user.netflixservice.accountvalidation.secureserver-userid0.com
Open in
urlscan Pro
93.157.62.211
Malicious Activity!
Public Scan
URL:
https://user.netflixservice.accountvalidation.secureserver-userid0.com/userid_validation=sessionid&updateaccountdetails=34g8uj3g0i3v90uv903uvk0c3-0fci3c24cu83c8yc9uj2f...
Submission: On May 25 via automatic, source openphish
Submission: On May 25 via automatic, source openphish
Summary
This website contacted 4 IPs
in 3 countries
across 3 domains to perform 13 HTTP transactions.
The main IP is 93.157.62.211, located in
Russian Federation and
belongs to NFORCE, NL.
The main domain is user.netflixservice.accountvalidation.secureserver-userid0.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on May 24th 2020. Valid for: 3 months.
This is the only time user.netflixservice.accountvalidation.secureserver-userid0.com was scanned on urlscan.io!
TLS certificate: Issued by Let's Encrypt Authority X3 on May 24th 2020. Valid for: 3 months.
This is the only time user.netflixservice.accountvalidation.secureserver-userid0.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Netflix (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 11 | 93.157.62.211 93.157.62.211 | 43350 (NFORCE) (NFORCE) | |
| 1 | 2a00:1450:400... 2a00:1450:4001:808::200a | 15169 (GOOGLE) (GOOGLE) | |
| 1 | 104.111.214.11 104.111.214.11 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
| 13 | 4 |
11
93.157.62.211
(Russian Federation)
ASN43350 (NFORCE, NL)
PTR: box.hubanalyzer.com
ASN43350 (NFORCE, NL)
PTR: box.hubanalyzer.com
| user.netflixservice.accountvalidation.secureserver-userid0.com |
1
104.111.214.11
(Netherlands)
ASN16625 (AKAMAI-AS, US)
PTR: a104-111-214-11.deploy.static.akamaitechnologies.com
ASN16625 (AKAMAI-AS, US)
PTR: a104-111-214-11.deploy.static.akamaitechnologies.com
| seal.verisign.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 11 |
secureserver-userid0.com
user.netflixservice.accountvalidation.secureserver-userid0.com |
95 KB |
| 1 |
verisign.com
seal.verisign.com |
217 B |
| 1 |
googleapis.com
ajax.googleapis.com |
30 KB |
| 13 | 3 |
| Domain | Requested by | |
|---|---|---|
| 11 | user.netflixservice.accountvalidation.secureserver-userid0.com |
user.netflixservice.accountvalidation.secureserver-userid0.com
|
| 1 | seal.verisign.com |
user.netflixservice.accountvalidation.secureserver-userid0.com
|
| 1 | ajax.googleapis.com |
user.netflixservice.accountvalidation.secureserver-userid0.com
|
| 13 | 3 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.verisign.com |
| help.netflix.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| user.netflixservice.accountvalidation.secureserver-userid0.com Let's Encrypt Authority X3 |
2020-05-24 - 2020-08-22 |
3 months | crt.sh |
| upload.video.google.com GTS CA 1O1 |
2020-05-05 - 2020-07-28 |
3 months | crt.sh |
| *.test.edgekey.net DigiCert SHA2 Secure Server CA |
2019-10-13 - 2021-01-11 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://user.netflixservice.accountvalidation.secureserver-userid0.com/userid_validation=sessionid&updateaccountdetails=34g8uj3g0i3v90uv903uvk0c3-0fci3c24cu83c8yc9uj2fh289fy238fu39fh389f/Files/YourAccountPayment.php
Frame ID: 692AC9C1656F8242593FA567EC361A7E
Requests: 14 HTTP requests in this frame
Screenshot
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- url /\.php(?:$|\?)/i
UNIX
(Operating Systems)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /Unix/i
OpenSSL
(Web Server Extensions)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
8 Outgoing links
These are links going to different origins than the main page.
URL: http://www.verisign.com/verisign-trust-seal
Title: ABOUT TRUST ONLINE
Title: ABOUT TRUST ONLINE
Search URL Search Domain Scan URL
URL: https://help.netflix.com/contactus
Title: Questions? Contact us.
Title: Questions? Contact us.
