148.72.10.21 Open in urlscan Pro
148.72.10.21 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://148.72.10.21/
Submission: On May 03 via api (May 3rd 2023, 7:09:18 pm UTC) from US — Scanned from DE

Summary HTTP 12 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 12 HTTP transactions. The main IP is 148.72.10.21, located in Ashburn, United States and belongs to AS-26496-GO-DADDY-COM-LLC, US. The main domain is 148.72.10.21.

This is the only time 148.72.10.21 was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address	AS Autonomous System
9	148.72.10.21 148.72.10.21	26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC)
1	2a00:1450:400... 2a00:1450:4001:827::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:831::2003	15169 (GOOGLE) (GOOGLE)
12	3

9 148.72.10.21 (Ashburn, United States)

ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: 21.10.72.148.host.secureserver.net

148.72.10.21	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:831::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	gstatic.com fonts.gstatic.com	32 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 37	1 KB
12	2

	Domain	Requested by
2	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	148.72.10.21
12	2

This site contains links to these domains. Also see Links.

Domain
policies.google.com
help.netflix.com

Subject Issuer	Validity	Valid
upload.video.google.com GTS CA 1C3	`2023-04-17` - `2023-07-10`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-04-17` - `2023-07-10`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://148.72.10.21/
Frame ID: B6711366DB5BEEB21D29C3E3378EB8DF
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Netflix

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

25 %
HTTPS

67 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

323 kB
Transfer

790 kB
Size

1
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://policies.google.com/privacy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://policies.google.com/terms
Title: Terms of Service

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/termsofuse
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/privacy
Title: Privacy Statement

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
148.72.10.21/ 12 KB
4 KB 2468ms
2284ms Document
text/html 148.72.10.21
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://148.72.10.21/
Protocol: HTTP/1.1
Server: 148.72.10.21 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: 21.10.72.148.host.secureserver.net
Software: Apache / PHP/7.3.33
Resource Hash: d6e36ece60c553ec87643bb9842041059f0b0d9cf784b9d9e229bfa9941b4b78

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: Upgrade, Keep-Alive
Content-Encoding: gzip
Content-Length: 3254
Content-Type: text/html; charset=UTF-8
Date: Wed, 03 May 2023 19:09:10 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=5
Pragma: no-cache
Server: Apache
Upgrade: h2,h2c
Vary: Accept-Encoding
X-Powered-By: PHP/7.3.33

GET
H/1.1 200
OK bootstrap.min.css
148.72.10.21/css/ 119 KB
20 KB 180ms
179ms Stylesheet
text/css 148.72.10.21
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://148.72.10.21/css/bootstrap.min.css
Requested by: Host: 148.72.10.21
URL: http://148.72.10.21/
Protocol: HTTP/1.1
Server: 148.72.10.21 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: 21.10.72.148.host.secureserver.net
Software: Apache /
Resource Hash: 6d92dfc1700fd38cd130ad818e23bc8aef697f815b2ea5face2b5dfad22f2e11

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://148.72.10.21/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Date: Wed, 03 May 2023 19:09:12 GMT
Content-Encoding: gzip
Last-Modified: Tue, 11 Feb 2020 18:56:48 GMT
Server: Apache
ETag: "19e0225-1da71-59e516afc1c00-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
Content-Length: 19741

GET
H/1.1 200
OK netflix1.css
148.72.10.21/css/ 160 KB
24 KB 339ms
173ms Stylesheet
text/css 148.72.10.21
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://148.72.10.21/css/netflix1.css
Requested by: Host: 148.72.10.21
URL: http://148.72.10.21/
Protocol: HTTP/1.1
Server: 148.72.10.21 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: 21.10.72.148.host.secureserver.net
Software: Apache /
Resource Hash: 8d7e22b69868370082e0d28094b1934a7eebc1029e860cb29493c0e1ed04ccc5

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://148.72.10.21/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Date: Wed, 03 May 2023 19:09:13 GMT
Content-Encoding: gzip
Last-Modified: Tue, 11 Feb 2020 18:56:47 GMT
Server: Apache
ETag: "19e0226-280da-59e516aecd9c0-gzip"
Vary: Accept-Encoding
Upgrade: h2,h2c
Content-Type: text/css
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
Content-Length: 24462

