ams-business-7.hostwindsdns.com
Open in
urlscan Pro
192.236.176.147
Malicious Activity!
Public Scan
Submission Tags: @ipnigh
Submission: On April 22 via api from GB
Summary
TLS certificate: Issued by COMODO RSA Domain Validation Secure S... on July 8th 2017. Valid for: 3 years.
This is the only time ams-business-7.hostwindsdns.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Netflix (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
4 | 192.236.176.147 192.236.176.147 | 54290 (HOSTWINDS) (HOSTWINDS) | |
1 | 2a00:86c0:209... 2a00:86c0:2090::1 | 40027 (NETFLIX-ASN) (NETFLIX-ASN) | |
3 | 2a00:86c0:209... 2a00:86c0:2091::1 | 40027 (NETFLIX-ASN) (NETFLIX-ASN) | |
10 | 4 |
ASN54290 (HOSTWINDS, US)
PTR: amsbs13.hostwindsdns.com
ams-business-7.hostwindsdns.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
nflxext.com
codex.nflxext.com Failed assets.nflxext.com |
428 KB |
4 |
hostwindsdns.com
ams-business-7.hostwindsdns.com |
83 KB |
10 | 2 |
Domain | Requested by | |
---|---|---|
4 | ams-business-7.hostwindsdns.com |
ams-business-7.hostwindsdns.com
|
3 | assets.nflxext.com |
ams-business-7.hostwindsdns.com
|
1 | codex.nflxext.com |
ams-business-7.hostwindsdns.com
|
10 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
help.netflix.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.hostwindsdns.com COMODO RSA Domain Validation Secure Server CA |
2017-07-08 - 2020-07-07 |
3 years | crt.sh |
*.1.nflxso.net DigiCert SHA2 Secure Server CA |
2020-03-30 - 2020-05-03 |
a month | crt.sh |
This page contains 1 frames:
Primary Page:
https://ams-business-7.hostwindsdns.com/~tupxyyaq/netflix/
Frame ID: 19B2E9C69ECBF816AEB029700E9411B4
Requests: 10 HTTP requests in this frame
2 Outgoing links
These are links going to different origins than the main page.
Title: Nutzungsbedingungen
Search URL Search Domain Scan URL
Title: Datenschutzerklärung
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
ams-business-7.hostwindsdns.com/~tupxyyaq/netflix/ |
315 KB 73 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
none
codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-js-v8a213ece/js/js/bootstrap.js,common%7Cbootstrap.js/2/4N024p4o4a4r0b4d464w4M050q004O4u4j4y4s4H4e4x4m4A090X014J/bck/true/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
none
codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-js-v8a213ece/js/js/components%7Clogin%7CloginControllerClient.js/2/4N024p4o4a4r0b4d464w4M050q004O4u4j4y4s4H4e4x4m4A090X014J/l/true/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WebsiteDetect
ams-business-7.hostwindsdns.com/personalization/cl2/freeform/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
none
codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-css-v8a213ece/css/css/less%7Clogin%7CloginBase.less,less%7Cpages%7Clogin%7CLogin.less/1/PBIasD3zCh9HNO/none/true/ |
158 KB 24 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
AT-de-20190916-popsignuptwoweeks-perspective_alpha_website_large.jpg
assets.nflxext.com/ffe/siteui/vlv3/296ad965-b50d-4897-b294-2bc6b56246d8/0fddbd1b-9cdf-4963-9578-bd36f321b65c/ |
329 KB 329 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
FB-f-Logo__blue_57.png
assets.nflxext.com/ffe/siteui/login/images/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WebsiteDetect
ams-business-7.hostwindsdns.com/personalization/cl2/freeform/ |
10 KB 5 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WebsiteScreen
ams-business-7.hostwindsdns.com/personalization/cl2/freeform/ |
10 KB 5 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
nf-icon-v1-93.woff
assets.nflxext.com/ffe/siteui/fonts/ |
72 KB 72 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- codex.nflxext.com
- URL
- https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-js-v8a213ece/js/js/bootstrap.js,common%7Cbootstrap.js/2/4N024p4o4a4r0b4d464w4M050q004O4u4j4y4s4H4e4x4m4A090X014J/bck/true/none
- Domain
- codex.nflxext.com
- URL
- https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/0.0.1-shakti-js-v8a213ece/js/js/components%7Clogin%7CloginControllerClient.js/2/4N024p4o4a4r0b4d464w4M050q004O4u4j4y4s4H4e4x4m4A090X014J/l/true/none
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Netflix (Online)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onformdata object| onpointerrawupdate object| netflix1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
ams-business-7.hostwindsdns.com/ | Name: PHPSESSID Value: 008fclgart9nnr6jvgbep36213 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ams-business-7.hostwindsdns.com
assets.nflxext.com
codex.nflxext.com
codex.nflxext.com
192.236.176.147
2a00:86c0:2090::1
2a00:86c0:2091::1
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
45e32bd8adb153a0ecc4b0e37323924856d45d8e228cfa84063904333775400b
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
c8ee96e2e7390a2f2e3b8a4465a47b4fb64786e69b6aafb0fac82007c3c6830c
d48c99e569acae1908040ec8eb9ed979ed80997ae7ad2b805d6d6651aa967cf8
f1c613c48b89e74edec48c9caf417aab528e9f13b8386c5675c462fa0c1370c5