gal-phishing-tests.s3-website.eu-central-1.amazonaws.com Open in urlscan Pro
52.219.171.180 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ntflx.html
Submission: On April 03 via api (April 3rd 2023, 2:03:52 am UTC) from JP — Scanned from JP

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 14 HTTP transactions. The main IP is 52.219.171.180, located in Frankfurt am Main, Germany and belongs to AMAZON-02, US. The main domain is gal-phishing-tests.s3-website.eu-central-1.amazonaws.com.

This is the only time gal-phishing-tests.s3-website.eu-central-1.amazonaws.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address	AS Autonomous System
12	52.219.171.180 52.219.171.180	16509 (AMAZON-02) (AMAZON-02)
2	2a00:86c0:209... 2a00:86c0:2090::1	40027 (NETFLIX-ASN) (NETFLIX-ASN)
14	2

12 52.219.171.180 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: s3-website.eu-central-1.amazonaws.com

gal-phishing-tests.s3-website.eu-central-1.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:86c0:2090::1 (United States)

ASN40027 (NETFLIX-ASN, US)

assets.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	amazonaws.com gal-phishing-tests.s3-website.eu-central-1.amazonaws.com	1 MB
2	nflxext.com assets.nflxext.com — Cisco Umbrella Rank: 3919	157 KB
14	2

	Domain	Requested by
12	gal-phishing-tests.s3-website.eu-central-1.amazonaws.com	gal-phishing-tests.s3-website.eu-central-1.amazonaws.com
2	assets.nflxext.com	gal-phishing-tests.s3-website.eu-central-1.amazonaws.com
14	2

This site contains no links.

Subject Issuer	Validity	Valid
*.1.nflxso.net DigiCert Secure Site ECC CA-1	`2023-03-20` - `2023-04-20`	a month	crt.sh

This page contains 3 frames:

Primary Page: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ntflx.html
Frame ID: 24719ACD15083C66446D340799978CCE
Requests: 1 HTTP requests in this frame

Frame: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/
Frame ID: 162B635CD4AC7AF2F7AD6AEFE0FDE32E
Requests: 12 HTTP requests in this frame

Frame: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/xaOI6zd9HW9.html
Frame ID: F0F0B83BD9913C0EFA1851175FD4B9B8
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Parent title

