![](/screenshots/5f104248-21f6-4052-bb45-2b77017ba145.png)
myservices-issue-info-resolve.com
Open in
urlscan Pro
185.156.72.17
Malicious Activity!
Public Scan
Effective URL: https://myservices-issue-info-resolve.com/au_login?sslchannel=true&sessionid=tXerif8Oeh1zjWo4cijd3angYyH9HL8JFI02NOCU7rAWA9DWHoYRRbCm6Jb5v...
Submission: On July 16 via automatic, source urlscan-observe — Scanned from GB
Summary
TLS certificate: Issued by R3 on July 10th 2023. Valid for: 3 months.
This is the only time myservices-issue-info-resolve.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Netflix (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 11 | 185.156.72.17 185.156.72.17 | 61432 (VAIZ-AS I...) (VAIZ-AS ITBks892) | |
10 | 1 |
ASN61432 (VAIZ-AS ITBks892, UA)
myservices-issue-info-resolve.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
11 |
myservices-issue-info-resolve.com
1 redirects
myservices-issue-info-resolve.com |
543 KB |
10 | 1 |
Domain | Requested by | |
---|---|---|
11 | myservices-issue-info-resolve.com |
1 redirects
myservices-issue-info-resolve.com
|
10 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.myservices-issue-info-resolve.com R3 |
2023-07-10 - 2023-10-08 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://myservices-issue-info-resolve.com/au_login?sslchannel=true&sessionid=tXerif8Oeh1zjWo4cijd3angYyH9HL8JFI02NOCU7rAWA9DWHoYRRbCm6Jb5vGFHQKSqwTu7VW6mOa0n7cF1a1iURFpvpxNftt32AuNj8yzwGAROhC5Y3XTn2aTtkbgnEr
Frame ID: 66621424CE81134647BFD792A9CC178C
Requests: 10 HTTP requests in this frame
Screenshot
![](/screenshots/5f104248-21f6-4052-bb45-2b77017ba145.png)
Page Title
NetflixPage URL History Show full URLs
-
https://myservices-issue-info-resolve.com/
HTTP 302
https://myservices-issue-info-resolve.com/au_login?sslchannel=true&sessionid=tXerif8Oeh1zjWo4cijd3angYyH9HL8JFI02NOCU7... Page URL
Detected technologies
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://myservices-issue-info-resolve.com/
HTTP 302
https://myservices-issue-info-resolve.com/au_login?sslchannel=true&sessionid=tXerif8Oeh1zjWo4cijd3angYyH9HL8JFI02NOCU7rAWA9DWHoYRRbCm6Jb5vGFHQKSqwTu7VW6mOa0n7cF1a1iURFpvpxNftt32AuNj8yzwGAROhC5Y3XTn2aTtkbgnEr Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
au_login
myservices-issue-info-resolve.com/ Redirect Chain
|
214 KB 8 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
error-page.b122c37502204303115a.css
myservices-issue-info-resolve.com/nfu_assetz/css/ |
9 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loginBase.db4481459b483cc78012.css
myservices-issue-info-resolve.com/nfu_assetz/css/ |
44 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Login.fcd0c98cb56a9e2b00f0.css
myservices-issue-info-resolve.com/nfu_assetz/css/ |
80 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
GB-en-20230306-popsignuptwoweeks-perspective_alpha_website_large.jpg
myservices-issue-info-resolve.com/nfu_assetz/img/ |
301 KB 301 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
myservices-issue-info-resolve.com/nfu_assetz/js/ |
87 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
misc.js
myservices-issue-info-resolve.com/nfu_assetz/js/ |
16 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
NetflixSans_W_Rg.woff2
myservices-issue-info-resolve.com/nfu_assetz/fonts/ |
52 KB 52 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
NetflixSans_W_Md.woff2
myservices-issue-info-resolve.com/nfu_assetz/fonts/ |
53 KB 53 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
nf-icon-v1-93.woff
myservices-issue-info-resolve.com/nfu_assetz/fonts/ |
72 KB 72 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Netflix (Online)6 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| onbeforetoggle object| onscrollend function| $ function| jQuery object| $jscomp1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
myservices-issue-info-resolve.com/ | Name: PHPSESSID Value: 14e9af5a9cb78e4fb58b55617e964173 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
myservices-issue-info-resolve.com
185.156.72.17
386a1062fb0a2e06ebc4e7268b5bbe338d90a14dc0f6dc461ab804502f5400fd
475575a56670c4ab3f05ca4b001674bbea9e6cbacaf9e0c0f2527a1aacdb9731
6e123e9feef2d2bf4e35b6c13f5040e7ebb00fe7b9306d210ee541aa690aa576
88bba823c928128c8082909680e12721b7c8eca71cc56562595abf407f488fd0
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
9ac2bd03fcde501b3f30f47ab1fae62161f87808ea6411f38e8feaa4bbddc42e
c0bceb927c506dce9f6e6f5f570e641ad580b9554be06f61508a4aee32380167
c37838652b66512cf2d2238f55c21a20be726e36712344e687a32d09c785f614
ce9d07500ad91ec2b524c270764ec4c9a33e78320d8d374ec400ede488f6251b
ee3f37a0800e0605cad0edd949e73df43ed3944a1c130b145cd2ef09f44dd7a2