connection
keep-alive
Accept-Ranges
bytes
CF-RAY
5b5907690ca00621-FRA
Content-Length
1455
cf-request-id
040b82f5a800000621faad2200000001
WebsiteDetect
soipsychpersconca.cf/ichnaea/cl2/freeform/ 		282 B
726 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://soipsychpersconca.cf/ichnaea/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=js&modalView=login
Requested by
Host: soipsychpersconca.cf
URL: http://soipsychpersconca.cf/WldyNXVVS3g=/index.php
Protocol
HTTP/1.1
Server
2606:4700:3035::681f:5dab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fcd7a4fca77e29944f03fe97482f3da077c7f16ff4778b365c442221714a7141

Request headers

Referer
http://soipsychpersconca.cf/WldyNXVVS3g=/index.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 20 Jul 2020 01:50:12 GMT
Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
Server
cloudflare
Transfer-Encoding
chunked
Content-Type
text/html; charset=iso-8859-1
Connection
keep-alive
CF-RAY
5b59078d1a1adfff-FRA
cf-request-id
040b830c2e0000dfff53373200000001
WebsiteScreen
soipsychpersconca.cf/ichnaea/cl2/freeform/ 		282 B
726 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://soipsychpersconca.cf/ichnaea/cl2/freeform/WebsiteScreen?source=wwwhead&fetchType=js&winw=1600&winh=1200&screenw=1600&screenh=1200&ratio=1
Requested by
Host: soipsychpersconca.cf
URL: http://soipsychpersconca.cf/WldyNXVVS3g=/index.php
Protocol
HTTP/1.1
Server
2606:4700:3035::681f:5dab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fcd7a4fca77e29944f03fe97482f3da077c7f16ff4778b365c442221714a7141

Request headers

Referer
http://soipsychpersconca.cf/WldyNXVVS3g=/index.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 20 Jul 2020 01:50:11 GMT
Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
Server
cloudflare
Transfer-Encoding
chunked
Content-Type
text/html; charset=iso-8859-1
Connection
keep-alive
CF-RAY
5b59078d1a8d2fa5-FRA
cf-request-id
040b830c2e00002fa57aad8200000001
login-the-crown_2-1500x1000.jpg
assets.nflxext.com/ffe/siteui/acquisition/login/ 		84 KB
85 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.nflxext.com/ffe/siteui/acquisition/login/login-the-crown_2-1500x1000.jpg
Requested by
Host: soipsychpersconca.cf
URL: http://soipsychpersconca.cf/WldyNXVVS3g=/index.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a00:86c0:2091::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
baafd74a4cb4dc594b614eeb45c7267bb1af729d9271752460348ece16532d04

Request headers

Referer
http://soipsychpersconca.cf/WldyNXVVS3g=/Netflix_files/none.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Mon, 20 Jul 2020 01:50:06 GMT
Last-Modified
Mon, 24 Oct 2016 20:49:51 GMT
Server
nginx
Content-MD5
5GY/BZWwL7HDlH/B8V64Eg==
Content-Type
image/jpeg
Cache-Control
public, max-age=6182
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
86226
Expires
Wed, 15 Jul 2020 21:48:12 GMT
nf-icon-v1-93.woff
assets.nflxext.com/ffe/siteui/fonts/ 		72 KB
72 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-93.woff
Requested by
Host: soipsychpersconca.cf
URL: http://soipsychpersconca.cf/WldyNXVVS3g=/index.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a00:86c0:2091::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
http://soipsychpersconca.cf/WldyNXVVS3g=/Netflix_files/none.css
Origin
http://soipsychpersconca.cf

Response headers

Date
Mon, 20 Jul 2020 01:50:06 GMT
Content-Encoding
gzip
Last-Modified
Mon, 29 Jan 2018 01:50:51 GMT
Server
nginx
Content-MD5
fPYVbMSBJEtaJUNi17c/AA==
Content-Type
text/plain
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=9402
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
73566
Expires
Tue, 14 Jul 2020 21:52:16 GMT
Cookie set xaOI6zd9HW9.html
soipsychpersconca.cf/WldyNXVVS3g=/Netflix_files/ Frame 750D 		42 KB
14 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://soipsychpersconca.cf/WldyNXVVS3g=/Netflix_files/xaOI6zd9HW9.html
Requested by
Host: soipsychpersconca.cf
URL: http://soipsychpersconca.cf/WldyNXVVS3g=/index.php
Protocol
HTTP/1.1
Server
2606:4700:3035::681f:5dab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d9013ca6d10e27a1c53881852fd9bc126a0f92eb0392f7138acae4bf8947e2f3

