nextdede.us Open in urlscan Pro
2606:4700:3031::6815:3946 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://nextdede.us/
Submission: On March 15 via api (March 15th 2024, 3:17:39 pm UTC) from US — Scanned from US

Summary HTTP 13 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 5 IPs in 1 countries across 5 domains to perform 13 HTTP transactions. The main IP is 2606:4700:3031::6815:3946, located in United States and belongs to CLOUDFLARENET, US. The main domain is nextdede.us.
TLS certificate: Issued by E1 on March 15th 2024. Valid for: 3 months.

This is the only time nextdede.us was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address	AS Autonomous System
8	2606:4700:303... 2606:4700:3031::6815:3946	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2607:f8b0:400... 2607:f8b0:4004:c09::5f	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4004:c08::61	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4004:c1d::8b	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4004:c1d::5e	15169 (GOOGLE) (GOOGLE)
13	5

8 2606:4700:3031::6815:3946 (United States)

ASN13335 (CLOUDFLARENET, US)

nextdede.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c09::5f (Washington, United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c08::61 (Washington, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4004:c1d::8b (Washington, United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c1d::5e (Washington, United States)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	nextdede.us nextdede.us	899 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 36	287 B
1	gstatic.com fonts.gstatic.com	19 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 43	94 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 38	1 KB
13	5

	Domain	Requested by
8	nextdede.us	nextdede.us
2	www.google-analytics.com	www.googletagmanager.com
1	fonts.gstatic.com	fonts.googleapis.com
1	www.googletagmanager.com	nextdede.us
1	fonts.googleapis.com	client
13	5

This site contains links to these domains. Also see Links.

Domain
discord.gg
t.me

Subject Issuer	Validity	Valid
nextdede.us E1	`2024-03-15` - `2024-06-13`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://nextdede.us/
Frame ID: B7114210B82F5C51C6E3D5A263E7AE90
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Nextdede - Películas y Series de TV Online

Detected technologies

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Page Statistics

13
Requests

100 %
HTTPS

100 %
IPv6

5
Domains

5
Subdomains

5
IPs

1
Countries

1014 kB
Transfer

1907 kB
Size

4
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://discord.gg/ueWBrS2QCp
Title: Únete a nuestro Discord

Search URL Search Domain Scan URL

URL: https://t.me/+U5f5Z975UFqjFTGK
Title: Únete a nuestro Telegram

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
nextdede.us/ 173 KB
49 KB 1363ms
1290ms Document
text/html 2606:4700:3031::6815:3946
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nextdede.us/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::6815:3946 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/8.0.28 PleskLin
Resource Hash: bc836b4831a6d8cf9bf5197a7bc7c8c4186d516639861e025b65352789f0e179

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 864d78837a899abd-MIA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Fri, 15 Mar 2024 15:17:32 GMT
expires: -1
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A5hC5ul8RlYBCeXjqPO19fn%2B%2FaV%2Ft3BaG%2FN06mvx%2Fx%2F3F0Cws8pbb0YDXO7UF1LeLMbzW0qZYIEa50flKW2gnTJjcSv09Q5hy6hEi9n3juLFVaZTlyXzYKH2J4TijONMhUbD%2BiXldy8YBA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: bootstrap;desc="Bootstrap";dur=599.02286529541, app;desc="App";dur=190, total;desc="Total";dur=790.14301300049,
vary: Accept-Encoding
x-powered-by: PHP/8.0.28 PleskLin

GET
H2 200 main-0d87d2da.css
nextdede.us/build/assets/ 95 KB
17 KB 507ms
506ms Stylesheet
text/css 2606:4700:3031::6815:3946
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nextdede.us/build/assets/main-0d87d2da.css
Requested by: Host: nextdede.us
URL: https://nextdede.us/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::6815:3946 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 0d87d2da8dfc09e72221a9e751c8f63ad7a3db5924156e3cb1a90b83d6429a89

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nextdede.us/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Fri, 15 Mar 2024 15:17:33 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Wed, 31 Jan 2024 18:47:54 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"65ba95da-17adf"
x-powered-by: PleskLin
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KUqnOwOuSZhc1wtX1VUfUCVwmzA%2BugdRl1Ta7FXv%2B0VgMI839gggyHHavGICRdrpR0eJZX6ude3X73YlvlyMmdvi00idS1l%2B6od9Al8eI1OqEnEKJ%2FMggwBoNrTtcphYwrZ0i60BIQHaHg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 864d788e5d4d9abd-MIA
alt-svc: h3=":443"; ma=86400

GET
H2 200 main-1a65f1a2.js Show response
nextdede.us/build/assets/ 752 KB
249 KB 913ms
912ms Script
application/javascript 2606:4700:3031::6815:3946
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://nextdede.us/build/assets/main-1a65f1a2.js
Requested by: Host: nextdede.us
URL: https://nextdede.us/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::6815:3946 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: f6499c183441d498b3359851192a26230964fba2e403dd8a830151335698e121

