xs511932.xsrv.jp Open in urlscan Pro
202.233.67.145  Malicious Activity! Public Scan

2 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response xs511932.xsrv.jp/GOOLKOOL/67dbda5a9527e7f2bd4798f897b41c44/	323 KB 85 KB	1626ms 1600ms	Document text/html	202.233.67.145 XSERVER Xserver Inc.
General Check archive.org Show headers Download Go to Full URL http://xs511932.xsrv.jp/GOOLKOOL/67dbda5a9527e7f2bd4798f897b41c44/ Protocol HTTP/1.1 Server 202.233.67.145 , Japan, ASN131965 (XSERVER Xserver Inc., JP), Reverse DNS sv12624.xserver.jp Software nginx / Resource Hash f37cf194fe757525ca8f2929a57b542621845ccb09fa4a45e0aa89edd99773c2 Request headers Host xs511932.xsrv.jp Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Server nginx Date Mon, 02 Aug 2021 01:38:49 GMT Content-Type text/html; charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Vary Accept-Encoding Content-Encoding gzip
GET H/1.1	200 OK	none Show response codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-js-mk-vd3ac2e8a/js/js/bootstrap.js,common%7Cbootstrap.js/2/4Z034u4t4e4w084h4a4A4Y060u004_4z4C4x0f4Q4O4M4i4B4r4E024U/bck/true/	9 KB 4 KB	20ms 6ms	Script application/javascript	2a00:86c0:2091::1 NETFLIX-ASN
General Check archive.org Show headers Download Go to Full URL https://codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-js-mk-vd3ac2e8a/js/js/bootstrap.js,common%7Cbootstrap.js/2/4Z034u4t4e4w084h4a4A4Y060u004_4z4C4x0f4Q4O4M4i4B4r4E024U/bck/true/none Requested by Host: xs511932.xsrv.jp URL: http://xs511932.xsrv.jp/GOOLKOOL/67dbda5a9527e7f2bd4798f897b41c44/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US), Reverse DNS Software nginx / Resource Hash 015a58aba75e0e8eed3a5ae186a423fec5f0b7b735666049f83d8febb46b06b1 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer http://xs511932.xsrv.jp/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 02 Aug 2021 01:38:49 GMT Content-Encoding gzip X-Content-Type-Options nosniff Server nginx Content-Type application/javascript; charset=UTF-8 Access-Control-Allow-Origin * Cache-Control public, max-age=16070400 req_id f49ff2f3-22d7-4fa2-a2e7-de56c32f08b5 Connection keep-alive Timing-Allow-Origin https://www.netflix.com Content-Length 3484 Expires Thu, 27 Jan 2022 23:40:24 GMT
GET H/1.1	200 OK	none Show response codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-js-mk-vd3ac2e8a/js/js/components%7Clogin%7CloginControllerClient.js/2/4Z034u4t4e4w084h4a4A4Y060u004_4z4C4x0f4Q4O4M4i4B4r4E024U/l/true/	666 KB 209 KB	22ms 5ms	Script application/javascript	2a00:86c0:2091::1 NETFLIX-ASN
General Check archive.org Show headers Download Go to Full URL https://codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-js-mk-vd3ac2e8a/js/js/components%7Clogin%7CloginControllerClient.js/2/4Z034u4t4e4w084h4a4A4Y060u004_4z4C4x0f4Q4O4M4i4B4r4E024U/l/true/none Requested by Host: xs511932.xsrv.jp URL: http://xs511932.xsrv.jp/GOOLKOOL/67dbda5a9527e7f2bd4798f897b41c44/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US), Reverse DNS Software nginx / Resource Hash b2482301af1ac6d03a5f2eb91520f1e472302130011bcde9d78c5c829cce2e47 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer http://xs511932.xsrv.jp/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 02 Aug 2021 01:38:49 GMT Content-Encoding gzip X-Content-Type-Options nosniff Server nginx Content-Type application/javascript; charset=UTF-8 Access-Control-Allow-Origin * Cache-Control public, max-age=16070400 req_id c79d482f-3ff4-4fff-a217-b9aa87615351 Connection keep-alive Timing-Allow-Origin https://www.netflix.com Content-Length 213119 Expires Thu, 03 Feb 2022 16:10:08 GMT
GET H/1.1	404 Not Found	WebsiteDetect xs511932.xsrv.jp/personalization/cl2/freeform/	0 0	568ms 543ms	Stylesheet text/html	202.233.67.145 XSERVER Xserver Inc.
