6e0549caa8d7.ngrok.io Open in urlscan Pro
2600:1f16:d83:1202::6e:5 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://6e0549caa8d7.ngrok.io/login.html
Submission: On August 01 via manual (August 1st 2021, 2:13:56 am UTC) from MY

Summary HTTP 30 Redirects Links 10 Behaviour Indicators

Summary

This website contacted 10 IPs in 2 countries across 6 domains to perform 30 HTTP transactions. The main IP is 2600:1f16:d83:1202::6e:5, located in Columbus, United States and belongs to AMAZON-02, US. The main domain is 6e0549caa8d7.ngrok.io.
TLS certificate: Issued by R3 on July 12th 2021. Valid for: 3 months.

This is the only time 6e0549caa8d7.ngrok.io was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address	AS Autonomous System
9	2600:1f16:d83... 2600:1f16:d83:1202::6e:5	16509 (AMAZON-02) (AMAZON-02)
4	2a00:86c0:209... 2a00:86c0:2090::1	40027 (NETFLIX-ASN) (NETFLIX-ASN)
6	2606:4700::68... 2606:4700::6810:9540	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:86c0:209... 2a00:86c0:2091::1	40027 (NETFLIX-ASN) (NETFLIX-ASN)
1	2a00:1450:400... 2a00:1450:4001:82f::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:831::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:828::2004	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:812::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:813::2003	15169 (GOOGLE) (GOOGLE)
30	10

9 2600:1f16:d83:1202::6e:5 (Columbus, United States)

ASN16509 (AMAZON-02, US)

6e0549caa8d7.ngrok.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:86c0:2090::1 (United States)

ASN40027 (NETFLIX-ASN, US)

codex.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700::6810:9540 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:86c0:2091::1 (United States)

ASN40027 (NETFLIX-ASN, US)

assets.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:812::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	ngrok.io 6e0549caa8d7.ngrok.io	211 KB
7	nflxext.com codex.nflxext.com assets.nflxext.com	712 KB
6	cookielaw.org cdn.cookielaw.org	109 KB
5	gstatic.com www.gstatic.com fonts.gstatic.com	309 KB
2	google.com www.google.com	2 KB
0	onetrust.com Failed geolocation.onetrust.com Failed
30	6

	Domain	Requested by
9	6e0549caa8d7.ngrok.io	6e0549caa8d7.ngrok.io codex.nflxext.com
6	cdn.cookielaw.org	6e0549caa8d7.ngrok.io cdn.cookielaw.org
4	www.gstatic.com	www.google.com www.gstatic.com
4	codex.nflxext.com	6e0549caa8d7.ngrok.io
3	assets.nflxext.com	6e0549caa8d7.ngrok.io codex.nflxext.com
2	www.google.com	codex.nflxext.com www.gstatic.com
1	fonts.gstatic.com	www.google.com
0	geolocation.onetrust.com Failed	cdn.cookielaw.org
30	8

This site contains links to these domains. Also see Links.

Domain
policies.google.com
help.netflix.com
optout.aboutads.info
onetrust.com

Subject Issuer	Validity	Valid
*.ngrok.io R3	`2021-07-12` - `2021-10-10`	3 months	crt.sh
*.1.nflxso.net DigiCert TLS RSA SHA256 2020 CA1	`2021-07-30` - `2021-08-28`	a month	crt.sh
cookielaw.org Cloudflare Inc ECC CA-3	`2021-06-01` - `2022-05-31`	a year	crt.sh
www.google.com GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-07-05` - `2021-09-27`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://6e0549caa8d7.ngrok.io/login.html
Frame ID: A78CE72CD74C74C1B567B7F9957B07AB
Requests: 25 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Lf8hrcUAAAAAIpQAFW2VFjtiYnThOjZOA5xvLyR&co=aHR0cHM6Ly82ZTA1NDljYWE4ZDcubmdyb2suaW86NDQz&hl=en&v=ecapuzyywmdXQ5gJHS3JQiXe&size=invisible&cb=ny31kspbukod
Frame ID: 88DADB463D6763752C26819C031D2438
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Python (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:^|\s)Python(?:\/([\d.]+))?/i

SimpleHTTP (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /SimpleHTTP(?:\/([\d.]+))?/i

Page Statistics

30
Requests

97 %
HTTPS

100 %
IPv6

6
Domains

8
Subdomains

10
IPs

2
Countries

1343 kB
Transfer

2913 kB
Size

1
Cookies

10 Outgoing links

These are links going to different origins than the main page.

URL: https://policies.google.com/privacy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://policies.google.com/terms
Title: Terms of Service

Search URL Search Domain Scan URL

URL: https://help.netflix.com/support/412
Title: FAQ

Search URL Search Domain Scan URL

URL: https://help.netflix.com/
Title: Help Center

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/termsofuse
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/privacy
Title: Privacy

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/corpinfo
Title: Corporate Information

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/privacy#cookies
Title: Cookies and Internet Advertising

Search URL Search Domain Scan URL

URL: https://optout.aboutads.info/
Title: here.

