business144.web-hosting.com
Open in
urlscan Pro
66.29.132.97
Malicious Activity!
Public Scan
URL:
https://business144.web-hosting.com/~upcrheyk/?utf=Ly9uZXRmbGl4Lz9pPSZhbXA7aT0zR1dDQw==&EemYl
Submission Tags: tweet @noladefense #phishing #infosec #cybersecurity #フィッシング詐欺 #netflix Search All
Submission: On February 27 via api from FI — Scanned from FI
Submission Tags: tweet @noladefense #phishing #infosec #cybersecurity #フィッシング詐欺 #netflix Search All
Submission: On February 27 via api from FI — Scanned from FI
Summary
This website contacted 2 IPs
in 1 countries
across 2 domains to perform 11 HTTP transactions.
The main IP is 66.29.132.97, located in
United States and
belongs to NAMECHEAP-NET, US.
The main domain is business144.web-hosting.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on March 9th 2022. Valid for: a year.
This is the only time business144.web-hosting.com was scanned on urlscan.io!
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on March 9th 2022. Valid for: a year.
This is the only time business144.web-hosting.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Netflix (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 9 | 66.29.132.97 66.29.132.97 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
| 2 | 2a00:86c0:209... 2a00:86c0:2090::1 | 40027 (NETFLIX-ASN) (NETFLIX-ASN) | |
| 11 | 2 |
9
66.29.132.97
(United States)
ASN22612 (NAMECHEAP-NET, US)
PTR: business144-1.web-hosting.com
ASN22612 (NAMECHEAP-NET, US)
PTR: business144-1.web-hosting.com
| business144.web-hosting.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 9 |
web-hosting.com
business144.web-hosting.com |
155 KB |
| 2 |
nflxext.com
assets.nflxext.com — Cisco Umbrella Rank: 5188 |
380 KB |
| 11 | 2 |
| Domain | Requested by | |
|---|---|---|
| 9 | business144.web-hosting.com |
business144.web-hosting.com
|
| 2 | assets.nflxext.com |
business144.web-hosting.com
|
| 11 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.web-hosting.com Sectigo RSA Domain Validation Secure Server CA |
2022-03-09 - 2023-04-09 |
a year | crt.sh |
| *.1.nflxso.net DigiCert Secure Site ECC CA-1 |
2023-02-14 - 2023-03-19 |
a month | crt.sh |
This page contains 2 frames:
Primary Page:
https://business144.web-hosting.com/~upcrheyk/?utf=Ly9uZXRmbGl4Lz9pPSZhbXA7aT0zR1dDQw==&EemYl
Frame ID: 4C6B76721E69D39C7D54F117057F2DD0
Requests: 1 HTTP requests in this frame
Frame:
https://business144.web-hosting.com/~upcrheyk/js-OGYGBSm//netflix/?i=&i=3GWCC
Frame ID: 3312D059A94563E19A972DB0E28D9D5A
Requests: 10 HTTP requests in this frame
Screenshot
Detected technologies
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
11 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
business144.web-hosting.com/~upcrheyk/ |
477 B 611 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
/
business144.web-hosting.com/~upcrheyk/js-OGYGBSm//netflix/ Frame 3312 |
9 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
codex.login.css
business144.web-hosting.com/~upcrheyk/js-OGYGBSm//netflix/Netflix_files/ Frame 3312 |
149 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
signin.css
business144.web-hosting.com/~upcrheyk/js-OGYGBSm//netflix/Netflix_files/ Frame 3312 |
2 KB 812 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.min.js.download
business144.web-hosting.com/~upcrheyk/js-OGYGBSm//netflix/Netflix_files/ Frame 3312 |
85 KB 85 KB |
Script
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
FB-f-Logo__blue_57.png
business144.web-hosting.com/~upcrheyk/js-OGYGBSm//netflix/Netflix_files/ Frame 3312 |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.placeholder.label.js.download
business144.web-hosting.com/~upcrheyk/js-OGYGBSm//netflix/Netflix_files/ Frame 3312 |
5 KB 5 KB |
Script
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.bootstrap.js.download
business144.web-hosting.com/~upcrheyk/js-OGYGBSm//netflix/Netflix_files/ Frame 3312 |
40 KB 40 KB |
Script
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
DZ-en-20180813-popsignuptwoweeks-perspective_alpha_website_large.jpg
assets.nflxext.com/ffe/siteui/vlv3/bd27b60f-02db-41da-8f5c-1558b01b44d0/17a20159-6c8b-4e60-be30-becbc0268684/ Frame 3312 |
324 KB 324 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
nf-icon-v1-93.woff
business144.web-hosting.com/~upcrheyk/js-OGYGBSm//netflix/Netflix_files/ Frame 3312 |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
nf-icon-v1-93.ttf
assets.nflxext.com/ffe/siteui/fonts/ Frame 3312 |
92 KB 56 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Netflix (Online)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 boolean| credentialless0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| Strict-Transport-Security | max-age=31536000; includeSubDomains; preload; |
| X-Content-Type-Options | nosniff |
| X-Frame-Options | SAMEORIGIN |
| X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
assets.nflxext.com
business144.web-hosting.com
2a00:86c0:2090::1
66.29.132.97
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
1fed1412af515fe34511cfabe7eac10cd4da51da08e494e13f5792cfc5645361
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
4ae58d47961137684b3aab1178b303d1afc30501da65087122dc59dd6d00ad44
7805c3c9f7fefb3f0238e642d88ff7ebcd483acfaee344262a4eab0c74c7b9cd
95520b3fc7b83d93a13a4fbdf0b8e58c9552d9a6e3d5d9fadb737442b23e6d9a
9a8eb1b89db204cf35c4cdf0d079fd3db8b9f4790b85a85b5a2e6ccd3d7df89c
b276f78e16684b9a430b082d9d0d018316c523590015631fb5ad15aa705a0f03
df9a8b117a4fd266818dee3d12d7080ebdc7d1e1802445d3584d2c7d78bd9725
fe8402a9358de9060c332a9eeb46a29add067639751ca10a62e06eeed66a900f