www.netflix.tbtricks.com Open in urlscan Pro
108.179.235.139 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.netflix.tbtricks.com/
Submission: On September 25 via automatic, source certstream-suspicious (September 25th 2020, 8:18:40 pm UTC)

Summary HTTP 17 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 7 IPs in 3 countries across 8 domains to perform 17 HTTP transactions. The main IP is 108.179.235.139, located in Houston, United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is www.netflix.tbtricks.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on September 25th 2020. Valid for: 3 months.

This is the only time www.netflix.tbtricks.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address	AS Autonomous System
9	108.179.235.139 108.179.235.139	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
2	23.111.9.35 23.111.9.35	33438 (HIGHWINDS2) (HIGHWINDS2)
2	3.225.87.211 3.225.87.211	14618 (AMAZON-AES) (AMAZON-AES)
1	2606:4700:303... 2606:4700:3031::681c:1cef	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:802::200a	15169 (GOOGLE) (GOOGLE)
1	78.142.29.171 78.142.29.171	201133 (VERDINA) (VERDINA)
1	2a00:1450:400... 2a00:1450:4001:825::2003	15169 (GOOGLE) (GOOGLE)
17	7

9 108.179.235.139 (Houston, United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 7vn.biz

www.netflix.tbtricks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.111.9.35 (Phoenix, United States)

ASN33438 (HIGHWINDS2, US)

use.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.225.87.211 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-225-87-211.compute-1.amazonaws.com

www.clickfam.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.locked2.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3031::681c:1cef (United States)

ASN13335 (CLOUDFLARENET, US)

bootstraplugin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 78.142.29.171 (Bulgaria)

ASN201133 (VERDINA, BZ)

ogcdn.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:825::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	tbtricks.com www.netflix.tbtricks.com	1 MB
2	fontawesome.com use.fontawesome.com	87 KB
1	gstatic.com fonts.gstatic.com	18 KB
1	ogcdn.co ogcdn.co	3 KB
1	googleapis.com ajax.googleapis.com	30 KB
1	bootstraplugin.com bootstraplugin.com	569 B
1	locked2.com www.locked2.com	14 KB
1	clickfam.com www.clickfam.com	2 KB
17	8

	Domain	Requested by
9	www.netflix.tbtricks.com	www.netflix.tbtricks.com
2	use.fontawesome.com	www.netflix.tbtricks.com use.fontawesome.com
1	fonts.gstatic.com	www.netflix.tbtricks.com
1	ogcdn.co	www.netflix.tbtricks.com
1	ajax.googleapis.com	www.locked2.com
1	bootstraplugin.com	www.netflix.tbtricks.com
1	www.locked2.com	www.netflix.tbtricks.com
1	www.clickfam.com	www.netflix.tbtricks.com
17	8

This site contains links to these domains. Also see Links.

Domain
www.google.com

Subject Issuer	Validity	Valid
www.netflix.tbtricks.com Let's Encrypt Authority X3	`2020-09-25` - `2020-12-24`	3 months	crt.sh
*.fontawesome.com DigiCert SHA2 Secure Server CA	`2019-10-28` - `2020-12-23`	a year	crt.sh
*.clickfam.com Let's Encrypt Authority X3	`2020-07-30` - `2020-10-28`	3 months	crt.sh
*.locked2.com Let's Encrypt Authority X3	`2020-09-11` - `2020-12-10`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-13` - `2021-08-13`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
ogcdn.co cPanel, Inc. Certification Authority	`2020-08-16` - `2020-11-14`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.netflix.tbtricks.com/
Frame ID: 38E064435DD2A2A152A11444D90B74DF
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href="https:\/\/use\.fontawesome\.com\/releases\/v([^>]+)\/css\//i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

17
Requests

100 %
HTTPS

43 %
IPv6

8
Domains

8
Subdomains

7
IPs

3
Countries

1235 kB
Transfer

1393 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://www.google.com/intl/en/policies/privacy/
Title: Privacy

