netflix-au.com Open in urlscan Pro
185.156.72.17  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response netflix-au.com/	4 KB 2 KB	1056ms 366ms	Document text/html	185.156.72.17 VAIZ-AS ITBks892
General Check archive.org Show headers Download Go to Full URL http://netflix-au.com/ Protocol HTTP/1.1 Server 185.156.72.17 , Russian Federation, ASN61432 (VAIZ-AS ITBks892, UA), Reverse DNS Software LiteSpeed / Resource Hash 398c0e06cc95008ff14781d263746ef9c62c6b094e5ea8d8e23352363a51bf89 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 accept-language en-AU,en;q=0.9 Response headers Connection Keep-Alive Keep-Alive timeout=5, max=100 content-encoding gzip content-length 1790 content-type text/html; charset=UTF-8 date Sat, 17 Jun 2023 09:03:54 GMT server LiteSpeed vary Accept-Encoding
GET H2	200	cash.css cash-f.squarecdn.com/ember/8e9fede24675d26d4335a5cac93d444b49c7de11/assets/	274 KB 40 KB	779ms 297ms	Stylesheet text/css	151.101.129.49 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cash-f.squarecdn.com/ember/8e9fede24675d26d4335a5cac93d444b49c7de11/assets/cash.css Requested by Host: netflix-au.com URL: http://netflix-au.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.129.49 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 651a9158125b43cdf7d07c79aac5b29dbc9923f351f232f75b8a56745dca90bb Request headers accept-language en-AU,en;q=0.9 Referer http://netflix-au.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers expires Fri, 11 Mar 2022 04:22:32 GMT x-amz-version-id HrGmYVfWhwQp7Vh7ehwh4Z41aOzGWUEH content-encoding gzip via 1.1 varnish date Sat, 17 Jun 2023 09:03:55 GMT x-amz-request-id QX7ZD31WM9BVB7SJ age 157813 x-cache HIT content-length 40664 x-amz-id-2 LzCrRPUgDAvmV5HzOQeedik63y0I2ccLlqsEyBM7D+b91cSieNmAA0+Hbu/d9boxlrTxb7pod5I= x-served-by cache-bfi-kbfi7400029-BFI last-modified Wed, 11 Mar 2020 04:29:11 GMT server AmazonS3 x-timer S1686992635.949096,VS0,VE66 etag "ba03ea7176bed3ceba56d90d4c98f77c" vary Accept-Encoding content-type text/css; charset=UTF-8 cache-control max-age=630720000, public accept-ranges bytes x-cache-hits 1
GET H2	200	jquery.min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery/3.1.0/	84 KB 27 KB	594ms 102ms	Script application/javascript	104.17.24.14 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery/3.1.0/jquery.min.js Requested by Host: netflix-au.com URL: http://netflix-au.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 702b9e051e82b32038ffdb33a4f7eb5f7b38f4cf6f514e4182d8898f4eb0b7fb Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers accept-language en-AU,en;q=0.9 Referer http://netflix-au.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers date Sat, 17 Jun 2023 09:03:54 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 2717160 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 27198 last-modified Mon, 04 May 2020 16:11:48 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03ec4-1514f" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HmFKywE0uxfdCHQ2X6Jx5OZKa1l37g%2FIq0dQ7AueXI9HdHk1wK1pXqe8TL%2FsD335ec1Kl%2BUW3tIe55O5uZAqhqxgykh0b0wyOCpwEe6vkNn1PHh7zweuascZRF719x4gJWfdi6RH"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 7d8a1f4019d1aae7-SYD expires Thu, 06 Jun 2024 09:03:54 GMT
GET H2	200	icon-196.png cash.app/	7 KB 8 KB	948ms 752ms	Image image/png	162.159.140.44 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://cash.app/icon-196.png Requested by Host: netflix-au.com URL: http://netflix-au.com/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 162.159.140.44 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c5d5efe729b38f2adbe2e88ac3583c844f9f658dade27cda61e6413293922b85 Security Headers Name Value Strict-Transport-Security max-age=631152000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language en-AU,en;q=0.9 Referer http://netflix-au.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers date Sat, 17 Jun 2023 09:03:56 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status DYNAMIC frame-options SAMEORIGIN strict-transport-security max-age=631152000; includeSubDomains; preload x-sq-dc aws surrogate-control max-age=60 x-sq-region us-east-1 x-xss-protection 1; mode=block server cloudflare vary Accept-Encoding x-frame-options SAMEORIGIN content-type image/png cache-control max-age=3600 cf-ray 7d8a1f44c9fe5569-SYD
GET H2	200	sqmarket-regular.woff2 cash-f.squarecdn.com/static/fonts/sqmarket/	28 KB 29 KB	734ms 244ms	Font application/octet-stream	151.101.129.49 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cash-f.squarecdn.com/static/fonts/sqmarket/sqmarket-regular.woff2 Requested by Host: cash-f.squarecdn.com URL: https://cash-f.squarecdn.com/ember/8e9fede24675d26d4335a5cac93d444b49c7de11/assets/cash.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.129.49 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 229ec17324b239127841118369b6ba49cb6acbc054be11dd6b27e68c115565c7 Request headers Referer https://cash-f.squarecdn.com/ember/8e9fede24675d26d4335a5cac93d444b49c7de11/assets/cash.css Origin http://netflix-au.com accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers expires Fri, 26 Jul 2024 23:00:52 GMT x-amz-version-id GQbC_MdRKLZj3hbt6FZom5GtFd4zBvkp content-encoding gzip via 1.1 varnish date Sat, 17 Jun 2023 09:03:56 GMT x-amz-request-id SP6RFSFDEJGTRFAC age 863174 x-cache HIT content-length 29068 x-amz-id-2 xlzLfca8+s2o/V8s+3mD4zM3xnQgXjBnWmpgKuXA66mwAY2oy+ygeynwlnuTU9YFRyUa9NDGOm4= x-served-by cache-bfi-krnt7300039-BFI last-modified Wed, 27 Jul 2022 23:01:06 GMT server AmazonS3 x-timer S1686992636.003555,VS0,VE1 etag "6d4c8c5352db683825ea9f4df649a4fb" content-type application/octet-stream access-control-allow-origin * cache-control max-age=630720000, public accept-ranges bytes x-cache-hits 1
GET H2	200	sqmarket-medium.woff2 cash-f.squarecdn.com/static/fonts/sqmarket/	30 KB 30 KB	818ms 329ms	Font application/octet-stream	151.101.129.49 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cash-f.squarecdn.com/static/fonts/sqmarket/sqmarket-medium.woff2 Requested by Host: cash-f.squarecdn.com URL: https://cash-f.squarecdn.com/ember/8e9fede24675d26d4335a5cac93d444b49c7de11/assets/cash.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.129.49 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash bd4d2e29f503390e4951af9232fc43780b43d349647188d8f3f600835f16afb7 Request headers Referer https://cash-f.squarecdn.com/ember/8e9fede24675d26d4335a5cac93d444b49c7de11/assets/cash.css Origin http://netflix-au.com accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36 Response headers expires Fri, 26 Jul 2024 23:00:52 GMT x-amz-version-id KRm7Y2ZAekL1Mf_h_R8HqJPW9Cd2AwvX content-encoding gzip via 1.1 varnish date Sat, 17 Jun 2023 09:03:56 GMT x-amz-request-id K2YRA73JVVHJ7MFH age 356542 x-cache HIT content-length 30750 x-amz-id-2 vZdN03Ib3JlnWrTxyd++DOB1OsogfkzalwBzj5YhW1MnsXbTp7yoH2q4j+unz6PXPhzoMJTt+AM= x-served-by cache-bfi-krnt7300039-BFI last-modified Wed, 27 Jul 2022 23:01:08 GMT server AmazonS3 x-timer S1686992636.003523,VS0,VE12 etag "7bcffbabe9dd30d1c914b30752d8aa01" content-type application/octet-stream access-control-allow-origin * cache-control max-age=630720000, public accept-ranges bytes x-cache-hits 1