Request headers

Referer
Origin: https://nextdede.us
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Fri, 15 Mar 2024 15:17:33 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Wed, 31 Jan 2024 18:47:55 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"65ba95db-bc0b0"
x-powered-by: PleskLin
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0BTtD6I7T5z4IU201XM%2BUbWCAnN0I4lK8waxIpii9%2BMw3aEeZpZYULw3F0C%2FMgedJdxnQl01oXemPdodd849oKhO7hkzTBpgO9UB2Apb84tIYiWxfiesXR5vkGX2Kv9QAudTyOoAFh8HAw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 864d788e5d529abd-MIA
alt-svc: h3=":443"; ma=86400

GET
H2 200 css2
fonts.googleapis.com/ 4 KB
1 KB 182ms
76ms Stylesheet
text/css 2607:f8b0:4004:c09::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=K2D&family=Rubik&display=swap

Requested by

Host: client
URL: about:client

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::5f Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c859554e6f183410db772f18b40d080a76314413dabe0dacda6bd0e7faa6f7b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nextdede.us/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 15 Mar 2024 15:17:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 15 Mar 2024 15:17:32 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 15 Mar 2024 15:17:32 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 282 KB
94 KB 201ms
88ms Script
application/javascript 2607:f8b0:4004:c08::61
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-CMPW4J3PSF

Requested by

Host: nextdede.us
URL: https://nextdede.us/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::61 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2e6f0c87f28ec6f7cc6d9a492d9ff1f1c35ac25a13fd1a847bb946b2f7973b30

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nextdede.us/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Fri, 15 Mar 2024 15:17:33 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 96343
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Fri, 15 Mar 2024 15:17:33 GMT

POST
H2 204 collect
www.google-analytics.com/g/ 0
242 B 172ms
60ms Ping
text/plain 2607:f8b0:4004:c1d::8b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-CMPW4J3PSF&gtm=45je43d0v9172474924za200&_p=1710515853034&gcd=13l3l3l3l1&npa=0&dma=0&cid=1615394421.1710515853&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_s=1&sid=1710515853&sct=1&seg=0&dl=https%3A%2F%2Fnextdede.us%2F&dt=Nextdede%20-%20Pel%C3%ADculas%20y%20Series%20de%20TV%20Online&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=2701
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CMPW4J3PSF
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c1d::8b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nextdede.us/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Mar 2024 15:17:33 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://nextdede.us
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 3e03bb1a-bac7-4381-9e35-d9642daa31e0.png
nextdede.us/storage/branding_media/ 4 KB
4 KB 702ms
701ms Image
image/png 2606:4700:3031::6815:3946
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nextdede.us/storage/branding_media/3e03bb1a-bac7-4381-9e35-d9642daa31e0.png
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:3946 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 3efc9d798a7bfe653218724f433b9c2f59f3e63edfa4fca19e8cbd3619a1fd9c

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nextdede.us/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Fri, 15 Mar 2024 15:17:34 GMT
cf-cache-status: MISS
last-modified: Thu, 09 Nov 2023 21:41:40 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "654d5214-fa1"
x-powered-by: PleskLin
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qEpri%2FI%2FHhRhKcqVyfVjOnf2Z8q9Dlg9TrDhsZd4KF85SM%2F9oeoJL8BlCmoQKizejYhf0Cx9dz0Ky%2FKL0sMiZwDctvXUTIJmxbVKxWW7wo49YlwyvnSh9g3qnCl2hoz%2Fyf1YsSs3MKQIHg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 864d78957c6d749a-MIA
alt-svc: h3=":443"; ma=86400
content-length: 4001

GET
H3 200 d45e4cfe-8ef8-47d8-8503-829fe068e1b9.jpg
nextdede.us/storage/homepage/ 108 KB
108 KB 925ms
924ms Image
image/jpeg 2606:4700:3031::6815:3946
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nextdede.us/storage/homepage/d45e4cfe-8ef8-47d8-8503-829fe068e1b9.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:3946 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 6e7b1972452fd912d458f23f45f0394348cea6e51e5310d0e57c2e1fd421d3af

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nextdede.us/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Fri, 15 Mar 2024 15:17:34 GMT
cf-cache-status: MISS
last-modified: Fri, 10 Nov 2023 16:58:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "654e6128-1aeb5"
x-powered-by: PleskLin
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yOANu4gdImxDWRiA9fjUveK8BaGoGZUBaSDXQNm1WD4wWLEutFK%2ForT7ARi5A38wN6r%2Fqx9giMgDbKx6TX1MUtj8LYLZ%2FEK6jeBIPsqgeZ6SN6jaTRj4tHXJI8ZrenGevS%2BYToRSwQhOHQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 864d78957c6e749a-MIA
alt-svc: h3=":443"; ma=86400
content-length: 110261