Request headers

Host
soipsychpersconca.cf
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer
http://soipsychpersconca.cf/WldyNXVVS3g=/index.php
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Cookie
cL=1595209806973%7C159520980627417999%7C159520980610372636%7C%7C4%7CUNPYKR5TOVFFFKE6OU2YTRLYFY
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
http://soipsychpersconca.cf/WldyNXVVS3g=/index.php

Response headers

Date
Mon, 20 Jul 2020 01:50:13 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
Set-Cookie
__cfduid=d398a5eedd59c5efb4a6cd1f104d357ef1595209807; expires=Wed, 19-Aug-20 01:50:07 GMT; path=/; domain=.soipsychpersconca.cf; HttpOnly; SameSite=Lax
Last-Modified
Sat, 18 Jul 2020 21:47:59 GMT
Vary
Accept-Encoding
CF-Cache-Status
DYNAMIC
cf-request-id
040b830cdc00000621fa82a200000001
Server
cloudflare
CF-RAY
5b59078e2b070621-FRA
Content-Encoding
gzip
xaOI6zd9HW9.js
www.facebook.com/connect/xd_arbiter/r/ Frame C11A
Redirect Chain
  • http://staticxx.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42
  • https://staticxx.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42
  • https://www.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42
Requested by
Host: soipsychpersconca.cf
URL: http://soipsychpersconca.cf/WldyNXVVS3g=/Netflix_files/sdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

:method
GET
:authority
www.facebook.com
:scheme
https
:path
/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
http://soipsychpersconca.cf/WldyNXVVS3g=/index.php
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
about:blank

Response headers

status
404
cache-control
private, no-cache, no-store, must-revalidate
expires
Sat, 01 Jan 2000 00:00:00 GMT
pragma
no-cache
strict-transport-security
max-age=15552000; preload
x-content-type-options
nosniff
content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
x-xss-protection
0
x-frame-options
DENY
content-type
text/html; charset="utf-8"
x-fb-debug
h3HPRpxVJ8GiMnQNzQFTvOdn5c8L4d53hYoQ59xqw2bVji6RAhTYW/B4CcSd/50LBUvDcfx6iS2nAPWtqdhUNg==
content-length
72
date
Mon, 20 Jul 2020 01:50:07 GMT
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

Redirect headers

status
302
location
https://www.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42
strict-transport-security
max-age=15552000; preload
content-type
text/html; charset="utf-8"
x-fb-debug
kslx562sERBOynxNaYRWk5QJ/qvDHZE8hpyOKEG4LXBnXjjAIipXUcbE3pgUeYuRjJ1c3euOUevT+vIL/a6acQ==
content-length
0
x-fb-trip-id
2011651281
date
Mon, 20 Jul 2020 01:50:07 GMT
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
xaOI6zd9HW9.js
www.facebook.com/connect/xd_arbiter/r/ Frame DB79
Redirect Chain
  • https://staticxx.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42
  • https://www.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42
Requested by
Host: soipsychpersconca.cf
URL: http://soipsychpersconca.cf/WldyNXVVS3g=/Netflix_files/sdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

:method
GET
:authority
www.facebook.com
:scheme
https
:path
/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
http://soipsychpersconca.cf/WldyNXVVS3g=/index.php
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
about:blank

Response headers

status
404
cache-control
private, no-cache, no-store, must-revalidate
expires
Sat, 01 Jan 2000 00:00:00 GMT
pragma
no-cache
strict-transport-security
max-age=15552000; preload
x-content-type-options
nosniff
content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
x-xss-protection
0
x-frame-options
DENY
content-type
text/html; charset="utf-8"
x-fb-debug
yci2YMlIFPa/0rltyVdCLAdd+6U8eCBUdRhJsLsReI1aDRQbMlxOQA+40Yf/UjI7cNtTjbDDENDIchM9hX6lLQ==
content-length
72
date
Mon, 20 Jul 2020 01:50:07 GMT
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600