Page Statistics

14
Requests

14 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

1438 kB
Transfer

1434 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request ntflx.html Show response gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/	360 B 694 B	531ms 277ms	Document text/html	52.219.171.180 AMAZON-02
General Check archive.org Show headers Download Go to Full URL http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ntflx.html Protocol HTTP/1.1 Server 52.219.171.180 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS s3-website.eu-central-1.amazonaws.com Software AmazonS3 / Resource Hash `453cb42bea6ee7a9e76e6441176bbc990d7dc38962b341d5b31675b1fc8e7912` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers Content-Length 360 Content-Type text/html Date Mon, 03 Apr 2023 02:03:47 GMT ETag "2171fe4bf081e10ad938862226e005d3" Last-Modified Wed, 13 Jul 2022 13:31:30 GMT Server AmazonS3 x-amz-id-2 XnLgmvndkV1j7mnwDBApxGuR2zHuV11c2g5OACgtLXnSn4gVX5z4NzaY2g7vKeG7yIR/sy5uv9Q= x-amz-request-id CCEQ5WTPSHM316GD
GET H/1.1	200 OK	/ Show response gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ Frame 162B	240 KB 241 KB	265ms 265ms	Document text/html	52.219.171.180 AMAZON-02
General Check archive.org Show headers Download Go to Full URL http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ Requested by Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ntflx.html Protocol HTTP/1.1 Server 52.219.171.180 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS s3-website.eu-central-1.amazonaws.com Software AmazonS3 / Resource Hash `53a882090787933350210770e49c74e0f80e5ffb75b7dc284955b92e896aafe6` Request headers Referer http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ntflx.html Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers Content-Length 246138 Content-Type text/html Date Mon, 03 Apr 2023 02:03:47 GMT ETag "8872dfc3088c8b216df3b77ce2de080f" Last-Modified Wed, 13 Jul 2022 13:31:11 GMT Server AmazonS3 x-amz-id-2 QEa2Hmwnb5Nd0/5zsy/9t0fgaB8waLNX6GDMwpPqHa9NwGuBa+h/MuMQV/9r0G9T029EpQX31Kk= x-amz-request-id CCESS076G82ECDBP
GET H/1.1	200 OK	none.js Show response gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/ Frame 162B	24 KB 25 KB	268ms 267ms	Script application/javascript	52.219.171.180 AMAZON-02
General Check archive.org Show headers Download Go to Full URL http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/none.js Requested by Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ Protocol HTTP/1.1 Server 52.219.171.180 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS s3-website.eu-central-1.amazonaws.com Software AmazonS3 / Resource Hash `36d6338e657cdef8022ef6782c4a709216a661166abaf141cd55e9286d774fda` Request headers accept-language jp-JP,jp;q=0.9 Referer http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Mon, 03 Apr 2023 02:03:48 GMT Last-Modified Wed, 13 Jul 2022 13:31:13 GMT Server AmazonS3 x-amz-request-id FQ437M362JKAZCJ0 ETag "ad3d9ad2c5b2c6efbc6423dba1de09d3" Content-Type application/javascript Content-Length 24871 x-amz-id-2 SKPxy57PKNJ+9OjWwKdycLMap77xkwfexBEM89Rbwbs6kATtyzrx9b+A1Op2dsu0sev9HpLTJJ0=
GET H/1.1	200 OK	none_002.js Show response gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/ Frame 162B	655 KB 655 KB	520ms 272ms	Script application/javascript	52.219.171.180 AMAZON-02
General Check archive.org Show headers Download Go to Full URL http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/none_002.js Requested by Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ Protocol HTTP/1.1 Server 52.219.171.180 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS s3-website.eu-central-1.amazonaws.com Software AmazonS3 / Resource Hash `abfe0e1b195380596a8d28abb2d472cc1cc670ac7f8a9582ca45bf3fb1b0950f` Request headers accept-language jp-JP,jp;q=0.9 Referer http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Mon, 03 Apr 2023 02:03:48 GMT Last-Modified Wed, 13 Jul 2022 13:31:13 GMT Server AmazonS3 x-amz-request-id FQ41C9BTA339QKNT ETag "de925e298f23668d274503b64f2449b8" Content-Type application/javascript Content-Length 670267 x-amz-id-2 7QLo5STUaGU3ioihWRn8MxxEPtWy7oCY16TkNKjudFdpjIa+bqa0MwcVtQID9Tp4idllwv9mddg=
GET H/1.1	403 Forbidden	WebsiteDetect.asc gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/ Frame 162B	0 0	511ms 268ms	Stylesheet text/html	52.219.171.180 AMAZON-02
General Check archive.org Show headers Download Go to Full URL http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/WebsiteDetect.asc Requested by Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ Protocol HTTP/1.1 Server 52.219.171.180 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS s3-website.eu-central-1.amazonaws.com Software AmazonS3 / Resource Hash Request headers accept-language jp-JP,jp;q=0.9 Referer http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Mon, 03 Apr 2023 02:03:46 GMT Server AmazonS3 x-amz-request-id FQ4EA7DSFKCJCWXC Content-Length 303 x-amz-id-2 hsPbmPQFmp1XyIhaahrTDbA8Y5izpqVS3m2GSYrVJ1vG+Bl+T0QL+voAApEPKM2Sauq8kxZedGs= Content-Type text/html; charset=utf-8