Search URL Search Domain Scan URL

URL: https://www.google.com/intl/en/policies/terms/
Title: Terms

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.netflix.tbtricks.com/ 7 KB
2 KB 1758ms
1478ms Document
text/html 108.179.235.139
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.netflix.tbtricks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.235.139 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 7vn.biz
Software: nginx/1.19.0 /
Resource Hash: c45f8848b5638d15666d425f94e1699ff700ad8891b6e41ce9d4b49e6160d401

Request headers

:method: GET
:authority: www.netflix.tbtricks.com
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Fri, 25 Sep 2020 20:18:21 GMT
server: nginx/1.19.0
content-type: text/html
content-length: 2026
last-modified: Fri, 25 Sep 2020 20:12:57 GMT
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
x-server-cache: false

GET
H2 200 all.css
use.fontawesome.com/releases/v5.8.2/css/ 54 KB
14 KB 55ms
19ms Stylesheet
text/css 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.8.2/css/all.css
Requested by: Host: www.netflix.tbtricks.com
URL: https://www.netflix.tbtricks.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 06d6e10886ed7de5561acab1935bce1c46174baa9cbd0bcb319aa3b69594131f

Request headers

Origin: https://www.netflix.tbtricks.com
Referer: https://www.netflix.tbtricks.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 20:18:21 GMT
content-encoding: gzip
last-modified: Tue, 07 May 2019 16:50:11 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"77cbad34e5ce95e70847b074e05faeab"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: text/css
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT

GET
H2 200 style.css
www.netflix.tbtricks.com/css/ 5 KB
2 KB 183ms
182ms Stylesheet
text/css 108.179.235.139
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.netflix.tbtricks.com/css/style.css
Requested by: Host: www.netflix.tbtricks.com
URL: https://www.netflix.tbtricks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.235.139 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 7vn.biz
Software: nginx/1.19.0 /
Resource Hash: 0b1667eb5814302cbbfb8e793a4991e62e1fef6ea2c89cd6bbe3ac1702020364

Request headers

Referer: https://www.netflix.tbtricks.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 20:18:21 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 20:10:42 GMT
server: nginx/1.19.0
x-server-cache: false
vary: Accept-Encoding
content-type: text/css
status: 200
accept-ranges: bytes
content-length: 1827

GET
H/1.1 200
OK load.php Show response
www.clickfam.com/cl/ 3 KB
2 KB 373ms
137ms Script
application/javascript 3.225.87.211
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.clickfam.com/cl/load.php?id=a26966e056a96ccab2039af138d000a3

Requested by

Host: www.netflix.tbtricks.com
URL: https://www.netflix.tbtricks.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

3.225.87.211 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-225-87-211.compute-1.amazonaws.com

Software

nginx/1.15.6 /

Resource Hash

33989f81f34e6438737b46953a1beea9925829957c0cf135f1b991c8f20fa28e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.netflix.tbtricks.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 20:18:21 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx/1.15.6
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Connection: keep-alive
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK captcha.js.php Show response
www.locked2.com/cp/js/ 62 KB
14 KB 424ms
201ms Script
application/javascript 3.225.87.211
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.locked2.com/cp/js/captcha.js.php?id=5fc178d8da9416c7624f8a491f004960

Requested by

Host: www.netflix.tbtricks.com
URL: https://www.netflix.tbtricks.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

3.225.87.211 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-225-87-211.compute-1.amazonaws.com

Software

nginx/1.15.6 /

Resource Hash

a207a1a1b0eeb85f6de35b3cd42ff7838219d57a3a7b76faefc3ee4358e1012d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.netflix.tbtricks.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Fri, 25 Sep 2020 20:18:21 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx/1.15.6
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
Connection: keep-alive
X-XSS-Protection: 1; mode=block

GET
H2 200 logo.png
www.netflix.tbtricks.com/img/ 6 KB
6 KB 614ms
614ms Image
image/png 108.179.235.139
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.netflix.tbtricks.com/img/logo.png
Requested by: Host: www.netflix.tbtricks.com
URL: https://www.netflix.tbtricks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.235.139 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 7vn.biz
Software: nginx/1.19.0 /
Resource Hash: caf69067b53f840529b7cc3a2494e90878dc9f62307fc458dd893fac746d37a0

