![](/screenshots/e249cdc8-9a13-4f42-8606-3fcf28350fed.png)
netflixcadastro.com
Open in
urlscan Pro
2606:4700:30::681c:1886
Malicious Activity!
Public Scan
Submission: On May 13 via automatic, source certstream-suspicious
Summary
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on May 13th 2019. Valid for: a year.
This is the only time netflixcadastro.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Netflix (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
9 | 2606:4700:30:... 2606:4700:30::681c:1886 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
6 | 2a02:26f0:6c0... 2a02:26f0:6c00:286::33c4 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
8 | 2a02:26f0:6c0... 2a02:26f0:6c00:297::33c4 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 2a01:578:3::3... 2a01:578:3::364d:8713 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 | 2a01:578:3::3... 2a01:578:3::341e:80ed | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
25 | 5 |
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
netflixcadastro.com |
ASN20940 (AKAMAI-ASN1, US)
codex.nflxext.com | |
assets.nflxext.com |
ASN20940 (AKAMAI-ASN1, US)
assets.nflxext.com | |
ae.nflximg.net |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
www.netflix.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
www.netflix.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
nflxext.com
codex.nflxext.com assets.nflxext.com |
1 MB |
9 |
netflixcadastro.com
netflixcadastro.com |
27 KB |
2 |
netflix.com
www.netflix.com |
1 KB |
2 |
nflximg.net
ae.nflximg.net |
|
25 | 4 |
Domain | Requested by | |
---|---|---|
9 | netflixcadastro.com |
netflixcadastro.com
codex.nflxext.com |
7 | assets.nflxext.com |
netflixcadastro.com
|
5 | codex.nflxext.com |
netflixcadastro.com
|
2 | www.netflix.com |
codex.nflxext.com
|
2 | ae.nflximg.net |
netflixcadastro.com
codex.nflxext.com |
25 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
help.netflix.com |
media.netflix.com |
ir.netflix.com |
jobs.netflix.com |
fast.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
sni.cloudflaressl.com CloudFlare Inc ECC CA-2 |
2019-05-13 - 2020-05-13 |
a year | crt.sh |
assets.nflxext.com DigiCert SHA2 Secure Server CA |
2018-03-09 - 2020-03-09 |
2 years | crt.sh |
www.netflix.com DigiCert SHA2 Secure Server CA |
2018-02-07 - 2020-02-07 |
2 years | crt.sh |
This page contains 3 frames:
Primary Page:
https://netflixcadastro.com/
Frame ID: BEC622FF8CB165DEC5E4B400BE711505
Requests: 23 HTTP requests in this frame
Frame:
https://ae.nflximg.net/monet/scripts/adtech_iframe_target_04.html?data=%7B%22is_member%22%3A%22anonymous%22%2C%22membership_status%22%3A%22NON_REGISTERED_MEMBER%22%2C%22session%22%3A%22n%2Fa%22%2C%22country%22%3A%22BR%22%2C%22referrer%22%3A%22nmLanding%22%2C%22source%22%3A%22https%3A%2F%2Fwww.netflix.com%2Fbr%2FLogin%3Fnextpage%3Dhttps%253A%252F%252Fwww.netflix.com%252Fbrowse%22%2C%22fbaId%22%3A%22e4d551ea-e385-4c79-8134-5fb9ddf6bfb4%22%7D
Frame ID: 1188DC5E5D265957102B502D5528B54E
Requests: 1 HTTP requests in this frame
Frame:
https://ae.nflximg.net/monet/scripts/adtech_iframe_target_04.html?data=%7B%22is_member%22%3A%22anonymous%22%2C%22membership_status%22%3A%22NON_REGISTERED_MEMBER%22%2C%22session%22%3A%22n%2Fa%22%2C%22country%22%3A%22BR%22%2C%22referrer%22%3A%22nmLanding%22%2C%22source%22%3A%22https%3A%2F%2Fwww.netflix.com%2Fbr%2FLogin%3Fnextpage%3Dhttps%253A%252F%252Fwww.netflix.com%252Fbrowse%22%2C%22fbaId%22%3A%22e4d551ea-e385-4c79-8134-5fb9ddf6bfb4%22%7D
Frame ID: C08167F18C908FB97AEFED39C122CEE4
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/e249cdc8-9a13-4f42-8606-3fcf28350fed.png)
Detected technologies
Detected patterns
- headers server /cloudflare/i
Page Statistics
12 Outgoing links
These are links going to different origins than the main page.
