net.membership.mhad24.com Open in urlscan Pro
45.88.108.231 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://demo.dctitan.com/reset/net.html
Effective URL:
https://net.membership.mhad24.com/net/id/login.php
Submission: On March 13 via manual (March 13th 2023, 2:04:06 am UTC) from AU — Scanned from AU

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 12 HTTP transactions. The main IP is 45.88.108.231, located in Germany and belongs to SYNLINQ synlinq.de, DE. The main domain is net.membership.mhad24.com.
TLS certificate: Issued by R3 on March 11th 2023. Valid for: 3 months.

This is the only time net.membership.mhad24.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	103.118.26.155 103.118.26.155	131626 (NSS-GROUP...) (NSS-GROUP-AS-TW NSS INTL CO.)
3 13	45.88.108.231 45.88.108.231	44486 (SYNLINQ s...) (SYNLINQ synlinq.de)
1	45.57.91.1 45.57.91.1	() ()
12	3

1 103.118.26.155 (Taiwan)

ASN131626 (NSS-GROUP-AS-TW NSS INTL CO., LTD., TW)
PTR: spr2.coowo.com

demo.dctitan.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 45.88.108.231 (Germany) 3 redirects

ASN44486 (SYNLINQ synlinq.de, DE)
PTR: plesk1.living-bots.net

net.membership.mhad24.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 45.57.91.1 (None, )

ASN- ()

assets.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	mhad24.com 3 redirects net.membership.mhad24.com	197 KB
1	nflxext.com assets.nflxext.com	72 KB
1	dctitan.com demo.dctitan.com	497 B
12	3

	Domain	Requested by
13	net.membership.mhad24.com	3 redirects net.membership.mhad24.com
1	assets.nflxext.com	net.membership.mhad24.com
1	demo.dctitan.com
12	3

This site contains no links.

Subject Issuer	Validity	Valid
net.membership.mhad24.com R3	`2023-03-11` - `2023-06-09`	3 months	crt.sh
*.1.nflxso.net DigiCert Secure Site ECC CA-1	`2023-02-19` - `2023-03-22`	a month	crt.sh

This page contains 1 frames:

Primary Page: https://net.membership.mhad24.com/net/id/login.php
Frame ID: ED34816F3FF47DC5171954A1C7FC60C1
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://demo.dctitan.com/reset/net.html Page URL
https://net.membership.mhad24.com/net HTTP 301
https://net.membership.mhad24.com/net/ HTTP 302
https://net.membership.mhad24.com/net/id/ HTTP 302
https://net.membership.mhad24.com/net/id/login.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