Search URL Search Domain Scan URL

URL: https://onetrust.com/poweredbyonetrust

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

30 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request login.html Show response
6e0549caa8d7.ngrok.io/ 207 KB
208 KB 1013ms
801ms Document
text/html 2600:1f16:d83:1202::6e:5
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://6e0549caa8d7.ngrok.io/login.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f16:d83:1202::6e:5 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: SimpleHTTP/0.6 Python/3.9.2 /
Resource Hash: 864d7c551824912c2a4d34aae4a53ef31a0e32b262ae6de9ffaa15ce67459124

Request headers

:method: GET
:authority: 6e0549caa8d7.ngrok.io
:scheme: https
:path: /login.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: text/html
date: Sun, 01 Aug 2021 02:13:42 GMT
last-modified: Sun, 01 Aug 2021 02:12:06 GMT
server: SimpleHTTP/0.6 Python/3.9.2
content-length: 212377

GET
H/1.1 200
OK none Show response
codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-js-v6ef6668d/js/js/bootstrap.js,common%7Cbootstrap.js/2/0b3g022T2L2V052I2_3f070l003h2Y3b2Q302W3a2N2-320a013c0N/bck/true/ 9 KB
4 KB 26ms
6ms Script
application/javascript 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-js-v6ef6668d/js/js/bootstrap.js,common%7Cbootstrap.js/2/0b3g022T2L2V052I2_3f070l003h2Y3b2Q302W3a2N2-320a013c0N/bck/true/none

Requested by

Host: 6e0549caa8d7.ngrok.io
URL: https://6e0549caa8d7.ngrok.io/login.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

a0eb42520982efbbc3c8d31bd13cfcaa41760f0508c5d7af4c9f060636dab456

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://6e0549caa8d7.ngrok.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 01 Aug 2021 02:13:36 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Content-Type: application/javascript; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=16070400
req_id: ca2cd6ac-de1f-4d50-89a2-78c8eca65fd9
Connection: keep-alive
Timing-Allow-Origin: https://www.netflix.com
Content-Length: 3631
Expires: Mon, 31 Jan 2022 19:13:12 GMT

GET
H/1.1 200
OK none Show response
codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-js-v6ef6668d/js/js/components%7Clogin%7CloginControllerClient.js/2/0b3g022T2L2V052I2_3f070l003h2Y3b2Q302W3a2N2-320a013c0N/l/true/ 920 KB
277 KB 26ms
6ms Script
application/javascript 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-js-v6ef6668d/js/js/components%7Clogin%7CloginControllerClient.js/2/0b3g022T2L2V052I2_3f070l003h2Y3b2Q302W3a2N2-320a013c0N/l/true/none

Requested by

Host: 6e0549caa8d7.ngrok.io
URL: https://6e0549caa8d7.ngrok.io/login.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

2241040b61d3386c3914acd077e8fbe46224c3118bddfdd6422ad2a4fd8a3cbd

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://6e0549caa8d7.ngrok.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 01 Aug 2021 02:13:36 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Content-Type: application/javascript; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=16070400
req_id: 652dd4e9-f950-4239-b9c6-7ecacdd41807
Connection: keep-alive
Timing-Allow-Origin: https://www.netflix.com
Content-Length: 283531
Expires: Mon, 31 Jan 2022 18:58:45 GMT

GET
H2 404 WebsiteDetect
6e0549caa8d7.ngrok.io/personalization/cl2/freeform/ 0
0 509ms
508ms Stylesheet
text/html 2600:1f16:d83:1202::6e:5
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://6e0549caa8d7.ngrok.io/personalization/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=css&modalView=login
Requested by: Host: 6e0549caa8d7.ngrok.io
URL: https://6e0549caa8d7.ngrok.io/login.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f16:d83:1202::6e:5 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: SimpleHTTP/0.6 Python/3.9.2 /
Resource Hash

Request headers

:path: /personalization/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=css&modalView=login
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: 6e0549caa8d7.ngrok.io
referer: https://6e0549caa8d7.ngrok.io/login.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://6e0549caa8d7.ngrok.io/login.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 01 Aug 2021 02:13:42 GMT
server: SimpleHTTP/0.6 Python/3.9.2
content-length: 469
content-type: text/html;charset=utf-8

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 19 KB
6 KB 13ms
12ms Script
application/javascript 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: 6e0549caa8d7.ngrok.io
URL: https://6e0549caa8d7.ngrok.io/login.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1cb4f8ad1c77d76c76fec82ee2bb6ec3709d9d724e09f447327d62cc590aa067

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Origin: https://6e0549caa8d7.ngrok.io
Referer: https://6e0549caa8d7.ngrok.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sun, 01 Aug 2021 02:13:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: ElyA2tEJE7gBmVkJbkUH5A==
age: 4965
vary: Accept-Encoding
content-length: 6319
x-ms-lease-status: unlocked
last-modified: Fri, 23 Jul 2021 01:58:42 GMT
server: cloudflare
etag: 0x8D94D7D65E6FA72
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 41c27621-401e-00fb-7e99-8410fc000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 677b8c56092d4e97-FRA