GET H/1.1	200 OK	sdk.js Show response gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/ Frame 162B	213 KB 214 KB	526ms 275ms	Script application/javascript	52.219.171.180 AMAZON-02
General Check archive.org Show headers Download Go to Full URL http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/sdk.js Requested by Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ Protocol HTTP/1.1 Server 52.219.171.180 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS s3-website.eu-central-1.amazonaws.com Software AmazonS3 / Resource Hash `d69b388d3d3c136484970f6ee5e1ebb2dfe51fbd4af2ea731d8de40cfce3816e` Request headers accept-language jp-JP,jp;q=0.9 Referer http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Mon, 03 Apr 2023 02:03:48 GMT Last-Modified Wed, 13 Jul 2022 13:31:14 GMT Server AmazonS3 x-amz-request-id FQ4C1VCCQ5CRG2D5 ETag "0c69f0ce076b2e2155d6c00f404d7b8f" Content-Type application/javascript Content-Length 218405 x-amz-id-2 RtgpgVL5R23YTbo0h7aV9YYe48yENRVvY+OZ+qm0CCTXW8dyjzgZOX2YO8SURpPiN0tFqmWjhfg=
GET H/1.1	200 OK	none.css gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/ Frame 162B	101 KB 102 KB	516ms 270ms	Stylesheet text/css	52.219.171.180 AMAZON-02
General Check archive.org Show headers Download Go to Full URL http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/none.css Requested by Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ Protocol HTTP/1.1 Server 52.219.171.180 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS s3-website.eu-central-1.amazonaws.com Software AmazonS3 / Resource Hash `601553a598f6c89f43b5f373d84fdf182db3af0acd6df215f9e4f62ee6c4dcb6` Request headers accept-language jp-JP,jp;q=0.9 Referer http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Mon, 03 Apr 2023 02:03:48 GMT Last-Modified Wed, 13 Jul 2022 13:31:13 GMT Server AmazonS3 x-amz-request-id FQ41GSY4EZB0FVVF ETag "33075e961185b732b5e74ad63516664c" Content-Type text/css Content-Length 103683 x-amz-id-2 wMNB/aIc01S2o7F+uny7HUZhCzLyBtY1kZB0kZk+zewvrSVKeZ5C6AqvM1jWoe3vDDgAvmKR+N8=
GET H/1.1	200 OK	FB-f-Logo__blue_57.png gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/ Frame 162B	1 KB 2 KB	274ms 273ms	Image image/png	52.219.171.180 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/FB-f-Logo__blue_57.png Requested by Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ Protocol HTTP/1.1 Server 52.219.171.180 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS s3-website.eu-central-1.amazonaws.com Software AmazonS3 / Resource Hash `3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece` Request headers accept-language jp-JP,jp;q=0.9 Referer http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Mon, 03 Apr 2023 02:03:49 GMT Last-Modified Wed, 13 Jul 2022 13:31:12 GMT Server AmazonS3 x-amz-request-id Q1S6D2HBHWN96T10 ETag "a33ca47ef110b6e3ec5086b8776407d3" Content-Type image/png Content-Length 1455 x-amz-id-2 6iG0SOPU0R4w8SH8SbQD5hg4i5P9zdqlxQhFafNM8+CKWHx3c5El+ZnW0HO9chrnynCbcQc5fVg=
GET H/1.1	403 Forbidden	WebsiteDetect Show response gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ichnaea/cl2/freeform/ Frame 162B	303 B 571 B	256ms 255ms	XHR text/html	52.219.171.180 AMAZON-02
General Check archive.org Show headers Download Go to Full URL http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ichnaea/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=js&modalView=login Requested by Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ Protocol HTTP/1.1 Server 52.219.171.180 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS s3-website.eu-central-1.amazonaws.com Software AmazonS3 / Resource Hash `926feb1e1bd6291036569a5ab0f6571ca5aa7091efaae382d8443cb153c1b0fb` Request headers accept-language jp-JP,jp;q=0.9 Referer http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Mon, 03 Apr 2023 02:03:48 GMT Server AmazonS3 x-amz-request-id Q1SB28826TKRJEQQ Content-Length 303 x-amz-id-2 Px6C4gcaR8Yud0S068mVqDgeoOEdYol/dyAatMq0PCEnz2Xrkm/8ahBiKHpscRm6AhLlIl8XlSc= Content-Type text/html; charset=utf-8
GET H/1.1	403 Forbidden	WebsiteScreen Show response gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ichnaea/cl2/freeform/ Frame 162B	303 B 571 B	258ms 257ms	XHR text/html	52.219.171.180 AMAZON-02
