urlscan.io logo urlscan.io
SecurityTrails logo

web7977.web07.bero-webspace.de Open in urlscan Pro
109.71.253.24  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://ranthamboreregency.com/new/ace/index.html
Effective URL: https://web7977.web07.bero-webspace.de/AAAJASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWID...
Submission: On June 01 via manual from IN — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 9 IPs in 2 countries across 7 domains to perform 21 HTTP transactions. The main IP is 109.71.253.24, located in Germany and belongs to SYNLINQ synlinq.de, DE. The main domain is web7977.web07.bero-webspace.de.
TLS certificate: Issued by R3 on June 1st 2022. Valid for: 3 months.
This is the only time web7977.web07.bero-webspace.de was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

IP Address AS Autonomous System
1 162.241.148.56 46606 (UNIFIEDLA...)
1 2606:4700:303... 13335 (CLOUDFLAR...)
4 109.71.253.24 44486 (SYNLINQ s...)
4 2a00:86c0:209... 40027 (NETFLIX-ASN)
3 2a00:86c0:209... 40027 (NETFLIX-ASN)
2 2a00:1450:400... 15169 (GOOGLE)
4 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
21 9
1    162.241.148.56 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: cp-ht-7.bigrockservers.com
ranthamboreregency.com
1    2606:4700:3032::6815:2ba2 (United States)

ASN13335 (CLOUDFLARENET, US)
fatikmall.com
4    109.71.253.24 (Germany)

ASN44486 (SYNLINQ synlinq.de, DE)
PTR: web07.bero-host.de
web7977.web07.bero-webspace.de
4    2a00:86c0:2090::1 (United States)

ASN40027 (NETFLIX-ASN, US)
codex.nflxext.com
3    2a00:86c0:2091::1 (United States)

ASN40027 (NETFLIX-ASN, US)
assets.nflxext.com
2    2a00:1450:4001:811::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
4    2a00:1450:4001:82f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.gstatic.com
1    2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
Apex Domain
Subdomains		 Transfer
7 nflxext.com
codex.nflxext.com — Cisco Umbrella Rank: 12722
assets.nflxext.com — Cisco Umbrella Rank: 4423
717 KB
5 gstatic.com
www.gstatic.com
fonts.gstatic.com
331 KB
4 bero-webspace.de
web7977.web07.bero-webspace.de
76 KB
2 google.com
www.google.com — Cisco Umbrella Rank: 2
2 KB
1 fatikmall.com
fatikmall.com
782 B
1 ranthamboreregency.com
ranthamboreregency.com
233 B
0 netflix.com Failed
www.netflix.com Failed
21 7
Domain Requested by
4 www.gstatic.com www.google.com
www.gstatic.com
4 codex.nflxext.com web7977.web07.bero-webspace.de
4 web7977.web07.bero-webspace.de web7977.web07.bero-webspace.de
codex.nflxext.com
3 assets.nflxext.com web7977.web07.bero-webspace.de
codex.nflxext.com
2 www.google.com codex.nflxext.com
www.gstatic.com
1 fonts.gstatic.com www.google.com
1 fatikmall.com
1 ranthamboreregency.com
0 www.netflix.com Failed web7977.web07.bero-webspace.de
21 9

This site contains links to these domains. Also see Links.

Domain
www.netflix.com
policies.google.com
help.netflix.com
Subject Issuer Validity Valid
*.ranthamboreregency.com
R3		 2022-04-28 -
2022-07-27		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-12-15 -
2022-12-14		 a year crt.sh
web7977.web07.bero-webspace.de
R3		 2022-06-01 -
2022-08-30		 3 months crt.sh
*.1.nflxso.net
DigiCert TLS RSA SHA256 2020 CA1		 2022-05-29 -
2022-06-30		 a month crt.sh
www.google.com
GTS CA 1C3		 2022-05-04 -
2022-07-27		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2022-05-04 -
2022-07-27		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://web7977.web07.bero-webspace.de/AAAJASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382NSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382J/www.netflix.com/nl/login.php
Frame ID: 39A6B4F7072B9188D822CB9FCFDD5B46
Requests: 16 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Lf8hrcUAAAAAIpQAFW2VFjtiYnThOjZOA5xvLyR&co=aHR0cHM6Ly93ZWI3OTc3LndlYjA3LmJlcm8td2Vic3BhY2UuZGU6NDQz&hl=de&v=M-QqaF9xk6BpjLH22uHZRhXt&size=invisible&cb=m6cm5higtiin
Frame ID: C61AB48EEA40D6FA4176AACCEFB910D1
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Netflix

