www.touristpeople.com.bd
Open in
urlscan Pro
202.4.96.47
Malicious Activity!
Public Scan
Effective URL: http://www.touristpeople.com.bd/service-netflix-custmor-id192929/f6b70b/2bd3/base1/dataone.php?1acdef4812b534f9f859605ae3065ff7
Submission: On March 30 via automatic, source openphish
Summary
This is the only time www.touristpeople.com.bd was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Netflix (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
5 10 | 202.4.96.47 202.4.96.47 | 23956 (AMBERIT-B...) (AMBERIT-BD-AS AmberIT Limited) | |
1 | 2a00:1450:400... 2a00:1450:4001:809::200a | 15169 (GOOGLE) (GOOGLE) | |
3 | 2a00:86c0:209... 2a00:86c0:2090::1 | 40027 (NETFLIX-ASN) (NETFLIX-ASN) | |
9 | 3 |
ASN23956 (AMBERIT-BD-AS AmberIT Limited, BD)
PTR: whm.dhakacom.com
www.touristpeople.com.bd |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
touristpeople.com.bd
5 redirects
www.touristpeople.com.bd |
163 KB |
3 |
nflxext.com
assets.nflxext.com |
413 KB |
1 |
googleapis.com
ajax.googleapis.com |
30 KB |
9 | 3 |
Domain | Requested by | |
---|---|---|
10 | www.touristpeople.com.bd |
5 redirects
www.touristpeople.com.bd
|
3 | assets.nflxext.com |
www.touristpeople.com.bd
|
1 | ajax.googleapis.com |
www.touristpeople.com.bd
|
9 | 3 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.storage.googleapis.com GTS CA 1O1 |
2020-03-03 - 2020-05-26 |
3 months | crt.sh |
*.1.nflxso.net DigiCert SHA2 Secure Server CA |
2020-03-12 - 2020-04-16 |
a month | crt.sh |
This page contains 1 frames:
Primary Page:
http://www.touristpeople.com.bd/service-netflix-custmor-id192929/f6b70b/2bd3/base1/dataone.php?1acdef4812b534f9f859605ae3065ff7
Frame ID: 20D4712209145182D751C56596A734D0
Requests: 9 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://www.touristpeople.com.bd/service-netflix-custmor-id192929/
HTTP 302
http://www.touristpeople.com.bd/service-netflix-custmor-id192929/f6b70b HTTP 301
http://www.touristpeople.com.bd/service-netflix-custmor-id192929/f6b70b/ HTTP 302
http://www.touristpeople.com.bd/service-netflix-custmor-id192929/f6b70b/2bd3 HTTP 301
http://www.touristpeople.com.bd/service-netflix-custmor-id192929/f6b70b/2bd3/ HTTP 302
http://www.touristpeople.com.bd/service-netflix-custmor-id192929/f6b70b/2bd3/base1/index.php?bab01bc6ccbf538... Page URL
- http://www.touristpeople.com.bd/service-netflix-custmor-id192929/f6b70b/2bd3/base1/dataone.php?1acdef4812b53... Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
React (JavaScript Frameworks) Expand
Detected patterns
- html /<[^>]+data-react/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://www.touristpeople.com.bd/service-netflix-custmor-id192929/
HTTP 302
http://www.touristpeople.com.bd/service-netflix-custmor-id192929/f6b70b HTTP 301
http://www.touristpeople.com.bd/service-netflix-custmor-id192929/f6b70b/ HTTP 302
http://www.touristpeople.com.bd/service-netflix-custmor-id192929/f6b70b/2bd3 HTTP 301
http://www.touristpeople.com.bd/service-netflix-custmor-id192929/f6b70b/2bd3/ HTTP 302
http://www.touristpeople.com.bd/service-netflix-custmor-id192929/f6b70b/2bd3/base1/index.php?bab01bc6ccbf538bcd89458bce1ca45c20&letit=6384030373 Page URL
- http://www.touristpeople.com.bd/service-netflix-custmor-id192929/f6b70b/2bd3/base1/dataone.php?1acdef4812b534f9f859605ae3065ff7 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://www.touristpeople.com.bd/service-netflix-custmor-id192929/ HTTP 302
- http://www.touristpeople.com.bd/service-netflix-custmor-id192929/f6b70b HTTP 301
- http://www.touristpeople.com.bd/service-netflix-custmor-id192929/f6b70b/ HTTP 302
- http://www.touristpeople.com.bd/service-netflix-custmor-id192929/f6b70b/2bd3 HTTP 301
- http://www.touristpeople.com.bd/service-netflix-custmor-id192929/f6b70b/2bd3/ HTTP 302
- http://www.touristpeople.com.bd/service-netflix-custmor-id192929/f6b70b/2bd3/base1/index.php?bab01bc6ccbf538bcd89458bce1ca45c20&letit=6384030373
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
index.php
www.touristpeople.com.bd/service-netflix-custmor-id192929/f6b70b/2bd3/base1/ Redirect Chain
|
191 B 542 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
dataone.php
www.touristpeople.com.bd/service-netflix-custmor-id192929/f6b70b/2bd3/base1/ |
10 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
z.css
www.touristpeople.com.bd/service-netflix-custmor-id192929/f6b70b/2bd3/css/ |
2 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
a.css
www.touristpeople.com.bd/service-netflix-custmor-id192929/f6b70b/2bd3/css/ |
149 KB 149 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.3.1/ |
85 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
FB-f-Logo__blue_57.png
assets.nflxext.com/ffe/siteui/login/images/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
MA-en-20190520-popsignuptwoweeks-perspective_alpha_website_large.jpg
assets.nflxext.com/ffe/siteui/vlv3/06f60d9f-3b9a-42e2-bc78-141074bcd075/174afadb-67be-434f-93c3-9a5dc4e96d8c/ |
319 KB 319 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nf-icon-v1-93.woff
www.touristpeople.com.bd/service-netflix-custmor-id192929/f6b70b/2bd3/css/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nf-icon-v1-93.ttf
assets.nflxext.com/ffe/siteui/fonts/ |
92 KB 92 KB |
Font
font/ttf |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Netflix (Online)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
assets.nflxext.com
www.touristpeople.com.bd
202.4.96.47
2a00:1450:4001:809::200a
2a00:86c0:2090::1
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
3a569322649edf9f25b2ef522336ecb37eba505e4919d5d784294ecf6400b399
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
4ae58d47961137684b3aab1178b303d1afc30501da65087122dc59dd6d00ad44
9524357be2c168089254967f58a506be84fbb50637e6ea9b099e0b6aa77a68d1
df9a8b117a4fd266818dee3d12d7080ebdc7d1e1802445d3584d2c7d78bd9725
fe8402a9358de9060c332a9eeb46a29add067639751ca10a62e06eeed66a900f