u10770160hg.ha004.t.justns.ru Open in urlscan Pro
2a00:b700::26 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.cdecornella.com/old/img/-/flixnets/zidnta/
Effective URL:
http://u10770160hg.ha004.t.justns.ru/zid/a6736742ac0a08e170092dd12779cb46/
Submission: On April 10 via automatic, source openphish (April 10th 2021, 1:29:46 am UTC)

Summary HTTP 13 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 13 HTTP transactions. The main IP is 2a00:b700::26, located in Russian Federation and belongs to ASBAXET, RU. The main domain is u10770160hg.ha004.t.justns.ru.

This is the only time u10770160hg.ha004.t.justns.ru was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	185.42.104.71 185.42.104.71	197712 (CDMON sis...) (CDMON sistemes@cdmon.com)
3 9	2a00:b700::26 2a00:b700::26	51659 (ASBAXET) (ASBAXET)
6	2a00:86c0:209... 2a00:86c0:2090::1	40027 (NETFLIX-ASN) (NETFLIX-ASN)
13	3

1 185.42.104.71 (Spain)

ASN197712 (CDMON sistemes@cdmon.com, ES)
PTR: vxhcd-31.srv.cat

www.cdecornella.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:b700::26 (Russian Federation) 3 redirects

ASN51659 (ASBAXET, RU)

u10770160hg.ha004.t.justns.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:86c0:2090::1 (United States)

ASN40027 (NETFLIX-ASN, US)

assets.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	justns.ru 3 redirects u10770160hg.ha004.t.justns.ru	23 KB
6	nflxext.com assets.nflxext.com	84 KB
1	cdecornella.com www.cdecornella.com	425 B
13	3

	Domain	Requested by
9	u10770160hg.ha004.t.justns.ru	3 redirects u10770160hg.ha004.t.justns.ru
6	assets.nflxext.com	u10770160hg.ha004.t.justns.ru
1	www.cdecornella.com
13	3

This site contains links to these domains. Also see Links.

Domain
www.khela-dhula.com

Subject Issuer	Validity	Valid
*.1.nflxso.net DigiCert SHA2 Secure Server CA	`2021-03-25` - `2021-04-24`	a month	crt.sh

This page contains 1 frames:

Primary Page: http://u10770160hg.ha004.t.justns.ru/zid/a6736742ac0a08e170092dd12779cb46/
Frame ID: 61FED4FCC6D3DC402F681DDEC949946E
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://www.cdecornella.com/old/img/-/flixnets/zidnta/ Page URL
http://u10770160hg.ha004.t.justns.ru/zid HTTP 301
http://u10770160hg.ha004.t.justns.ru/zid/ HTTP 302
http://u10770160hg.ha004.t.justns.ru/zid/a6736742ac0a08e170092dd12779cb46 HTTP 301
http://u10770160hg.ha004.t.justns.ru/zid/a6736742ac0a08e170092dd12779cb46/ Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

13
Requests

46 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

106 kB
Transfer

176 kB
Size

0
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: http://www.khela-dhula.com/public/assets/backend/quiz/ok/
Title: Netflix

