download.army
Open in
urlscan Pro
162.213.251.230
Malicious Activity!
Public Scan
Submission: On September 30 via automatic, source phishtank
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on January 14th 2020. Valid for: a year.
This is the only time download.army was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Netflix (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 13 | 162.213.251.230 162.213.251.230 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
12 | 1 |
ASN22612 (NAMECHEAP-NET, US)
PTR: premium87-5.web-hosting.com
download.army |
Apex Domain Subdomains |
Transfer | |
---|---|---|
13 |
download.army
1 redirects
download.army |
39 KB |
12 | 1 |
Domain | Requested by | |
---|---|---|
13 | download.army |
1 redirects
download.army
|
12 | 1 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
download.army Sectigo RSA Domain Validation Secure Server CA |
2020-01-14 - 2021-01-13 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://download.army/downloads/Banners/images/main/account/
Frame ID: 3BAA1C621AD53289283AEC36D97EC03C
Requests: 12 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://download.army/downloads/Banners/images/main/account
HTTP 301
https://download.army/downloads/Banners/images/main/account/ Page URL
Detected technologies
animate.css (Web Frameworks) ExpandDetected patterns
- html /<link [^>]+(?:\/([\d.]+)\/)?animate\.(?:min\.)?css/i
Apache (Web Servers) Expand
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://download.army/downloads/Banners/images/main/account
HTTP 301
https://download.army/downloads/Banners/images/main/account/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
download.army/downloads/Banners/images/main/account/ Redirect Chain
|
9 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
master.css
download.army/downloads/Banners/images/main/account/assets/css/ |
8 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loading.css
download.army/downloads/Banners/images/main/account/assets/css/ |
189 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
loading-btn.css
download.army/downloads/Banners/images/main/account/assets/css/ |
3 KB 747 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
icon.ico
download.army/downloads/Banners/images/main/assets/img/ |
17 KB 2 KB |
Stylesheet
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
animate.css
download.army/downloads/Banners/images/main/account/assets/css/ |
79 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
cleve.js
download.army/downloads/Banners/images/main/account/assets/js/ |
18 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.js
download.army/downloads/Banners/images/main/account/assets/js/ |
20 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
shield.png
download.army/downloads/Banners/images/main/account/assets/img/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tick.png
download.army/downloads/Banners/images/main/account/assets/img/ |
686 B 798 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
globe.png
download.army/downloads/Banners/images/main/account/assets/img/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
drop.png
download.army/downloads/Banners/images/main/account/assets/img/ |
478 B 590 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Netflix (Online)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| trustedTypes function| Cleave object| errors object| carderror function| driveStep function| formatString object| cleave function| getCardType function| luhnCheck function| loginNetflix1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
download.army/ | Name: PHPSESSID Value: 2e3b03ff0cb25cebed17b894d7c6c298 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
download.army
162.213.251.230
00988c4a2d389c085c15f02fb2db2a28d8ebe71dfa3d33b8751559fd708e6ed8
0f0940b8c00d2c78b0ac3b0b2d8e3676cbebc502320c39ff5b32f8446d8fd40c
3c925403eeb24cf057851003097e8bbc81f8baf6467c4748571cd440d20a7d12
43a600f9e33d65f6596e98057dbf0ae18b049671749b19a6c59058bfc975a196
4801bf781679e30457faed26adaa4522c403d74d9f06d1d63233fee1e4868bfc
4df05297cede46f8c179649f69573fee7322aadbbdbac3c2427c888cfc436adf
61534c5fc273f1d899927470c30ee2419258f28ff6b584553e2543a551732a87
b4ea3f56351395b7528c9049014f2e33442f8620f0b5e0bcae9d6aae234e87fe
c2b96c6f17f8c548bfadb33a8e11b77f155d8e1e985e37c07d2ce23bd24c380a
c8d904d2bb3904ebc2e3e6dfe37872553e2b5b41642111b9c97906b0c8b82386
d20ca4c5f157e2475bdc2cd10843b8e4bc7b5e99f925f9d6c2441dda958596b6
ed229a57e697e1eee579a1bbf898693bbf6f4b2acfa05f29bf30081db504fcca