urlscan.io logo urlscan.io
SecurityTrails logo

demo2.cloudwp.dev Open in urlscan Pro
151.139.128.10  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://ilnetraceflix.b-cdn.net/traces.html
Effective URL: https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login?netflix_id=&country=&iso=
Submission: On December 28 via manual from IL — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 3 countries across 3 domains to perform 14 HTTP transactions. The main IP is 151.139.128.10, located in United States and belongs to STACKPATH-CDN, US. The main domain is demo2.cloudwp.dev.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on March 22nd 2022. Valid for: a year.
This is the only time demo2.cloudwp.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

IP Address AS Autonomous System
1 138.199.36.9 60068 (CDN77 ^_^)
1 1 46.101.22.196 14061 (DIGITALOC...)
1 14 151.139.128.10 20446 (STACKPATH...)
14 2
Apex Domain
Subdomains		 Transfer
14 cloudwp.dev
demo2.cloudwp.dev
175 KB
1 tanzaniaprinters.co.tz
tanzaniaprinters.co.tz
214 B
1 b-cdn.net
ilnetraceflix.b-cdn.net
602 B
14 3
Domain Requested by
14 demo2.cloudwp.dev 1 redirects ilnetraceflix.b-cdn.net
demo2.cloudwp.dev
1 tanzaniaprinters.co.tz 1 redirects
1 ilnetraceflix.b-cdn.net
14 3

This site contains no links.

Subject Issuer Validity Valid
*.b-cdn.net
Sectigo RSA Domain Validation Secure Server CA		 2022-11-07 -
2023-11-11		 a year crt.sh
*.cloudwp.dev
Sectigo RSA Domain Validation Secure Server CA		 2022-03-22 -
2023-04-22		 a year crt.sh

This page contains 2 frames:

Primary Page: https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login?netflix_id=&country=&iso=
Frame ID: ABD22B0379CDF32AB818CC053C2D3061
Requests: 11 HTTP requests in this frame

Frame: https://demo2.cloudwp.dev/sbbi/?sbbpg=sbbShell&gprid=rA
Frame ID: E5E64C85556DDC723AFE3F4142485548
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Netflix

Page URL History Show full URLs

  1. https://ilnetraceflix.b-cdn.net/traces.html Page URL
  2. https://tanzaniaprinters.co.tz//Bunny// HTTP 302
    https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/ HTTP 302
    https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login?netflix_id=&country=&iso= Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /wp-(?:content|includes)/