Request headers

Referer: https://www.netflix.tbtricks.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 20:18:22 GMT
last-modified: Fri, 25 Sep 2020 20:10:42 GMT
server: nginx/1.19.0
x-server-cache: false
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 6332

GET
H2 200 tab-content-1.png
www.netflix.tbtricks.com/img/ 169 KB
171 KB 613ms
611ms Image
image/png 108.179.235.139
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.netflix.tbtricks.com/img/tab-content-1.png
Requested by: Host: www.netflix.tbtricks.com
URL: https://www.netflix.tbtricks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.235.139 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 7vn.biz
Software: nginx/1.19.0 /
Resource Hash: d0a1d3ab0e60382d7cd4c92eea1d6381b9b71b5c403a95877d67fff18ac6779d

Request headers

Referer: https://www.netflix.tbtricks.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 20:18:22 GMT
last-modified: Fri, 25 Sep 2020 20:10:42 GMT
server: nginx/1.19.0
x-server-cache: false
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 173496

GET
H2 200 tab-content-2-1.png
www.netflix.tbtricks.com/img/ 242 KB
243 KB 613ms
611ms Image
image/png 108.179.235.139
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.netflix.tbtricks.com/img/tab-content-2-1.png
Requested by: Host: www.netflix.tbtricks.com
URL: https://www.netflix.tbtricks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.235.139 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 7vn.biz
Software: nginx/1.19.0 /
Resource Hash: 103646e75938c72c1e14b79899b6a6ae8050f255a35fefadae283e55b2b48127

Request headers

Referer: https://www.netflix.tbtricks.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 20:18:22 GMT
last-modified: Fri, 25 Sep 2020 20:10:42 GMT
server: nginx/1.19.0
x-server-cache: false
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 247810

GET
H2 200 tab-content-2-2.png
www.netflix.tbtricks.com/img/ 119 KB
120 KB 613ms
611ms Image
image/png 108.179.235.139
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.netflix.tbtricks.com/img/tab-content-2-2.png
Requested by: Host: www.netflix.tbtricks.com
URL: https://www.netflix.tbtricks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.235.139 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 7vn.biz
Software: nginx/1.19.0 /
Resource Hash: 55bc0f00df3c8622dc3ea9146aadf47791ea0730f1a98f452f4843366bc894b9

Request headers

Referer: https://www.netflix.tbtricks.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 20:18:22 GMT
last-modified: Fri, 25 Sep 2020 20:10:42 GMT
server: nginx/1.19.0
x-server-cache: false
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 122232

GET
H2 200 tab-content-2-3.png
www.netflix.tbtricks.com/img/ 170 KB
171 KB 612ms
611ms Image
image/png 108.179.235.139
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.netflix.tbtricks.com/img/tab-content-2-3.png
Requested by: Host: www.netflix.tbtricks.com
URL: https://www.netflix.tbtricks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.235.139 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 7vn.biz
Software: nginx/1.19.0 /
Resource Hash: fcb40d090bcfa2ef6b71c945cc84cb6c339b8b5b053df9e7d759961257dd9b8d

Request headers

Referer: https://www.netflix.tbtricks.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 20:18:22 GMT
last-modified: Fri, 25 Sep 2020 20:10:42 GMT
server: nginx/1.19.0
x-server-cache: false
content-type: image/png
status: 200
accept-ranges: bytes
content-length: 174061

GET
H2 200 main.js Show response
www.netflix.tbtricks.com/js/ 731 B
360 B 294ms
293ms Script
application/javascript 108.179.235.139
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://www.netflix.tbtricks.com/js/main.js
Requested by: Host: www.netflix.tbtricks.com
URL: https://www.netflix.tbtricks.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.235.139 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 7vn.biz
Software: nginx/1.19.0 /
Resource Hash: 41234ff8da6e3dfa6d65ca36b633452c270e88f6a48587774f4f5b36f8017512

