gal-phishing-tests.s3-website.eu-central-1.amazonaws.com Open in urlscan Pro
52.219.140.128 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ntflx.html
Submission: On April 02 via manual (April 2nd 2023, 12:24:51 pm UTC) from JP — Scanned from JP

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 14 HTTP transactions. The main IP is 52.219.140.128, located in Frankfurt am Main, Germany and belongs to AMAZON-02, US. The main domain is gal-phishing-tests.s3-website.eu-central-1.amazonaws.com.

This is the only time gal-phishing-tests.s3-website.eu-central-1.amazonaws.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address	AS Autonomous System
12	52.219.140.128 52.219.140.128	16509 (AMAZON-02) (AMAZON-02)
2	2a00:86c0:209... 2a00:86c0:2090::1	40027 (NETFLIX-ASN) (NETFLIX-ASN)
14	2

12 52.219.140.128 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: s3-website.eu-central-1.amazonaws.com

gal-phishing-tests.s3-website.eu-central-1.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:86c0:2090::1 (United States)

ASN40027 (NETFLIX-ASN, US)

assets.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	amazonaws.com gal-phishing-tests.s3-website.eu-central-1.amazonaws.com	1 MB
2	nflxext.com assets.nflxext.com — Cisco Umbrella Rank: 3919	157 KB
14	2

	Domain	Requested by
12	gal-phishing-tests.s3-website.eu-central-1.amazonaws.com	gal-phishing-tests.s3-website.eu-central-1.amazonaws.com
2	assets.nflxext.com	gal-phishing-tests.s3-website.eu-central-1.amazonaws.com
14	2

This site contains no links.

Subject Issuer	Validity	Valid
*.1.nflxso.net DigiCert Secure Site ECC CA-1	`2023-03-20` - `2023-04-20`	a month	crt.sh

This page contains 3 frames:

Primary Page: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ntflx.html
Frame ID: 2FF01CEB1B9309D7FF86F926857538F5
Requests: 1 HTTP requests in this frame

Frame: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/
Frame ID: 04D6987B0E32B1DC6609FA1414A0270C
Requests: 12 HTTP requests in this frame

Frame: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/xaOI6zd9HW9.html
Frame ID: FD6F2B3E3CAB1C45582CC8358EBCDB47
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Parent title

