urlscan.io logo urlscan.io
SecurityTrails logo

gal-phishing-tests.s3-website.eu-central-1.amazonaws.com Open in urlscan Pro
52.219.47.118  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ntflx.html
Submission: On April 03 via automatic, source phishtank — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 16 HTTP transactions. The main IP is 52.219.47.118, located in Frankfurt am Main, Germany and belongs to AMAZON-02, US. The main domain is gal-phishing-tests.s3-website.eu-central-1.amazonaws.com.
This is the only time gal-phishing-tests.s3-website.eu-central-1.amazonaws.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

IP Address AS Autonomous System
12 52.219.47.118 16509 (AMAZON-02)
2 2a00:86c0:209... 40027 (NETFLIX-ASN)
2 2a05:d018:76c... ()
16 3
Apex Domain
Subdomains		 Transfer
12 amazonaws.com
gal-phishing-tests.s3-website.eu-central-1.amazonaws.com
1 MB
2 netflix.com
www.netflix.com
1 KB
2 nflxext.com
assets.nflxext.com — Cisco Umbrella Rank: 3919
157 KB
16 3
Domain Requested by
12 gal-phishing-tests.s3-website.eu-central-1.amazonaws.com gal-phishing-tests.s3-website.eu-central-1.amazonaws.com
2 www.netflix.com gal-phishing-tests.s3-website.eu-central-1.amazonaws.com
2 assets.nflxext.com gal-phishing-tests.s3-website.eu-central-1.amazonaws.com
16 3

This site contains no links.

Subject Issuer Validity Valid
*.1.nflxso.net
DigiCert Secure Site ECC CA-1		 2023-03-16 -
2023-04-18		 a month crt.sh
www.netflix.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-12-14 -
2024-01-14		 a year crt.sh

This page contains 3 frames:

Primary Page: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ntflx.html
Frame ID: DA4A51030A3359148CA974098769D4B4
Requests: 1 HTTP requests in this frame

Frame: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/
Frame ID: 334EDAEDD5451E928BFD8F71C600F646
Requests: 13 HTTP requests in this frame

Frame: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/xaOI6zd9HW9.html
Frame ID: 4BBF127AA1833B537C67596B9E6F650F
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Parent title

Page Statistics

16
Requests

25 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

1440 kB
Transfer

1434 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request ntflx.html
gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ 		360 B
694 B 		Document
General
Check archive.org
Download Go to
Full URL
http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ntflx.html
Protocol
HTTP/1.1
Server
52.219.47.118 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-website.eu-central-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
453cb42bea6ee7a9e76e6441176bbc990d7dc38962b341d5b31675b1fc8e7912

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Content-Length
360
Content-Type
text/html
Date
Mon, 03 Apr 2023 05:07:20 GMT
ETag
"2171fe4bf081e10ad938862226e005d3"
Last-Modified
Wed, 13 Jul 2022 13:31:30 GMT
Server
AmazonS3
x-amz-id-2
ron6i/p/hJeQerEAGJATslWr+pfrBX3PD8AkiEk3Xq/9bdcGdOt+MUzaDw3rPEbC6ZoYQNz0Fak=
x-amz-request-id
PZFF4V68YS38ZR43
/
gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ Frame 334E 		240 KB
241 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/
Requested by
Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com
URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ntflx.html
Protocol
HTTP/1.1
Server
52.219.47.118 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-website.eu-central-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
53a882090787933350210770e49c74e0f80e5ffb75b7dc284955b92e896aafe6

Request headers

Referer
http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ntflx.html
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Content-Length
246138
Content-Type
text/html
Date
Mon, 03 Apr 2023 05:07:20 GMT
ETag
"8872dfc3088c8b216df3b77ce2de080f"
Last-Modified
Wed, 13 Jul 2022 13:31:11 GMT
Server
AmazonS3
x-amz-id-2
vnQBlqUCEDT1g3PzhHuCQCK9tW1fnQTVt9b1I4uR69lc+kUC/8BI21dU4AOxVQfKMWdq8KzSCFE=
x-amz-request-id
PZFAVQXBPXFZC9N1
none.js
gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/ Frame 334E 		24 KB
25 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/none.js
Requested by
Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com
URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/
Protocol
HTTP/1.1
Server
52.219.47.118 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-website.eu-central-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
36d6338e657cdef8022ef6782c4a709216a661166abaf141cd55e9286d774fda