Title: Perguntas frequentes
Search URL Search Domain Scan URL
Title: Centro de ajuda
Search URL Search Domain Scan URL
Title: Imprensa
Search URL Search Domain Scan URL
Title: Relações com investidores
Search URL Search Domain Scan URL
Title: Carreiras
Search URL Search Domain Scan URL
Title: Termos de uso
Search URL Search Domain Scan URL
Title: Privacidade
Search URL Search Domain Scan URL
Title: Preferências de cookies
Search URL Search Domain Scan URL
Title: Informações corporativas
Search URL Search Domain Scan URL
Title: Entre em contato
Search URL Search Domain Scan URL
Title: Teste de velocidade
Search URL Search Domain Scan URL
Title: Avisos legais
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
25 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
netflixcadastro.com/ |
93 KB 25 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
none
codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-nmhp-js-va017de80/js/js/bootstrap.js,common%7Cbootstrap.js/1/5236/bck/true/ |
14 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
none
codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-nmhp-js-va017de80/js/js/signup%7Chome%7Clite%7Cclient.js/1/5236/l/true/ |
57 KB 17 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WebsiteDetect
netflixcadastro.com/ichnaea/cl2/freeform/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
none
codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-css-va017de80/css/css/less%7Cpages%7Chome%7Cconcord.less/2/0B0Q040J090y0I0V0Y0R0K0W0P0X10/none/true/ |
115 KB 18 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
BR-pt-20180924-popsignuptwoweeks-perspective_alpha_website_large.jpg
assets.nflxext.com/ffe/siteui/vlv3/d7d52ec5-3d0e-4555-8442-d955bfe02968/a909af79-b31d-4173-b078-0b675d970337/ |
354 KB 355 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
asset_cancelanytime_withdevice.png
assets.nflxext.com/ffe/siteui/acquisition/home/thisIsNetflix/modules/ |
169 KB 170 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
asset_TV_UI.png
assets.nflxext.com/ffe/siteui/acquisition/home/thisIsNetflix/modules/ |
242 KB 243 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
asset_mobile_tablet_UI_2.png
assets.nflxext.com/ffe/siteui/acquisition/home/thisIsNetflix/modules/ |
119 KB 120 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
asset_website_UI.png
assets.nflxext.com/ffe/siteui/acquisition/home/thisIsNetflix/modules/ |
170 KB 171 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
DebugEvent
netflixcadastro.com/ichnaea/cl2/freeform/ |
314 B 314 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
DebugEvent
netflixcadastro.com/ichnaea/cl2/freeform/ |
314 B 314 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WebsiteDetect
netflixcadastro.com/ichnaea/cl2/freeform/ |
317 B 278 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WebsiteScreen
netflixcadastro.com/ichnaea/cl2/freeform/ |
317 B 277 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
chevron-right-whitespace.png
assets.nflxext.com/ffe/siteui/acquisition/home/ |
216 B 404 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
nf-icon-v1-93.woff
assets.nflxext.com/ffe/siteui/fonts/ |
72 KB 72 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
none
codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-js-va017de80/js/js/signup%7Csimplicity%7CsimpleSignupClient.js/2/4_044u4s4e4w094a4B4Z070u014-4A4n4D4x0e4R4P4N4i4C4q4F4k4j034V/l/true/ |
1 MB 322 KB |
XHR
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
none
codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-css-va017de80/css/css/less%7Cpages%7Csignup%7Csimplicity%7Csimplicity.less/2/0B0Q040J090y0I0V0Y0R0K0W0P0X10/none/true/ |
176 KB 29 KB |
XHR
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
adtech_iframe_target_04.html
ae.nflximg.net/monet/scripts/ Frame 1188 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
DebugEvent
netflixcadastro.com/ichnaea/cl2/freeform/ |
314 B 314 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
WebsiteTTI
netflixcadastro.com/ichnaea/cl2/freeform/ |
314 B 378 B |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
adtech_iframe_target_04.html
ae.nflximg.net/monet/scripts/ Frame C081 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H/1.1 |
cl2
www.netflix.com/ichnaea/ |
0 0 |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
cl2
www.netflix.com/ichnaea/ |
0 1 KB |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
DebugEvent
netflixcadastro.com/ichnaea/cl2/freeform/ |
314 B 314 B |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Netflix (Online)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask object| netflix object| Codex object| C object| global object| process object| __core-js_shared__1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.doubleclick.net/ | Name: IDE Value: AHWqTUlw7XE0sUzY3twA30f6exwtzOsx6m8UapbCOo8PdRljp7FrESpSW7s8jCy9 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ae.nflximg.net
assets.nflxext.com
codex.nflxext.com
netflixcadastro.com
www.netflix.com
2606:4700:30::681c:1886
2a01:578:3::341e:80ed
2a01:578:3::364d:8713
2a02:26f0:6c00:286::33c4
2a02:26f0:6c00:297::33c4
103646e75938c72c1e14b79899b6a6ae8050f255a35fefadae283e55b2b48127
1461d16115735daab6fdef0a95e72dea3bcf5100d277b8d585da3b9ad19df8c6
2688d86616a350fa22ddee73a55d9c9d042d9f64b369150e03baaeebdeb48cfc
2761af5c8e90f0ae14ce982816b8784b900fa591730daf3bae07bbee0f107dac
2d20ba106756f856ac76cc7bc55f9cd5f61e8161c8c121b94acc7666dca80592
55bc0f00df3c8622dc3ea9146aadf47791ea0730f1a98f452f4843366bc894b9
6ae8d2daa05efa90df72bb1ba3b642e056740ef6e466344f555524ce9cfc99ed
6afd72c98b94b64f10476aa5728157795c49cbba9aaf875b0db7155c9143c05c
71d77a0077b0f1eec3227393f9c445051f7c355c7cee005790d7fdb33bfad910
855914f25bfe9333cb8f502353515e719067f5c2438b98732d4c213ac3681358
8be88eb57aef52c29ec66ec4b20457aebab468fac2220dfa53551273c29ae3f0
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
d0a1d3ab0e60382d7cd4c92eea1d6381b9b71b5c403a95877d67fff18ac6779d
e299e748f8dfb438466cbebac0aee453c4b3acd72d63c9e212e3efb45d761e6c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f26edb610531f5d8a814c2c36c680e310b252d5a415ca91f23b19f5aa81db9c6
f91f9b912721d13e879269b58530a681c52ad1c33efc31903e61bf1e94f14ff1
fcb40d090bcfa2ef6b71c945cc84cb6c339b8b5b053df9e7d759961257dd9b8d