GET
H/1.1 200
OK none
codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-v6ef6668d/css/css/less%7Ccore%7Cerror-page.less/1/arytF4Dps9xCE/none/true/ 11 KB
3 KB 25ms
7ms Stylesheet
text/css 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-v6ef6668d/css/css/less%7Ccore%7Cerror-page.less/1/arytF4Dps9xCE/none/true/none

Requested by

Host: 6e0549caa8d7.ngrok.io
URL: https://6e0549caa8d7.ngrok.io/login.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

d9bac1aefff045998fd064ed279defcd96c37a53ee0ee3816d1ebab19c1ff739

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://6e0549caa8d7.ngrok.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 01 Aug 2021 02:13:36 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Content-Type: text/css; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=16070400
req_id: 31c3c412-1cd3-4bd8-ab62-a0cf9a42022a
Connection: keep-alive
Timing-Allow-Origin: https://www.netflix.com
Content-Length: 2595
Expires: Mon, 31 Jan 2022 18:48:43 GMT

GET
H/1.1 200
OK none
codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-v6ef6668d/css/css/less%7Clogin%7CloginBase.less,less%7Cpages%7Clogin%7CLogin.less/1/arytF4Dps9xCE/none/true/ 132 KB
22 KB 24ms
6ms Stylesheet
text/css 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-v6ef6668d/css/css/less%7Clogin%7CloginBase.less,less%7Cpages%7Clogin%7CLogin.less/1/arytF4Dps9xCE/none/true/none

Requested by

Host: 6e0549caa8d7.ngrok.io
URL: https://6e0549caa8d7.ngrok.io/login.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

4b27429d411b25e69d402d57928be186a16ece667fd2a68ea3556802a3b6690b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://6e0549caa8d7.ngrok.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 01 Aug 2021 02:13:36 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Content-Type: text/css; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=16070400
req_id: 35e04325-a0cc-41c3-aeab-bb4c2fa8351b
Connection: keep-alive
Timing-Allow-Origin: https://www.netflix.com
Content-Length: 21768
Expires: Mon, 31 Jan 2022 18:48:36 GMT

GET
H/1.1 200
OK MY-en-20210719-popsignuptwoweeks-perspective_alpha_website_large.jpg
assets.nflxext.com/ffe/siteui/vlv3/9c5457b8-9ab0-4a04-9fc1-e608d5670f1a/57b9d2f4-7a79-4004-9af4-14c864b4fbbe/ 332 KB
333 KB 172ms
158ms Image
image/jpeg 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.nflxext.com/ffe/siteui/vlv3/9c5457b8-9ab0-4a04-9fc1-e608d5670f1a/57b9d2f4-7a79-4004-9af4-14c864b4fbbe/MY-en-20210719-popsignuptwoweeks-perspective_alpha_website_large.jpg
Requested by: Host: 6e0549caa8d7.ngrok.io
URL: https://6e0549caa8d7.ngrok.io/login.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: f5ad281550973d504d44461f539870ea853fb4ba5dafc538a22f43310a630c3b

Request headers

Referer: https://6e0549caa8d7.ngrok.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 01 Aug 2021 02:13:36 GMT
Last-Modified: Wed, 21 Jul 2021 13:20:45 GMT
Server: nginx
Content-MD5: w1i3RNv1prA5vThEIYacrw==
Content-Type: image/jpeg
Cache-Control: max-age=604801
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 340264
Expires: Sun, 08 Aug 2021 02:13:36 GMT

GET
H2 404 WebsiteDetect Show response
6e0549caa8d7.ngrok.io/personalization/cl2/freeform/ 469 B
501 B 422ms
422ms XHR
text/html 2600:1f16:d83:1202::6e:5
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://6e0549caa8d7.ngrok.io/personalization/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=js&modalView=login
Requested by: Host: 6e0549caa8d7.ngrok.io
URL: https://6e0549caa8d7.ngrok.io/login.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f16:d83:1202::6e:5 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: SimpleHTTP/0.6 Python/3.9.2 /
Resource Hash: eef948e1d511bd86ff673f904bf0a97106d5395f0b7ed2cfb043da7ccc6ca6dd

Request headers

:path: /personalization/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=js&modalView=login
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: 6e0549caa8d7.ngrok.io
referer: https://6e0549caa8d7.ngrok.io/login.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://6e0549caa8d7.ngrok.io/login.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 01 Aug 2021 02:13:43 GMT
server: SimpleHTTP/0.6 Python/3.9.2
content-length: 469
content-type: text/html;charset=utf-8