Page Statistics

14
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

2
IPs

3
Countries

175 kB
Transfer

201 kB
Size

8
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://ilnetraceflix.b-cdn.net/traces.html Page URL
  2. https://tanzaniaprinters.co.tz//Bunny// HTTP 302
    https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/ HTTP 302
    https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login?netflix_id=&country=&iso= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
traces.html
ilnetraceflix.b-cdn.net/ 		133 B
602 B 		Document
General
Check archive.org
Download Go to
Full URL
https://ilnetraceflix.b-cdn.net/traces.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
138.199.36.9 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
138-199-36-9.bunnyinfra.net
Software
BunnyCDN-DE1-1049 /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
public, max-age=2592000
cdn-cache
HIT
cdn-cachedat
12/27/2022 23:45:10
cdn-edgestorageid
1053
cdn-fileserver
383
cdn-proxyver
1.03
cdn-pullzone
1116623
cdn-requestcountrycode
DE
cdn-requestid
7b5f53276cf4fc8447b6ffe26317a784
cdn-requestpullcode
206
cdn-requestpullsuccess
True
cdn-status
200
cdn-storageserver
DE-164
cdn-uid
ad069e6d-4753-448a-ab27-12dc73ccae1d
content-encoding
gzip
content-type
text/html
date
Wed, 28 Dec 2022 08:27:17 GMT
last-modified
Tue, 27 Dec 2022 23:30:34 GMT
server
BunnyCDN-DE1-1049
vary
Accept-Encoding
Primary Request login
demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/
Redirect Chain
  • https://tanzaniaprinters.co.tz//Bunny//
  • https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/
  • https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login?netflix_id=&country=&iso=
11 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login?netflix_id=&country=&iso=
Requested by
Host: ilnetraceflix.b-cdn.net
URL: https://ilnetraceflix.b-cdn.net/traces.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
fbs / PHP/7.4.33
Resource Hash
a999fcb3941bd402672ccc19e1c57be35fe7ce5e7b3c20ab45313f2487e4404c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://ilnetraceflix.b-cdn.net/traces.html
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Wed, 28 Dec 2022 08:27:19 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
link
<https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login>; rel="canonical"
pragma
no-cache
server
fbs
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
x-hw
1672216039.cds056.fr8.hn,1672216039.cds001.fr8.sc,1672216039.waf1-node02-fra02.stackpath.systems.-.wx,1672216039.cds001.fr8.p
x-powered-by
PHP/7.4.33
x-proxy-cache
MISS
x-robots-tag
noindex, nofollow, noarchive, nosnippet
x-sp-metadata
HS256.CPeXsJ0GEocBCiQ2ZGM0MjBkOS0yYjMwLTQxMGEtOGMzOS0xMTJmNDAxYzA4N2QQ2J+KgafZ+wIaBgjn+6+dBiIMMzcuNTguNTguMjUwKPLGAjADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGiYSJGY2YmI4NDAyLWUyYWItNDg3OS1iNDk2LTVhYThjMTcyNjgzOCIaCAISFGNkczAwMS5mcjguaHdjZG4ubmV0GAg=.p34ajJ84Q0wQqwvy1zRf+zZ+lnBovqG6v3cUvUQZ9IQ=