General Check archive.org Show headers Download Go to Full URL http://xs511932.xsrv.jp/personalization/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=css&modalView=login Requested by Host: xs511932.xsrv.jp URL: http://xs511932.xsrv.jp/GOOLKOOL/67dbda5a9527e7f2bd4798f897b41c44/ Protocol HTTP/1.1 Server 202.233.67.145 , Japan, ASN131965 (XSERVER Xserver Inc., JP), Reverse DNS sv12624.xserver.jp Software nginx / Resource Hash Request headers Pragma no-cache Accept-Encoding gzip, deflate Host xs511932.xsrv.jp Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/css,*/*;q=0.1 Referer http://xs511932.xsrv.jp/GOOLKOOL/67dbda5a9527e7f2bd4798f897b41c44/ Connection keep-alive Cache-Control no-cache Referer http://xs511932.xsrv.jp/GOOLKOOL/67dbda5a9527e7f2bd4798f897b41c44/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 02 Aug 2021 01:38:50 GMT Content-Encoding gzip Last-Modified Tue, 13 Apr 2021 08:18:59 GMT Server nginx ETag W/"afe-5bfd6483ff8fd" Vary Accept-Encoding Content-Type text/html Transfer-Encoding chunked Connection keep-alive
GET H/1.1	200 OK	none codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-css-vd3ac2e8a/css/css/less%7Clogin%7CloginBase.less,less%7Cpages%7Clogin%7CLogin.less/1/AI4rD9CNTKEHSPW/none/true/	124 KB 21 KB	19ms 6ms	Stylesheet text/css	2a00:86c0:2091::1 NETFLIX-ASN
General Check archive.org Show headers Download Go to Full URL https://codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-css-vd3ac2e8a/css/css/less%7Clogin%7CloginBase.less,less%7Cpages%7Clogin%7CLogin.less/1/AI4rD9CNTKEHSPW/none/true/none Requested by Host: xs511932.xsrv.jp URL: http://xs511932.xsrv.jp/GOOLKOOL/67dbda5a9527e7f2bd4798f897b41c44/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US), Reverse DNS Software nginx / Resource Hash 154e9866c94f43a17d75aed32adc27020f95f614232f8b3cfedd7fc4bf2a48d3 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer http://xs511932.xsrv.jp/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 02 Aug 2021 01:38:49 GMT Content-Encoding gzip X-Content-Type-Options nosniff Server nginx Content-Type text/css; charset=UTF-8 Access-Control-Allow-Origin * Cache-Control public, max-age=16070400 req_id 82bfea0e-d311-4221-82a5-097c3d7c903f Connection keep-alive Timing-Allow-Origin https://www.netflix.com Content-Length 20746 Expires Thu, 27 Jan 2022 09:58:10 GMT
GET H/1.1	200 OK	ES-es-20190311-popsignuptwoweeks-perspective_alpha_website_large.jpg assets.nflxext.com/ffe/siteui/vlv3/8428eba7-ed9f-44a5-b263-496900005b56/3ecbf985-674a-4c66-a88c-07a6c34a5362/	341 KB 341 KB	385ms 371ms	Image image/jpeg	2a00:86c0:2091::1 NETFLIX-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://assets.nflxext.com/ffe/siteui/vlv3/8428eba7-ed9f-44a5-b263-496900005b56/3ecbf985-674a-4c66-a88c-07a6c34a5362/ES-es-20190311-popsignuptwoweeks-perspective_alpha_website_large.jpg Requested by Host: xs511932.xsrv.jp URL: http://xs511932.xsrv.jp/GOOLKOOL/67dbda5a9527e7f2bd4798f897b41c44/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US), Reverse DNS Software nginx / Resource Hash 8d842cf193c0b64aa139855e78fa16a4900c6df4491f015d6b2d7798f061ec48 Request headers Referer http://xs511932.xsrv.jp/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 02 Aug 2021 01:38:50 GMT Last-Modified Wed, 13 Mar 2019 13:39:46 GMT Server nginx Content-MD5 s2ynmclL/8FCrzyRSd+5KA== Content-Type image/jpeg Cache-Control max-age=604801 Connection keep-alive Accept-Ranges bytes Content-Length 349058 Expires Mon, 09 Aug 2021 01:38:50 GMT
GET H/1.1	404 Not Found	WebsiteDetect Show response xs511932.xsrv.jp/personalization/cl2/freeform/	3 KB 2 KB	285ms 285ms	XHR text/html	202.233.67.145 XSERVER Xserver Inc.