GET
H2 404 WebsiteScreen Show response
6e0549caa8d7.ngrok.io/personalization/cl2/freeform/ 469 B
524 B 409ms
409ms XHR
text/html 2600:1f16:d83:1202::6e:5
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://6e0549caa8d7.ngrok.io/personalization/cl2/freeform/WebsiteScreen?source=wwwhead&fetchType=js&winw=1600&winh=1200&screenw=1600&screenh=1200&ratio=1
Requested by: Host: 6e0549caa8d7.ngrok.io
URL: https://6e0549caa8d7.ngrok.io/login.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f16:d83:1202::6e:5 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: SimpleHTTP/0.6 Python/3.9.2 /
Resource Hash: eef948e1d511bd86ff673f904bf0a97106d5395f0b7ed2cfb043da7ccc6ca6dd

Request headers

:path: /personalization/cl2/freeform/WebsiteScreen?source=wwwhead&fetchType=js&winw=1600&winh=1200&screenw=1600&screenh=1200&ratio=1
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: 6e0549caa8d7.ngrok.io
referer: https://6e0549caa8d7.ngrok.io/login.html
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://6e0549caa8d7.ngrok.io/login.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 01 Aug 2021 02:13:43 GMT
server: SimpleHTTP/0.6 Python/3.9.2
content-length: 469
content-type: text/html;charset=utf-8

GET
H2 200 87b6a5c0-0104-4e96-a291-092c11350111.json Show response
cdn.cookielaw.org/consent/87b6a5c0-0104-4e96-a291-092c11350111/ 4 KB
2 KB 11ms
11ms XHR
application/x-javascript 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/87b6a5c0-0104-4e96-a291-092c11350111/87b6a5c0-0104-4e96-a291-092c11350111.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

722171182a1f656e8d502dd5ed5708d5315b1b281536777b78242fb408e0ed9b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://6e0549caa8d7.ngrok.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sun, 01 Aug 2021 02:13:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: 9ewFVvLrzQ8zjABYc0Hj7Q==
age: 4803
vary: Accept-Encoding
content-length: 1558
x-ms-lease-status: unlocked
last-modified: Wed, 19 May 2021 23:30:43 GMT
server: cloudflare
etag: 0x8D91B1E1EF6A6BC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: a0f92e4f-701e-0059-4168-6fdd60000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 677b8c594c314e97-FRA

GET location
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 0
0

GET
H/1.1 200
OK FB-f-Logo__blue_57.png
assets.nflxext.com/ffe/siteui/login/images/ 1 KB
2 KB 5ms
5ms Image
image/png 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.nflxext.com/ffe/siteui/login/images/FB-f-Logo__blue_57.png
Requested by: Host: 6e0549caa8d7.ngrok.io
URL: https://6e0549caa8d7.ngrok.io/login.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece

Request headers

Referer: https://6e0549caa8d7.ngrok.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 01 Aug 2021 02:13:36 GMT
Last-Modified: Thu, 30 Jun 2016 17:48:49 GMT
Server: nginx
Content-MD5: ozykfvEQtuPsUIa4d2QH0w==
Content-Type: image/png
Cache-Control: max-age=604801
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1455
Expires: Fri, 06 Aug 2021 22:05:57 GMT

GET
H/1.1 200
OK nf-icon-v1-93.woff
assets.nflxext.com/ffe/siteui/fonts/ 72 KB
72 KB 17ms
5ms Font
font/woff 2a00:86c0:2091::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-93.woff
Requested by: Host: codex.nflxext.com
URL: https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-v6ef6668d/css/css/less%7Clogin%7CloginBase.less,less%7Cpages%7Clogin%7CLogin.less/1/arytF4Dps9xCE/none/true/none
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d

Request headers

Origin: https://6e0549caa8d7.ngrok.io
Referer: https://codex.nflxext.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 01 Aug 2021 02:13:36 GMT
Last-Modified: Mon, 29 Jan 2018 01:50:51 GMT
Server: nginx
Content-MD5: fPYVbMSBJEtaJUNi17c/AA==
Content-Type: font/woff
Access-Control-Allow-Origin: *
Cache-Control: max-age=604801
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 73572
Expires: Fri, 06 Aug 2021 22:05:52 GMT

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/6.6.0/ 338 KB
72 KB 82ms
81ms Script
application/javascript 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.6.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fefa6bc00a2fca4d3ca705862d42dfdbb8f69124b2f0cc0896d3c7c2c05890a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Origin: https://6e0549caa8d7.ngrok.io
Referer: https://6e0549caa8d7.ngrok.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sun, 01 Aug 2021 02:13:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: MISS
content-md5: Xs4BplpA7QV+zkRYpo3+wA==
vary: Accept-Encoding
content-length: 73082
x-ms-lease-status: unlocked
last-modified: Thu, 10 Sep 2020 01:36:33 GMT
server: cloudflare
etag: 0x8D85529F2EBAD26
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 72abc339-901e-017e-5d7a-86017c000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=691200
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 677b8c59ac914e97-FRA
expires: Mon, 09 Aug 2021 02:13:36 GMT