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.cdecornella.com/old/img/-/flixnets/zidnta/ Page URL
http://u10770160hg.ha004.t.justns.ru/zid HTTP 301
http://u10770160hg.ha004.t.justns.ru/zid/ HTTP 302
http://u10770160hg.ha004.t.justns.ru/zid/a6736742ac0a08e170092dd12779cb46 HTTP 301
http://u10770160hg.ha004.t.justns.ru/zid/a6736742ac0a08e170092dd12779cb46/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ www.cdecornella.com/old/img/-/flixnets/zidnta/	85 B 425 B	133ms 105ms	Document text/html	185.42.104.71 CDMON sistemes@cd...
General Check archive.org Show headers Download Go to Full URL http://www.cdecornella.com/old/img/-/flixnets/zidnta/ Protocol HTTP/1.1 Server 185.42.104.71 , Spain, ASN197712 (CDMON sistemes@cdmon.com, ES), Reverse DNS vxhcd-31.srv.cat Software Apache / Resource Hash Request headers Host www.cdecornella.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sat, 10 Apr 2021 01:29:29 GMT Server Apache Last-Modified Thu, 08 Apr 2021 14:24:27 GMT ETag "340045-55-5bf76ce047cc0" Accept-Ranges bytes Vary Accept-Encoding Content-Encoding gzip Content-Length 103 Keep-Alive timeout=3, max=500 Connection Keep-Alive Content-Type text/html
GET H/1.1	200 OK	Primary Request / Show response u10770160hg.ha004.t.justns.ru/zid/a6736742ac0a08e170092dd12779cb46/ Redirect Chain http://u10770160hg.ha004.t.justns.ru/zid http://u10770160hg.ha004.t.justns.ru/zid/ http://u10770160hg.ha004.t.justns.ru/zid/a6736742ac0a08e170092dd12779cb46 http://u10770160hg.ha004.t.justns.ru/zid/a6736742ac0a08e170092dd12779cb46/	6 KB 2 KB	42ms 41ms	Document text/html	2a00:b700::26 ASBAXET
General Check archive.org Show headers Download Go to Full URL http://u10770160hg.ha004.t.justns.ru/zid/a6736742ac0a08e170092dd12779cb46/ Protocol HTTP/1.1 Server 2a00:b700::26 , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `c5f3e24c0c58314ef2af8ec0a66d1b04f2128e3378c13eace0d95edd6be2a065` Request headers Host u10770160hg.ha004.t.justns.ru Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer http://www.cdecornella.com/ Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Referer http://www.cdecornella.com/old/img/-/flixnets/zidnta/ Response headers Connection Keep-Alive Content-Type text/html Last-Modified Sat, 10 Apr 2021 01:29:29 GMT Etag "1972-6070ff79-d151968cc75aa804;gz" Accept-Ranges bytes Transfer-Encoding chunked Content-Encoding gzip Vary Accept-Encoding,User-Agent Date Sat, 10 Apr 2021 01:29:29 GMT Server LiteSpeed Redirect headers Connection Keep-Alive Content-Type text/html Content-Length 707 Date Sat, 10 Apr 2021 01:29:29 GMT Server LiteSpeed Location http://u10770160hg.ha004.t.justns.ru/zid/a6736742ac0a08e170092dd12779cb46/ Vary User-Agent
GET H/1.1	200 OK	b.css u10770160hg.ha004.t.justns.ru/zid/a6736742ac0a08e170092dd12779cb46/index_files/	43 KB 9 KB	42ms 41ms	Stylesheet text/css	2a00:b700::26 ASBAXET
General Check archive.org Show headers Download Go to Full URL http://u10770160hg.ha004.t.justns.ru/zid/a6736742ac0a08e170092dd12779cb46/index_files/b.css Requested by Host: u10770160hg.ha004.t.justns.ru URL: http://u10770160hg.ha004.t.justns.ru/zid/a6736742ac0a08e170092dd12779cb46/ Protocol HTTP/1.1 Server 2a00:b700::26 , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `b1d4358139d259928e7dbff719d6a684ad71fdab2b4707de62ca63906cb35a92` Request headers Referer http://u10770160hg.ha004.t.justns.ru/zid/a6736742ac0a08e170092dd12779cb46/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sat, 10 Apr 2021 01:29:29 GMT Content-Encoding gzip Last-Modified Sat, 10 Apr 2021 01:29:29 GMT Server LiteSpeed Etag "ab91-6070ff79-1904e333f44c207f;gz" Vary Accept-Encoding,User-Agent Content-Type text/css Cache-Control public, max-age=604800 Transfer-Encoding chunked Connection Keep-Alive Accept-Ranges bytes Expires Sat, 17 Apr 2021 01:29:29 GMT
