netflix-execution.com
Open in
urlscan Pro
162.213.251.109
Malicious Activity!
Public Scan
Effective URL: https://netflix-execution.com/
Submission: On December 01 via automatic, source openphish
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on November 30th 2020. Valid for: a year.
This is the only time netflix-execution.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Disney (Entertainment)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 10 | 162.213.251.109 162.213.251.109 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
2 | 2600:9000:215... 2600:9000:2156:1c00:7:f6eb:b280:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
11 | 2 |
ASN22612 (NAMECHEAP-NET, US)
PTR: business89-5.web-hosting.com
netflix-execution.com |
ASN16509 (AMAZON-02, US)
prod-static.disney-plus.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
netflix-execution.com
1 redirects
netflix-execution.com |
77 KB |
2 |
disney-plus.net
prod-static.disney-plus.net |
99 KB |
11 | 2 |
Domain | Requested by | |
---|---|---|
10 | netflix-execution.com |
1 redirects
netflix-execution.com
|
2 | prod-static.disney-plus.net |
netflix-execution.com
|
11 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
netflix-execution.com Sectigo RSA Domain Validation Secure Server CA |
2020-11-30 - 2021-11-30 |
a year | crt.sh |
*.disney-plus.net COMODO RSA Organization Validation Secure Server CA |
2020-05-30 - 2021-05-30 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://netflix-execution.com/
Frame ID: F9A2D64C9D51DA403834E0E84867D81C
Requests: 11 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://netflix-execution.com/
HTTP 301
https://netflix-execution.com/ Page URL
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://netflix-execution.com/
HTTP 301
https://netflix-execution.com/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
netflix-execution.com/ Redirect Chain
|
36 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics_script_bundle.js.t%C3%A9l%C3%A9chargement
netflix-execution.com/assets/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
basesite_styles_bundle.css
netflix-execution.com/assets/ |
4 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
app_styles_bundle.css
netflix-execution.com/assets/ |
260 KB 60 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
logo.svg
netflix-execution.com/assets/ |
7 KB 3 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
disney-account.svg
netflix-execution.com/assets/ |
7 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tr
netflix-execution.com/assets/ |
44 B 353 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
0
netflix-execution.com/assets/ |
0 299 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
0(1)
netflix-execution.com/assets/ |
0 299 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Avenir-Roman-12.woff
prod-static.disney-plus.net/builds/103332c04959a68f6c4cb7fb864c6751d8a8de8c_1576008097376/fonts/ |
42 KB 43 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Avenir-Heavy-05.woff
prod-static.disney-plus.net/builds/103332c04959a68f6c4cb7fb864c6751d8a8de8c_1576008097376/fonts/ |
56 KB 56 KB |
Font
application/font-woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Disney (Entertainment)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000; includeSubDomains; preload; |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
netflix-execution.com
prod-static.disney-plus.net
162.213.251.109
2600:9000:2156:1c00:7:f6eb:b280:93a1
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
1920ca5153bc2ae87e17795a12ac5835113513b922c95d0bf44ee026200b8631
4442cba812240f56b7adde799c1a97c7970875d0d01cbf1c5667e25c6beed2cf
6a7eb353b38a935a0ec168fb6429a2705ee9a9b5003831787f8fa66b6a6b3554
881b18f3f5c471177d845aec1f623e1352589ad5bdaed13abbbb57a14afc0d6d
b78d2f71915b0816a670e070d9e130e74c8fa38fdab58517c709eccef918fb84
c31544c5f6aca2b373369dcb74e374019dc9ef5d0a6fe90ab5016d0c170deb4a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fd9abcdb3ec7bf852f7f0668d07ce19b0e970943aedcfc95685f16a9c41e9440