Page URL History Show full URLs

  1. https://ranthamboreregency.com/new/ace/index.html Page URL
  2. https://fatikmall.com/khajatelecom/log/index.html Page URL
  3. https://web7977.web07.bero-webspace.de/AAAJASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSND... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • cdn\.cookielaw\.org
  • otSDKStub\.js

Page Statistics

21
Requests

95 %
HTTPS

75 %
IPv6

7
Domains

9
Subdomains

9
IPs

2
Countries

1127 kB
Transfer

2669 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://ranthamboreregency.com/new/ace/index.html Page URL
  2. https://fatikmall.com/khajatelecom/log/index.html Page URL
  3. https://web7977.web07.bero-webspace.de/AAAJASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382NSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382J/www.netflix.com/nl/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

21 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
index.html
ranthamboreregency.com/new/ace/ 		93 B
233 B 		Document
General
Check archive.org
Download Go to
Full URL
https://ranthamboreregency.com/new/ace/index.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
162.241.148.56 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
cp-ht-7.bigrockservers.com
Software
Apache /
Resource Hash
65e1e35da1c94c521f29f7438719cfa901e99bd9a9091f3e744a731a707c72f1

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
content-encoding
gzip
content-length
101
content-type
text/html
date
Wed, 01 Jun 2022 06:18:10 GMT
last-modified
Tue, 31 May 2022 23:39:50 GMT
server
Apache
vary
Accept-Encoding
x-server-cache
false
index.html
fatikmall.com/khajatelecom/log/ 		320 B
782 B 		Document
General
Check archive.org
Download Go to
Full URL
https://fatikmall.com/khajatelecom/log/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3032::6815:2ba2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5664e09239b1f4434258104e55297e9b9b51c98842bbc2f67ba32cf1db62619f

Request headers

Referer
https://ranthamboreregency.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
max-age=3600, public
cf-cache-status
DYNAMIC
cf-ray
7145d495abb19235-FRA
content-encoding
br
content-type
text/html
date
Wed, 01 Jun 2022 06:18:10 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
last-modified
Wed, 01 Jun 2022 05:11:04 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
public
referrer-policy
no-referrer-when-downgrade
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bwVxwxaenIE4gcU4dVz6hY4q7DOxsWlZbrp%2BJ2zTZdAe30VDPbrQ3jYS%2FrUD04W8SQtdHENpPjVECmYLrD2WGMhsk%2BtRsaxbEesNIKELPNDRErfZzAL9VsfNK%2BYhtozktT%2FqBzb5LnmW2k6g"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-turbo-charged-by
LiteSpeed
Primary Request login.php
web7977.web07.bero-webspace.de/AAAJASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382NSDWIE3UWIDJSCSNDSU382JASCNSDWIE3... 		358 KB
75 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://web7977.web07.bero-webspace.de/AAAJASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382NSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382J/www.netflix.com/nl/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
109.71.253.24 , Germany, ASN44486 (SYNLINQ synlinq.de, DE),
Reverse DNS
web07.bero-host.de
Software
nginx / PHP/7.4.29 PleskLin
Resource Hash
b0293faaaecf0d60e8420e230b74a783a516cd5bee6847ca9ce28bcfcd1823ea