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date
Mon, 03 Apr 2023 05:07:20 GMT
Last-Modified
Wed, 13 Jul 2022 13:31:13 GMT
Server
AmazonS3
x-amz-request-id
PZFEHDM4447SY3VQ
ETag
"ad3d9ad2c5b2c6efbc6423dba1de09d3"
Content-Type
application/javascript
Content-Length
24871
x-amz-id-2
JvKyj4cWE9d2nSwGsJvMYdQ0d4Ep3PMPz+64S5vwfvP/833vwcPwUft6yDNC8CvG30T0fICMI/U=
none_002.js
gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/ Frame 334E 		655 KB
655 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/none_002.js
Requested by
Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com
URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/
Protocol
HTTP/1.1
Server
52.219.47.118 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-website.eu-central-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
abfe0e1b195380596a8d28abb2d472cc1cc670ac7f8a9582ca45bf3fb1b0950f

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date
Mon, 03 Apr 2023 05:07:20 GMT
Last-Modified
Wed, 13 Jul 2022 13:31:13 GMT
Server
AmazonS3
x-amz-request-id
PZF34XXFRN2BZT0D
ETag
"de925e298f23668d274503b64f2449b8"
Content-Type
application/javascript
Content-Length
670267
x-amz-id-2
bpMosqzIhwDZ6T2pibn6a+3/5d8DFEfDEJzFuMO3xdT/A7vFCnkGgXgEDf/kYWpYy9zHhYhwQ6A=
WebsiteDetect.asc
gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/ Frame 334E 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/WebsiteDetect.asc
Requested by
Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com
URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/
Protocol
HTTP/1.1
Server
52.219.47.118 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-website.eu-central-1.amazonaws.com
Software
AmazonS3 /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date
Mon, 03 Apr 2023 05:07:19 GMT
Server
AmazonS3
x-amz-request-id
PZFB6GBCZHYZ75QB
Content-Length
303
x-amz-id-2
KrYXGjRcMRL6dnFt5CnsqIyDRKpljSu4zJp8P8ycF0iSnqV/5L47aDaOT8pU/xiJf3EJ1anvAyI=
Content-Type
text/html; charset=utf-8
sdk.js
gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/ Frame 334E 		213 KB
214 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/sdk.js
Requested by
Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com
URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/
Protocol
HTTP/1.1
Server
52.219.47.118 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-website.eu-central-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
d69b388d3d3c136484970f6ee5e1ebb2dfe51fbd4af2ea731d8de40cfce3816e

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date
Mon, 03 Apr 2023 05:07:20 GMT
Last-Modified
Wed, 13 Jul 2022 13:31:14 GMT
Server
AmazonS3
x-amz-request-id
PZFF2K83R7EGCGEV
ETag
"0c69f0ce076b2e2155d6c00f404d7b8f"
Content-Type
application/javascript
Content-Length
218405
x-amz-id-2
Gy34TUV3YgmngeMZu+irAND0r2NzyZrWOfhtqwfS0bZTxtPXBa9YDHIM9J0Wle9+le02wGjJAlo=
none.css
gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/ Frame 334E 		101 KB
102 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/none.css
Requested by
Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com
URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/
Protocol
HTTP/1.1
Server
52.219.47.118 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-website.eu-central-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
601553a598f6c89f43b5f373d84fdf182db3af0acd6df215f9e4f62ee6c4dcb6

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date
Mon, 03 Apr 2023 05:07:20 GMT
Last-Modified
Wed, 13 Jul 2022 13:31:13 GMT
Server
AmazonS3
x-amz-request-id
PZF6V5YZGFY40C6P
ETag
"33075e961185b732b5e74ad63516664c"
Content-Type
text/css
Content-Length
103683
x-amz-id-2
Cv8OcXaYTE/D2HkHbtXeoU8jQG68iPYQNEfH1NBpJWDSSQjmho5QgP40WXQ9ZkluPJmaziA/I/k=
FB-f-Logo__blue_57.png
gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/ Frame 334E 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/FB-f-Logo__blue_57.png
Requested by
Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com
URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/
Protocol
HTTP/1.1
Server
52.219.47.118 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-website.eu-central-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date
Mon, 03 Apr 2023 05:07:21 GMT
Last-Modified
Wed, 13 Jul 2022 13:31:12 GMT
Server
AmazonS3
x-amz-request-id
4B2FHKDFB88KJT4D
ETag
"a33ca47ef110b6e3ec5086b8776407d3"
Content-Type
image/png
Content-Length
1455
x-amz-id-2
0qtXwTyNJWtlg234APDyYrf4zw6zODx+0Twtou0v7bmjpIQ0OJlXtLDrDt7smin5PKuITvFqn1o=
WebsiteDetect
gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ichnaea/cl2/freeform/ Frame 334E 		303 B
571 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ichnaea/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=js&modalView=login
Requested by
Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com
URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/
Protocol
HTTP/1.1
Server
52.219.47.118 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-website.eu-central-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
2574fb4784bbf3881b5ad0ec076f1388e0c6134c9e91005febcb5fca037317df