Page Statistics

14
Requests

14 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

1438 kB
Transfer

1434 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request ntflx.html Show response gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/	360 B 694 B	669ms 327ms	Document text/html	52.219.140.128 AMAZON-02
General Check archive.org Show headers Download Go to Full URL http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ntflx.html Protocol HTTP/1.1 Server 52.219.140.128 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS s3-website.eu-central-1.amazonaws.com Software AmazonS3 / Resource Hash `453cb42bea6ee7a9e76e6441176bbc990d7dc38962b341d5b31675b1fc8e7912` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers Content-Length 360 Content-Type text/html Date Sun, 02 Apr 2023 12:24:46 GMT ETag "2171fe4bf081e10ad938862226e005d3" Last-Modified Wed, 13 Jul 2022 13:31:30 GMT Server AmazonS3 x-amz-id-2 lw3LeNu9isbSKeFO1BQ4qVwePn4B4rtF+/kUw6SzmLH+OVC4ZLwFiOhKVVYD4yXoNtUg+r5COes= x-amz-request-id VK2MXRM1NGGG6XP1
GET H/1.1	200 OK	/ Show response gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ Frame 04D6	240 KB 241 KB	274ms 274ms	Document text/html	52.219.140.128 AMAZON-02
General Check archive.org Show headers Download Go to Full URL http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ Requested by Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ntflx.html Protocol HTTP/1.1 Server 52.219.140.128 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS s3-website.eu-central-1.amazonaws.com Software AmazonS3 / Resource Hash `53a882090787933350210770e49c74e0f80e5ffb75b7dc284955b92e896aafe6` Request headers Referer http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ntflx.html Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers Content-Length 246138 Content-Type text/html Date Sun, 02 Apr 2023 12:24:46 GMT ETag "8872dfc3088c8b216df3b77ce2de080f" Last-Modified Wed, 13 Jul 2022 13:31:11 GMT Server AmazonS3 x-amz-id-2 tJ7Cpq/L1q4CjuRHSs6fLOwBOjqMTxeYwWufVL5mmqZ9KAMP00aOEru4hwIGHXGFgX+qkVXAbJo= x-amz-request-id VK2HTR6WRRSS433K
GET H/1.1	200 OK	none.js Show response gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/ Frame 04D6	24 KB 25 KB	274ms 274ms	Script application/javascript	52.219.140.128 AMAZON-02
General Check archive.org Show headers Download Go to Full URL http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/none.js Requested by Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ Protocol HTTP/1.1 Server 52.219.140.128 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS s3-website.eu-central-1.amazonaws.com Software AmazonS3 / Resource Hash `36d6338e657cdef8022ef6782c4a709216a661166abaf141cd55e9286d774fda` Request headers accept-language jp-JP,jp;q=0.9 Referer http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Sun, 02 Apr 2023 12:24:46 GMT Last-Modified Wed, 13 Jul 2022 13:31:13 GMT Server AmazonS3 x-amz-request-id VK2YVPHXRNYD6DEZ ETag "ad3d9ad2c5b2c6efbc6423dba1de09d3" Content-Type application/javascript Content-Length 24871 x-amz-id-2 oxmEgAoLVF2789HJkfpgwSo8QWkzNbH7EfVHmjBS8VqBED+qpW1FiR61rSX8lSe0KGtnKGyUuOM=
GET H/1.1	200 OK	none_002.js Show response gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/ Frame 04D6	655 KB 655 KB	636ms 364ms	Script application/javascript	52.219.140.128 AMAZON-02
General Check archive.org Show headers Download Go to Full URL http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/none_002.js Requested by Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ Protocol HTTP/1.1 Server 52.219.140.128 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS s3-website.eu-central-1.amazonaws.com Software AmazonS3 / Resource Hash `abfe0e1b195380596a8d28abb2d472cc1cc670ac7f8a9582ca45bf3fb1b0950f` Request headers accept-language jp-JP,jp;q=0.9 Referer http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Sun, 02 Apr 2023 12:24:47 GMT Last-Modified Wed, 13 Jul 2022 13:31:13 GMT Server AmazonS3 x-amz-request-id FG30VXZN5H44X7YK ETag "de925e298f23668d274503b64f2449b8" Content-Type application/javascript Content-Length 670267 x-amz-id-2 1e9R6oM2Y/kGWPpJKNhXh4F27LSMKe4hPG1BukDse+A18mZVy0F215GLY9uAcBbY+zEaM7Ce6jM=
GET H/1.1	403 Forbidden	WebsiteDetect.asc gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/ Frame 04D6	0 0	568ms 312ms	Stylesheet text/html	52.219.140.128 AMAZON-02
General Check archive.org Show headers Download Go to Full URL http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/WebsiteDetect.asc Requested by Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ Protocol HTTP/1.1 Server 52.219.140.128 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS s3-website.eu-central-1.amazonaws.com Software AmazonS3 / Resource Hash Request headers accept-language jp-JP,jp;q=0.9 Referer http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Sun, 02 Apr 2023 12:24:46 GMT Server AmazonS3 x-amz-request-id FG3F22N6Z26MTK8Q Content-Length 303 x-amz-id-2 KpVkdM637DLBzU+fPqTkjyRtccYm89s8gjJpp2ttT+pEN1OsghBOi0sE+IzYvj4erbZjZJGz0LU= Content-Type text/html; charset=utf-8