Request headers

Referer
https://fatikmall.com/khajatelecom/log/index.html
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Wed, 01 Jun 2022 06:18:10 GMT
server
nginx
vary
Accept-Encoding
x-powered-by
PHP/7.4.29 PleskLin
none
codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-js-vad9e75e5/js/js/bootstrap.js,common%7Cbootstrap.js/2/0c3d022T2M052J2Y3c070m003e2X382V372N2Z302G01391O/bck/true/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-js-vad9e75e5/js/js/bootstrap.js,common%7Cbootstrap.js/2/0c3d022T2M052J2Y3c070m003e2X382V372N2Z302G01391O/bck/true/none
Requested by
Host: web7977.web07.bero-webspace.de
URL: https://web7977.web07.bero-webspace.de/AAAJASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382NSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382J/www.netflix.com/nl/login.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
3a837a7b0af6304465a4582067c2c64db56fe6bc0e3b5c7c7faf3273f54cf898
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://web7977.web07.bero-webspace.de/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Wed, 01 Jun 2022 06:18:10 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
nginx
Content-Type
application/javascript; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=16070400
req_id
392b5266-d9af-4e0a-a506-1600d0f51ab2
Connection
keep-alive
Timing-Allow-Origin
https://www.netflix.com
Content-Length
3628
Expires
Sun, 04 Dec 2022 06:18:10 GMT
none
codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-js-vad9e75e5/js/js/components%7Clogin%7CloginControllerClient.js/2/0c3d022T2M052J2Y3c070m003e2X382V372N2Z302G01391O/l/true/ 		949 KB
285 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-js-vad9e75e5/js/js/components%7Clogin%7CloginControllerClient.js/2/0c3d022T2M052J2Y3c070m003e2X382V372N2Z302G01391O/l/true/none
Requested by
Host: web7977.web07.bero-webspace.de
URL: https://web7977.web07.bero-webspace.de/AAAJASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382NSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382J/www.netflix.com/nl/login.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
4f28f9c0756985ece3e147d91f959a1db0f8b60a07c706d1a322695c94494f36
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://web7977.web07.bero-webspace.de/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Wed, 01 Jun 2022 06:18:10 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
nginx
Content-Type
application/javascript; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=16070400
req_id
eb8ce8d2-5ee5-452f-a0f4-7705e1da8161
Connection
keep-alive
Timing-Allow-Origin
https://www.netflix.com
Content-Length
291139
Expires
Sun, 04 Dec 2022 06:18:10 GMT
WebsiteDetect
www.netflix.com/personalization/cl2/freeform/ 		0
0
otSDKStub.js
web7977.web07.bero-webspace.de/AAAJASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382NSDWIE3UWIDJSCSNDSU382JASCNSDWIE3... 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://web7977.web07.bero-webspace.de/AAAJASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382NSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382J/cdn.cookielaw.org/scripttemplates/otSDKStub.js
Requested by
Host: web7977.web07.bero-webspace.de
URL: https://web7977.web07.bero-webspace.de/AAAJASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382NSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382J/www.netflix.com/nl/login.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
109.71.253.24 , Germany, ASN44486 (SYNLINQ synlinq.de, DE),
Reverse DNS
web07.bero-host.de
Software
nginx /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://web7977.web07.bero-webspace.de/AAAJASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382NSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382J/www.netflix.com/nl/login.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Wed, 01 Jun 2022 06:18:10 GMT
content-encoding
br
last-modified
Wed, 01 Jun 2022 05:06:13 GMT
server
nginx
etag
W/"328-5e05bd928cd1a"
content-type
text/html
none
codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-vad9e75e5/css/css/less%7Ccore%7Cerror-page.less/1/bwtzvF4DunAgayCE/none/true/ 		11 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-vad9e75e5/css/css/less%7Ccore%7Cerror-page.less/1/bwtzvF4DunAgayCE/none/true/none
Requested by
Host: web7977.web07.bero-webspace.de
