ams-business-7.hostwindsdns.com
Open in
urlscan Pro
192.236.176.147
Malicious Activity!
Public Scan
Submission: On April 22 via automatic, source phishtank
Summary
TLS certificate: Issued by COMODO RSA Domain Validation Secure S... on July 8th 2017. Valid for: 3 years.
This is the only time ams-business-7.hostwindsdns.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Netflix (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 9 | 192.236.176.147 192.236.176.147 | 54290 (HOSTWINDS) (HOSTWINDS) | |
3 | 2a00:86c0:209... 2a00:86c0:2090::1 | 40027 (NETFLIX-ASN) (NETFLIX-ASN) | |
3 | 2a00:86c0:209... 2a00:86c0:2091::1 | 40027 (NETFLIX-ASN) (NETFLIX-ASN) | |
2 | 2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3 | 32934 (FACEBOOK) (FACEBOOK) | |
1 | 2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de | 32934 (FACEBOOK) (FACEBOOK) | |
17 | 5 |
ASN54290 (HOSTWINDS, US)
PTR: amsbs13.hostwindsdns.com
ams-business-7.hostwindsdns.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
hostwindsdns.com
1 redirects
ams-business-7.hostwindsdns.com |
102 KB |
6 |
nflxext.com
codex.nflxext.com assets.nflxext.com |
655 KB |
2 |
facebook.net
connect.facebook.net |
117 KB |
1 |
facebook.com
www.facebook.com |
|
17 | 4 |
Domain | Requested by | |
---|---|---|
9 | ams-business-7.hostwindsdns.com |
1 redirects
ams-business-7.hostwindsdns.com
codex.nflxext.com |
3 | assets.nflxext.com |
ams-business-7.hostwindsdns.com
|
3 | codex.nflxext.com |
ams-business-7.hostwindsdns.com
|
2 | connect.facebook.net |
codex.nflxext.com
connect.facebook.net |
1 | www.facebook.com |
connect.facebook.net
|
17 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
help.netflix.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.hostwindsdns.com COMODO RSA Domain Validation Secure Server CA |
2017-07-08 - 2020-07-07 |
3 years | crt.sh |
*.1.nflxso.net DigiCert SHA2 Secure Server CA |
2020-04-08 - 2020-05-10 |
a month | crt.sh |
*.facebook.com DigiCert SHA2 High Assurance Server CA |
2020-03-01 - 2020-05-30 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://ams-business-7.hostwindsdns.com/~tupxyyaq/netflix/
Frame ID: 4C125449BE5134822CC7076F9E818B3C
Requests: 17 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://ams-business-7.hostwindsdns.com/~tupxyyaq/netflix
HTTP 301
https://ams-business-7.hostwindsdns.com/~tupxyyaq/netflix/ Page URL
Detected technologies
LiteSpeed (Web Servers) ExpandDetected patterns
- headers server /^LiteSpeed$/i
Facebook (Widgets) Expand
Detected patterns
- script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: Nutzungsbedingungen
Search URL Search Domain Scan URL
Title: Datenschutzerklärung
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://ams-business-7.hostwindsdns.com/~tupxyyaq/netflix
HTTP 301
https://ams-business-7.hostwindsdns.com/~tupxyyaq/netflix/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
ams-business-7.hostwindsdns.com/~tupxyyaq/netflix/ Redirect Chain
|
315 KB 73 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
none
codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-js-v8a213ece/js/js/bootstrap.js,common%7Cbootstrap.js/2/4N024p4o4a4r0b4d464w4M050q004O4u4j4y4s4H4e4x4m4A090X014J/bck/true/ |
9 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
none
codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-js-v8a213ece/js/js/components%7Clogin%7CloginControllerClient.js/2/4N024p4o4a4r0b4d464w4M050q004O4u4j4y4s4H4e4x4m4A090X014J/l/true/ |
720 KB 223 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WebsiteDetect
ams-business-7.hostwindsdns.com/personalization/cl2/freeform/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
none
codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-css-v8a213ece/css/css/less%7Clogin%7CloginBase.less,less%7Cpages%7Clogin%7CLogin.less/1/PBIasD3zCh9HNO/none/true/ |
158 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
AT-de-20190916-popsignuptwoweeks-perspective_alpha_website_large.jpg
assets.nflxext.com/ffe/siteui/vlv3/296ad965-b50d-4897-b294-2bc6b56246d8/0fddbd1b-9cdf-4963-9578-bd36f321b65c/ |
329 KB 329 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
FB-f-Logo__blue_57.png
assets.nflxext.com/ffe/siteui/login/images/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WebsiteDetect
ams-business-7.hostwindsdns.com/personalization/cl2/freeform/ |
10 KB 5 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WebsiteScreen
ams-business-7.hostwindsdns.com/personalization/cl2/freeform/ |
10 KB 5 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nf-icon-v1-93.woff
assets.nflxext.com/ffe/siteui/fonts/ |
72 KB 72 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sdk.js
connect.facebook.net/de_AT/ |
3 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
log
ams-business-7.hostwindsdns.com/personalization/ |
10 KB 5 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sdk.js
connect.facebook.net/en_US/ |
394 KB 115 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
status
www.facebook.com/x/oauth/ |
0 0 |
Fetch
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
cl2
ams-business-7.hostwindsdns.com/personalization/ |
10 KB 5 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
cl2
ams-business-7.hostwindsdns.com/personalization/ |
10 KB 5 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
cl2
ams-business-7.hostwindsdns.com/personalization/ |
10 KB 5 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Netflix (Online)12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate object| netflix object| Codex object| C object| global object| process object| util function| jQuery object| jQuery111106353234114579287 function| fbAsyncInit object| FB2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.ams-business-7.hostwindsdns.com/ | Name: cL Value: 1587573635345%7C1587573635426267%7C158757363561981936%7C%7C4%7Cnull |
|
ams-business-7.hostwindsdns.com/ | Name: PHPSESSID Value: q088u89atnf5fbkggpjir2ihg1 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ams-business-7.hostwindsdns.com
assets.nflxext.com
codex.nflxext.com
connect.facebook.net
www.facebook.com
192.236.176.147
2a00:86c0:2090::1
2a00:86c0:2091::1
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
115d5d82df4deb0ff18f802238fa416fb5aaeb27f5be3382e37c1c9ed3348f52
3811f704fb719ed03eeb6eec4f549c0bb1685baf25d69c89f42bc747a8ee0af7
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
45e32bd8adb153a0ecc4b0e37323924856d45d8e228cfa84063904333775400b
5868f46dceecdfe25647f1a9ed416d4538bb594922a70bc7aa0fdc8626ca4b99
5de45d2ff1e3fd873234fa24a3b4c942909dd1a4ebdfa626bb02d1dff934c04f
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
a425ac194b2f8e00693036baea1658df3d28e7c8791cc4156a9e26103346b807
c8ee96e2e7390a2f2e3b8a4465a47b4fb64786e69b6aafb0fac82007c3c6830c
cd2b9e5ddc13a1633f8f8c17382b5a9c9ac651c16b626349dbb4b576cd4a6b79
dfd3751ae3b1e1ad0daf621265db930a88bf952d09ff7ac8f87d6a2f82163a6d
f1c613c48b89e74edec48c9caf417aab528e9f13b8386c5675c462fa0c1370c5
f5167b3bf22bb92754a8247438bb88cbe123fdc6049379ea0f64dcfc8c71e079