Request headers

Referer: https://www.netflix.tbtricks.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 20:18:21 GMT
content-encoding: gzip
last-modified: Fri, 25 Sep 2020 20:10:42 GMT
server: nginx/1.19.0
x-server-cache: false
vary: Accept-Encoding
content-type: application/javascript
status: 200
accept-ranges: bytes
content-length: 311

GET
H2 200 p.php Show response
bootstraplugin.com/ 0
569 B 344ms
317ms Script
text/html 2606:4700:3031::681c:1cef
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://bootstraplugin.com/p.php?id=148
Requested by: Host: www.netflix.tbtricks.com
URL: https://www.netflix.tbtricks.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::681c:1cef , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.netflix.tbtricks.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 20:18:22 GMT
via: 1.1 vegur
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 5d876f16793ad6f1-FRA
content-type: text/html; charset=UTF-8
status: 200
cache-control: no-cache, private
content-encoding: br
cf-request-id: 056883c20b0000d6f1af0c6200000001

GET
H2 200 background.jpg
www.netflix.tbtricks.com/img/ 362 KB
365 KB 325ms
325ms Image
image/jpeg 108.179.235.139
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.netflix.tbtricks.com/img/background.jpg
Requested by: Host: www.netflix.tbtricks.com
URL: https://www.netflix.tbtricks.com/css/style.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 108.179.235.139 Houston, United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 7vn.biz
Software: nginx/1.19.0 /
Resource Hash: e80af08a4fc42043410733f64494a8094c202e1f8cf1fc2edfd39f40cf4124bd

Request headers

Referer: https://www.netflix.tbtricks.com/css/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 20:18:22 GMT
last-modified: Fri, 25 Sep 2020 20:10:42 GMT
server: nginx/1.19.0
x-server-cache: false
content-type: image/jpeg
status: 200
accept-ranges: bytes
content-length: 370628

GET
H2 200 fa-solid-900.woff2
use.fontawesome.com/releases/v5.8.2/webfonts/ 73 KB
73 KB 20ms
20ms Font
font/woff2 23.111.9.35
HIGHWINDS2

General

Check archive.org

Show headers Download Go to

Full URL: https://use.fontawesome.com/releases/v5.8.2/webfonts/fa-solid-900.woff2
Requested by: Host: use.fontawesome.com
URL: https://use.fontawesome.com/releases/v5.8.2/css/all.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 23.111.9.35 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software: NetDNA-cache/2.2 /
Resource Hash: 0fe6a4357505cb0d3ca8ba0671ad57df6b7410ca02cb8065eed58e2c0381e640

Request headers

Origin: https://www.netflix.tbtricks.com
Referer: https://use.fontawesome.com/releases/v5.8.2/css/all.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 20:18:21 GMT
last-modified: Tue, 07 May 2019 16:51:05 GMT
server: NetDNA-cache/2.2
status: 200
etag: "64b3e814a66c2719b15abf8f7998bd73"
vary: Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: font/woff2
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=31556926
x-cache: HIT
accept-ranges: bytes
content-length: 74328

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.1.0/ 84 KB
30 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:802::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.1.0/jquery.min.js

Requested by

Host: www.locked2.com
URL: https://www.locked2.com/cp/js/captcha.js.php?id=5fc178d8da9416c7624f8a491f004960

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

702b9e051e82b32038ffdb33a4f7eb5f7b38f4cf6f514e4182d8898f4eb0b7fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.netflix.tbtricks.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 21 Sep 2020 12:39:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 373135
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30211
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 21 Sep 2021 12:39:27 GMT

GET
H2 200 ft7ei84.png
ogcdn.co/captcha/ 3 KB
3 KB 252ms
58ms Image
image/png 78.142.29.171
VERDINA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ogcdn.co/captcha/ft7ei84.png
Requested by: Host: www.netflix.tbtricks.com
URL: https://www.netflix.tbtricks.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 78.142.29.171 , Bulgaria, ASN201133 (VERDINA, BZ),
Reverse DNS
Software: LiteSpeed /
Resource Hash: 9463786261a387907ed51538e899bd31f84ebbdf03daa7e5da9d43cc46934998