Redirect headers

status
302
location
https://www.facebook.com/connect/xd_arbiter/r/xaOI6zd9HW9.js?version=42
strict-transport-security
max-age=15552000; preload
content-type
text/html; charset="utf-8"
x-fb-debug
ArEUxZGX3n99HG5z2USz/594bNNAKxI3E4C7rmOGv5RRj3IEK7xGIl1XnYZg5snh8hZmSrFbm9YSRj7Ed2EbpQ==
content-length
0
x-fb-trip-id
2011651281
date
Mon, 20 Jul 2020 01:50:07 GMT
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
ping
www.facebook.com/connect/ Frame C00A 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/connect/ping?client_id=163114453728333&domain=soipsychpersconca.cf&origin=1&redirect_uri=http%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter%2Fr%2FxaOI6zd9HW9.js%3Fversion%3D42%23cb%3Df485bca4cae568%26domain%3Dsoipsychpersconca.cf%26origin%3Dhttp%253A%252F%252Fsoipsychpersconca.cf%252Ff39d4cb59e8b50c%26relation%3Dparent&response_type=token%2Csigned_request%2Ccode&sdk=joey&version=v2.9
Requested by
Host: soipsychpersconca.cf
URL: http://soipsychpersconca.cf/WldyNXVVS3g=/Netflix_files/sdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
www.facebook.com
:scheme
https
:path
/connect/ping?client_id=163114453728333&domain=soipsychpersconca.cf&origin=1&redirect_uri=http%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter%2Fr%2FxaOI6zd9HW9.js%3Fversion%3D42%23cb%3Df485bca4cae568%26domain%3Dsoipsychpersconca.cf%26origin%3Dhttp%253A%252F%252Fsoipsychpersconca.cf%252Ff39d4cb59e8b50c%26relation%3Dparent&response_type=token%2Csigned_request%2Ccode&sdk=joey&version=v2.9
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
http://soipsychpersconca.cf/WldyNXVVS3g=/index.php
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
http://soipsychpersconca.cf/WldyNXVVS3g=/index.php

Response headers

status
200
cache-control
private, no-cache, no-store, must-revalidate
pragma
no-cache
strict-transport-security
max-age=15552000; preload
content-encoding
br
content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
expires
Sat, 01 Jan 2000 00:00:00 GMT
content-type
text/html; charset="utf-8"
x-fb-debug
F4Y0MvTr+8ySNXxK4eUkp8p1yeHs3IQhuOUT0ZERvnwe0T7vCezeqLgEK+TCqrz93l3UONkdzq95uoF11tbXcA==
date
Mon, 20 Jul 2020 01:50:07 GMT
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
log
soipsychpersconca.cf/ichnaea/ 		282 B
726 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://soipsychpersconca.cf/ichnaea/log
Requested by
Host: soipsychpersconca.cf
URL: http://soipsychpersconca.cf/WldyNXVVS3g=/Netflix_files/none_002.js
Protocol
HTTP/1.1
Server
2606:4700:3035::681f:5dab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fcd7a4fca77e29944f03fe97482f3da077c7f16ff4778b365c442221714a7141

Request headers

Accept
*/*
Referer
http://soipsychpersconca.cf/WldyNXVVS3g=/index.php
X-Netflix.ichnaea.request.type
UiRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
X-Requested-With
XMLHttpRequest
Content-Type
application/json

Response headers

Date
Mon, 20 Jul 2020 01:50:13 GMT
Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
Server
cloudflare
Transfer-Encoding
chunked
Content-Type
text/html; charset=iso-8859-1
Connection
keep-alive
CF-RAY
5b59078e5f62324c-FRA
cf-request-id
040b830cf80000324cdd05a200000001
cl2
www.netflix.com/ichnaea/ 		0
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.netflix.com/ichnaea/cl2
Requested by
Host: soipsychpersconca.cf
URL: http://soipsychpersconca.cf/WldyNXVVS3g=/Netflix_files/none_002.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a01:578:3::3433:d00d Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
clingest-secure i-015cdb0593cd111f7 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
http://soipsychpersconca.cf/WldyNXVVS3g=/index.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/json

Response headers

Date
Mon, 20 Jul 2020 01:50:11 GMT
Via
1.1 i-0fa328746e239d218 (eu-west-1)
X-Content-Type-Options
nosniff
X-Netflix_proxy_execution-time
7
Connection
keep-alive
Content-Length
0
X-XSS-Protection
1; mode=block
Pragma
no-cache
Allow
GET, POST, OPTIONS
Server
clingest-secure i-015cdb0593cd111f7
X-Frame-Options
DENY
X-Netflix_nfstatus
1_1
Strict-Transport-Security
max-age=31536000
Access-Control-Allow-Methods
GET, POST, OPTIONS
X-Originating-URL
https://www.netflix.com/ichnaea/cl2
Access-Control-Allow-Origin
http://soipsychpersconca.cf
Cache-Control
no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials
true
X-Ichnaea
~0=true~RL=0
Access-Control-Allow-Headers
Accept,Authorization,Content-Type,Cookie,debugRequest,X-Netflix.application.name,X-Netflix.application.version,X-Netflix.certification.version,X-Netflix.Client.Request.Name,X-Netflix.device.type,X-Netflix.esn,X-Netflix.ichnaea.request.type,X-Netflix.oauth.consumer.key,X-Netflix.oauth.token,X-Netflix.request.uuid,X-Netflix.user.id
Expires
0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| FB object| netflix object| Codex object| C object| global object| process object| __core-js_shared__ object| util function| jQuery object| jQuery111105374031688691447 function| fbAsyncInit

1 Cookies

Domain/Path Name / Value
.soipsychpersconca.cf/ Name: __cfduid
Value: d398a5eedd59c5efb4a6cd1f104d357ef1595209807