www.netflixsecurepayment.wcdjind.in
Open in
urlscan Pro
208.91.199.230
Malicious Activity!
Public Scan
Submission: On November 06 via automatic, source certstream-suspicious
Summary
TLS certificate: Issued by Let's Encrypt Authority X3 on November 6th 2020. Valid for: 3 months.
This is the only time www.netflixsecurepayment.wcdjind.in was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Netflix (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
12 | 208.91.199.230 208.91.199.230 | 394695 (PUBLIC-DO...) (PUBLIC-DOMAIN-REGISTRY) | |
1 | 2a00:86c0:209... 2a00:86c0:2090::1 | 40027 (NETFLIX-ASN) (NETFLIX-ASN) | |
2 | 2a05:d018:76c... 2a05:d018:76c:b685:3b38:679d:2640:1ced | 16509 (AMAZON-02) (AMAZON-02) | |
15 | 3 |
ASN394695 (PUBLIC-DOMAIN-REGISTRY, US)
PTR: 208.91.199-230.publicdomainregistry.com
www.netflixsecurepayment.wcdjind.in |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
wcdjind.in
www.netflixsecurepayment.wcdjind.in |
1 MB |
2 |
netflix.com
www.netflix.com |
955 B |
1 |
nflxext.com
assets.nflxext.com |
72 KB |
15 | 3 |
Domain | Requested by | |
---|---|---|
12 | www.netflixsecurepayment.wcdjind.in |
www.netflixsecurepayment.wcdjind.in
|
2 | www.netflix.com |
www.netflixsecurepayment.wcdjind.in
|
1 | assets.nflxext.com |
www.netflixsecurepayment.wcdjind.in
|
15 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.netflix.com |
help.netflix.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.netflixsecurepayment.wcdjind.in Let's Encrypt Authority X3 |
2020-11-06 - 2021-02-04 |
3 months | crt.sh |
*.1.nflxso.net DigiCert SHA2 Secure Server CA |
2020-10-16 - 2020-11-18 |
a month | crt.sh |
www.netflix.com DigiCert SHA2 Secure Server CA |
2020-01-13 - 2022-01-13 |
2 years | crt.sh |
This page contains 2 frames:
Primary Page:
https://www.netflixsecurepayment.wcdjind.in/
Frame ID: 717A30D7D0AD97C6F1C451E32B4DA565
Requests: 13 HTTP requests in this frame
Frame:
https://www.netflixsecurepayment.wcdjind.in/files/mp2v3DK3INU.htm
Frame ID: A52C2C772446AD1E9AA42DB5CFA16432
Requests: 1 HTTP requests in this frame
5 Outgoing links
These are links going to different origins than the main page.
Title: Netflix
Search URL Search Domain Scan URL
Title: Forgot your email or password?
Search URL Search Domain Scan URL
Title: Gift Card Terms
Search URL Search Domain Scan URL
Title: Terms of Use
Search URL Search Domain Scan URL
Title: Privacy Statement
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
15 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
www.netflixsecurepayment.wcdjind.in/ |
224 KB 81 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
none
www.netflixsecurepayment.wcdjind.in/files/ |
25 KB 25 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
none_002
www.netflixsecurepayment.wcdjind.in/files/ |
694 KB 698 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WebsiteDetect.htm
www.netflixsecurepayment.wcdjind.in/files/ |
3 KB 1 KB |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sdk.js
www.netflixsecurepayment.wcdjind.in/files/ |
238 KB 100 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
none1.css
www.netflixsecurepayment.wcdjind.in/files/ |
120 KB 26 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
FB-f-Logo__blue_57.png
www.netflixsecurepayment.wcdjind.in/files/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WebsiteDetect
www.netflixsecurepayment.wcdjind.in/ichnaea/cl2/freeform/ |
741 B 489 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WebsiteScreen
www.netflixsecurepayment.wcdjind.in/ichnaea/cl2/freeform/ |
741 B 512 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
index1.jpg
www.netflixsecurepayment.wcdjind.in/files/ |
389 KB 390 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nf-icon-v1-93.woff
assets.nflxext.com/ffe/siteui/fonts/ |
72 KB 72 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mp2v3DK3INU.htm
www.netflixsecurepayment.wcdjind.in/files/ Frame A52C |
42 KB 16 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
log
www.netflixsecurepayment.wcdjind.in/ichnaea/ |
741 B 489 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
cl2
www.netflix.com/ichnaea/ Frame |
0 0 |
Other
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
cl2
www.netflix.com/ichnaea/ |
0 955 B |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Netflix (Online)15 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes object| FB object| netflix object| Codex object| C object| global object| process object| __core-js_shared__ object| util function| jQuery object| jQuery1111055104794818162881 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.www.netflixsecurepayment.wcdjind.in/ | Name: cL Value: 1604639103486%7C160463910337107268%7C160463910326775866%7C%7C4%7CQ4LGITRPTFBBXPRW54H7JNZGOA |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
assets.nflxext.com
www.netflix.com
www.netflixsecurepayment.wcdjind.in
208.91.199.230
2a00:86c0:2090::1
2a05:d018:76c:b685:3b38:679d:2640:1ced
332dd04ae9deb819b7345e6f9d455c1b29b7f828cbb7d2a96afda1a9f3a6b48f
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
446a294643b28f44cf240f610c538d552fbdb64fb13db423913fbf9f21aecbf8
447218b88b08e611c0de431d1f664780ee6224a125b513dee42e723d1e0d3253
942d1276728cdf23e0c45e32c80004a878a42c6f70d8eb6ba22f046ba4984475
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
ad8332120d695eabaea380aa97f46620501739ebfbbb48786c169cd6aa8a442d
c4cfc25b4c87c6ba26026727c2363ed602e8be9f9acbd289638a0f59807eac0b
e1ed5df67073b308265fbe9a224014285611798f67909209d49c994a534dbf35
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f1238665449f521ff056e9e4e2b1b93a95d5947a1b46412e44610d4d8cbcc0fb
f5dc76a7b69f335b84a84122960c1db3684d85f30a39a953be9e835d691dfe77