General Check archive.org Show headers Download Go to Full URL http://xs511932.xsrv.jp/personalization/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=js&modalView=login Requested by Host: xs511932.xsrv.jp URL: http://xs511932.xsrv.jp/GOOLKOOL/67dbda5a9527e7f2bd4798f897b41c44/ Protocol HTTP/1.1 Server 202.233.67.145 , Japan, ASN131965 (XSERVER Xserver Inc., JP), Reverse DNS sv12624.xserver.jp Software nginx / Resource Hash d365165afdcb6f4108f403153aa460fd81c69824524df90d8a9ed4853f82e49f Request headers Pragma no-cache Accept-Encoding gzip, deflate Host xs511932.xsrv.jp Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept */* Referer http://xs511932.xsrv.jp/GOOLKOOL/67dbda5a9527e7f2bd4798f897b41c44/ Connection keep-alive Cache-Control no-cache Referer http://xs511932.xsrv.jp/GOOLKOOL/67dbda5a9527e7f2bd4798f897b41c44/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 02 Aug 2021 01:38:50 GMT Content-Encoding gzip Last-Modified Tue, 13 Apr 2021 08:18:59 GMT Server nginx ETag W/"afe-5bfd6483ff8fd" Vary Accept-Encoding Content-Type text/html Transfer-Encoding chunked Connection keep-alive
GET H/1.1	404 Not Found	WebsiteScreen Show response xs511932.xsrv.jp/personalization/cl2/freeform/	3 KB 2 KB	315ms 308ms	XHR text/html	202.233.67.145 XSERVER Xserver Inc.
General Check archive.org Show headers Download Go to Full URL http://xs511932.xsrv.jp/personalization/cl2/freeform/WebsiteScreen?source=wwwhead&fetchType=js&winw=1600&winh=1200&screenw=1600&screenh=1200&ratio=1 Requested by Host: xs511932.xsrv.jp URL: http://xs511932.xsrv.jp/GOOLKOOL/67dbda5a9527e7f2bd4798f897b41c44/ Protocol HTTP/1.1 Server 202.233.67.145 , Japan, ASN131965 (XSERVER Xserver Inc., JP), Reverse DNS sv12624.xserver.jp Software nginx / Resource Hash d365165afdcb6f4108f403153aa460fd81c69824524df90d8a9ed4853f82e49f Request headers Pragma no-cache Accept-Encoding gzip, deflate Host xs511932.xsrv.jp Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept */* Referer http://xs511932.xsrv.jp/GOOLKOOL/67dbda5a9527e7f2bd4798f897b41c44/ Connection keep-alive Cache-Control no-cache Referer http://xs511932.xsrv.jp/GOOLKOOL/67dbda5a9527e7f2bd4798f897b41c44/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 02 Aug 2021 01:38:50 GMT Content-Encoding gzip Last-Modified Tue, 13 Apr 2021 08:18:59 GMT Server nginx ETag W/"afe-5bfd6483ff8fd" Vary Accept-Encoding Content-Type text/html Transfer-Encoding chunked Connection keep-alive
GET H/1.1	200 OK	nf-icon-v1-93.woff assets.nflxext.com/ffe/siteui/fonts/	72 KB 72 KB	18ms 5ms	Font font/woff	2a00:86c0:2091::1 NETFLIX-ASN
General Check archive.org Show headers Download Go to Full URL https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-93.woff Requested by Host: codex.nflxext.com URL: https://codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-css-vd3ac2e8a/css/css/less%7Clogin%7CloginBase.less,less%7Cpages%7Clogin%7CLogin.less/1/AI4rD9CNTKEHSPW/none/true/none Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US), Reverse DNS Software nginx / Resource Hash 98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d Request headers Origin http://xs511932.xsrv.jp Referer https://codex.nflxext.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 02 Aug 2021 01:38:50 GMT Last-Modified Mon, 29 Jan 2018 01:50:51 GMT Server nginx Content-MD5 fPYVbMSBJEtaJUNi17c/AA== Content-Type font/woff Access-Control-Allow-Origin * Cache-Control max-age=604801 Connection keep-alive Accept-Ranges bytes Content-Length 73572 Expires Fri, 06 Aug 2021 22:05:52 GMT
POST H/1.1	404 Not Found	log Show response xs511932.xsrv.jp/personalization/	3 KB 2 KB	453ms 453ms	XHR text/html	202.233.67.145 XSERVER Xserver Inc.