GET H/1.1	200 OK	c.css u10770160hg.ha004.t.justns.ru/zid/a6736742ac0a08e170092dd12779cb46/index_files/	45 KB 10 KB	85ms 43ms	Stylesheet text/css	2a00:b700::26 ASBAXET
General Check archive.org Show headers Download Go to Full URL http://u10770160hg.ha004.t.justns.ru/zid/a6736742ac0a08e170092dd12779cb46/index_files/c.css Requested by Host: u10770160hg.ha004.t.justns.ru URL: http://u10770160hg.ha004.t.justns.ru/zid/a6736742ac0a08e170092dd12779cb46/ Protocol HTTP/1.1 Server 2a00:b700::26 , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash `1f24e58ff9d53d36818697d994c3fc7e3c4fb7191d5769c3c74fde80b72637a1` Request headers Referer http://u10770160hg.ha004.t.justns.ru/zid/a6736742ac0a08e170092dd12779cb46/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sat, 10 Apr 2021 01:29:29 GMT Content-Encoding gzip Last-Modified Sat, 10 Apr 2021 01:29:29 GMT Server LiteSpeed Etag "b403-6070ff79-77e4132328e66bb1;gz" Vary Accept-Encoding,User-Agent Content-Type text/css Cache-Control public, max-age=604800 Transfer-Encoding chunked Connection Keep-Alive Accept-Ranges bytes Expires Sat, 17 Apr 2021 01:29:29 GMT
GET H/1.1	404 Not Found	jquery.js.t%C3%A9l%C3%A9chargement u10770160hg.ha004.t.justns.ru/zid/a6736742ac0a08e170092dd12779cb46/index_files/	0 0	85ms 42ms	Script text/html	2a00:b700::26 ASBAXET
General Check archive.org Show headers Download Go to Full URL http://u10770160hg.ha004.t.justns.ru/zid/a6736742ac0a08e170092dd12779cb46/index_files/jquery.js.t%C3%A9l%C3%A9chargement Requested by Host: u10770160hg.ha004.t.justns.ru URL: http://u10770160hg.ha004.t.justns.ru/zid/a6736742ac0a08e170092dd12779cb46/ Protocol HTTP/1.1 Server 2a00:b700::26 , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash Request headers Referer http://u10770160hg.ha004.t.justns.ru/zid/a6736742ac0a08e170092dd12779cb46/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sat, 10 Apr 2021 01:29:29 GMT Content-Encoding gzip Server LiteSpeed Connection Keep-Alive Content-Length 399 Vary Accept-Encoding,User-Agent Content-Type text/html
GET H/1.1	404 Not Found	jquery.maskedinput.js.t%C3%A9l%C3%A9chargement u10770160hg.ha004.t.justns.ru/zid/a6736742ac0a08e170092dd12779cb46/index_files/	0 0	85ms 42ms	Script text/html	2a00:b700::26 ASBAXET
General Check archive.org Show headers Download Go to Full URL http://u10770160hg.ha004.t.justns.ru/zid/a6736742ac0a08e170092dd12779cb46/index_files/jquery.maskedinput.js.t%C3%A9l%C3%A9chargement Requested by Host: u10770160hg.ha004.t.justns.ru URL: http://u10770160hg.ha004.t.justns.ru/zid/a6736742ac0a08e170092dd12779cb46/ Protocol HTTP/1.1 Server 2a00:b700::26 , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash Request headers Referer http://u10770160hg.ha004.t.justns.ru/zid/a6736742ac0a08e170092dd12779cb46/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sat, 10 Apr 2021 01:29:29 GMT Content-Encoding gzip Server LiteSpeed Connection Keep-Alive Content-Length 408 Vary Accept-Encoding,User-Agent Content-Type text/html
GET H/1.1	404 Not Found	jquery.maskedinput.js.t%C3%A9l%C3%A9chargement u10770160hg.ha004.t.justns.ru/zid/a6736742ac0a08e170092dd12779cb46/index_files/	0 0	41ms 41ms	Script text/html	2a00:b700::26 ASBAXET
General Check archive.org Show headers Download Go to Full URL http://u10770160hg.ha004.t.justns.ru/zid/a6736742ac0a08e170092dd12779cb46/index_files/jquery.maskedinput.js.t%C3%A9l%C3%A9chargement Requested by Host: u10770160hg.ha004.t.justns.ru URL: http://u10770160hg.ha004.t.justns.ru/zid/a6736742ac0a08e170092dd12779cb46/ Protocol HTTP/1.1 Server 2a00:b700::26 , Russian Federation, ASN51659 (ASBAXET, RU), Reverse DNS Software LiteSpeed / Resource Hash Request headers Referer http://u10770160hg.ha004.t.justns.ru/zid/a6736742ac0a08e170092dd12779cb46/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sat, 10 Apr 2021 01:29:29 GMT Content-Encoding gzip Server LiteSpeed Connection Keep-Alive Content-Length 408 Vary Accept-Encoding,User-Agent Content-Type text/html