Redirect headers

access-control-allow-origin
*
cache-control
no-store, no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
date
Wed, 28 Dec 2022 08:27:19 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
link
<https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/>; rel="canonical"
location
login?netflix_id=&country=&iso=
pragma
no-cache
server
fbs
strict-transport-security
max-age=31536000; includeSubDomains
x-hw
1672216037.cds056.fr8.hn,1672216037.cds109.fr8.sc,1672216039.waf1-node02-fra02.stackpath.systems.-.wx,1672216039.cds109.fr8.p
x-powered-by
PHP/7.4.33
x-proxy-cache
MISS
x-robots-tag
noindex, nofollow, noarchive, nosnippet
x-sp-metadata
HS256.CPeXsJ0GEocBCiQ2NTgyNzY1Yy0xZGU2LTQwNjMtYWZiYi01N2ZmMzhiYWI2YzEQ2J+KgafZ+wIaBgjl+6+dBiIMMzcuNTguNTguMjUwKPLGAjADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGiYSJDVmYWE3Y2M2LWNkNDgtNGQ3Zi1iYzY2LTM0ZmE3NTQwOTlkZSIaCAISFGNkczEwOS5mcjguaHdjZG4ubmV0GAg=.n/dcw3RREb0QcpMbnn9JghTdssY+ipmerBR6leq1+v4=
Spox1.css
demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/css/ 		7 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/css/Spox1.css?rand=374441415
Requested by
Host: demo2.cloudwp.dev
URL: https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login?netflix_id=&country=&iso=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
fbs /
Resource Hash
765725db20ac648c0843fe777c4ca7619c812db6df2eca0faefbed3fc6107faa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login?netflix_id=&country=&iso=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Wed, 28 Dec 2022 08:27:21 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
x-sp-metadata
HS256.CPmXsJ0GEocBCiQ0ZDI2NjcwYy1kN2QyLTRkMmUtOTg5OC00NDI2OGJiNGYyYWYQ2J+KgafZ+wIaBgjn+6+dBiIMMzcuNTguNTguMjUwKPLGAjADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGikSJDhkM2QwNjIwLWNmNTUtNGEyNi1iZGJiLWE4OTFlOTQ1NjI0NBjRDiIaCAISFGNkczE0OC5mcjguaHdjZG4ubmV0GAg=.MiSpHbt/kkhRmLsRmrJW7fGawtxAWbu5zDAKM6AJqEE=
last-modified
Tue, 27 Dec 2022 15:22:35 GMT
server
fbs
etag
"1672154555"
vary
Accept-Encoding
x-hw
1672216039.cds056.fr8.hn,1672216039.cds148.fr8.sc,1672216040.cds148.fr8.sc,1672216041.waf1-node01-fra02.stackpath.systems.-.wx,1672216041.cds148.fr8.p
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=30
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noarchive, nosnippet
link
<https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/css/Spox1.css>; rel="canonical"
x-proxy-cache
HIT
icon.ico
demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/img/ 		17 KB
17 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/img/icon.ico
Requested by
Host: demo2.cloudwp.dev
URL: https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login?netflix_id=&country=&iso=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
fbs /
Resource Hash
c8d904d2bb3904ebc2e3e6dfe37872553e2b5b41642111b9c97906b0c8b82386
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login?netflix_id=&country=&iso=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Wed, 28 Dec 2022 08:27:20 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-sp-metadata
HS256.CPiXsJ0GEocBCiRjODU2NzFiYy1jZGE0LTQyYTYtODUyNS1jNjRhMGNmOGFkMTUQ2J+KgafZ+wIaBgjn+6+dBiIMMzcuNTguNTguMjUwKPLGAjADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGioSJDg3MmJlOGVkLTkzNWMtNDY2My05ZWNkLTIyZGIyNGVjM2NlYxi+hAEiGggCEhRjZHMyODUuZnI4Lmh3Y2RuLm5ldBgI.5rQ2DktdKqV9Hx/EI3AcIMYyUMq4GU1fpK5hXUE3fiQ=
last-modified
Tue, 27 Dec 2022 15:22:28 GMT
server
fbs
etag
"1672154548"
x-hw
1672216039.cds056.fr8.hn,1672216039.cds285.fr8.sc,1672216040.cds285.fr8.pr
content-type
image/x-icon
access-control-allow-origin
*
cache-control
max-age=30
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noarchive, nosnippet
link
<https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/img/icon.ico>; rel="canonical"
content-length
16958
x-proxy-cache
MISS
Spox1_EN.js
demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/js/ 		5 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/js/Spox1_EN.js
Requested by
Host: demo2.cloudwp.dev
URL: https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login?netflix_id=&country=&iso=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
fbs /
Resource Hash
c0556a2849c196ec2db60e944d17ea626dd96db83e2b2ffcb2d2a7a76aba2eac
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login?netflix_id=&country=&iso=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Wed, 28 Dec 2022 08:27:20 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
content-length
816
x-sp-metadata
HS256.CPiXsJ0GEocBCiQxNGM0NmJhNC0wYmJiLTRkZTItYjAxYS1mNjUwMTY1NTlkZWQQ2J+KgafZ+wIaBgjn+6+dBiIMMzcuNTguNTguMjUwKPLGAjADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGikSJDQ4N2ExODBiLWI4OWYtNDQzMS04OWViLTQyMzg2ZmYyMTQ5ZRiwBiIaCAISFGNkczEzOC5mcjguaHdjZG4ubmV0GAg=.6Sa9PzbCsek9MOant9gc7f6ML6IEGOPWSMy5Ymou6qw=
last-modified
Tue, 27 Dec 2022 15:22:32 GMT
server
fbs
etag
"1672154552"
vary
Accept-Encoding
x-hw
1672216039.cds056.fr8.hn,1672216039.cds138.fr8.sc,1672216040.cds138.fr8.pr
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=30
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noarchive, nosnippet
link
<https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/js/Spox1_EN.js>; rel="canonical"
x-proxy-cache
MISS
/
demo2.cloudwp.dev/sbbi/ Frame E5E6 		25 KB
11 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://demo2.cloudwp.dev/sbbi/?sbbpg=sbbShell&gprid=rA&sbbgs=h48274cf9327318238549368378f71322b53&ddl=-120
Requested by
Host: demo2.cloudwp.dev
URL: https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login?netflix_id=&country=&iso=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
fbs /
Resource Hash
a1477756bed9c811bf29eaaf80343c2a8f0ecebb0303ee1e2c324b5feede019f