GET
H2 200 enterprise.js Show response
www.google.com/recaptcha/ 974 B
709 B 17ms
17ms Script
text/javascript 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/enterprise.js?render=6Lf8hrcUAAAAAIpQAFW2VFjtiYnThOjZOA5xvLyR

Requested by

Host: codex.nflxext.com
URL: https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-js-v6ef6668d/js/js/components%7Clogin%7CloginControllerClient.js/2/0b3g022T2L2V052I2_3f070l003h2Y3b2Q302W3a2N2-320a013c0N/l/true/none

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

deb4f380aa26737b0f32929f38c92cfa1786e9220be58ea5b52a9327d2ff177b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://6e0549caa8d7.ngrok.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 01 Aug 2021 02:13:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 615
x-xss-protection: 1; mode=block
expires: Sun, 01 Aug 2021 02:13:37 GMT

POST
H2 501 log Show response
6e0549caa8d7.ngrok.io/personalization/ 497 B
536 B 421ms
421ms XHR
text/html 2600:1f16:d83:1202::6e:5
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://6e0549caa8d7.ngrok.io/personalization/log
Requested by: Host: codex.nflxext.com
URL: https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-js-v6ef6668d/js/js/components%7Clogin%7CloginControllerClient.js/2/0b3g022T2L2V052I2_3f070l003h2Y3b2Q302W3a2N2-320a013c0N/l/true/none
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f16:d83:1202::6e:5 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: SimpleHTTP/0.6 Python/3.9.2 /
Resource Hash: a1178431e9eda23a8b300e44bd92c6cbd7aad17521d38dd48498ed15a200e7b2

Request headers

sec-fetch-mode: cors
origin: https://6e0549caa8d7.ngrok.io
accept-encoding: gzip, deflate, br
accept-language: en-US
x-netflix.ichnaea.request.type: UiRequest
sec-fetch-dest: empty
x-requested-with: XMLHttpRequest
cookie: cL=1627784016974%7C162778401638287458%7C162778401682824833%7C%7C4%7Cnull
content-length: 1369
:path: /personalization/log
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
content-type: application/json
accept: */*
cache-control: no-cache
:authority: 6e0549caa8d7.ngrok.io
referer: https://6e0549caa8d7.ngrok.io/login.html
:scheme: https
sec-fetch-site: same-origin
:method: POST
Accept: */*
Referer: https://6e0549caa8d7.ngrok.io/login.html
X-Netflix.ichnaea.request.type: UiRequest
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

date: Sun, 01 Aug 2021 02:13:43 GMT
server: SimpleHTTP/0.6 Python/3.9.2
content-length: 497
content-type: text/html;charset=utf-8

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/87b6a5c0-0104-4e96-a291-092c11350111/1267eca1-c7b7-477d-b090-69fef956b58c/ 35 KB
11 KB 16ms
16ms Fetch
application/x-javascript 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/87b6a5c0-0104-4e96-a291-092c11350111/1267eca1-c7b7-477d-b090-69fef956b58c/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.6.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

52f9c54e170a131bc1bcce24dd7ef29897957dc08f446c1b8f12839b776520fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://6e0549caa8d7.ngrok.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sun, 01 Aug 2021 02:13:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: Ji81kI+mNiqe+LNYB0ShTQ==
age: 4670
vary: Accept-Encoding
content-length: 11106
x-ms-lease-status: unlocked
last-modified: Wed, 19 May 2021 23:30:52 GMT
server: cloudflare
etag: 0x8D91B1E24BD42ED
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 864c266e-a01e-00f1-1016-4d0975000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 677b8c5acddd4e97-FRA

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/ecapuzyywmdXQ5gJHS3JQiXe/ 342 KB
133 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/ecapuzyywmdXQ5gJHS3JQiXe/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/enterprise.js?render=6Lf8hrcUAAAAAIpQAFW2VFjtiYnThOjZOA5xvLyR

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

654a6d6808dfc4e817d8d70eebebd98f0add214485983e60a53111de95db8bdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://6e0549caa8d7.ngrok.io
Referer: https://6e0549caa8d7.ngrok.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 31 Jul 2021 22:41:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12711
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 136251
x-xss-protection: 0
last-modified: Mon, 26 Jul 2021 00:05:58 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 31 Jul 2022 22:41:46 GMT

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/6.6.0/assets/ 12 KB
3 KB 107ms
107ms Fetch
application/json 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.6.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.6.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ae407e415a45b6c720d8d61fef8c28756883d0f546a64e7a2969d6174c669951

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://6e0549caa8d7.ngrok.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sun, 01 Aug 2021 02:13:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: MISS
content-md5: R7qOr1WClmhADOzbz5s+Bw==
vary: Accept-Encoding
content-length: 3248
x-ms-lease-status: unlocked
last-modified: Thu, 10 Sep 2020 01:36:24 GMT
server: cloudflare
etag: 0x8D85529EDFDCA3B
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 49083215-c01e-0144-0a7a-8642df000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=691200
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 677b8c5aedfe4e97-FRA
expires: Mon, 09 Aug 2021 02:13:37 GMT