GET H/1.1	200 OK	carrot_sprite_16x33.png assets.nflxext.com/en_us/layout/ecweb/common/	1 KB 2 KB	112ms 93ms	Image image/png	2a00:86c0:2090::1 NETFLIX-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://assets.nflxext.com/en_us/layout/ecweb/common/carrot_sprite_16x33.png Requested by Host: u10770160hg.ha004.t.justns.ru URL: http://u10770160hg.ha004.t.justns.ru/zid/a6736742ac0a08e170092dd12779cb46/index_files/c.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US), Reverse DNS Software nginx / Resource Hash `a47661d7ad003fe7df9ac30d1ce3b984dd9186b676f77b41e0d53f2f4ce4ac8b` Request headers Referer http://u10770160hg.ha004.t.justns.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sat, 10 Apr 2021 01:29:29 GMT Last-Modified Wed, 17 Dec 2014 02:28:11 GMT Server nginx Content-MD5 S5zo1aDe9OUlKAAcIeVx8w== ETag "4b9ce8d5a0def4e52528001c21e571f3:1418785349" Content-Type image/png Cache-Control max-age=14401 Connection keep-alive Accept-Ranges bytes Content-Length 1449 Expires Thu, 11 Mar 2021 07:15:02 GMT
GET H/1.1	200 OK	12_11_2014_icon_visa_37x25.png assets.nflxext.com/ffe/siteui/acquisition/payment/	859 B 1 KB	24ms 5ms	Image image/png	2a00:86c0:2090::1 NETFLIX-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://assets.nflxext.com/ffe/siteui/acquisition/payment/12_11_2014_icon_visa_37x25.png Requested by Host: u10770160hg.ha004.t.justns.ru URL: http://u10770160hg.ha004.t.justns.ru/zid/a6736742ac0a08e170092dd12779cb46/index_files/c.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US), Reverse DNS Software nginx / Resource Hash `7ed65da4bcdc5f0f68d20f2b489f2f1e4df6d5b1235ece01afd24624126be504` Request headers Referer http://u10770160hg.ha004.t.justns.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sat, 10 Apr 2021 01:29:29 GMT Last-Modified Wed, 10 Jul 2019 23:52:28 GMT Server nginx Content-MD5 InDyhjoqaXrupmtM5xGKHA== Content-Type image/png Cache-Control max-age=604801 Connection keep-alive Accept-Ranges bytes Content-Length 859 Expires Wed, 14 Apr 2021 16:21:05 GMT
GET H/1.1	200 OK	10_18_2014_icon_master_37x25.png assets.nflxext.com/ffe/siteui/acquisition/payment/	833 B 1 KB	25ms 6ms	Image image/png	2a00:86c0:2090::1 NETFLIX-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://assets.nflxext.com/ffe/siteui/acquisition/payment/10_18_2014_icon_master_37x25.png Requested by Host: u10770160hg.ha004.t.justns.ru URL: http://u10770160hg.ha004.t.justns.ru/zid/a6736742ac0a08e170092dd12779cb46/index_files/c.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US), Reverse DNS Software nginx / Resource Hash `4958e4d47607004834b13d3c29d91f8c15b2ab2c488a15d9745a039e970f0bf3` Request headers Referer http://u10770160hg.ha004.t.justns.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sat, 10 Apr 2021 01:29:29 GMT Last-Modified Wed, 10 Jul 2019 23:52:28 GMT Server nginx Content-MD5 xwSU1ALetVNBhYpdQPEPWw== Content-Type image/png Cache-Control max-age=604801 Connection keep-alive Accept-Ranges bytes Content-Length 833 Expires Fri, 16 Apr 2021 20:18:02 GMT
GET H/1.1	200 OK	10_18_2014_icon_amex_37x25.png assets.nflxext.com/ffe/siteui/acquisition/payment/	525 B 844 B	24ms 5ms	Image image/png	2a00:86c0:2090::1 NETFLIX-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://assets.nflxext.com/ffe/siteui/acquisition/payment/10_18_2014_icon_amex_37x25.png Requested by Host: u10770160hg.ha004.t.justns.ru URL: http://u10770160hg.ha004.t.justns.ru/zid/a6736742ac0a08e170092dd12779cb46/index_files/c.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US), Reverse DNS Software nginx / Resource Hash `cc5859d74f8cde62e1cdeeea341f85f9725d4f4398f58203aa1e5080faf1685a` Request headers Referer http://u10770160hg.ha004.t.justns.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sat, 10 Apr 2021 01:29:29 GMT Last-Modified Wed, 10 Jul 2019 23:52:28 GMT Server nginx Content-MD5 XUIHbO4+/oKKw/K3EvF4SA== Content-Type image/png Cache-Control max-age=604801 Connection keep-alive Accept-Ranges bytes Content-Length 525 Expires Mon, 12 Apr 2021 21:35:26 GMT