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Cash App (Banking)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend function| $ function| jQuery

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.cash.app/	1970-01-20 12:36:34	Name: __cf_bm Value: .YtkdJ_Nrx7aSj7T7gcdaeQkR1DSsTA1DNBlNe8v.2Q-1686992636-0-AXliY2OhYz/wx+L/IKrxX0N8E8rmRSlhsz6ByZE0xa+DnxnIQ0mHndcibChyOssgrs5StWcZtV7A8FnRoBrUSg0=

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cash-f.squarecdn.com
cash.app
cdnjs.cloudflare.com
netflix-au.com
104.17.24.14
151.101.129.49
162.159.140.44
185.156.72.17
229ec17324b239127841118369b6ba49cb6acbc054be11dd6b27e68c115565c7
398c0e06cc95008ff14781d263746ef9c62c6b094e5ea8d8e23352363a51bf89
651a9158125b43cdf7d07c79aac5b29dbc9923f351f232f75b8a56745dca90bb
702b9e051e82b32038ffdb33a4f7eb5f7b38f4cf6f514e4182d8898f4eb0b7fb
bd4d2e29f503390e4951af9232fc43780b43d349647188d8f3f600835f16afb7
c5d5efe729b38f2adbe2e88ac3583c844f9f658dade27cda61e6413293922b85