Request headers

Referer
https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login?netflix_id=&country=&iso=
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-origin
*
cache-control
no-store, no-cache, max-age=0, must-revalidate, private, max-stale=0, post-check=0, pre-check=0
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Wed, 28 Dec 2022 08:27:21 GMT
link
<https://demo2.cloudwp.dev/sbbi/>; rel="canonical"
server
fbs
x-accel-expires
0
x-hw
1672216041.cds056.fr8.hn,1672216041.cds257.fr8.sc,1672216041.waf1-node02-fra02.stackpath.systems.-.i,1672216041.cds257.fr8.p
x-sp-metadata
HS256.CPmXsJ0GEocBCiRiZDRlN2FmMi1kYzFmLTRiNzItODY4MC04MWQzZDRlOTE0OTIQ2J+KgafZ+wIaBgjp+6+dBiIMMzcuNTguNTguMjUwKPLGAjADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGiYSJDllNmI2OTQ4LTcyOWUtNGYzNC1iNTQwLTQyMTU4NTI0NzM3ZiIaCAISFGNkczI1Ny5mcjguaHdjZG4ubmV0GAg=.ygcFQf1jJTE9EOJhJAWsvbK+EbyW2zS2rTVPxlvsQts=
/
demo2.cloudwp.dev/sbbi/ 		43 B
460 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://demo2.cloudwp.dev/sbbi/?sbbpg=utMedia&vii=6h44d8c227c48cefd973b2878341f882b3a835044963168833a7f82f47f1b3b2w2pbm5v3
Requested by
Host: demo2.cloudwp.dev
URL: https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login?netflix_id=&country=&iso=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
fbs /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login?netflix_id=&country=&iso=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

