![](/screenshots/a2555b43-459c-49ca-902c-e15d3ee64ece.png)
netflixclone.mycodewave.com
Open in
urlscan Pro
144.126.210.192
Malicious Activity!
Public Scan
Effective URL: https://netflixclone.mycodewave.com/
Submission: On January 18 via api from JP — Scanned from JP
Summary
TLS certificate: Issued by R3 on January 11th 2023. Valid for: 3 months.
This is the only time netflixclone.mycodewave.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Netflix (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 6 | 144.126.210.192 144.126.210.192 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
3 | 151.101.64.176 151.101.64.176 | 54113 (FASTLY) (FASTLY) | |
3 | 54.187.119.242 54.187.119.242 | 16509 (AMAZON-02) (AMAZON-02) | |
2 | 2600:9000:21d... 2600:9000:21d2:400:19:7d10:bd80:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 44.241.99.69 44.241.99.69 | 16509 (AMAZON-02) (AMAZON-02) | |
14 | 5 |
ASN14061 (DIGITALOCEAN-ASN, US)
netflixclone.mycodewave.com |
ASN16509 (AMAZON-02, US)
PTR: ip-54-187-119-242.stripe.com
q.stripe.com |
ASN16509 (AMAZON-02, US)
PTR: ec2-44-241-99-69.us-west-2.compute.amazonaws.com
m.stripe.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
stripe.com
js.stripe.com — Cisco Umbrella Rank: 995 q.stripe.com — Cisco Umbrella Rank: 5906 m.stripe.com — Cisco Umbrella Rank: 991 |
105 KB |
6 |
mycodewave.com
1 redirects
netflixclone.mycodewave.com |
446 KB |
2 |
stripe.network
m.stripe.network — Cisco Umbrella Rank: 1108 |
16 KB |
14 | 3 |
Domain | Requested by | |
---|---|---|
6 | netflixclone.mycodewave.com |
1 redirects
netflixclone.mycodewave.com
|
3 | q.stripe.com |
netflixclone.mycodewave.com
|
3 | js.stripe.com |
netflixclone.mycodewave.com
js.stripe.com |
2 | m.stripe.network |
js.stripe.com
m.stripe.network |
1 | m.stripe.com |
m.stripe.network
|
14 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
www.mycodewave.com R3 |
2023-01-11 - 2023-04-11 |
3 months | crt.sh |
a.stripecdn.com DigiCert SHA2 Extended Validation Server CA |
2023-01-10 - 2023-05-10 |
4 months | crt.sh |
*.stripe.com DigiCert TLS Hybrid ECC SHA384 2020 CA1 |
2022-11-12 - 2023-03-09 |
4 months | crt.sh |
m.stripe.com DigiCert TLS RSA SHA256 2020 CA1 |
2023-01-08 - 2023-04-08 |
3 months | crt.sh |
This page contains 3 frames:
Primary Page:
https://netflixclone.mycodewave.com/
Frame ID: B241FC0A07D9EE6B289660E5C026B775
Requests: 6 HTTP requests in this frame
Frame:
https://js.stripe.com/v3/m-outer-93afeeb17bc37e711759584dbfc50d47.html
Frame ID: 92E3759A39B3CE38BE118F3443B5E1A5
Requests: 4 HTTP requests in this frame
Frame:
https://m.stripe.network/inner.html
Frame ID: F072BA6B1670FFD44A352DD872084CF6
Requests: 4 HTTP requests in this frame
Screenshot
![](/screenshots/a2555b43-459c-49ca-902c-e15d3ee64ece.png)
Page Title
Netflix built with ReactJS and ReduxPage URL History Show full URLs
-
http://netflixclone.mycodewave.com/
HTTP 301
https://netflixclone.mycodewave.com/ Page URL
Detected technologies
![](/vendor/wappa/icons/Stripe.png)
Detected patterns
- js\.stripe\.com
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://netflixclone.mycodewave.com/
HTTP 301
https://netflixclone.mycodewave.com/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
netflixclone.mycodewave.com/ Redirect Chain
|
692 B 749 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.73a20e5a.js
netflixclone.mycodewave.com/static/js/ |
753 KB 225 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.15cd6101.css
netflixclone.mycodewave.com/static/css/ |
6 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
v3
js.stripe.com/ |
422 KB 101 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.png
netflixclone.mycodewave.com/ |
17 KB 17 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bg.b79a7bcf909f9ac4cb07.jpeg
netflixclone.mycodewave.com/static/media/ |
200 KB 200 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m-outer-93afeeb17bc37e711759584dbfc50d47.html
js.stripe.com/v3/ Frame 92E3 |
200 B 810 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
csp-report
q.stripe.com/ Frame 92E3 |
0 600 B |
Other
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
csp-report
q.stripe.com/ Frame 92E3 |
0 601 B |
Other
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
m-outer-8cb24ab2d649fd36a488d04d8c457933.js
js.stripe.com/v3/fingerprinted/js/ Frame 92E3 |
631 B 467 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
inner.html
m.stripe.network/ Frame F072 |
930 B 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
csp-report
q.stripe.com/ Frame F072 |
0 374 B |
Other
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
out-4.5.42.js
m.stripe.network/ Frame F072 |
86 KB 14 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
6
m.stripe.com/ Frame F072 |
156 B 553 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Netflix (Online)5 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| oncontentvisibilityautostatechange object| webpackChunknetflix object| webpackChunkStripeJSouter function| Stripe3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
m.stripe.com/ | Name: m Value: 0f7cbbc5-2379-443f-91d5-37a6f49026d09c8055 |
|
.netflixclone.mycodewave.com/ | Name: __stripe_mid Value: b81a4ddb-991a-4989-b771-c180d8aed13f5e8084 |
|
.netflixclone.mycodewave.com/ | Name: __stripe_sid Value: 752f8fcf-2e48-4c54-ac91-4e82ac71d451a1f700 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
js.stripe.com
m.stripe.com
m.stripe.network
netflixclone.mycodewave.com
q.stripe.com
144.126.210.192
151.101.64.176
2600:9000:21d2:400:19:7d10:bd80:93a1
44.241.99.69
54.187.119.242
124b79187db45c8293fa66f2d16a5aa94dee0279bb129b779dc028c2b62d68bd
218bc2b47bb718e6c65206f46f0c9791edcfdf5ccff6e6abcecb7637be7cf33b
223b52dfe12563a075dae0af3bf281575b4bde67ce2679ce80308e1f1fd904ca
250a0782da875705bd206ee23c2a46abf90656645a81e084126c5e8c53eeb9d6
3feba0dc6d265fe4f720b752b57e86b7f1077fedec9ecca56dda0bd562699c47
47dab17db2624bce19d9b8651524d6c7990967d972040d10e2a6bc7f9c74fe74
5cdb70b2aead66915748302c670733a13c12fe63bb593db36c01376cb993dd89
a19a56f646f2f6b4e9bde7ef8a2072e50027bc7827fd4c7824e8aa2983da892d
a5f27af9c0c6f37979ebafcac22eb3a613841a3d4e728f4577baf94e64d42f35
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f22005da41e15b7adb453814b37a794f7c6b955f086a6c5fc9980e3c3f6c8bca
f445ee14f2454d974293d28677213ae002e9ac17721fc04b2fdeb037e083b083