General Check archive.org Show headers Download Go to Full URL http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ichnaea/cl2/freeform/WebsiteScreen?source=wwwhead&fetchType=js&winw=1600&winh=1200&screenw=1600&screenh=1200&ratio=1 Requested by Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ Protocol HTTP/1.1 Server 52.219.171.180 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS s3-website.eu-central-1.amazonaws.com Software AmazonS3 / Resource Hash `352e5e93b2b56ae4a2d8721e5f44c249491d28717e09436805cba228cc36c61c` Request headers accept-language jp-JP,jp;q=0.9 Referer http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Mon, 03 Apr 2023 02:03:48 GMT Server AmazonS3 x-amz-request-id Q1SAZJRE1CJ4FGHP Content-Length 303 x-amz-id-2 avvqwf9FFKE2BYFMNIuEYSgzc220l2icqaFiy/T6bigydxMSdVFkL8Nb3cEnKB9eJDcuZ0RaNB8= Content-Type text/html; charset=utf-8
GET H/1.1	200 OK	login-the-crown_2-1500x1000.jpg assets.nflxext.com/ffe/siteui/acquisition/login/ Frame 162B	84 KB 85 KB	13ms 7ms	Image image/jpeg	2a00:86c0:2090::1 NETFLIX-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://assets.nflxext.com/ffe/siteui/acquisition/login/login-the-crown_2-1500x1000.jpg Requested by Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/none.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US), Reverse DNS Software nginx / Resource Hash `baafd74a4cb4dc594b614eeb45c7267bb1af729d9271752460348ece16532d04` Request headers accept-language jp-JP,jp;q=0.9 Referer http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Mon, 03 Apr 2023 02:03:48 GMT Last-Modified Mon, 24 Oct 2016 20:49:51 GMT Server nginx Content-MD5 5GY/BZWwL7HDlH/B8V64Eg== Content-Type image/jpeg Cache-Control max-age=604801 Connection keep-alive Accept-Ranges bytes Content-Length 86226 Expires Mon, 10 Apr 2023 02:03:49 GMT
GET H/1.1	200 OK	nf-icon-v1-93.woff assets.nflxext.com/ffe/siteui/fonts/ Frame 162B	72 KB 72 KB	5ms 1ms	Font font/woff	2a00:86c0:2090::1 NETFLIX-ASN
General Check archive.org Show headers Download Go to Full URL https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-93.woff Requested by Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/none.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US), Reverse DNS Software nginx / Resource Hash `98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d` Request headers Referer http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ Origin http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Mon, 03 Apr 2023 02:03:48 GMT Last-Modified Mon, 29 Jan 2018 01:50:51 GMT Server nginx Content-MD5 fPYVbMSBJEtaJUNi17c/AA== Content-Type font/woff Access-Control-Allow-Origin * Cache-Control max-age=604801 Connection keep-alive Accept-Ranges bytes Content-Length 73572 Expires Mon, 10 Apr 2023 02:03:49 GMT
GET H/1.1	200 OK	xaOI6zd9HW9.html Show response gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/ Frame F0F0	42 KB 42 KB	269ms 268ms	Document text/html	52.219.171.180 AMAZON-02
General Check archive.org Show headers Download Go to Full URL http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/xaOI6zd9HW9.html Requested by Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ Protocol HTTP/1.1 Server 52.219.171.180 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS s3-website.eu-central-1.amazonaws.com Software AmazonS3 / Resource Hash `d9013ca6d10e27a1c53881852fd9bc126a0f92eb0392f7138acae4bf8947e2f3` Request headers Referer http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers Content-Length 42738 Content-Type text/html Date Mon, 03 Apr 2023 02:03:50 GMT ETag "f061cabded8c9c295e49b9e27e2963a8" Last-Modified Wed, 13 Jul 2022 13:31:14 GMT Server AmazonS3 x-amz-id-2 GiZZecb2NP9duiKk2vI9ee91LfjdULySqU7vFvYDWw1xkRnm8+v8vnMthclJcaGPyu7IAsdEmbo= x-amz-request-id 9S0A4C9E0GASX7CS
POST H/1.1	405 Method Not Allowed	log Show response gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ichnaea/ Frame 162B	422 B 745 B	251ms 251ms	XHR text/html	52.219.171.180 AMAZON-02
General Check archive.org Show headers Download Go to Full URL http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ichnaea/log Requested by Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/none_002.js Protocol HTTP/1.1 Server 52.219.171.180 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS s3-website.eu-central-1.amazonaws.com Software AmazonS3 / Resource Hash `a020f2fe89cf3c5f2115ad8573c5c687db1f9d7bee3fdb2baafe3e9a821ba11f` Request headers Accept / X-Netflix.ichnaea.request.type UiRequest Referer http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ X-Requested-With XMLHttpRequest accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Content-Type application/json Response headers Date Mon, 03 Apr 2023 02:03:48 GMT Server AmazonS3 x-amz-request-id 9S01HGD9PEPVFENR Allow GET, HEAD, OPTIONS Content-Type text/html; charset=utf-8 Connection close Content-Length 422 x-amz-id-2 +KJiNVKuX1PUrWSOLcsqt1EIZe6TMMjAyEC775qoyyg/5VJnHpZhBjCLYgcwlQrcksQy/PPqai8=