Request headers

Referer: https://www.netflix.tbtricks.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 25 Sep 2020 20:18:21 GMT
last-modified: Fri, 20 Jul 2018 17:31:11 GMT
server: LiteSpeed
content-type: image/png
status: 200
cache-control: public, max-age=604800
alt-svc: quic=":443"; ma=2592000; v="35,39,43"
content-length: 2746
expires: Fri, 02 Oct 2020 20:18:21 GMT

GET
H2 200 zN7GBFwfMP4uA6AR0HCoLQ.ttf
fonts.gstatic.com/s/roboto/v15/ 32 KB
18 KB 7ms
6ms Font
font/ttf 2a00:1450:4001:825::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v15/zN7GBFwfMP4uA6AR0HCoLQ.ttf

Requested by

Host: www.netflix.tbtricks.com
URL: https://www.netflix.tbtricks.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

967e5cecfbfbf64099c3c1232273482dd7436f05714266953c4d2c8ee9c28af5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.netflix.tbtricks.com
Referer: https://www.netflix.tbtricks.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 24 Sep 2020 07:14:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 133447
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18754
x-xss-protection: 0
last-modified: Wed, 14 Jan 2015 22:47:37 GMT
server: sffe
vary: Accept-Encoding
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 24 Sep 2021 07:14:15 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

27 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
bootstraplugin.com
fonts.gstatic.com
ogcdn.co
use.fontawesome.com
www.clickfam.com
www.locked2.com
www.netflix.tbtricks.com
108.179.235.139
23.111.9.35
2606:4700:3031::681c:1cef
2a00:1450:4001:802::200a
2a00:1450:4001:825::2003
3.225.87.211
78.142.29.171
06d6e10886ed7de5561acab1935bce1c46174baa9cbd0bcb319aa3b69594131f
0b1667eb5814302cbbfb8e793a4991e62e1fef6ea2c89cd6bbe3ac1702020364
0fe6a4357505cb0d3ca8ba0671ad57df6b7410ca02cb8065eed58e2c0381e640
103646e75938c72c1e14b79899b6a6ae8050f255a35fefadae283e55b2b48127
33989f81f34e6438737b46953a1beea9925829957c0cf135f1b991c8f20fa28e
41234ff8da6e3dfa6d65ca36b633452c270e88f6a48587774f4f5b36f8017512
55bc0f00df3c8622dc3ea9146aadf47791ea0730f1a98f452f4843366bc894b9
702b9e051e82b32038ffdb33a4f7eb5f7b38f4cf6f514e4182d8898f4eb0b7fb
9463786261a387907ed51538e899bd31f84ebbdf03daa7e5da9d43cc46934998
967e5cecfbfbf64099c3c1232273482dd7436f05714266953c4d2c8ee9c28af5
a207a1a1b0eeb85f6de35b3cd42ff7838219d57a3a7b76faefc3ee4358e1012d
c45f8848b5638d15666d425f94e1699ff700ad8891b6e41ce9d4b49e6160d401
caf69067b53f840529b7cc3a2494e90878dc9f62307fc458dd893fac746d37a0
d0a1d3ab0e60382d7cd4c92eea1d6381b9b71b5c403a95877d67fff18ac6779d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e80af08a4fc42043410733f64494a8094c202e1f8cf1fc2edfd39f40cf4124bd
fcb40d090bcfa2ef6b71c945cc84cb6c339b8b5b053df9e7d759961257dd9b8d

www.netflix.tbtricks.com Open in urlscan Pro 108.179.235.139 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

17 Requests

100 %HTTPS

43 %IPv6

8 Domains

8 Subdomains

7 IPs

3 Countries

1235 kBTransfer

1393 kBSize

0 Cookies

2 Outgoing links

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

27 JavaScript Global Variables

0 Cookies

Indicators

www.netflix.tbtricks.com Open in urlscan Pro
108.179.235.139 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

100 %
HTTPS

43 %
IPv6

8
Domains

8
Subdomains

7
IPs

3
Countries

1235 kB
Transfer

1393 kB
Size

0
Cookies

17 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!