URL: https://web7977.web07.bero-webspace.de/AAAJASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382NSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382J/www.netflix.com/nl/login.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
d9bac1aefff045998fd064ed279defcd96c37a53ee0ee3816d1ebab19c1ff739
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://web7977.web07.bero-webspace.de/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Wed, 01 Jun 2022 06:18:10 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
nginx
Content-Type
text/css; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=16070400
req_id
7e0cb94c-a37c-42d5-8539-a514db75c417
Connection
keep-alive
Timing-Allow-Origin
https://www.netflix.com
Content-Length
2595
Expires
Sun, 04 Dec 2022 06:18:10 GMT
none
codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-vad9e75e5/css/css/less%7Clogin%7CloginBase.less,less%7Cpages%7Clogin%7CLogin.less/1/bwtzvF4DunAgayCE/none/true/ 		131 KB
22 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-vad9e75e5/css/css/less%7Clogin%7CloginBase.less,less%7Cpages%7Clogin%7CLogin.less/1/bwtzvF4DunAgayCE/none/true/none
Requested by
Host: web7977.web07.bero-webspace.de
URL: https://web7977.web07.bero-webspace.de/AAAJASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382NSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382J/www.netflix.com/nl/login.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
8401b85cad6af09d0817e96c2e126b48cb4a0c962e92f6d803c4c1be71185b36
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://web7977.web07.bero-webspace.de/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Wed, 01 Jun 2022 06:18:10 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
nginx
Content-Type
text/css; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=16070400
req_id
bca3ab9d-4f1a-4ab1-a210-0d4ee4ac91b2
Connection
keep-alive
Timing-Allow-Origin
https://www.netflix.com
Content-Length
21631
Expires
Sun, 04 Dec 2022 06:18:10 GMT
NL-nl-20211108-popsignuptwoweeks-perspective_alpha_website_large.jpg
assets.nflxext.com/ffe/siteui/vlv3/5dd45df7-33f1-4274-97ea-e9c6aca69dad/6eec7ec0-bf0a-4116-bd71-50ad6f077add/ 		329 KB
330 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.nflxext.com/ffe/siteui/vlv3/5dd45df7-33f1-4274-97ea-e9c6aca69dad/6eec7ec0-bf0a-4116-bd71-50ad6f077add/NL-nl-20211108-popsignuptwoweeks-perspective_alpha_website_large.jpg
Requested by
Host: web7977.web07.bero-webspace.de
URL: https://web7977.web07.bero-webspace.de/AAAJASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382NSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382J/www.netflix.com/nl/login.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
be26c3dbe0cabe56cbe2903a71ab1de587b2beb135e78875c04d2083f8e510c5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://web7977.web07.bero-webspace.de/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Wed, 01 Jun 2022 06:18:11 GMT
Last-Modified
Wed, 10 Nov 2021 13:53:46 GMT
Server
nginx
Content-MD5
USRBCCSH/ixFoc7/livixQ==
Content-Type
image/jpeg
Cache-Control
max-age=604801
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
337233
Expires
Wed, 08 Jun 2022 06:18:12 GMT
FB-f-Logo__blue_57.png
assets.nflxext.com/ffe/siteui/login/images/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.nflxext.com/ffe/siteui/login/images/FB-f-Logo__blue_57.png
Requested by
Host: web7977.web07.bero-webspace.de
URL: https://web7977.web07.bero-webspace.de/AAAJASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382NSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382J/www.netflix.com/nl/login.php
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://web7977.web07.bero-webspace.de/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Wed, 01 Jun 2022 06:18:11 GMT
Last-Modified
Thu, 30 Jun 2016 17:48:49 GMT
Server
nginx
Content-MD5
ozykfvEQtuPsUIa4d2QH0w==
Content-Type
image/png
Cache-Control
max-age=604801
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1455
Expires
Wed, 08 Jun 2022 06:18:12 GMT
nf-icon-v1-93.woff
assets.nflxext.com/ffe/siteui/fonts/ 		72 KB
72 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-93.woff
Requested by
Host: codex.nflxext.com
URL: https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-vad9e75e5/css/css/less%7Clogin%7CloginBase.less,less%7Cpages%7Clogin%7CLogin.less/1/bwtzvF4DunAgayCE/none/true/none
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d