12
Requests

92 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

270 kB
Transfer

613 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://demo.dctitan.com/reset/net.html Page URL
https://net.membership.mhad24.com/net HTTP 301
https://net.membership.mhad24.com/net/ HTTP 302
https://net.membership.mhad24.com/net/id/ HTTP 302
https://net.membership.mhad24.com/net/id/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	net.html Show response demo.dctitan.com/reset/	205 B 497 B	1096ms 290ms	Document text/html	103.118.26.155 NSS-GROUP-AS-TW N...
General Check archive.org Show headers Download Go to Full URL http://demo.dctitan.com/reset/net.html Protocol HTTP/1.1 Server 103.118.26.155 , Taiwan, ASN131626 (NSS-GROUP-AS-TW NSS INTL CO., LTD., TW), Reverse DNS spr2.coowo.com Software Apache / PleskLin Resource Hash `6831148f37032d7d983043ff9369816ba07d6735a86ca04f48f6ec09c4e374e8` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 accept-language en-AU,en;q=0.9 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Length 205 Content-Type text/html Date Mon, 13 Mar 2023 02:03:59 GMT ETag "cd-5f6950f408580" Keep-Alive timeout=5, max=100 Last-Modified Sat, 11 Mar 2023 00:35:50 GMT Server Apache X-Powered-By PleskLin
GET H2	200	Primary Request login.php Show response net.membership.mhad24.com/net/id/ Redirect Chain https://net.membership.mhad24.com/net https://net.membership.mhad24.com/net/ https://net.membership.mhad24.com/net/id/ https://net.membership.mhad24.com/net/id/login.php	9 KB 2 KB	385ms 385ms	Document text/html	45.88.108.231 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://net.membership.mhad24.com/net/id/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.88.108.231 , Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk1.living-bots.net Software nginx / PHP/7.3.33 PleskLin Resource Hash `ba6fb9ca7a8bbfddc24a70ea97780e578c3611ce068e561c9c0a3abec6e99f42` Request headers Referer http://demo.dctitan.com/reset/net.html Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 accept-language en-AU,en;q=0.9 Response headers cache-control no-store, no-cache, must-revalidate content-encoding gzip content-length 2258 content-type text/html; charset=UTF-8 date Mon, 13 Mar 2023 02:04:03 GMT expires Thu, 19 Nov 1981 08:52:00 GMT pragma no-cache server nginx vary Accept-Encoding x-powered-by PHP/7.3.33 PleskLin Redirect headers cache-control no-store, no-cache, must-revalidate content-length 0 content-type text/html; charset=UTF-8 date Mon, 13 Mar 2023 02:04:03 GMT expires Thu, 19 Nov 1981 08:52:00 GMT location login.php pragma no-cache server nginx x-powered-by PHP/7.3.33 PleskLin
GET H2	200	none.css net.membership.mhad24.com/net/id/files/css/	145 KB 18 KB	1156ms 1155ms	Stylesheet text/css	45.88.108.231 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://net.membership.mhad24.com/net/id/files/css/none.css Requested by Host: net.membership.mhad24.com URL: https://net.membership.mhad24.com/net/id/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.88.108.231 , Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk1.living-bots.net Software nginx / PleskLin Resource Hash `996606e12517e3bb57e0a5f01fed3d7144e2d07a4d8076717a90285c351fa835` Request headers accept-language en-AU,en;q=0.9 Referer https://net.membership.mhad24.com/net/id/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Mon, 13 Mar 2023 02:04:04 GMT content-encoding br last-modified Sat, 11 Mar 2023 05:10:13 GMT server nginx etag W/"640c0d35-245ae" x-powered-by PleskLin content-type text/css
GET H2	200	none2.css net.membership.mhad24.com/net/id/files/css/	163 KB 21 KB	1156ms 1155ms	Stylesheet text/css	45.88.108.231 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://net.membership.mhad24.com/net/id/files/css/none2.css Requested by Host: net.membership.mhad24.com URL: https://net.membership.mhad24.com/net/id/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.88.108.231 , Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk1.living-bots.net Software nginx / PleskLin Resource Hash `72b3228cb98385052ac5e8e287ad5e563cd7e4f7943bfc23090dc9c4776e72dd` Request headers accept-language en-AU,en;q=0.9 Referer https://net.membership.mhad24.com/net/id/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Mon, 13 Mar 2023 02:04:04 GMT content-encoding br last-modified Sat, 11 Mar 2023 05:10:13 GMT server nginx etag W/"640c0d35-28bf6" x-powered-by PleskLin content-type text/css