GET
H/1.1 200
OK style.css
148.72.10.21/css/ 103 B
451 B 334ms
167ms Stylesheet
text/css 148.72.10.21
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://148.72.10.21/css/style.css
Requested by: Host: 148.72.10.21
URL: http://148.72.10.21/
Protocol: HTTP/1.1
Server: 148.72.10.21 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: 21.10.72.148.host.secureserver.net
Software: Apache /
Resource Hash: 7895be395221c5127a191b31dfba4591e9bd1ff07c795e2e0b582cecc49afc13

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://148.72.10.21/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Date: Wed, 03 May 2023 19:09:13 GMT
Content-Encoding: gzip
Last-Modified: Tue, 11 Feb 2020 18:56:46 GMT
Server: Apache
ETag: "19e0228-67-59e516add9780-gzip"
Vary: Accept-Encoding
Upgrade: h2,h2c
Content-Type: text/css
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
Content-Length: 107

GET
H/1.1 200
OK jquery.min.js Show response
148.72.10.21/js/ 86 KB
30 KB 340ms
173ms Script
application/javascript 148.72.10.21
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://148.72.10.21/js/jquery.min.js
Requested by: Host: 148.72.10.21
URL: http://148.72.10.21/
Protocol: HTTP/1.1
Server: 148.72.10.21 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: 21.10.72.148.host.secureserver.net
Software: Apache /
Resource Hash: 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://148.72.10.21/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Date: Wed, 03 May 2023 19:09:13 GMT
Content-Encoding: gzip
Last-Modified: Tue, 11 Feb 2020 18:56:49 GMT
Server: Apache
ETag: "19e022f-15851-59e516b0b5e40-gzip"
Vary: Accept-Encoding
Upgrade: h2,h2c
Content-Type: application/javascript
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
Content-Length: 30677

GET
H/1.1 200
OK bootstrap.min.js Show response
148.72.10.21/js/ 39 KB
11 KB 338ms
171ms Script
application/javascript 148.72.10.21
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://148.72.10.21/js/bootstrap.min.js
Requested by: Host: 148.72.10.21
URL: http://148.72.10.21/
Protocol: HTTP/1.1
Server: 148.72.10.21 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: 21.10.72.148.host.secureserver.net
Software: Apache /
Resource Hash: 9ee2fcff6709e4d0d24b09ca0fc56aade12b4961ed9c43fd13b03248bfb57afe

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://148.72.10.21/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Date: Wed, 03 May 2023 19:09:13 GMT
Content-Encoding: gzip
Last-Modified: Tue, 11 Feb 2020 18:56:49 GMT
Server: Apache
ETag: "19e022e-9b00-59e516b0b5e40-gzip"
Vary: Accept-Encoding
Upgrade: h2,h2c
Content-Type: application/javascript
Connection: Upgrade, Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
Content-Length: 10940

GET
H/1.1 200
OK bg.jpg
148.72.10.21/img/ 84 KB
84 KB 170ms
169ms Image
image/jpeg 148.72.10.21
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://148.72.10.21/img/bg.jpg
Requested by: Host: 148.72.10.21
URL: http://148.72.10.21/
Protocol: HTTP/1.1
Server: 148.72.10.21 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: 21.10.72.148.host.secureserver.net
Software: Apache /
Resource Hash: baafd74a4cb4dc594b614eeb45c7267bb1af729d9271752460348ece16532d04

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://148.72.10.21/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Date: Wed, 03 May 2023 19:09:13 GMT
Last-Modified: Tue, 11 Feb 2020 18:56:52 GMT
Server: Apache
ETag: "19e0229-150d2-59e516b392500"
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
Content-Length: 86226

GET
H2 200 css
fonts.googleapis.com/ 7 KB
1 KB 118ms
62ms Stylesheet
text/css 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:300,400i,500&display=swap

Requested by

Host: 148.72.10.21
URL: http://148.72.10.21/css/netflix1.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

5b70ce076a2721ac9b6b0bdcdc552a4ba33c50e51bdac61dd2101c18949bf6a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://148.72.10.21/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 03 May 2023 19:09:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 03 May 2023 19:09:13 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 03 May 2023 19:09:13 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 16 KB
16 KB 90ms
33ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400i,500&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: http://148.72.10.21
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Sat, 29 Apr 2023 18:58:23 GMT
x-content-type-options: nosniff
age: 346250
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 28 Apr 2024 18:58:23 GMT