Request headers

Referer
https://codex.nflxext.com/
Origin
https://web7977.web07.bero-webspace.de
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Date
Wed, 01 Jun 2022 06:18:11 GMT
Last-Modified
Mon, 29 Jan 2018 01:50:51 GMT
Server
nginx
Content-MD5
fPYVbMSBJEtaJUNi17c/AA==
Content-Type
font/woff
Access-Control-Allow-Origin
*
Cache-Control
max-age=604801
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
73572
Expires
Wed, 08 Jun 2022 06:18:12 GMT
enterprise.js
www.google.com/recaptcha/ 		974 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/enterprise.js?render=6Lf8hrcUAAAAAIpQAFW2VFjtiYnThOjZOA5xvLyR
Requested by
Host: codex.nflxext.com
URL: https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-js-vad9e75e5/js/js/components%7Clogin%7CloginControllerClient.js/2/0c3d022T2M052J2Y3c070m003e2X382V372N2Z302G01391O/l/true/none
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
7b63bd65edb98882e3eaa1f36ccb8a5ff063d8f86124b2fb37dc357860d8196b
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://web7977.web07.bero-webspace.de/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Wed, 01 Jun 2022 06:18:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
content-security-policy
frame-ancestors 'self'
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
616
x-xss-protection
1; mode=block
expires
Wed, 01 Jun 2022 06:18:11 GMT
log
web7977.web07.bero-webspace.de/personalization/ 		808 B
500 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://web7977.web07.bero-webspace.de/personalization/log
Requested by
Host: codex.nflxext.com
URL: https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-js-vad9e75e5/js/js/components%7Clogin%7CloginControllerClient.js/2/0c3d022T2M052J2Y3c070m003e2X382V372N2Z302G01391O/l/true/none
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
109.71.253.24 , Germany, ASN44486 (SYNLINQ synlinq.de, DE),
Reverse DNS
web07.bero-host.de
Software
nginx /
Resource Hash
b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187

Request headers

Accept
*/*
Referer
https://web7977.web07.bero-webspace.de/AAAJASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382NSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382J/www.netflix.com/nl/login.php
X-Netflix.ichnaea.request.type
UiRequest
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type
application/json