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date
Mon, 03 Apr 2023 05:07:19 GMT
Server
AmazonS3
x-amz-request-id
4B27F7A8JQ0J2M37
Content-Length
303
x-amz-id-2
LPXRMzhWk0ANikahpNBA82Iv7ptFey1HIv/VgV/sr+ZvuQcH+9veKSk4q0qUz0ulQ6hleKOVG6M=
Content-Type
text/html; charset=utf-8
WebsiteScreen
gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ichnaea/cl2/freeform/ Frame 334E 		303 B
571 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ichnaea/cl2/freeform/WebsiteScreen?source=wwwhead&fetchType=js&winw=1600&winh=1200&screenw=1600&screenh=1200&ratio=1
Requested by
Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com
URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/
Protocol
HTTP/1.1
Server
52.219.47.118 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-website.eu-central-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
d2d8dd9c47db17ad969aee9e7a63f253d1ec235d7ec8f63dd701a2d8b1783940

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date
Mon, 03 Apr 2023 05:07:19 GMT
Server
AmazonS3
x-amz-request-id
4B21N118EWRFK3NG
Content-Length
303
x-amz-id-2
3A4GbI0yFGq8MC+isvO+icxbWeZCF/m6kFtCiEnJQ5360wzwXimwnOOM+KxlEBCa+Ir/TtJWG0M=
Content-Type
text/html; charset=utf-8
login-the-crown_2-1500x1000.jpg
assets.nflxext.com/ffe/siteui/acquisition/login/ Frame 334E 		84 KB
85 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://assets.nflxext.com/ffe/siteui/acquisition/login/login-the-crown_2-1500x1000.jpg
Requested by
Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com
URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/none.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
baafd74a4cb4dc594b614eeb45c7267bb1af729d9271752460348ece16532d04

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date
Mon, 03 Apr 2023 05:07:20 GMT
Last-Modified
Mon, 24 Oct 2016 20:49:51 GMT
Server
nginx
Content-MD5
5GY/BZWwL7HDlH/B8V64Eg==
Content-Type
image/jpeg
Cache-Control
max-age=604801
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
86226
Expires
Mon, 10 Apr 2023 05:07:21 GMT
nf-icon-v1-93.woff
assets.nflxext.com/ffe/siteui/fonts/ Frame 334E 		72 KB
72 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-93.woff
Requested by
Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com
URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/none.css
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2a00:86c0:2091::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software
nginx /
Resource Hash
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d

Request headers

Referer
http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/
Origin
http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date
Mon, 03 Apr 2023 05:07:20 GMT
Last-Modified
Mon, 29 Jan 2018 01:50:51 GMT
Server
nginx
Content-MD5
fPYVbMSBJEtaJUNi17c/AA==
Content-Type
font/woff
Access-Control-Allow-Origin
*
Cache-Control
max-age=604801
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
73572
Expires
Mon, 10 Apr 2023 05:07:21 GMT
xaOI6zd9HW9.html
gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/ Frame 4BBF 		42 KB
42 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/xaOI6zd9HW9.html
Requested by
Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com
URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/
Protocol
HTTP/1.1
Server
52.219.47.118 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-website.eu-central-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
d9013ca6d10e27a1c53881852fd9bc126a0f92eb0392f7138acae4bf8947e2f3

Request headers

Referer
http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Content-Length
42738
Content-Type
text/html
Date
Mon, 03 Apr 2023 05:07:21 GMT
ETag
"f061cabded8c9c295e49b9e27e2963a8"
Last-Modified
Wed, 13 Jul 2022 13:31:14 GMT
Server
AmazonS3
x-amz-id-2
judfEdmiYxC7Hdy7p0nQ/gvnP8dzxWNY6+WO8h3QXfaX4jFx9JXmWJG2ylWey82coBCCq7YaimM=
x-amz-request-id
4B20YEGEJ0YXJHNM
log
gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ichnaea/ Frame 334E 		422 B
745 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ichnaea/log
Requested by
Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com
URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/none_002.js
Protocol
HTTP/1.1
Server
52.219.47.118 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
s3-website.eu-central-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
6b2600b00feb94c5edad1e8d841dc603bf427a2df9df50c34cea36ccce1e077d

Request headers

Accept
*/*
X-Netflix.ichnaea.request.type
UiRequest
Referer
http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
Content-Type
application/json

