ams-business-7.hostwindsdns.com
Open in
urlscan Pro
192.236.176.147
Malicious Activity!
Public Scan
Submission: On April 22 via api from CA
Summary
TLS certificate: Issued by COMODO RSA Domain Validation Secure S... on July 8th 2017. Valid for: 3 years.
This is the only time ams-business-7.hostwindsdns.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Netflix (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 10 | 192.236.176.147 192.236.176.147 | 54290 (HOSTWINDS) (HOSTWINDS) | |
6 | 2a00:86c0:209... 2a00:86c0:2091::1 | 40027 (NETFLIX-ASN) (NETFLIX-ASN) | |
2 | 2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3 | 32934 (FACEBOOK) (FACEBOOK) | |
1 | 2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de | 32934 (FACEBOOK) (FACEBOOK) | |
18 | 4 |
ASN54290 (HOSTWINDS, US)
PTR: amsbs13.hostwindsdns.com
ams-business-7.hostwindsdns.com |
ASN40027 (NETFLIX-ASN, US)
codex.nflxext.com | |
assets.nflxext.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
hostwindsdns.com
1 redirects
ams-business-7.hostwindsdns.com |
108 KB |
6 |
nflxext.com
codex.nflxext.com assets.nflxext.com |
656 KB |
2 |
facebook.net
connect.facebook.net |
117 KB |
1 |
facebook.com
www.facebook.com |
|
18 | 4 |
Domain | Requested by | |
---|---|---|
10 | ams-business-7.hostwindsdns.com |
1 redirects
ams-business-7.hostwindsdns.com
codex.nflxext.com |
3 | assets.nflxext.com |
ams-business-7.hostwindsdns.com
|
3 | codex.nflxext.com |
ams-business-7.hostwindsdns.com
|
2 | connect.facebook.net |
codex.nflxext.com
connect.facebook.net |
1 | www.facebook.com |
connect.facebook.net
|
18 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
help.netflix.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.hostwindsdns.com COMODO RSA Domain Validation Secure Server CA |
2017-07-08 - 2020-07-07 |
3 years | crt.sh |
*.1.nflxso.net DigiCert SHA2 Secure Server CA |
2020-04-13 - 2020-05-17 |
a month | crt.sh |
*.facebook.com DigiCert SHA2 High Assurance Server CA |
2020-03-01 - 2020-05-30 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://ams-business-7.hostwindsdns.com/~tupxyyaq/netflix/
Frame ID: D6BB21584282D62A8C07AFAEC85724CE
Requests: 18 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://ams-business-7.hostwindsdns.com/~tupxyyaq/netflix
HTTP 301
https://ams-business-7.hostwindsdns.com/~tupxyyaq/netflix/ Page URL
Detected technologies
LiteSpeed (Web Servers) ExpandDetected patterns
- headers server /^LiteSpeed$/i
Facebook (Widgets) Expand
Detected patterns
- script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: Nutzungsbedingungen
Search URL Search Domain Scan URL
Title: Datenschutzerklärung
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://ams-business-7.hostwindsdns.com/~tupxyyaq/netflix
HTTP 301
https://ams-business-7.hostwindsdns.com/~tupxyyaq/netflix/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
18 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
ams-business-7.hostwindsdns.com/~tupxyyaq/netflix/ Redirect Chain
|
315 KB 73 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
none
codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-js-v8a213ece/js/js/bootstrap.js,common%7Cbootstrap.js/2/4N024p4o4a4r0b4d464w4M050q004O4u4j4y4s4H4e4x4m4A090X014J/bck/true/ |
9 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
none
codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-js-v8a213ece/js/js/components%7Clogin%7CloginControllerClient.js/2/4N024p4o4a4r0b4d464w4M050q004O4u4j4y4s4H4e4x4m4A090X014J/l/true/ |
720 KB 224 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WebsiteDetect
ams-business-7.hostwindsdns.com/personalization/cl2/freeform/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
none
codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-css-v8a213ece/css/css/less%7Clogin%7CloginBase.less,less%7Cpages%7Clogin%7CLogin.less/1/PBIasD3zCh9HNO/none/true/ |
158 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
AT-de-20190916-popsignuptwoweeks-perspective_alpha_website_large.jpg
assets.nflxext.com/ffe/siteui/vlv3/296ad965-b50d-4897-b294-2bc6b56246d8/0fddbd1b-9cdf-4963-9578-bd36f321b65c/ |
329 KB 329 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
FB-f-Logo__blue_57.png
assets.nflxext.com/ffe/siteui/login/images/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WebsiteDetect
ams-business-7.hostwindsdns.com/personalization/cl2/freeform/ |
10 KB 5 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WebsiteScreen
ams-business-7.hostwindsdns.com/personalization/cl2/freeform/ |
10 KB 5 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nf-icon-v1-93.woff
assets.nflxext.com/ffe/siteui/fonts/ |
72 KB 72 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sdk.js
connect.facebook.net/de_AT/ |
3 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
log
ams-business-7.hostwindsdns.com/personalization/ |
10 KB 5 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sdk.js
connect.facebook.net/en_US/ |
394 KB 115 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
status
www.facebook.com/x/oauth/ |
0 0 |
Fetch
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
cl2
ams-business-7.hostwindsdns.com/personalization/ |
10 KB 5 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
cl2
ams-business-7.hostwindsdns.com/personalization/ |
10 KB 5 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
cl2
ams-business-7.hostwindsdns.com/personalization/ |
10 KB 5 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
cl2
ams-business-7.hostwindsdns.com/personalization/ |
10 KB 5 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Netflix (Online)12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate object| netflix object| Codex object| C object| global object| process object| util function| jQuery object| jQuery111103404858855889632 function| fbAsyncInit object| FB2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.ams-business-7.hostwindsdns.com/ | Name: cL Value: 1587581497065%7C158758149710305847%7C158758149736326149%7C%7C4%7Cnull |
|
ams-business-7.hostwindsdns.com/ | Name: PHPSESSID Value: 2le6n0b03g1iag3n6k4a16r047 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ams-business-7.hostwindsdns.com
assets.nflxext.com
codex.nflxext.com
connect.facebook.net
www.facebook.com
192.236.176.147
2a00:86c0:2091::1
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
006ffd6dc1ccfde695186144bd0b395e0992ce3d0f21acfb0d4dc4a39aab45c8
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
45e32bd8adb153a0ecc4b0e37323924856d45d8e228cfa84063904333775400b
5de45d2ff1e3fd873234fa24a3b4c942909dd1a4ebdfa626bb02d1dff934c04f
686a43a21d678d1032d58419bf74e6aa9028fbe9b1ebba47d87634b78916d3c6
75ab76d01d7a336f207465784078abd22fff00e27e21e601c8eb086bd0df61c5
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
99aedac934ec33609c6eda895def3daff8f24b7bf2785db6351199c02ac23019
b0c4d316fdd154ec0a28fae1d2a9b5be11c325fe799f1adb9955895df169dc10
b129aae90a9bc905be1baec731eb341367cb51c03222f11448abb654b27376d3
c62f9a50dbb104c1f7c8decc84655acfa9f13fd9910e719e1b68deab3029bf3c
c8ee96e2e7390a2f2e3b8a4465a47b4fb64786e69b6aafb0fac82007c3c6830c
c9effb17120ba747306c5734a92d7338da969c36ec22ca5903bf90adc4260f98
dfd3751ae3b1e1ad0daf621265db930a88bf952d09ff7ac8f87d6a2f82163a6d
f1c613c48b89e74edec48c9caf417aab528e9f13b8386c5675c462fa0c1370c5