Response headers

date
Wed, 01 Jun 2022 06:18:11 GMT
content-encoding
br
last-modified
Wed, 01 Jun 2022 05:06:13 GMT
server
nginx
etag
W/"328-5e05bd928cd1a"
content-type
text/html
recaptcha__de.js
www.gstatic.com/recaptcha/releases/M-QqaF9xk6BpjLH22uHZRhXt/ 		365 KB
145 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/M-QqaF9xk6BpjLH22uHZRhXt/recaptcha__de.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/enterprise.js?render=6Lf8hrcUAAAAAIpQAFW2VFjtiYnThOjZOA5xvLyR
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
195fc406dbdbe81846387873a37f88b81514ddedd3877b59e1a4615e90b18173
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://web7977.web07.bero-webspace.de/
Origin
https://web7977.web07.bero-webspace.de
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Tue, 31 May 2022 19:36:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
38500
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
147703
x-xss-protection
0
last-modified
Mon, 16 May 2022 04:03:20 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 31 May 2023 19:36:31 GMT
anchor
www.google.com/recaptcha/enterprise/ Frame C61A 		7 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Lf8hrcUAAAAAIpQAFW2VFjtiYnThOjZOA5xvLyR&co=aHR0cHM6Ly93ZWI3OTc3LndlYjA3LmJlcm8td2Vic3BhY2UuZGU6NDQz&hl=de&v=M-QqaF9xk6BpjLH22uHZRhXt&size=invisible&cb=m6cm5higtiin
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/M-QqaF9xk6BpjLH22uHZRhXt/recaptcha__de.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
f0fe526512d6849e97f294b0e738dc8009c81b68ba866cbc3560eb9031b0b260
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-vkMPVhYp2Tql79xQ-soAMg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://web7977.web07.bero-webspace.de/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private, max-age=0
content-encoding
gzip
content-length
1043
content-security-policy
script-src 'report-sample' 'nonce-vkMPVhYp2Tql79xQ-soAMg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Wed, 01 Jun 2022 06:18:11 GMT
expires
Wed, 01 Jun 2022 06:18:11 GMT
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
styles__ltr.css
www.gstatic.com/recaptcha/releases/M-QqaF9xk6BpjLH22uHZRhXt/ Frame C61A 		51 KB
24 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/M-QqaF9xk6BpjLH22uHZRhXt/styles__ltr.css
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Lf8hrcUAAAAAIpQAFW2VFjtiYnThOjZOA5xvLyR&co=aHR0cHM6Ly93ZWI3OTc3LndlYjA3LmJlcm8td2Vic3BhY2UuZGU6NDQz&hl=de&v=M-QqaF9xk6BpjLH22uHZRhXt&size=invisible&cb=m6cm5higtiin
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f6d032132eed5aa1a417456f07864c51fe631858b190224cf7d1a50116d15f48
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Wed, 01 Jun 2022 05:03:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
4482
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
24237
x-xss-protection
0
last-modified
Mon, 16 May 2022 04:03:20 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/css
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 01 Jun 2023 05:03:29 GMT
recaptcha__de.js
www.gstatic.com/recaptcha/releases/M-QqaF9xk6BpjLH22uHZRhXt/ Frame C61A 		365 KB
144 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/M-QqaF9xk6BpjLH22uHZRhXt/recaptcha__de.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Lf8hrcUAAAAAIpQAFW2VFjtiYnThOjZOA5xvLyR&co=aHR0cHM6Ly93ZWI3OTc3LndlYjA3LmJlcm8td2Vic3BhY2UuZGU6NDQz&hl=de&v=M-QqaF9xk6BpjLH22uHZRhXt&size=invisible&cb=m6cm5higtiin
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
195fc406dbdbe81846387873a37f88b81514ddedd3877b59e1a4615e90b18173
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Tue, 31 May 2022 19:36:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
38500
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
147703
x-xss-protection
0
last-modified
Mon, 16 May 2022 04:03:20 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Wed, 31 May 2023 19:36:31 GMT
logo_48.png
www.gstatic.com/recaptcha/api2/ Frame C61A 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.gstatic.com/recaptcha/api2/logo_48.png
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/M-QqaF9xk6BpjLH22uHZRhXt/styles__ltr.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.gstatic.com/recaptcha/releases/M-QqaF9xk6BpjLH22uHZRhXt/styles__ltr.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Tue, 31 May 2022 18:59:48 GMT
x-content-type-options
nosniff
age
40703
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2228
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
image/png
cache-control
public, max-age=604800
accept-ranges
bytes
expires
Tue, 07 Jun 2022 18:59:48 GMT
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame C61A 		15 KB
16 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Lf8hrcUAAAAAIpQAFW2VFjtiYnThOjZOA5xvLyR&co=aHR0cHM6Ly93ZWI3OTc3LndlYjA3LmJlcm8td2Vic3BhY2UuZGU6NDQz&hl=de&v=M-QqaF9xk6BpjLH22uHZRhXt&size=invisible&cb=m6cm5higtiin
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.google.com/
Origin
https://www.google.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date
Tue, 31 May 2022 11:18:05 GMT
x-content-type-options
nosniff
age
68406
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
15344
x-xss-protection
0
last-modified
Mon, 16 Oct 2017 17:32:55 GMT
server
sffe
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-themes"
expires
Wed, 31 May 2023 11:18:05 GMT
cl2
web7977.web07.bero-webspace.de/personalization/ 		808 B
500 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://web7977.web07.bero-webspace.de/personalization/cl2
Requested by
Host: codex.nflxext.com
URL: https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-js-vad9e75e5/js/js/components%7Clogin%7CloginControllerClient.js/2/0c3d022T2M052J2Y3c070m003e2X382V372N2Z302G01391O/l/true/none
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
109.71.253.24 , Germany, ASN44486 (SYNLINQ synlinq.de, DE),
Reverse DNS
web07.bero-host.de
Software
nginx /
Resource Hash
b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187