GET H2	200	modernizr.min.js Show response net.membership.mhad24.com/net/id/files/js/	4 KB 2 KB	775ms 774ms	Script application/javascript	45.88.108.231 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://net.membership.mhad24.com/net/id/files/js/modernizr.min.js Requested by Host: net.membership.mhad24.com URL: https://net.membership.mhad24.com/net/id/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.88.108.231 , Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk1.living-bots.net Software nginx / PleskLin Resource Hash `a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44` Request headers accept-language en-AU,en;q=0.9 Referer https://net.membership.mhad24.com/net/id/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Mon, 13 Mar 2023 02:04:04 GMT content-encoding br last-modified Sat, 11 Mar 2023 05:10:13 GMT server nginx etag W/"640c0d35-edf" x-powered-by PleskLin content-type application/javascript
GET H2	200	jquery.js Show response net.membership.mhad24.com/net/id/files/js/	85 KB 29 KB	773ms 772ms	Script application/javascript	45.88.108.231 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://net.membership.mhad24.com/net/id/files/js/jquery.js Requested by Host: net.membership.mhad24.com URL: https://net.membership.mhad24.com/net/id/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.88.108.231 , Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk1.living-bots.net Software nginx / PleskLin Resource Hash `8603b20b548270423fb03c2138c16f5f863ead4c48eb0999167df869e2eef8a6` Request headers accept-language en-AU,en;q=0.9 Referer https://net.membership.mhad24.com/net/id/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Mon, 13 Mar 2023 02:04:04 GMT content-encoding br last-modified Sat, 11 Mar 2023 05:10:13 GMT server nginx etag W/"640c0d35-15339" x-powered-by PleskLin content-type application/javascript
GET H2	200	jquery.ccvalid.js Show response net.membership.mhad24.com/net/id/files/js/	7 KB 2 KB	816ms 816ms	Script application/javascript	45.88.108.231 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://net.membership.mhad24.com/net/id/files/js/jquery.ccvalid.js Requested by Host: net.membership.mhad24.com URL: https://net.membership.mhad24.com/net/id/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.88.108.231 , Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk1.living-bots.net Software nginx / PleskLin Resource Hash `ca83477931d09aca84c55e779bb2e6ef502b1af1bef668de771b8209a43eb11b` Request headers accept-language en-AU,en;q=0.9 Referer https://net.membership.mhad24.com/net/id/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Mon, 13 Mar 2023 02:04:04 GMT content-encoding br last-modified Sat, 11 Mar 2023 05:10:13 GMT server nginx etag W/"640c0d35-1d12" x-powered-by PleskLin content-type application/javascript
GET H2	200	jquery.mask.js Show response net.membership.mhad24.com/net/id/files/js/	8 KB 3 KB	774ms 774ms	Script application/javascript	45.88.108.231 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Full URL https://net.membership.mhad24.com/net/id/files/js/jquery.mask.js Requested by Host: net.membership.mhad24.com URL: https://net.membership.mhad24.com/net/id/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.88.108.231 , Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk1.living-bots.net Software nginx / PleskLin Resource Hash `38c89b667f0b98ab618ce6eef2947a58b9cac93e4dce667fec781562c34cd66e` Request headers accept-language en-AU,en;q=0.9 Referer https://net.membership.mhad24.com/net/id/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Mon, 13 Mar 2023 02:04:04 GMT content-encoding br last-modified Sat, 11 Mar 2023 05:10:13 GMT server nginx etag W/"640c0d35-1fad" x-powered-by PleskLin content-type application/javascript
GET H2	200	bg.jpg net.membership.mhad24.com/net/id/files/img/	117 KB 118 KB	386ms 386ms	Image image/jpeg	45.88.108.231 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Show image Full URL https://net.membership.mhad24.com/net/id/files/img/bg.jpg Requested by Host: net.membership.mhad24.com URL: https://net.membership.mhad24.com/net/id/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.88.108.231 , Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk1.living-bots.net Software nginx / PleskLin Resource Hash `cde4074549e72df2b148594b13728b01118887d02d99e5e7d67c5d1e54cc6669` Request headers accept-language en-AU,en;q=0.9 Referer https://net.membership.mhad24.com/net/id/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Mon, 13 Mar 2023 02:04:05 GMT last-modified Sat, 11 Mar 2023 05:10:13 GMT server nginx etag "640c0d35-1d529" x-powered-by PleskLin content-type image/jpeg accept-ranges bytes content-length 120105