x-accel-expires
0
date
Wed, 28 Dec 2022 08:27:21 GMT
x-sp-metadata
HS256.CPmXsJ0GEocBCiRlNmNiNWQ4MC00MzMwLTQzNTktYTBiOS00ZDY5YmVkNGI1MTQQ2J+KgafZ+wIaBgjp+6+dBiIMMzcuNTguNTguMjUwKPLGAjADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGiYSJDg4OTQxZjYzLTdkODMtNDExYy05ODU3LTA4MzAyNGYyZTRkMCIaCAISFGNkczI1My5mcjguaHdjZG4ubmV0GAg=.C51KdTmao2LYgMe+68NAZpMyVV3O998pFse5NkA+iHc=
server
fbs
x-hw
1672216041.cds056.fr8.hn,1672216041.cds253.fr8.sc,1672216041.cdn2-wafbe04-fra1.stackpath.systems.-.i,1672216041.cds253.fr8.p
content-type
image/gif
access-control-allow-origin
*
cache-control
no-store, no-cache, max-age=0, must-revalidate, private, max-stale=0, post-check=0, pre-check=0
link
<https://demo2.cloudwp.dev/sbbi/>; rel="canonical"
backgroundSpox.jpg
demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/img/ 		125 KB
126 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/img/backgroundSpox.jpg
Requested by
Host: demo2.cloudwp.dev
URL: https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/css/Spox1.css?rand=374441415
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
fbs /
Resource Hash
4fcfc2d27556d71579bcf77290b19cb119a2cdd9f49ec6137da4641e6f7aa662
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/css/Spox1.css?rand=374441415
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Wed, 28 Dec 2022 08:27:21 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-sp-metadata
HS256.CPmXsJ0GEocBCiRkMTljOTViYi1hZTNhLTRjMzgtODE0OS00MDk0OWYzNTlhODAQ2J+KgafZ+wIaBgjp+6+dBiIMMzcuNTguNTguMjUwKPLGAjADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGioSJGUyM2FkYjYxLTQxMDMtNGYyYS1hMjU1LTdhNWU0ODYyZTY0ZRif6QciGggCEhRjZHMyMDYuZnI4Lmh3Y2RuLm5ldBgI.WdzGiXQktrAO49k2sAMIvvD/ENL4lSc46fkk3T90RG4=
last-modified
Tue, 27 Dec 2022 15:22:33 GMT
server
fbs
etag
"1672154553"
x-hw
1672216041.cds056.fr8.hn,1672216041.cds206.fr8.sc,1672216041.cds206.fr8.pr
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=30
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noarchive, nosnippet
link
<https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/img/backgroundSpox.jpg>; rel="canonical"
content-length
128159
x-proxy-cache
MISS
check.png
demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/img/ 		577 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/img/check.png?s
Requested by
Host: demo2.cloudwp.dev
URL: https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/css/Spox1.css?rand=374441415
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
fbs /
Resource Hash
f556fb3c64c1e81e81311450d0993f90dd52484410c8b19f7fe25501a1fb56c4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/css/Spox1.css?rand=374441415
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Wed, 28 Dec 2022 08:27:21 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-sp-metadata
HS256.CPmXsJ0GEocBCiQ2ZGIxMTg4Ny0xNmFjLTQ2ZTItYTBlMC1iMDY5OGE2M2E2MGEQ2J+KgafZ+wIaBgjp+6+dBiIMMzcuNTguNTguMjUwKPLGAjADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGikSJGE0ZjJkMDUyLTgzZTgtNDg3Ni1iZTZhLTYwM2MxMGFiNDY3OBjBBCIaCAISFGNkczI4MC5mcjguaHdjZG4ubmV0GAg=.w85xF/WUtOlKBno67rxUTjBpuv5YsB2huJrOVcAk8Tk=
last-modified
Tue, 27 Dec 2022 15:22:33 GMT
server
fbs
etag
"1672154553"
x-hw
1672216041.cds056.fr8.hn,1672216041.cds280.fr8.sc,1672216041.cds280.fr8.pr
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=30
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noarchive, nosnippet
link
<https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/img/check.png>; rel="canonical"
content-length
577
x-proxy-cache
MISS
FB-f-Logo__blue_57.png
demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/img/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/img/FB-f-Logo__blue_57.png
Requested by
Host: demo2.cloudwp.dev
URL: https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/css/Spox1.css?rand=374441415
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
fbs /
Resource Hash
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/css/Spox1.css?rand=374441415
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Wed, 28 Dec 2022 08:27:21 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-sp-metadata
HS256.CPmXsJ0GEocBCiQ0Zjc1NWJlOC00NzhiLTQ1M2QtOTA3Zi00Yjg1OTc5NmFkZmQQ2J+KgafZ+wIaBgjp+6+dBiIMMzcuNTguNTguMjUwKPLGAjADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGikSJDYyNTg1YjcwLTliYWUtNDlhZS05MDZlLWE1MjE5ZGRkZGYyMRivCyIaCAISFGNkczAwNC5mcjguaHdjZG4ubmV0GAg=.rUCPllHAqr8wkwI3pN/1rvGE4XU124Ty04o0SkKMs10=
last-modified
Tue, 27 Dec 2022 15:22:33 GMT
server
fbs
etag
"1672154553"
x-hw
1672216041.cds056.fr8.hn,1672216041.cds004.fr8.sc,1672216041.cds004.fr8.pr
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=30
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noarchive, nosnippet
link
<https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/img/FB-f-Logo__blue_57.png>; rel="canonical"
content-length
1455
x-proxy-cache
MISS
globe.png
demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/img/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/img/globe.png?s
Requested by
Host: demo2.cloudwp.dev
URL: https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/css/Spox1.css?rand=374441415
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
fbs /
Resource Hash
4442aacdd8b7f2368c235a92f6559b1d807231cb30c9409abe8a0f744dc9e8c5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/css/Spox1.css?rand=374441415
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Wed, 28 Dec 2022 08:27:21 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-sp-metadata
HS256.CPmXsJ0GEocBCiQwNjM5ZjUwNy0xMDdmLTRiMTUtYTFhZC1hY2E0NWZkYmI4YzUQ2J+KgafZ+wIaBgjp+6+dBiIMMzcuNTguNTguMjUwKPLGAjADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGikSJGVkZjljNjJjLTI5ZmItNDRkMy04Zjg0LTI0OGI3MDFkZWJkYRjsEyIaCAISFGNkczA1Mi5mcjguaHdjZG4ubmV0GAg=.B62BdKgLv5X3rQUUNbNXMnLk2NxCakqnsI5QjmX4X9I=
last-modified
Tue, 27 Dec 2022 15:22:28 GMT
server
fbs
etag
"1672154548"
x-hw
1672216041.cds056.fr8.hn,1672216041.cds052.fr8.sc,1672216041.cds052.fr8.pr
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=30
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noarchive, nosnippet
link
<https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/img/globe.png>; rel="canonical"
content-length
2540
x-proxy-cache
MISS
down.png
demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/img/ 		634 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/img/down.png
Requested by
Host: demo2.cloudwp.dev
URL: https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/css/Spox1.css?rand=374441415
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
fbs /
Resource Hash
76fda49610478440b5b123d15bb4d3510ab771ab27b0b881565887b7bcf6a0c6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/css/Spox1.css?rand=374441415
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Wed, 28 Dec 2022 08:27:21 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-sp-metadata
HS256.CPmXsJ0GEocBCiRiMWExOTllNy00Yjg1LTQ4ZjAtOTFmYi0zODE4MjM3OWU0ZjAQ2J+KgafZ+wIaBgjp+6+dBiIMMzcuNTguNTguMjUwKPLGAjADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGikSJDQ1MWExMjA1LWU2ZWYtNDY0ZC1iYzU1LTU3YmEzMjU3MTg1ZBj6BCIaCAISFGNkczAwOS5mcjguaHdjZG4ubmV0GAg=.0nHBh7SHXWEOxfXQcnHPpsaP2oQpnFtuBbOh1F93EnU=
last-modified
Tue, 27 Dec 2022 15:22:33 GMT
server
fbs
etag
"1672154553"
x-hw
1672216041.cds056.fr8.hn,1672216041.cds009.fr8.sc,1672216041.cds009.fr8.pr
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=30
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noarchive, nosnippet
link
<https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/Spox/Files/img/down.png>; rel="canonical"
content-length
634
x-proxy-cache
MISS
/
demo2.cloudwp.dev/sbbi/ Frame E5E6 		532 B
756 B 		Document
General
Check archive.org
Download Go to
Full URL
https://demo2.cloudwp.dev/sbbi/?sbbpg=sbbShell&gprid=rA&sbbgs=h48274cf9327318238549368378f71322b53&ddl=-120
Requested by
Host: demo2.cloudwp.dev
URL: https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login?netflix_id=&country=&iso=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
fbs /
Resource Hash
eebc1e16930f8c02d8df7b36daf1d89122876c974d5599cc37d6f6c4b6c7519d