GET
H2 200 otPcTab.json Show response
cdn.cookielaw.org/scripttemplates/6.6.0/assets/ 57 KB
14 KB 109ms
108ms Fetch
application/json 2606:4700::6810:9540
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.6.0/assets/otPcTab.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.6.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9540 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9ea7f0a7844cada198d1e8a28343cc081d3631c716c9dd53d889e4b7feae04ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://6e0549caa8d7.ngrok.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sun, 01 Aug 2021 02:13:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: MISS
content-md5: Mg7iJdVoxVGmqw/VwCobbQ==
vary: Accept-Encoding
content-length: 14112
x-ms-lease-status: unlocked
last-modified: Thu, 10 Sep 2020 01:36:26 GMT
server: cloudflare
etag: 0x8D85529EEE93F94
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 667f1aee-b01e-00e5-597a-86ca11000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=691200
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 677b8c5aedff4e97-FRA
expires: Mon, 09 Aug 2021 02:13:37 GMT

GET
H3-29 200 anchor Show response
www.google.com/recaptcha/enterprise/ Frame 88DA 7 KB
1 KB 19ms
18ms Document
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Lf8hrcUAAAAAIpQAFW2VFjtiYnThOjZOA5xvLyR&co=aHR0cHM6Ly82ZTA1NDljYWE4ZDcubmdyb2suaW86NDQz&hl=en&v=ecapuzyywmdXQ5gJHS3JQiXe&size=invisible&cb=ny31kspbukod

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/ecapuzyywmdXQ5gJHS3JQiXe/recaptcha__en.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

cf072ac1901e9d2582d3c166232bc822be23ee22e68e32b1a3c0fedb71ee6e22

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-BUF/SjW1gSGuGDJ+dkSnMg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/enterprise/anchor?ar=1&k=6Lf8hrcUAAAAAIpQAFW2VFjtiYnThOjZOA5xvLyR&co=aHR0cHM6Ly82ZTA1NDljYWE4ZDcubmdyb2suaW86NDQz&hl=en&v=ecapuzyywmdXQ5gJHS3JQiXe&size=invisible&cb=ny31kspbukod
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://6e0549caa8d7.ngrok.io/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://6e0549caa8d7.ngrok.io/

Response headers

content-security-policy: script-src 'report-sample' 'nonce-BUF/SjW1gSGuGDJ+dkSnMg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
content-encoding: gzip
date: Sun, 01 Aug 2021 02:13:37 GMT
expires: Sun, 01 Aug 2021 02:13:37 GMT
cache-control: private, max-age=0
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 1041
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/ecapuzyywmdXQ5gJHS3JQiXe/ Frame 88DA 52 KB
25 KB 15ms
14ms Stylesheet
text/css 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/ecapuzyywmdXQ5gJHS3JQiXe/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Lf8hrcUAAAAAIpQAFW2VFjtiYnThOjZOA5xvLyR&co=aHR0cHM6Ly82ZTA1NDljYWE4ZDcubmdyb2suaW86NDQz&hl=en&v=ecapuzyywmdXQ5gJHS3JQiXe&size=invisible&cb=ny31kspbukod

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5fe20047c1cc1be61a786d56c5c02b96453b9c60656d6c8429a1add79017e47f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 30 Jul 2021 12:26:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 136039
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25732
x-xss-protection: 0
last-modified: Mon, 26 Jul 2021 00:05:58 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 30 Jul 2022 12:26:18 GMT

GET
H3-29 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/ecapuzyywmdXQ5gJHS3JQiXe/ Frame 88DA 342 KB
133 KB 22ms
20ms Script
text/javascript 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/ecapuzyywmdXQ5gJHS3JQiXe/recaptcha__en.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

654a6d6808dfc4e817d8d70eebebd98f0add214485983e60a53111de95db8bdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 31 Jul 2021 18:43:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 27037
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 136251
x-xss-protection: 0
last-modified: Mon, 26 Jul 2021 00:05:58 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 31 Jul 2022 18:43:00 GMT

GET
H3-29 200 logo_48.png
www.gstatic.com/recaptcha/api2/ Frame 88DA 2 KB
2 KB 6ms
6ms Image
image/png 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/logo_48.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/ecapuzyywmdXQ5gJHS3JQiXe/styles__ltr.css

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.gstatic.com/recaptcha/releases/ecapuzyywmdXQ5gJHS3JQiXe/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 00:00:30 GMT
x-content-type-options: nosniff
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
age: 439987
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
content-type: image/png
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2228
x-xss-protection: 0
expires: Tue, 03 Aug 2021 00:00:30 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 88DA 15 KB
15 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.google.com
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 21:27:21 GMT
x-content-type-options: nosniff
age: 449176
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Jul 2022 21:27:21 GMT