Response headers

Date
Mon, 03 Apr 2023 05:07:20 GMT
Server
AmazonS3
x-amz-request-id
4B20ZZP1DTTGPQG4
Allow
GET, HEAD, OPTIONS
Content-Type
text/html; charset=utf-8
Connection
close
Content-Length
422
x-amz-id-2
fmxsteD0zwXWOoVRM2KEbMESWQ378EipEwaTKlF2gxrLP7qZXE5i6fdpN2TT6MbDKQVnUs1cnZw=
cl2
www.netflix.com/ichnaea/ Frame 334E 		0
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.netflix.com/ichnaea/cl2
Requested by
Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com
URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/none_002.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a05:d018:76c:b684:b233:ac1f:be1f:7 -, , ASN (),
Reverse DNS
Software
clingest-secure i-07a6be986754dd471 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
Content-Type
application/json

Response headers

date
Mon, 03 Apr 2023 05:07:24 GMT
x-envoy-decorator-operation
lo_svc_http
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains
via
2 i-0d12e993e3a9fb2ba (eu-west-1)
x-b3-traceid
9699bf24a90ad765
x-netflix.proxy.execution-time
5
x-envoy-upstream-service-time
1
content-length
0
x-xss-protection
1; mode=block
x-request-id
f1a7f3ba-4434-4e76-80f4-465932216afb
pragma
no-cache
server
clingest-secure i-07a6be986754dd471
x-netflix.nfstatus
1_1
allow
GET, POST, OPTIONS
access-control-allow-methods
GET, POST, OPTIONS
x-originating-url
http://www.netflix.com/ichnaea/cl2
access-control-allow-origin
http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com
cache-control
no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials
true
x-frame-options
DENY
x-ichnaea
~0=true~RL=0
access-control-allow-headers
Accept,Accept-Language,Authorization,Content-Type,Cookie,debugRequest,X-Netflix.application.name,X-Netflix.application.version,X-Netflix.certification.version,X-Netflix.Client.Request.Name,X-Netflix.device.type,X-Netflix.esn,X-Netflix.ichnaea.request.type,X-Netflix.oauth.consumer.key,X-Netflix.oauth.token,X-Netflix.request.uuid,X-Netflix.user.id
expires
0
cl2
www.netflix.com/ichnaea/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://www.netflix.com/ichnaea/cl2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a05:d018:76c:b684:b233:ac1f:be1f:7 -, , ASN (),
Reverse DNS
Software
clingest-secure i-078f49653a0d46d07 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Accept,Accept-Language,Authorization,Content-Type,Cookie,debugRequest,X-Netflix.application.name,X-Netflix.application.version,X-Netflix.certification.version,X-Netflix.Client.Request.Name,X-Netflix.device.type,X-Netflix.esn,X-Netflix.ichnaea.request.type,X-Netflix.oauth.consumer.key,X-Netflix.oauth.token,X-Netflix.request.uuid,X-Netflix.user.id
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com
allow
GET, POST, OPTIONS
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-length
0
date
Mon, 03 Apr 2023 05:07:24 GMT
expires
0
pragma
no-cache
server
clingest-secure i-078f49653a0d46d07
strict-transport-security
max-age=31536000 ; includeSubDomains
vary
Origin,Access-Control-Request-Method,Access-Control-Request-Headers
via
2 i-0d0e01a714f925607 (eu-west-1)
x-b3-traceid
dfdfb6aae032779c
x-content-type-options
nosniff
x-envoy-decorator-operation
lo_svc_http
x-envoy-upstream-service-time
0
x-frame-options
DENY
x-netflix.nfstatus
1_1
x-netflix.proxy.execution-time
4
x-originating-url
http://www.netflix.com/ichnaea/cl2
x-request-id
7d1b7c78-32a8-4ad6-9e04-8a9935c29f4d
x-xss-protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 boolean| credentialless

1 Cookies

Domain/Path Name / Value
.gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ Name: cL
Value: 1680498440084%7C16804984407558253%7C168049844079643324%7C%7C4%7CUNPYKR5TOVFFFKE6OU2YTRLYFY

4 Console Messages

Source Level URL
Text
network error URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/WebsiteDetect.asc
Message:
Failed to load resource: the server responded with a status of 403 (Forbidden)
network error URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ichnaea/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=js&modalView=login
Message:
Failed to load resource: the server responded with a status of 403 (Forbidden)
network error URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ichnaea/cl2/freeform/WebsiteScreen?source=wwwhead&fetchType=js&winw=1600&winh=1200&screenw=1600&screenh=1200&ratio=1
Message:
Failed to load resource: the server responded with a status of 403 (Forbidden)
network error URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ichnaea/log
Message:
Failed to load resource: the server responded with a status of 405 (Method Not Allowed)