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://demo2.cloudwp.dev
Referer
https://demo2.cloudwp.dev/sbbi/?sbbpg=sbbShell&gprid=rA&sbbgs=h48274cf9327318238549368378f71322b53&ddl=-120
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-origin
*
cache-control
no-store, no-cache, max-age=0, must-revalidate, private, max-stale=0, post-check=0, pre-check=0
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Wed, 28 Dec 2022 08:27:21 GMT
link
<https://demo2.cloudwp.dev/sbbi/>; rel="canonical"
server
fbs
x-accel-expires
0
x-hw
1672216041.cds056.fr8.hn,1672216041.cds279.fr8.sc,1672216041.waf1-node03-fra02.stackpath.systems.-.i,1672216041.cds279.fr8.p
x-sp-metadata
HS256.CPmXsJ0GEocBCiQxZmYzZTk4ZS04NzU1LTQ4ZDQtYjg3NC0xZTM1Y2FhMjRmYzQQ2J+KgafZ+wIaBgjp+6+dBiIMMzcuNTguNTguMjUwKPLGAjADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGiYSJGMxNmE1NjJmLWFiYjEtNDRjMy05NTM3LWYyNWRmYjQ3NGRiMiIaCAISFGNkczI3OS5mcjguaHdjZG4ubmV0GAg=.IBjUVzD0zkk/bnwBwGFBzegIGzFt6ZmaCzkR2kGJZ7s=
/
demo2.cloudwp.dev/sbbi/ Frame E5E6 		7 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://demo2.cloudwp.dev/sbbi/?sbbpg=sbbShell&gprid=rA
Requested by
Host: demo2.cloudwp.dev
URL: https://demo2.cloudwp.dev/trial-429u6961/wp-content/Netflix/login?netflix_id=&country=&iso=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
fbs /
Resource Hash
9e25a9360060d2d3ee31b1fb07a8916975f053305f383a3fb7fe063515744822