POST
H2 501 cl2 Show response
6e0549caa8d7.ngrok.io/personalization/ 497 B
552 B 475ms
475ms XHR
text/html 2600:1f16:d83:1202::6e:5
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://6e0549caa8d7.ngrok.io/personalization/cl2
Requested by: Host: codex.nflxext.com
URL: https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-js-v6ef6668d/js/js/components%7Clogin%7CloginControllerClient.js/2/0b3g022T2L2V052I2_3f070l003h2Y3b2Q302W3a2N2-320a013c0N/l/true/none
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f16:d83:1202::6e:5 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: SimpleHTTP/0.6 Python/3.9.2 /
Resource Hash: a1178431e9eda23a8b300e44bd92c6cbd7aad17521d38dd48498ed15a200e7b2

Request headers

sec-fetch-mode: cors
origin: https://6e0549caa8d7.ngrok.io
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: empty
cookie: cL=1627784016974%7C162778401638287458%7C162778401682824833%7C%7C4%7Cnull
content-length: 2458
:path: /personalization/cl2
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
content-type: application/json
accept: */*
cache-control: no-cache
:authority: 6e0549caa8d7.ngrok.io
referer: https://6e0549caa8d7.ngrok.io/login.html
:scheme: https
sec-fetch-site: same-origin
x-netflix.client.request.name: ui/cl
:method: POST
Referer: https://6e0549caa8d7.ngrok.io/login.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
X-Netflix.Client.Request.Name: ui/cl
Content-Type: application/json

Response headers

date: Sun, 01 Aug 2021 02:13:48 GMT
server: SimpleHTTP/0.6 Python/3.9.2
content-length: 497
content-type: text/html;charset=utf-8

POST
H2 501 cl2 Show response
6e0549caa8d7.ngrok.io/personalization/ 497 B
552 B 540ms
539ms XHR
text/html 2600:1f16:d83:1202::6e:5
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://6e0549caa8d7.ngrok.io/personalization/cl2
Requested by: Host: codex.nflxext.com
URL: https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-js-v6ef6668d/js/js/components%7Clogin%7CloginControllerClient.js/2/0b3g022T2L2V052I2_3f070l003h2Y3b2Q302W3a2N2-320a013c0N/l/true/none
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f16:d83:1202::6e:5 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: SimpleHTTP/0.6 Python/3.9.2 /
Resource Hash: a1178431e9eda23a8b300e44bd92c6cbd7aad17521d38dd48498ed15a200e7b2

Request headers

sec-fetch-mode: cors
origin: https://6e0549caa8d7.ngrok.io
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: empty
content-length: 2458
:path: /personalization/cl2
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
content-type: application/json
accept: */*
cache-control: no-cache
:authority: 6e0549caa8d7.ngrok.io
referer: https://6e0549caa8d7.ngrok.io/login.html
:scheme: https
sec-fetch-site: same-origin
x-netflix.client.request.name: ui/cl
:method: POST
Referer: https://6e0549caa8d7.ngrok.io/login.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
X-Netflix.Client.Request.Name: ui/cl
Content-Type: application/json

Response headers

date: Sun, 01 Aug 2021 02:13:50 GMT
server: SimpleHTTP/0.6 Python/3.9.2
content-length: 497
content-type: text/html;charset=utf-8

POST
H2 501 cl2 Show response
6e0549caa8d7.ngrok.io/personalization/ 497 B
552 B 415ms
414ms XHR
text/html 2600:1f16:d83:1202::6e:5
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://6e0549caa8d7.ngrok.io/personalization/cl2
Requested by: Host: codex.nflxext.com
URL: https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-js-v6ef6668d/js/js/components%7Clogin%7CloginControllerClient.js/2/0b3g022T2L2V052I2_3f070l003h2Y3b2Q302W3a2N2-320a013c0N/l/true/none
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f16:d83:1202::6e:5 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: SimpleHTTP/0.6 Python/3.9.2 /
Resource Hash: a1178431e9eda23a8b300e44bd92c6cbd7aad17521d38dd48498ed15a200e7b2

Request headers

sec-fetch-mode: cors
origin: https://6e0549caa8d7.ngrok.io
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: empty
content-length: 2458
:path: /personalization/cl2
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
content-type: application/json
accept: */*
cache-control: no-cache
:authority: 6e0549caa8d7.ngrok.io
referer: https://6e0549caa8d7.ngrok.io/login.html
:scheme: https
sec-fetch-site: same-origin
x-netflix.client.request.name: ui/cl
:method: POST
Referer: https://6e0549caa8d7.ngrok.io/login.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
X-Netflix.Client.Request.Name: ui/cl
Content-Type: application/json

Response headers

date: Sun, 01 Aug 2021 02:13:52 GMT
server: SimpleHTTP/0.6 Python/3.9.2
content-length: 497
content-type: text/html;charset=utf-8