GET H/1.1	200 OK	10_18_2014_icon_discovery_37x25.png assets.nflxext.com/ffe/siteui/acquisition/payment/	886 B 1 KB	121ms 102ms	Image image/png	2a00:86c0:2090::1 NETFLIX-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://assets.nflxext.com/ffe/siteui/acquisition/payment/10_18_2014_icon_discovery_37x25.png Requested by Host: u10770160hg.ha004.t.justns.ru URL: http://u10770160hg.ha004.t.justns.ru/zid/a6736742ac0a08e170092dd12779cb46/index_files/c.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US), Reverse DNS Software nginx / Resource Hash `694668a605f294bff15137923aadc4576ef0fbc158f035e1bcedf521a6cf1fd8` Request headers Referer http://u10770160hg.ha004.t.justns.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sat, 10 Apr 2021 01:29:29 GMT Last-Modified Wed, 10 Jul 2019 23:52:28 GMT Server nginx Content-MD5 ZQtXvGUVzsBCsNsR/RE3lA== Content-Type image/png Cache-Control max-age=604801 Connection keep-alive Accept-Ranges bytes Content-Length 886 Expires Sat, 17 Apr 2021 01:29:29 GMT
GET H/1.1	200 OK	nf-icon-v1-80.woff assets.nflxext.com/ffe/siteui/fonts/	78 KB 78 KB	145ms 133ms	Font font/woff	2a00:86c0:2090::1 NETFLIX-ASN
General Check archive.org Show headers Download Go to Full URL https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-80.woff Requested by Host: u10770160hg.ha004.t.justns.ru URL: http://u10770160hg.ha004.t.justns.ru/zid/a6736742ac0a08e170092dd12779cb46/index_files/b.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US), Reverse DNS Software nginx / Resource Hash `2555364bdd6374d0c273c69322f2f78554c02fe630ee6582eeb2d2c9031d1a9d` Request headers Origin http://u10770160hg.ha004.t.justns.ru Referer http://u10770160hg.ha004.t.justns.ru/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sat, 10 Apr 2021 01:29:29 GMT Last-Modified Thu, 28 Jan 2016 20:46:04 GMT Server nginx Content-MD5 GkWpE2r/FESZk08OjSTsgQ== Content-Type font/woff Access-Control-Allow-Origin * Cache-Control max-age=604801 Connection keep-alive Accept-Ranges bytes Content-Length 79392 Expires Sat, 17 Apr 2021 01:29:29 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.nflxext.com
u10770160hg.ha004.t.justns.ru
www.cdecornella.com
185.42.104.71
2a00:86c0:2090::1
2a00:b700::26
1f24e58ff9d53d36818697d994c3fc7e3c4fb7191d5769c3c74fde80b72637a1
2555364bdd6374d0c273c69322f2f78554c02fe630ee6582eeb2d2c9031d1a9d
4958e4d47607004834b13d3c29d91f8c15b2ab2c488a15d9745a039e970f0bf3
694668a605f294bff15137923aadc4576ef0fbc158f035e1bcedf521a6cf1fd8
7ed65da4bcdc5f0f68d20f2b489f2f1e4df6d5b1235ece01afd24624126be504
a47661d7ad003fe7df9ac30d1ce3b984dd9186b676f77b41e0d53f2f4ce4ac8b
b1d4358139d259928e7dbff719d6a684ad71fdab2b4707de62ca63906cb35a92
c5f3e24c0c58314ef2af8ec0a66d1b04f2128e3378c13eace0d95edd6be2a065
cc5859d74f8cde62e1cdeeea341f85f9725d4f4398f58203aa1e5080faf1685a

u10770160hg.ha004.t.justns.ru Open in urlscan Pro 2a00:b700::26 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

13 Requests

46 %HTTPS

67 %IPv6

3 Domains

3 Subdomains

3 IPs

3 Countries

106 kBTransfer

176 kBSize

0 Cookies

1 Outgoing links

Page URL History

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

0 Cookies

Indicators

u10770160hg.ha004.t.justns.ru Open in urlscan Pro
2a00:b700::26 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

46 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

106 kB
Transfer

176 kB
Size

0
Cookies

13 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!