main.d29o0525iojzp5.amplifyapp.com
Open in
urlscan Pro
13.35.253.78
Malicious Activity!
Public Scan
Submitted URL: https://main.d29o0525iojzp5.amplifyapp.com/ads.html?account.netflix%20.com/signup?action=startAction&locale=en-NG
Effective URL: https://main.d29o0525iojzp5.amplifyapp.com/ads.html?account.netflix%20.com/signup?action=startAction&locale=en-NG
Submission: On October 18 via manual from IE — Scanned from DE
Effective URL: https://main.d29o0525iojzp5.amplifyapp.com/ads.html?account.netflix%20.com/signup?action=startAction&locale=en-NG
Submission: On October 18 via manual from IE — Scanned from DE
Summary
This website contacted 5 IPs
in 1 countries
across 5 domains to perform 17 HTTP transactions.
The main IP is 13.35.253.78, located in
United States and
belongs to AMAZON-02, US.
The main domain is main.d29o0525iojzp5.amplifyapp.com.
TLS certificate: Issued by Amazon on October 13th 2021. Valid for: a year.
This is the only time main.d29o0525iojzp5.amplifyapp.com was scanned on urlscan.io!
TLS certificate: Issued by Amazon on October 13th 2021. Valid for: a year.
This is the only time main.d29o0525iojzp5.amplifyapp.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Netflix (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 5 | 13.35.253.78 13.35.253.78 | 16509 (AMAZON-02) (AMAZON-02) | |
| 1 | 209.126.105.197 209.126.105.197 | 30083 (AS-30083-...) (AS-30083-GO-DADDY-COM-LLC) | |
| 1 3 | 91.235.133.103 91.235.133.103 | 30286 (THM) (THM) | |
| 8 | 45.57.90.1 45.57.90.1 | 2906 (AS-SSI) (AS-SSI) | |
| 17 | 5 |
5
13.35.253.78
(United States)
ASN16509 (AMAZON-02, US)
PTR: server-13-35-253-78.fra6.r.cloudfront.net
ASN16509 (AMAZON-02, US)
PTR: server-13-35-253-78.fra6.r.cloudfront.net
| main.d29o0525iojzp5.amplifyapp.com |
1
209.126.105.197
(St Louis, United States)
ASN30083 (AS-30083-GO-DADDY-COM-LLC, US)
PTR: huracan.quadkore7.com
ASN30083 (AS-30083-GO-DADDY-COM-LLC, US)
PTR: huracan.quadkore7.com
| creedmoria.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 8 |
nflxext.com
assets.nflxext.com |
88 KB |
| 5 |
amplifyapp.com
main.d29o0525iojzp5.amplifyapp.com |
99 KB |
| 3 |
netflix.com
1 redirects
secured.netflix.com |
1 KB |
| 1 |
creedmoria.com
creedmoria.com |
|
| 0 |
transconpackaging.com
Failed
css.transconpackaging.com Failed |
|
| 17 | 5 |
| Domain | Requested by | |
|---|---|---|
| 8 | assets.nflxext.com |
main.d29o0525iojzp5.amplifyapp.com
|
| 5 | main.d29o0525iojzp5.amplifyapp.com |
main.d29o0525iojzp5.amplifyapp.com
|
| 3 | secured.netflix.com |
1 redirects
main.d29o0525iojzp5.amplifyapp.com
|
| 1 | creedmoria.com |
main.d29o0525iojzp5.amplifyapp.com
|
| 0 | css.transconpackaging.com Failed |
main.d29o0525iojzp5.amplifyapp.com
|
| 17 | 5 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.d29o0525iojzp5.amplifyapp.com Amazon |
2021-10-13 - 2022-11-11 |
a year | crt.sh |
| *.creedmoria.com R3 |
2021-03-31 - 2021-06-29 |
3 months | crt.sh |
| secured.netflix.com DigiCert SHA2 Secure Server CA |
2021-01-08 - 2022-02-08 |
a year | crt.sh |
| *.1.nflxso.net DigiCert TLS RSA SHA256 2020 CA1 |
2021-10-06 - 2021-11-06 |
a month | crt.sh |
This page contains 1 frames:
Primary Page:
https://main.d29o0525iojzp5.amplifyapp.com/ads.html?account.netflix%20.com/signup?action=startAction&locale=en-NG
Frame ID: 559799294F392207277B2EC6A5C480A4
Requests: 17 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 5- https://secured.netflix.com/fp/clear.png?org_id=lg9m47ph&session_id=5CE021D3-BEAA-E720-E22E-95203DE22096&m=2 HTTP 302
- https://secured.netflix.com/fp/clear.png?org_id=lg9m47ph&session_id=5ce021d3-beaa-e720-e22e-95203de22096&k=1
17 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