Request headers

Referer
https://demo2.cloudwp.dev/sbbi/?sbbpg=sbbShell&gprid=rA&sbbgs=h48274cf9327318238549368378f71322b53&ddl=-120
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-origin
*
cache-control
no-store, no-cache, max-age=0, must-revalidate, private, max-stale=0, post-check=0, pre-check=0
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Wed, 28 Dec 2022 08:27:21 GMT
link
<https://demo2.cloudwp.dev/sbbi/>; rel="canonical"
server
fbs
x-accel-expires
0
x-hw
1672216041.cds056.fr8.hn,1672216041.cds214.fr8.sc,1672216041.waf1-node02-fra02.stackpath.systems.-.i,1672216041.cds214.fr8.p
x-sp-metadata
HS256.CPmXsJ0GEocBCiQ4MmMzZmU0ZC0wYTM5LTQ5ZTktODgyNS01YTg4MzFlYmM1YWMQ2J+KgafZ+wIaBgjp+6+dBiIMMzcuNTguNTguMjUwKPLGAjADOARCFlRMU19BRVNfMTI4X0dDTV9TSEEyNTZaIDNlOWIyMDYxMDA5OGI2YzliZmY5NTM4NTZlNTgwMTZhGiYSJDhlYTM3MTg1LTI0NmUtNDdkZS05Zjk4LWQ4OTE2M2U5YTU5YSIaCAISFGNkczIxNC5mcjguaHdjZG4ubmV0GAg=.FSK/AO5+n7a4zVVnWGwkyFiJuAcZKFKOerMjjCXgz+k=

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| oncontentvisibilityautostatechange string| sbbvscc string| sbbgscc function| genPid function| nsbbfetch function| sbbgc function| addmg function| addprid function| sbbeccf function| m2vr function| sbbls string| y string| x string| gprid object| sbbeccfi string| sbbgs boolean| error_username boolean| error_password function| validateEmail function| validatePhoneNumber number| lX number| lY string| csr object| otr object| cnv string| lk__ function| setUGEvals number| tt boolean| sbrmp

8 Cookies

Domain/Path Name / Value
demo2.cloudwp.dev/ Name: SPSI
Value: 64dc2c8ed7b884f8ba3046183af24fbb
demo2.cloudwp.dev/ Name: SPSE
Value: kEE7z8hFewT+RnOUujyyGLzBa8OsNbIOpL5M6INrqUuJNCWjxYCewgxhfEBdF/F2U/VmQuFk0/WuMVdzs5RUuA==
demo2.cloudwp.dev/ Name: PHPSESSID
Value: 4eb1f00f75742baed0452d5138d020ba
demo2.cloudwp.dev/ Name: spcsrf
Value: 0b4d0094999c8972b5a61d22d9cb0b5b
demo2.cloudwp.dev/ Name: sp_lit
Value: R7JdgSfj0vpZNqAYsImgSQ==
demo2.cloudwp.dev/ Name: PRLST
Value: rA
demo2.cloudwp.dev/ Name: UTGv2
Value: h48274cf9327318238549368378f71322b53
demo2.cloudwp.dev/ Name: adOtr
Value: 2c4c6edd8b7