urlscan.io logo urlscan.io
SecurityTrails logo

netflixstreaming.ga Open in urlscan Pro
2606:4700:3037::681c:11b  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://netflixstreaming.ga/
Submission: On October 13 via automatic, source certstream-suspicious
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 6 HTTP transactions. The main IP is 2606:4700:3037::681c:11b, located in United States and belongs to CLOUDFLARENET, US. The main domain is netflixstreaming.ga.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on October 13th 2020. Valid for: a year.
This is the only time netflixstreaming.ga was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

IP Address AS Autonomous System
1 2606:4700:303... 13335 (CLOUDFLAR...)
3 2a00:86c0:209... 40027 (NETFLIX-ASN)
1 2a02:26f0:eb:... 20940 (AKAMAI-ASN1)
6 4
Domain Requested by
2 assets.nflxext.com codex.nflxext.com
1 adtech.nflximg.net netflixstreaming.ga
1 codex.nflxext.com netflixstreaming.ga
1 netflixstreaming.ga netflixstreaming.ga
6 4

This site contains links to these domains. Also see Links.

Domain
www.netflix.com
help.netflix.com
Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-10-13 -
2021-10-12		 a year crt.sh
*.1.nflxso.net
DigiCert SHA2 Secure Server CA		 2020-10-08 -
2020-11-11		 a month crt.sh
assets.nflxext.com
DigiCert SHA2 Secure Server CA		 2020-02-19 -
2022-02-19		 2 years crt.sh

This page contains 2 frames:

Primary Page: https://netflixstreaming.ga/
Frame ID: 71FC9E8A32CC0CC7744B9F45523044B4
Requests: 5 HTTP requests in this frame

Frame: https://adtech.nflximg.net/adtech_iframe_target_03.html?data=%7B%22membership_status%22%3A%22NON_REGISTERED_MEMBER%22%2C%22country%22%3A%22BR%22%2C%22nli%22%3A%229038c8a6-bfea-4abd-9c52-8711d331a07f%22%2C%22fbaId%22%3A%224c43bdd6-826f-466c-8547-423c90bcd11b%22%2C%22is_member%22%3A%22anonymous%22%2C%22wasFormerMember%22%3Afalse%2C%22referrer%22%3A%22planSelectionContext%22%7D
Frame ID: 73C80A675199EDA3137CC337111C9AF9
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Page Statistics

6
Requests

83 %
HTTPS

100 %
IPv6

3
Domains

4
Subdomains

4
IPs

3
Countries

111 kB
Transfer

245 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
netflixstreaming.ga/ 		45 KB
17 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://netflixstreaming.ga/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3037::681c:11b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
64c883ab5d5bc6178c9f166e7b8f4adadbc089698f9aad80079d33a63a57521e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
netflixstreaming.ga
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
date
Tue, 13 Oct 2020 21:14:32 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=d80e975197306ae99b3f35d3f72ef9e9d1602623671; expires=Thu, 12-Nov-20 21:14:31 GMT; path=/; domain=.netflixstreaming.ga; HttpOnly; SameSite=Lax; Secure
x-xss-protection
1; mode=block
x-content-type-options
nosniff
x-request-id
182489438cd996b5349d24f9d986d654
cf-cache-status
DYNAMIC
cf-request-id
05c569a60100001f250713c200000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1602623672"}],"group":"cf-nel","max_age":604800}
nel
{"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
5e1c121cca211f25-FRA
content-encoding
br
WebsiteDetect
netflixstreaming.ga/ichnaea/cl2/freeform/ 		0
0
none
codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-css-c5f5180e/css/css/pages%7Csignup%7Csimplicity%7Csimplicity.less/2/0H0Z0i0f0-0P0N110_0O0X/none/true/ 		128 KB
22 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-css-c5f5180e/css/css/pages%7Csignup%7Csimplicity%7Csimplicity.less/2/0H0Z0i0f0-0P0N110_0O0X/none/true/none
Requested by
Host: netflixstreaming.ga
URL: https://netflixstreaming.ga/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a00:86c0:2090::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
13e62f891940f940d0a9da9f175136a9db9e2fbd2e8444792d1fdf3d71126220
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://netflixstreaming.ga/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 13 Oct 2020 21:14:32 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
nginx
Transfer-Encoding
chunked
Content-Type
text/css; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=16070400
req_id
af62cf38-01d4-4209-a416-27a0ed2fb62d
Connection
keep-alive
Timing-Allow-Origin
https://www.netflix.com
Expires
Sat, 17 Apr 2021 21:14:32 GMT
adtech_iframe_target_03.html
adtech.nflximg.net/ Frame 73C8 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://adtech.nflximg.net/adtech_iframe_target_03.html?data=%7B%22membership_status%22%3A%22NON_REGISTERED_MEMBER%22%2C%22country%22%3A%22BR%22%2C%22nli%22%3A%229038c8a6-bfea-4abd-9c52-8711d331a07f%22%2C%22fbaId%22%3A%224c43bdd6-826f-466c-8547-423c90bcd11b%22%2C%22is_member%22%3A%22anonymous%22%2C%22wasFormerMember%22%3Afalse%2C%22referrer%22%3A%22planSelectionContext%22%7D
Requested by
Host: netflixstreaming.ga
URL: https://netflixstreaming.ga/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:eb:3af::33c4 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash

Request headers

Host
adtech.nflximg.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://netflixstreaming.ga/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://netflixstreaming.ga/

Response headers

Accept-Ranges
bytes
Content-Type
text/html
ETag
"15ea117e697201fb35e5598e829da564:1473219202"
Last-Modified
Wed, 07 Sep 2016 03:33:19 GMT
Server
AkamaiNetStorage
X-Akamai-Path-Stats
[3:100812:5188]
Vary
Accept-Encoding
Content-Encoding
gzip
Date
Tue, 13 Oct 2020 21:14:32 GMT
Content-Length
1403
Connection
keep-alive
Checkmark.png
assets.nflxext.com/ffe/siteui/acquisition/simplicity/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.nflxext.com/ffe/siteui/acquisition/simplicity/Checkmark.png
Requested by
Host: codex.nflxext.com
URL: https://codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-css-c5f5180e/css/css/pages%7Csignup%7Csimplicity%7Csimplicity.less/2/0H0Z0i0f0-0P0N110_0O0X/none/true/none
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a00:86c0:2090::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
421fda28f37b12f33bd0d268a14a0acc0b996b69497896fe66f4f4681bdf0c9c

Request headers

Referer
https://codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-css-c5f5180e/css/css/pages%7Csignup%7Csimplicity%7Csimplicity.less/2/0H0Z0i0f0-0P0N110_0O0X/none/true/none
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 13 Oct 2020 21:14:32 GMT
Last-Modified
Fri, 26 Feb 2016 23:48:46 GMT
Server
nginx
Content-MD5
2tlyh/5kP9TN++aHFQ/YiA==
Content-Type
image/png
Cache-Control
public, max-age=6183
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3249
Expires
Tue, 30 Jun 2020 22:56:29 GMT
nf-icon-v1-88.woff
assets.nflxext.com/ffe/siteui/fonts/ 		69 KB
69 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-88.woff
Requested by
Host: codex.nflxext.com
URL: https://codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-css-c5f5180e/css/css/pages%7Csignup%7Csimplicity%7Csimplicity.less/2/0H0Z0i0f0-0P0N110_0O0X/none/true/none
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a00:86c0:2090::1 , United Kingdom, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
ba892f7903e737d06c952be4ed3266746ed5e1090377fbc5d2ac975626c4533a

Request headers

Origin
https://netflixstreaming.ga
Referer
https://codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-css-c5f5180e/css/css/pages%7Csignup%7Csimplicity%7Csimplicity.less/2/0H0Z0i0f0-0P0N110_0O0X/none/true/none
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Tue, 13 Oct 2020 21:14:32 GMT
Content-Encoding
gzip
Last-Modified
Fri, 27 Jan 2017 22:53:52 GMT
Server
nginx
Content-MD5
ezBCotj2o1GiKPEVK1YDAg==
Content-Type
text/plain
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=8909
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
70053
Expires
Tue, 13 Oct 2020 15:38:02 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
netflixstreaming.ga
URL
https://netflixstreaming.ga/ichnaea/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=css&modalView=signupSimplicity-planSelectionWithContext

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes

1 Cookies

Domain/Path Name / Value
.netflixstreaming.ga/ Name: __cfduid
Value: d80e975197306ae99b3f35d3f72ef9e9d1602623671

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block