Request headers

Referer
https://web7977.web07.bero-webspace.de/AAAJASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382NSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382J/www.netflix.com/nl/login.php
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
X-Netflix.Client.Request.Name
ui/cl
Content-Type
application/json

Response headers

date
Wed, 01 Jun 2022 06:18:15 GMT
content-encoding
br
last-modified
Wed, 01 Jun 2022 05:06:13 GMT
server
nginx
etag
W/"328-5e05bd928cd1a"
content-type
text/html

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www.netflix.com
URL
https://www.netflix.com/personalization/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=css&modalView=login

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails object| navigation function| OptanonWrapper object| netflix string| __public_path__ object| Codex object| C object| global object| process object| util function| jQuery object| jQuery1111017025347794575652 object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client object| recaptcha object| closure_lm_240648

1 Cookies

Domain/Path Name / Value
.web7977.web07.bero-webspace.de/ Name: cL
Value: 1654064290938%7C165406429032206583%7C165406429091836455%7C%7C4%7Cnull

4 Console Messages

Source Level URL
Text
network error URL: https://web7977.web07.bero-webspace.de/AAAJASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382NSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382J/cdn.cookielaw.org/scripttemplates/otSDKStub.js
Message:
Failed to load resource: the server responded with a status of 404 ()
security error URL: https://web7977.web07.bero-webspace.de/AAAJASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382NSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382JASCNSDWIE3UWIDJSCSNDSU382J/www.netflix.com/nl/login.php
Message:
Refused to apply style from 'https://www.netflix.com/personalization/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=css&modalView=login' because its MIME type ('') is not a supported stylesheet MIME type, and strict MIME checking is enabled.
network error URL: https://web7977.web07.bero-webspace.de/personalization/log
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://web7977.web07.bero-webspace.de/personalization/cl2
Message:
Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.nflxext.com
codex.nflxext.com
fatikmall.com
fonts.gstatic.com
ranthamboreregency.com
web7977.web07.bero-webspace.de
www.google.com
www.gstatic.com
www.netflix.com
www.netflix.com
109.71.253.24
162.241.148.56
2606:4700:3032::6815:2ba2
2a00:1450:4001:80e::2003
2a00:1450:4001:811::2004
2a00:1450:4001:82f::2003
2a00:86c0:2090::1
2a00:86c0:2091::1
195fc406dbdbe81846387873a37f88b81514ddedd3877b59e1a4615e90b18173
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
3a837a7b0af6304465a4582067c2c64db56fe6bc0e3b5c7c7faf3273f54cf898
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
4f28f9c0756985ece3e147d91f959a1db0f8b60a07c706d1a322695c94494f36
5664e09239b1f4434258104e55297e9b9b51c98842bbc2f67ba32cf1db62619f
65e1e35da1c94c521f29f7438719cfa901e99bd9a9091f3e744a731a707c72f1
7b63bd65edb98882e3eaa1f36ccb8a5ff063d8f86124b2fb37dc357860d8196b
8401b85cad6af09d0817e96c2e126b48cb4a0c962e92f6d803c4c1be71185b36
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
b0293faaaecf0d60e8420e230b74a783a516cd5bee6847ca9ce28bcfcd1823ea
b9347f234dc3c8d56e015e86d88a1400415db8f7a5ad91f02b6a2323c10a4187
be26c3dbe0cabe56cbe2903a71ab1de587b2beb135e78875c04d2083f8e510c5
d9bac1aefff045998fd064ed279defcd96c37a53ee0ee3816d1ebab19c1ff739
f0fe526512d6849e97f294b0e738dc8009c81b68ba866cbc3560eb9031b0b260
f6d032132eed5aa1a417456f07864c51fe631858b190224cf7d1a50116d15f48