General Check archive.org Show headers Download Go to Full URL http://xs511932.xsrv.jp/personalization/log Requested by Host: codex.nflxext.com URL: https://codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-js-mk-vd3ac2e8a/js/js/components%7Clogin%7CloginControllerClient.js/2/4Z034u4t4e4w084h4a4A4Y060u004_4z4C4x0f4Q4O4M4i4B4r4E024U/l/true/none Protocol HTTP/1.1 Server 202.233.67.145 , Japan, ASN131965 (XSERVER Xserver Inc., JP), Reverse DNS sv12624.xserver.jp Software nginx / Resource Hash d365165afdcb6f4108f403153aa460fd81c69824524df90d8a9ed4853f82e49f Request headers Pragma no-cache Origin http://xs511932.xsrv.jp Accept-Encoding gzip, deflate Host xs511932.xsrv.jp Accept-Language en-US X-Requested-With XMLHttpRequest Content-Type application/json Accept */* Cache-Control no-cache X-Netflix.ichnaea.request.type UiRequest Cookie cL=1627868330588%7C162786833042670617%7C16278683301018425%7C%7C4%7Cundefined Connection keep-alive Referer http://xs511932.xsrv.jp/GOOLKOOL/67dbda5a9527e7f2bd4798f897b41c44/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Length 1460 Accept */* Referer http://xs511932.xsrv.jp/GOOLKOOL/67dbda5a9527e7f2bd4798f897b41c44/ X-Netflix.ichnaea.request.type UiRequest X-Requested-With XMLHttpRequest User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type application/json Response headers Date Mon, 02 Aug 2021 01:38:50 GMT Content-Encoding gzip Last-Modified Tue, 13 Apr 2021 08:18:59 GMT Server nginx ETag W/"afe-5bfd6483ff8fd" Vary Accept-Encoding Content-Type text/html Transfer-Encoding chunked Connection keep-alive

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| Codex object| C object| global object| process object| netflix object| util function| jQuery object| jQuery111107912624647605084

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.xs511932.xsrv.jp/	1969-12-31 23:59:59	Name: cL Value: 1627868330588%7C162786833042670617%7C16278683301018425%7C%7C4%7Cundefined

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.nflxext.com
codex.nflxext.com
xs511932.xsrv.jp
202.233.67.145
2a00:86c0:2091::1
015a58aba75e0e8eed3a5ae186a423fec5f0b7b735666049f83d8febb46b06b1
154e9866c94f43a17d75aed32adc27020f95f614232f8b3cfedd7fc4bf2a48d3
8d842cf193c0b64aa139855e78fa16a4900c6df4491f015d6b2d7798f061ec48
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
b2482301af1ac6d03a5f2eb91520f1e472302130011bcde9d78c5c829cce2e47
d365165afdcb6f4108f403153aa460fd81c69824524df90d8a9ed4853f82e49f
f37cf194fe757525ca8f2929a57b542621845ccb09fa4a45e0aa89edd99773c2