Search URL Search Domain Scan URL
URL: https://help.netflix.com/support/412
Title: FAQ
Title: FAQ
Search URL Search Domain Scan URL
URL: https://help.netflix.com/
Title: Help Centre
Title: Help Centre
Search URL Search Domain Scan URL
URL: https://help.netflix.com/legal/termsofuse
Title: Terms of Use
Title: Terms of Use
Search URL Search Domain Scan URL
URL: https://help.netflix.com/legal/privacy
Title: Privacy
Title: Privacy
Search URL Search Domain Scan URL
URL: https://help.netflix.com/legal/privacy#cookies
Title: Cookie Preferences
Title: Cookie Preferences
Search URL Search Domain Scan URL
URL: https://help.netflix.com/en/node/2101
Title: Corporate Information
Title: Corporate Information
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
YourAccountPayment.php
user.netflixservice.accountvalidation.secureserver-userid0.com/userid_validation=sessionid&updateaccountdetails=34g8uj3g0i3v90uv903uvk0c3-0fci3c24cu83c8yc9uj2fh289fy238fu39fh389f/Files/ |
16 KB 16 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
css1.css
user.netflixservice.accountvalidation.secureserver-userid0.com/userid_validation=sessionid&updateaccountdetails=34g8uj3g0i3v90uv903uvk0c3-0fci3c24cu83c8yc9uj2fh289fy238fu39fh389f/Files/Style/ |
41 KB 41 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.4.1/ |
86 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
css4.css
user.netflixservice.accountvalidation.secureserver-userid0.com/userid_validation=sessionid&updateaccountdetails=34g8uj3g0i3v90uv903uvk0c3-0fci3c24cu83c8yc9uj2fh289fy238fu39fh389f/Files/Style/ |
15 KB 15 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
css5.css
user.netflixservice.accountvalidation.secureserver-userid0.com/userid_validation=sessionid&updateaccountdetails=34g8uj3g0i3v90uv903uvk0c3-0fci3c24cu83c8yc9uj2fh289fy238fu39fh389f/Files/Style/ |
7 KB 7 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
icon_lock_12x15_yellow.png
user.netflixservice.accountvalidation.secureserver-userid0.com/userid_validation=sessionid&updateaccountdetails=34g8uj3g0i3v90uv903uvk0c3-0fci3c24cu83c8yc9uj2fh289fy238fu39fh389f/Files/Images/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
getseal
seal.verisign.com/ |
13 B 217 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
logo-reg2x.png
user.netflixservice.accountvalidation.secureserver-userid0.com/userid_validation=sessionid&updateaccountdetails=34g8uj3g0i3v90uv903uvk0c3-0fci3c24cu83c8yc9uj2fh289fy238fu39fh389f/Files/Images/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
icon_lock_27x34_yellow.png
user.netflixservice.accountvalidation.secureserver-userid0.com/userid_validation=sessionid&updateaccountdetails=34g8uj3g0i3v90uv903uvk0c3-0fci3c24cu83c8yc9uj2fh289fy238fu39fh389f/Files/Images/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
carrot_sprite_16x33.png
user.netflixservice.accountvalidation.secureserver-userid0.com/userid_validation=sessionid&updateaccountdetails=34g8uj3g0i3v90uv903uvk0c3-0fci3c24cu83c8yc9uj2fh289fy238fu39fh389f/Files/Images/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
amex.png
user.netflixservice.accountvalidation.secureserver-userid0.com/userid_validation=sessionid&updateaccountdetails=34g8uj3g0i3v90uv903uvk0c3-0fci3c24cu83c8yc9uj2fh289fy238fu39fh389f/Files/Images/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
visa.png
user.netflixservice.accountvalidation.secureserver-userid0.com/userid_validation=sessionid&updateaccountdetails=34g8uj3g0i3v90uv903uvk0c3-0fci3c24cu83c8yc9uj2fh289fy238fu39fh389f/Files/Images/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
mastercard_white.png
user.netflixservice.accountvalidation.secureserver-userid0.com/userid_validation=sessionid&updateaccountdetails=34g8uj3g0i3v90uv903uvk0c3-0fci3c24cu83c8yc9uj2fh289fy238fu39fh389f/Files/Images/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
52 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Netflix (Online)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate function| $ function| jQuery0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
seal.verisign.com
user.netflixservice.accountvalidation.secureserver-userid0.com
104.111.214.11
2a00:1450:4001:808::200a
93.157.62.211
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
1b4cc145fe4bf6ea8f31828d7b0ee1dae743d16ba57df503e4a392d1ea686527
208994e7418599fbe8296b8b5c8a69736b69e6915aacb9ce8077bb52ce752d11
35e275b35dda959f3002f691b1959082e5f60fc2627b29001f2c2bbca13de647
47b36ceb99c45b929ddf205a5a36e691a99d564fa7639ba77b50182fc7346a7c
7af0b99fe498a2a08ec7b24bd2eaae602e2196feeff308ec133ec27d6cdd56ee
a24c8777a32f4c55a0198e8b5a187b1c88669e1490c72b7e76db7eddbfb35899
a33fdeaa7ff39a19987f29d0cf53b7f545ee9f7d6734a44d3a4c3d12e3d29085
a47661d7ad003fe7df9ac30d1ce3b984dd9186b676f77b41e0d53f2f4ce4ac8b
aac221747f167e5ac91b1244b223924651241cb48a18b1e1a24042c9e39f69f5
abfa8149b1c80c562dc9e3a814a2219bd41dd709d52300a0e13b4a720795b253
bb807cd3b9903a753407ec9d82c403490bad87e9b707458b7d0e7f165277cd2c
c31e5ae9166763db7211b4719f4b8cbe34e7b15c0c4fa510e9f60510d94fb1ce
e44a99d07dd940151eb5d0c7062c18c15b56d69dfe7b1bbe045e42cf37c3f5ee