POST
H2 501 cl2 Show response
6e0549caa8d7.ngrok.io/personalization/ 497 B
552 B 538ms
538ms XHR
text/html 2600:1f16:d83:1202::6e:5
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://6e0549caa8d7.ngrok.io/personalization/cl2
Requested by: Host: codex.nflxext.com
URL: https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-js-v6ef6668d/js/js/components%7Clogin%7CloginControllerClient.js/2/0b3g022T2L2V052I2_3f070l003h2Y3b2Q302W3a2N2-320a013c0N/l/true/none
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:1f16:d83:1202::6e:5 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: SimpleHTTP/0.6 Python/3.9.2 /
Resource Hash: a1178431e9eda23a8b300e44bd92c6cbd7aad17521d38dd48498ed15a200e7b2

Request headers

sec-fetch-mode: cors
origin: https://6e0549caa8d7.ngrok.io
accept-encoding: gzip, deflate, br
accept-language: en-US
sec-fetch-dest: empty
content-length: 2458
:path: /personalization/cl2
pragma: no-cache
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
content-type: application/json
accept: */*
cache-control: no-cache
:authority: 6e0549caa8d7.ngrok.io
referer: https://6e0549caa8d7.ngrok.io/login.html
:scheme: https
sec-fetch-site: same-origin
x-netflix.client.request.name: ui/cl
:method: POST
Referer: https://6e0549caa8d7.ngrok.io/login.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
X-Netflix.Client.Request.Name: ui/cl
Content-Type: application/json

Response headers

date: Sun, 01 Aug 2021 02:13:57 GMT
server: SimpleHTTP/0.6 Python/3.9.2
content-length: 497
content-type: text/html;charset=utf-8

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: geolocation.onetrust.com
URL: https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

36 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.6e0549caa8d7.ngrok.io/	1969-12-31 23:59:59	Name: cL Value: 1627784016974%7C162778401638287458%7C162778401682824833%7C%7C4%7Cnull

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

6e0549caa8d7.ngrok.io
assets.nflxext.com
cdn.cookielaw.org
codex.nflxext.com
fonts.gstatic.com
geolocation.onetrust.com
www.google.com
www.gstatic.com
geolocation.onetrust.com
2600:1f16:d83:1202::6e:5
2606:4700::6810:9540
2a00:1450:4001:812::2003
2a00:1450:4001:813::2003
2a00:1450:4001:828::2004
2a00:1450:4001:82f::2004
2a00:1450:4001:831::2003
2a00:86c0:2090::1
2a00:86c0:2091::1
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
1cb4f8ad1c77d76c76fec82ee2bb6ec3709d9d724e09f447327d62cc590aa067
2241040b61d3386c3914acd077e8fbe46224c3118bddfdd6422ad2a4fd8a3cbd
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
4b27429d411b25e69d402d57928be186a16ece667fd2a68ea3556802a3b6690b
52f9c54e170a131bc1bcce24dd7ef29897957dc08f446c1b8f12839b776520fa
5fe20047c1cc1be61a786d56c5c02b96453b9c60656d6c8429a1add79017e47f
5fefa6bc00a2fca4d3ca705862d42dfdbb8f69124b2f0cc0896d3c7c2c05890a
654a6d6808dfc4e817d8d70eebebd98f0add214485983e60a53111de95db8bdc
722171182a1f656e8d502dd5ed5708d5315b1b281536777b78242fb408e0ed9b
864d7c551824912c2a4d34aae4a53ef31a0e32b262ae6de9ffaa15ce67459124
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
9ea7f0a7844cada198d1e8a28343cc081d3631c716c9dd53d889e4b7feae04ac
a0eb42520982efbbc3c8d31bd13cfcaa41760f0508c5d7af4c9f060636dab456
a1178431e9eda23a8b300e44bd92c6cbd7aad17521d38dd48498ed15a200e7b2
ae407e415a45b6c720d8d61fef8c28756883d0f546a64e7a2969d6174c669951
cf072ac1901e9d2582d3c166232bc822be23ee22e68e32b1a3c0fedb71ee6e22
d9bac1aefff045998fd064ed279defcd96c37a53ee0ee3816d1ebab19c1ff739
deb4f380aa26737b0f32929f38c92cfa1786e9220be58ea5b52a9327d2ff177b
eef948e1d511bd86ff673f904bf0a97106d5395f0b7ed2cfb043da7ccc6ca6dd
f5ad281550973d504d44461f539870ea853fb4ba5dafc538a22f43310a630c3b

6e0549caa8d7.ngrok.io Open in urlscan Pro 2600:1f16:d83:1202::6e:5 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

30 Requests

97 %HTTPS

100 %IPv6

6 Domains

8 Subdomains

10 IPs

2 Countries

1343 kBTransfer

2913 kBSize

1 Cookies

10 Outgoing links

Redirected requests

30 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

6e0549caa8d7.ngrok.io Open in urlscan Pro
2600:1f16:d83:1202::6e:5 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

30
Requests

97 %
HTTPS

100 %
IPv6

6
Domains

8
Subdomains

10
IPs

2
Countries

1343 kB
Transfer

2913 kB
Size

1
Cookies

30 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!