GET
H3 200 593c7c85-514a-44c2-8e95-99e6b12f01c6.jpg
nextdede.us/storage/homepage/ 47 KB
47 KB 621ms
620ms Image
image/jpeg 2606:4700:3031::6815:3946
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nextdede.us/storage/homepage/593c7c85-514a-44c2-8e95-99e6b12f01c6.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:3946 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 96bf1005fe5bf96c9bbeb0347ba83a0c414fa84d5af5681d0f5e906951c6b5a5

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nextdede.us/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Fri, 15 Mar 2024 15:17:34 GMT
cf-cache-status: MISS
last-modified: Fri, 10 Nov 2023 17:04:16 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "654e6290-ba19"
x-powered-by: PleskLin
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8k24WAWIkgfym6l4Dn4Wil%2FGPIc%2BhwU%2BCOQyWlSm6G35CvXBpOgrRAJVhaL08gF2qzY616cDSg9yOJV8GU%2FKOcwOz5qr9fXeOYPv1t9sTChrBzmgFlJkTiRsBW2M9SBNoe%2ByfHzF3vQ19A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 864d78957c70749a-MIA
alt-svc: h3=":443"; ma=86400
content-length: 47641

GET
H3 200 b4f623fb-20ad-4300-92b9-379fbd6be1cf.jpg
nextdede.us/storage/homepage/ 108 KB
108 KB 919ms
919ms Image
image/jpeg 2606:4700:3031::6815:3946
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nextdede.us/storage/homepage/b4f623fb-20ad-4300-92b9-379fbd6be1cf.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:3946 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: 3976053b50d3ec557372c3dc999fffd92bd4b1df074f98facced886d394039aa

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nextdede.us/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Fri, 15 Mar 2024 15:17:34 GMT
cf-cache-status: MISS
last-modified: Fri, 10 Nov 2023 17:07:42 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "654e635e-1aedc"
x-powered-by: PleskLin
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bIvq1V73tSEA4LvRqS3h4cxNhWfIjEZ9M3zzMQDH3T0lxZrSlop1ei3VqpRbQ5pb8RPlYpwtwRBcVZHl94JWgUY1QHA29nl0mzBuCMcTCqqZt206cLK9qeU9caRhL%2BzxCKw7m7AlHf50Xw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 864d78957c71749a-MIA
alt-svc: h3=":443"; ma=86400
content-length: 110300

GET
H2 200 iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-B4iFV0U1.woff2
fonts.gstatic.com/s/rubik/v28/ 18 KB
19 KB 330ms
53ms Font
font/woff2 2607:f8b0:4004:c1d::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/rubik/v28/iJWZBXyIfDnIV5PNhY1KTN7Z-Yh-B4iFV0U1.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=K2D&family=Rubik&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::5e Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c87fcac153783ea615f856ad1c0e12791952c39b8ddde7f11fa3d47c0a3b3998

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://nextdede.us
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 08:55:23 GMT
x-content-type-options: nosniff
age: 195730
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18856
x-xss-protection: 0
last-modified: Thu, 29 Jun 2023 16:30:12 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 13 Mar 2025 08:55:23 GMT

GET
H3 200 landing.jpg
nextdede.us/images/landing/ 316 KB
317 KB 917ms
917ms Image
image/jpeg 2606:4700:3031::6815:3946
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nextdede.us/images/landing/landing.jpg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::6815:3946 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PleskLin
Resource Hash: c4d143fbc63dde4eb0f0f8bd9a8ced56f7e0bd663e45b3a4b7f5f30c9f105be1

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nextdede.us/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Fri, 15 Mar 2024 15:17:34 GMT
cf-cache-status: MISS
last-modified: Tue, 24 Oct 2023 14:57:38 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "6537db62-4f159"
x-powered-by: PleskLin
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=559dKrdBzUlM201brES%2F0hqxjXYCgH%2B%2FeTiX59eP0e3ctvO0VdR1Z2e%2FmpQ31VO9%2Bl0st9ji%2FOrYCC0dyWj694ifR81Bxd1sOrXEsj4RGZoAy9yOUuQ%2FfGgxkoJ5CVCAW%2FbtRIYe%2FQxYuQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 864d7895aca9749a-MIA
alt-svc: h3=":443"; ma=86400
content-length: 323929

