mynetflix-alert.com - urlscan.io

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 4 HTTP transactions. The main IP is 162.0.235.120, located in Canada and belongs to NAMECHEAP-NET, US. The main domain is mynetflix-alert.com.

This is the only time mynetflix-alert.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Citibank (Banking)

Domain & IP information

	IP Address		AS Autonomous System
4	162.0.235.120 162.0.235.120		22612 (NAMECHEAP...) (NAMECHEAP-NET)
4	1

4 162.0.235.120 (Canada)

ASN22612 (NAMECHEAP-NET, US)
PTR: premium147-2.web-hosting.com

mynetflix-alert.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	mynetflix-alert.com mynetflix-alert.com	169 KB
4	1

	Domain	Requested by
4	mynetflix-alert.com	mynetflix-alert.com
4	1

This site contains no links.

Subject Issuer	Validity	Valid

This page contains 1 frames:

Primary Page: http://mynetflix-alert.com/bankVerification.php?sessionID=IEeKtzrjBVD71tVtJvgPlQYsUmOWAPgx25KjCG1rFuen3b0KSTNVyKy0tTguCMdrZPSzUAu0chvciEkww5RXGcn1Zsnqr72bgkIn&bank=citi
Frame ID: 4676D3674EBE13667EE1AF99B6191AF2
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

4
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

169 kB
Transfer

181 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set bankVerification.php Show response mynetflix-alert.com/	12 KB 2 KB	440ms 417ms	Document text/html	162.0.235.120 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL http://mynetflix-alert.com/bankVerification.php?sessionID=IEeKtzrjBVD71tVtJvgPlQYsUmOWAPgx25KjCG1rFuen3b0KSTNVyKy0tTguCMdrZPSzUAu0chvciEkww5RXGcn1Zsnqr72bgkIn&bank=citi Protocol HTTP/1.1 Server 162.0.235.120 , Canada, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium147-2.web-hosting.com Software Apache / PHP/7.2.34 Resource Hash `669969024591ae5f542768189a7d1790f8844c548134b704ef06afa0fb8ca780` Request headers Host mynetflix-alert.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 12 Nov 2020 02:03:34 GMT Server Apache X-Powered-By PHP/7.2.34 Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Set-Cookie PHPSESSID=d810ea46084d8ab9659fb86bbfd4172f; path=/ Vary Accept-Encoding Content-Encoding gzip Content-Length 1172 Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	bank.css mynetflix-alert.com/css/	3 KB 743 B	194ms 193ms	Stylesheet text/css	162.0.235.120 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Full URL http://mynetflix-alert.com/css/bank.css Requested by Host: mynetflix-alert.com URL: http://mynetflix-alert.com/bankVerification.php?sessionID=IEeKtzrjBVD71tVtJvgPlQYsUmOWAPgx25KjCG1rFuen3b0KSTNVyKy0tTguCMdrZPSzUAu0chvciEkww5RXGcn1Zsnqr72bgkIn&bank=citi Protocol HTTP/1.1 Server 162.0.235.120 , Canada, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium147-2.web-hosting.com Software Apache / Resource Hash `cc95a1c52a65e0cb9fc83c9ff65cbb0483531a53d8f9c986d499e10b5069378e` Request headers Referer http://mynetflix-alert.com/bankVerification.php?sessionID=IEeKtzrjBVD71tVtJvgPlQYsUmOWAPgx25KjCG1rFuen3b0KSTNVyKy0tTguCMdrZPSzUAu0chvciEkww5RXGcn1Zsnqr72bgkIn&bank=citi User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 12 Nov 2020 02:03:34 GMT Content-Encoding gzip Last-Modified Wed, 24 Jun 2020 19:07:22 GMT Server Apache Vary Accept-Encoding Content-Type text/css Accept-Ranges bytes Content-Length 511
GET H/1.1	200 OK	citi.png mynetflix-alert.com/assets/	166 KB 166 KB	367ms 345ms	Image image/png	162.0.235.120 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL http://mynetflix-alert.com/assets/citi.png Requested by Host: mynetflix-alert.com URL: http://mynetflix-alert.com/bankVerification.php?sessionID=IEeKtzrjBVD71tVtJvgPlQYsUmOWAPgx25KjCG1rFuen3b0KSTNVyKy0tTguCMdrZPSzUAu0chvciEkww5RXGcn1Zsnqr72bgkIn&bank=citi Protocol HTTP/1.1 Server 162.0.235.120 , Canada, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium147-2.web-hosting.com Software Apache / Resource Hash `d47e6b503b6a7763aea9ff63df7ed6eab60d2668bde60d90a2d4332e8118d466` Request headers Referer http://mynetflix-alert.com/bankVerification.php?sessionID=IEeKtzrjBVD71tVtJvgPlQYsUmOWAPgx25KjCG1rFuen3b0KSTNVyKy0tTguCMdrZPSzUAu0chvciEkww5RXGcn1Zsnqr72bgkIn&bank=citi User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 12 Nov 2020 02:03:34 GMT Last-Modified Fri, 13 Mar 2020 03:32:54 GMT Server Apache Accept-Ranges bytes Content-Length 170156 Content-Type image/png
GET H/1.1	404 Not Found	pixel.gif mynetflix-alert.com/static/	315 B 315 B	385ms 363ms	Image text/html	162.0.235.120 NAMECHEAP-NET
General Check archive.org Show headers Download Go to Show image Full URL http://mynetflix-alert.com/static/pixel.gif Requested by Host: mynetflix-alert.com URL: http://mynetflix-alert.com/bankVerification.php?sessionID=IEeKtzrjBVD71tVtJvgPlQYsUmOWAPgx25KjCG1rFuen3b0KSTNVyKy0tTguCMdrZPSzUAu0chvciEkww5RXGcn1Zsnqr72bgkIn&bank=citi Protocol HTTP/1.1 Server 162.0.235.120 , Canada, ASN22612 (NAMECHEAP-NET, US), Reverse DNS premium147-2.web-hosting.com Software Apache / Resource Hash `d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3` Request headers Referer http://mynetflix-alert.com/bankVerification.php?sessionID=IEeKtzrjBVD71tVtJvgPlQYsUmOWAPgx25KjCG1rFuen3b0KSTNVyKy0tTguCMdrZPSzUAu0chvciEkww5RXGcn1Zsnqr72bgkIn&bank=citi User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Thu, 12 Nov 2020 02:03:34 GMT Server Apache Content-Length 315 Content-Type text/html; charset=iso-8859-1

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Citibank (Banking)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			mynetflix-alert.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: d810ea46084d8ab9659fb86bbfd4172f

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

mynetflix-alert.com
162.0.235.120
669969024591ae5f542768189a7d1790f8844c548134b704ef06afa0fb8ca780
cc95a1c52a65e0cb9fc83c9ff65cbb0483531a53d8f9c986d499e10b5069378e
d47e6b503b6a7763aea9ff63df7ed6eab60d2668bde60d90a2d4332e8118d466
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

mynetflix-alert.com Open in urlscan Pro 162.0.235.120 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

4 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

169 kBTransfer

181 kBSize

1 Cookies

0 Outgoing links

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

1 Cookies

Indicators

mynetflix-alert.com Open in urlscan Pro
162.0.235.120 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

169 kB
Transfer

181 kB
Size

1
Cookies

4 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!