GET H2	200	logo.svg net.membership.mhad24.com/net/id/files/img/	864 B 1 KB	766ms 765ms	Image image/svg+xml	45.88.108.231 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Show image Full URL https://net.membership.mhad24.com/net/id/files/img/logo.svg Requested by Host: net.membership.mhad24.com URL: https://net.membership.mhad24.com/net/id/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.88.108.231 , Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk1.living-bots.net Software nginx / PleskLin Resource Hash `8a421d5798accee1c284865ac05cee792ad3f6bcb3c70ce1dcb954d23e86fdad` Request headers accept-language en-AU,en;q=0.9 Referer https://net.membership.mhad24.com/net/id/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Mon, 13 Mar 2023 02:04:05 GMT last-modified Sat, 11 Mar 2023 05:10:13 GMT server nginx x-accel-version 0.01 etag "360-5f698e49333a2" x-powered-by PleskLin content-type image/svg+xml accept-ranges bytes content-length 864
GET H2	200	fb.png net.membership.mhad24.com/net/id/files/img/	1 KB 2 KB	749ms 748ms	Image image/png	45.88.108.231 SYNLINQ synlinq.de
General Check archive.org Show headers Download Go to Show image Full URL https://net.membership.mhad24.com/net/id/files/img/fb.png Requested by Host: net.membership.mhad24.com URL: https://net.membership.mhad24.com/net/id/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 45.88.108.231 , Germany, ASN44486 (SYNLINQ synlinq.de, DE), Reverse DNS plesk1.living-bots.net Software nginx / PleskLin Resource Hash `3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece` Request headers accept-language en-AU,en;q=0.9 Referer https://net.membership.mhad24.com/net/id/login.php User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers date Mon, 13 Mar 2023 02:04:05 GMT last-modified Sat, 11 Mar 2023 05:10:13 GMT server nginx etag "640c0d35-5af" x-powered-by PleskLin content-type image/png accept-ranges bytes content-length 1455
GET H/1.1	200 OK	nf-icon-v1-93.woff assets.nflxext.com/ffe/siteui/fonts/	72 KB 72 KB	300ms 99ms	Font font/woff	45.57.91.1
General Check archive.org Show headers Download Go to Full URL https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-93.woff Requested by Host: net.membership.mhad24.com URL: https://net.membership.mhad24.com/net/id/files/css/none.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 45.57.91.1 -, , ASN (), Reverse DNS Software nginx / Resource Hash `98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d` Request headers Referer https://net.membership.mhad24.com/ Origin https://net.membership.mhad24.com accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.64 Safari/537.36 Response headers Date Mon, 13 Mar 2023 02:04:05 GMT Last-Modified Mon, 29 Jan 2018 01:50:51 GMT Server nginx Content-MD5 fPYVbMSBJEtaJUNi17c/AA== Content-Type font/woff Access-Control-Allow-Origin * Cache-Control max-age=604801 Connection keep-alive Accept-Ranges bytes Content-Length 73572 Expires Mon, 20 Mar 2023 02:04:06 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.nflxext.com
demo.dctitan.com
net.membership.mhad24.com
103.118.26.155
45.57.91.1
45.88.108.231
38c89b667f0b98ab618ce6eef2947a58b9cac93e4dce667fec781562c34cd66e
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
6831148f37032d7d983043ff9369816ba07d6735a86ca04f48f6ec09c4e374e8
72b3228cb98385052ac5e8e287ad5e563cd7e4f7943bfc23090dc9c4776e72dd
8603b20b548270423fb03c2138c16f5f863ead4c48eb0999167df869e2eef8a6
8a421d5798accee1c284865ac05cee792ad3f6bcb3c70ce1dcb954d23e86fdad
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
996606e12517e3bb57e0a5f01fed3d7144e2d07a4d8076717a90285c351fa835
a6c3bff965978df8093c3a29f7071c21d7439a212af41e7b40ce70d94d6bcc44
ba6fb9ca7a8bbfddc24a70ea97780e578c3611ce068e561c9c0a3abec6e99f42
ca83477931d09aca84c55e779bb2e6ef502b1af1bef668de771b8209a43eb11b
cde4074549e72df2b148594b13728b01118887d02d99e5e7d67c5d1e54cc6669

net.membership.mhad24.com Open in urlscan Pro 45.88.108.231 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

92 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

270 kBTransfer

613 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

Indicators

net.membership.mhad24.com Open in urlscan Pro
45.88.108.231 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

92 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

270 kB
Transfer

613 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!