POST
H2 204 collect
www.google-analytics.com/g/ 0
45 B 61ms
60ms Ping
text/plain 2607:f8b0:4004:c1d::8b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-CMPW4J3PSF&gtm=45je43d0v9172474924za200&_p=1710515853034&gcd=13l3l3l3l1&npa=0&dma=0&cid=1615394421.1710515853&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_eu=AEA&_s=2&sid=1710515853&sct=1&seg=0&dl=https%3A%2F%2Fnextdede.us%2F&dt=Nextdede%20-%20Pel%C3%ADculas%20y%20Series%20de%20TV%20Online&en=scroll&epn.percent_scrolled=90&_et=8&tfd=7715
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CMPW4J3PSF
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c1d::8b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://nextdede.us/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 15 Mar 2024 15:17:38 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://nextdede.us
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
nextdede.us/	1970-01-20 19:08:43	Name: XSRF-TOKEN Value: eyJpdiI6IkpwYUFGVHp0d0RxT2tFbnNQNkJPR1E9PSIsInZhbHVlIjoieXo4b1h6RHBhdzc0eC9sRituYXJCV3FDb1oxdGdGb2s1U2Jid3h3Tzg4L0FJVGZuWE5FZk5ZeGdRSEhWZUhxaU5zbFZRb09LdWljNzdRVjZlU2wyS1lPSEdIcDRscGlhejA5NG5hc3B3aEg1VkZTZU5tMmlFL2pRVFlPWjdxVHgiLCJtYWMiOiI4ZDI4YmFhZWE2MDRkYTc0OThhNjYyYTNmZWUxOTA2ZTU1YmEwNmNjN2I4ODRmOTVjNDMwNWQwMjNhOTcyMTM2IiwidGFnIjoiIn0%3D
nextdede.us/	1970-01-20 19:08:43	Name: nextdede_session Value: eyJpdiI6IitCbzR3eVA0ZnNUNEVkR2lDbU5GZlE9PSIsInZhbHVlIjoiUHVrRy9JTFQxZmlqUFFKTGViYk1mejRJY0VDTmRDaVVvUzg1bGZROGZFL0U0cFZPZ3pnYVF3RmhCbnpyNXgwdWdycFJrVGMyVWxqSFYwbGFIMC9xeWtTLzRJZjJiaG1FbjBQd3hvRHdmbmF3dWlGYWpVb055VE9IWVRTR2lHa0oiLCJtYWMiOiIxMjU2YmEwNGI3NTYyMWQ5NjJjMThjMjFiOTNiZWU2MDc4NDdhOTM0Yjg2ZGE4NmMwMGI3ODk4NjBlM2E5YzJlIiwidGFnIjoiIn0%3D
.nextdede.us/	1970-01-21 04:44:35	Name: _ga Value: GA1.1.1615394421.1710515853
.nextdede.us/	1970-01-21 04:44:35	Name: _ga_CMPW4J3PSF Value: GS1.1.1710515853.1.0.1710515853.0.0.0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
nextdede.us
www.google-analytics.com
www.googletagmanager.com
2606:4700:3031::6815:3946
2607:f8b0:4004:c08::61
2607:f8b0:4004:c09::5f
2607:f8b0:4004:c1d::5e
2607:f8b0:4004:c1d::8b
0d87d2da8dfc09e72221a9e751c8f63ad7a3db5924156e3cb1a90b83d6429a89
2e6f0c87f28ec6f7cc6d9a492d9ff1f1c35ac25a13fd1a847bb946b2f7973b30
3976053b50d3ec557372c3dc999fffd92bd4b1df074f98facced886d394039aa
3efc9d798a7bfe653218724f433b9c2f59f3e63edfa4fca19e8cbd3619a1fd9c
6e7b1972452fd912d458f23f45f0394348cea6e51e5310d0e57c2e1fd421d3af
96bf1005fe5bf96c9bbeb0347ba83a0c414fa84d5af5681d0f5e906951c6b5a5
bc836b4831a6d8cf9bf5197a7bc7c8c4186d516639861e025b65352789f0e179
c4d143fbc63dde4eb0f0f8bd9a8ced56f7e0bd663e45b3a4b7f5f30c9f105be1
c859554e6f183410db772f18b40d080a76314413dabe0dacda6bd0e7faa6f7b6
c87fcac153783ea615f856ad1c0e12791952c39b8ddde7f11fa3d47c0a3b3998
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f6499c183441d498b3359851192a26230964fba2e403dd8a830151335698e121

nextdede.us Open in urlscan Pro 2606:4700:3031::6815:3946 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

100 %IPv6

5 Domains

5 Subdomains

5 IPs

1 Countries

1014 kBTransfer

1907 kBSize

4 Cookies

2 Outgoing links

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

8 JavaScript Global Variables

4 Cookies

Indicators

nextdede.us Open in urlscan Pro
2606:4700:3031::6815:3946 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

100 %
IPv6

5
Domains

5
Subdomains

5
IPs

1
Countries

1014 kB
Transfer

1907 kB
Size

4
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!