GET
H2 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
15 KB 96ms
40ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400i,500&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: http://148.72.10.21
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

date: Fri, 28 Apr 2023 23:14:12 GMT
x-content-type-options: nosniff
age: 417301
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15740
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 27 Apr 2024 23:14:12 GMT

GET
H/1.1 200
OK netflix1.css
148.72.10.21/css/ 160 KB
24 KB 171ms
171ms Font
text/css 148.72.10.21
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://148.72.10.21/css/netflix1.css
Requested by: Host: 148.72.10.21
URL: http://148.72.10.21/css/netflix1.css
Protocol: HTTP/1.1
Server: 148.72.10.21 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: 21.10.72.148.host.secureserver.net
Software: Apache /
Resource Hash: 8d7e22b69868370082e0d28094b1934a7eebc1029e860cb29493c0e1ed04ccc5

Request headers

Referer: http://148.72.10.21/css/netflix1.css
Origin: http://148.72.10.21
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Date: Wed, 03 May 2023 19:09:13 GMT
Content-Encoding: gzip
Last-Modified: Tue, 11 Feb 2020 18:56:47 GMT
Server: Apache
ETag: "19e0226-280da-59e516aecd9c0-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
Content-Length: 24462

GET
H/1.1 200
OK nf-icon-v1-93.ttf
148.72.10.21/css/ 92 KB
92 KB 167ms
167ms Font
font/ttf 148.72.10.21
AS-26496-GO-DADDY...

General

Check archive.org

Show headers Download Go to

Full URL: http://148.72.10.21/css/nf-icon-v1-93.ttf
Requested by: Host: 148.72.10.21
URL: http://148.72.10.21/css/netflix1.css
Protocol: HTTP/1.1
Server: 148.72.10.21 Ashburn, United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS: 21.10.72.148.host.secureserver.net
Software: Apache /
Resource Hash: df9a8b117a4fd266818dee3d12d7080ebdc7d1e1802445d3584d2c7d78bd9725

Request headers

Referer: http://148.72.10.21/css/netflix1.css
Origin: http://148.72.10.21
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.63 Safari/537.36

Response headers

Date: Wed, 03 May 2023 19:09:13 GMT
Last-Modified: Tue, 11 Feb 2020 18:56:47 GMT
Server: Apache
ETag: "19e0227-16ef8-59e516aecd9c0"
Vary: Accept-Encoding
Content-Type: font/ttf
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5
Content-Length: 93944

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			148.72.10.21/	1969-12-31 23:59:59	Name: PHPSESSID Value: f7bd593bcf566be36a9f71df0236774c

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: http://148.72.10.21/ Message: Failed to decode downloaded font: http://148.72.10.21/css/netflix1.css#
other	warning	URL: http://148.72.10.21/ Message: OTS parsing error: invalid sfntVersion: 1080651120

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
148.72.10.21
2a00:1450:4001:827::200a
2a00:1450:4001:831::2003
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
5b70ce076a2721ac9b6b0bdcdc552a4ba33c50e51bdac61dd2101c18949bf6a4
6d92dfc1700fd38cd130ad818e23bc8aef697f815b2ea5face2b5dfad22f2e11
7895be395221c5127a191b31dfba4591e9bd1ff07c795e2e0b582cecc49afc13
8d7e22b69868370082e0d28094b1934a7eebc1029e860cb29493c0e1ed04ccc5
9ee2fcff6709e4d0d24b09ca0fc56aade12b4961ed9c43fd13b03248bfb57afe
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
baafd74a4cb4dc594b614eeb45c7267bb1af729d9271752460348ece16532d04
d6e36ece60c553ec87643bb9842041059f0b0d9cf784b9d9e229bfa9941b4b78
df9a8b117a4fd266818dee3d12d7080ebdc7d1e1802445d3584d2c7d78bd9725
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef

148.72.10.21 Open in urlscan Pro 148.72.10.21 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

12 Requests

25 %HTTPS

67 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

323 kBTransfer

790 kBSize

1 Cookies

4 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

1 Cookies

2 Console Messages

Indicators

148.72.10.21 Open in urlscan Pro
148.72.10.21 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

25 %
HTTPS

67 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

323 kB
Transfer

790 kB
Size

1
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!