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 boolean| credentialless

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/	1969-12-31 23:59:59	Name: cL Value: 1680487429019%7C168048742965472037%7C168048742911262324%7C%7C4%7CUNPYKR5TOVFFFKE6OU2YTRLYFY

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/WebsiteDetect.asc Message: Failed to load resource: the server responded with a status of 403 (Forbidden)
network	error	URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ichnaea/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=js&modalView=login Message: Failed to load resource: the server responded with a status of 403 (Forbidden)
network	error	URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ichnaea/cl2/freeform/WebsiteScreen?source=wwwhead&fetchType=js&winw=1600&winh=1200&screenw=1600&screenh=1200&ratio=1 Message: Failed to load resource: the server responded with a status of 403 (Forbidden)
network	error	URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ichnaea/log Message: Failed to load resource: the server responded with a status of 405 (Method Not Allowed)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.nflxext.com
gal-phishing-tests.s3-website.eu-central-1.amazonaws.com
2a00:86c0:2090::1
52.219.171.180
352e5e93b2b56ae4a2d8721e5f44c249491d28717e09436805cba228cc36c61c
36d6338e657cdef8022ef6782c4a709216a661166abaf141cd55e9286d774fda
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
453cb42bea6ee7a9e76e6441176bbc990d7dc38962b341d5b31675b1fc8e7912
53a882090787933350210770e49c74e0f80e5ffb75b7dc284955b92e896aafe6
601553a598f6c89f43b5f373d84fdf182db3af0acd6df215f9e4f62ee6c4dcb6
926feb1e1bd6291036569a5ab0f6571ca5aa7091efaae382d8443cb153c1b0fb
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
a020f2fe89cf3c5f2115ad8573c5c687db1f9d7bee3fdb2baafe3e9a821ba11f
abfe0e1b195380596a8d28abb2d472cc1cc670ac7f8a9582ca45bf3fb1b0950f
baafd74a4cb4dc594b614eeb45c7267bb1af729d9271752460348ece16532d04
d69b388d3d3c136484970f6ee5e1ebb2dfe51fbd4af2ea731d8de40cfce3816e
d9013ca6d10e27a1c53881852fd9bc126a0f92eb0392f7138acae4bf8947e2f3

gal-phishing-tests.s3-website.eu-central-1.amazonaws.com Open in urlscan Pro 52.219.171.180 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

14 Requests

14 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

1438 kBTransfer

1434 kBSize

1 Cookies

0 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

1 Cookies

4 Console Messages

Indicators

gal-phishing-tests.s3-website.eu-central-1.amazonaws.com Open in urlscan Pro
52.219.171.180 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

14 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

1438 kB
Transfer

1434 kB
Size

1
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!