ads.html
main.d29o0525iojzp5.amplifyapp.com/ |
54 KB 19 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
none.css
main.d29o0525iojzp5.amplifyapp.com/style/css/ |
106 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
none1.css
main.d29o0525iojzp5.amplifyapp.com/style/css/ |
127 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
login,css
creedmoria.com/wordpress/img/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.min.js
main.d29o0525iojzp5.amplifyapp.com/style/js/ |
95 KB 33 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.validate.min.js
main.d29o0525iojzp5.amplifyapp.com/style/js/ |
23 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
clear.png
secured.netflix.com/fp/ Redirect Chain
|
81 B 474 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
login.jpg
css.transconpackaging.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Lock.png
assets.nflxext.com/ffe/siteui/acquisition/simplicity/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Devices.png
assets.nflxext.com/ffe/siteui/acquisition/simplicity/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
nf-icon-v1-88.woff
assets.nflxext.com/ffe/siteui/fonts/ |
69 KB 69 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
site-spinner-240-light.png
assets.nflxext.com/ffe/siteui/common/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
12_11_2014_icon_visa_37x25.png
assets.nflxext.com/ffe/siteui/acquisition/payment/ |
859 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
10_18_2014_icon_master_37x25.png
assets.nflxext.com/ffe/siteui/acquisition/payment/ |
833 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
10_18_2014_icon_amex_37x25.png
assets.nflxext.com/ffe/siteui/acquisition/payment/ |
525 B 844 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
10_18_2014_icon_discovery_37x25.png
assets.nflxext.com/ffe/siteui/acquisition/payment/ |
886 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
clear.png
secured.netflix.com/fp/ |
81 B 474 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- css.transconpackaging.com
- URL
- http://css.transconpackaging.com/login.jpg
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Netflix (Online)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect boolean| originAgentCluster object| netflix function| openNav function| closeNav function| $ function| jQuery1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| secured.netflix.com/ | Name: thx_guid Value: 4d55049a0d474a2186f3d92f9be17996 |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
assets.nflxext.com
creedmoria.com
css.transconpackaging.com
main.d29o0525iojzp5.amplifyapp.com
secured.netflix.com
css.transconpackaging.com
13.35.253.78
209.126.105.197
45.57.90.1
91.235.133.103
14e90a33a528f27f5445a17fa9bf2e48cd6db1f37884bfd72c04afc47404821b
4958e4d47607004834b13d3c29d91f8c15b2ab2c488a15d9745a039e970f0bf3
4da1b557c188d9cc0a780d2b2881b7c6178f3419a90602728d4dfe09544c2a19
5a7ed665f614fe2c62e79a477715dd18c8afae67f7c580bc049e013feb2864b7
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
694668a605f294bff15137923aadc4576ef0fbc158f035e1bcedf521a6cf1fd8
7942ad062144dddfb55956fee22cc66e7aa18f5ae080a4b086b09efbf6ea29d8
7ed65da4bcdc5f0f68d20f2b489f2f1e4df6d5b1235ece01afd24624126be504
95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743
998d986954afdd4a51b968652d8cc7d34cb17d847c93ba2fde2f70b8a9a6ca73
a309d09926f567f4415df64e618f32fabd75c49108667fd6021f7765d7193a4f
ab005cc776a44d7427fb34ebd18fd4a0f5a7d0c2c2a6b2c94cc96c594ae019b3
ba892f7903e737d06c952be4ed3266746ed5e1090377fbc5d2ac975626c4533a
cc5859d74f8cde62e1cdeeea341f85f9725d4f4398f58203aa1e5080faf1685a