GET H/1.1	200 OK	sdk.js Show response gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/ Frame 04D6	213 KB 214 KB	848ms 291ms	Script application/javascript	52.219.140.128 AMAZON-02
General Check archive.org Show headers Download Go to Full URL http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/sdk.js Requested by Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ Protocol HTTP/1.1 Server 52.219.140.128 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS s3-website.eu-central-1.amazonaws.com Software AmazonS3 / Resource Hash `d69b388d3d3c136484970f6ee5e1ebb2dfe51fbd4af2ea731d8de40cfce3816e` Request headers accept-language jp-JP,jp;q=0.9 Referer http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Sun, 02 Apr 2023 12:24:47 GMT Last-Modified Wed, 13 Jul 2022 13:31:14 GMT Server AmazonS3 x-amz-request-id FG37W88Y3PBTTWGY ETag "0c69f0ce076b2e2155d6c00f404d7b8f" Content-Type application/javascript Content-Length 218405 x-amz-id-2 qFma/TQxhk9gRlWsmust4gujBXjcE4ZvOtFVKTLuKetX/WtO6KS8jLXmAGgaJuwdp+rXTsz4jy0=
GET H/1.1	200 OK	none.css gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/ Frame 04D6	101 KB 102 KB	573ms 314ms	Stylesheet text/css	52.219.140.128 AMAZON-02
General Check archive.org Show headers Download Go to Full URL http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/none.css Requested by Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ Protocol HTTP/1.1 Server 52.219.140.128 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS s3-website.eu-central-1.amazonaws.com Software AmazonS3 / Resource Hash `601553a598f6c89f43b5f373d84fdf182db3af0acd6df215f9e4f62ee6c4dcb6` Request headers accept-language jp-JP,jp;q=0.9 Referer http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Sun, 02 Apr 2023 12:24:47 GMT Last-Modified Wed, 13 Jul 2022 13:31:13 GMT Server AmazonS3 x-amz-request-id FG3609MYSPE416M1 ETag "33075e961185b732b5e74ad63516664c" Content-Type text/css Content-Length 103683 x-amz-id-2 zgtJpcWsr4OMpiR14NXD43QJGl3UZbtxcsFoaNGlHYWZ1I11keVYS156ukuVu56AKa+1cEeCxSA=
GET H/1.1	200 OK	FB-f-Logo__blue_57.png gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/ Frame 04D6	1 KB 2 KB	301ms 300ms	Image image/png	52.219.140.128 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/FB-f-Logo__blue_57.png Requested by Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ Protocol HTTP/1.1 Server 52.219.140.128 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS s3-website.eu-central-1.amazonaws.com Software AmazonS3 / Resource Hash `3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece` Request headers accept-language jp-JP,jp;q=0.9 Referer http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Sun, 02 Apr 2023 12:24:48 GMT Last-Modified Wed, 13 Jul 2022 13:31:12 GMT Server AmazonS3 x-amz-request-id 7C4KC5ZN6DC0CHS5 ETag "a33ca47ef110b6e3ec5086b8776407d3" Content-Type image/png Content-Length 1455 x-amz-id-2 s/p67eFvIxBw0JvpyjT2c4LxHs//XMSrObRpyBNBdcSV4AU1HwP6GhopBP4bwOkC/3ZustMjhIA=
GET H/1.1	403 Forbidden	WebsiteDetect Show response gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ichnaea/cl2/freeform/ Frame 04D6	303 B 571 B	284ms 283ms	XHR text/html	52.219.140.128 AMAZON-02
General Check archive.org Show headers Download Go to Full URL http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ichnaea/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=js&modalView=login Requested by Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ Protocol HTTP/1.1 Server 52.219.140.128 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS s3-website.eu-central-1.amazonaws.com Software AmazonS3 / Resource Hash `b80453ac29600e451c30db7cfef0c3485a8736be7877239a323077eaeb545ad6` Request headers accept-language jp-JP,jp;q=0.9 Referer http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Sun, 02 Apr 2023 12:24:47 GMT Server AmazonS3 x-amz-request-id 7C4VJ5BH16Y0KMR0 Content-Length 303 x-amz-id-2 x0eRmE9zwD7ub2/MnE6z7IQiP/tyLR4WYkm6c6mG4Lf0/PmJSeJcDhlRKswxBt9h9UDnAQeWTwY= Content-Type text/html; charset=utf-8
GET H/1.1	403 Forbidden	WebsiteScreen Show response gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ichnaea/cl2/freeform/ Frame 04D6	303 B 571 B	286ms 285ms	XHR text/html	52.219.140.128 AMAZON-02
General Check archive.org Show headers Download Go to Full URL http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ichnaea/cl2/freeform/WebsiteScreen?source=wwwhead&fetchType=js&winw=1600&winh=1200&screenw=1600&screenh=1200&ratio=1 Requested by Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ Protocol HTTP/1.1 Server 52.219.140.128 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS s3-website.eu-central-1.amazonaws.com Software AmazonS3 / Resource Hash `80cde3594c656f48a5b7af53e394b15e6189893b36e65dac5074d903644529a3` Request headers accept-language jp-JP,jp;q=0.9 Referer http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Sun, 02 Apr 2023 12:24:46 GMT Server AmazonS3 x-amz-request-id 7C4QFAFYP0BZBAN7 Content-Length 303 x-amz-id-2 fs1FL2T877W1jXUSE8i07sqby9cc87tnLP7C7ed95yMF/v2K94uJUKzEHhb5u0wHlazByKu7H/Y= Content-Type text/html; charset=utf-8
GET H/1.1	200 OK	login-the-crown_2-1500x1000.jpg assets.nflxext.com/ffe/siteui/acquisition/login/ Frame 04D6	84 KB 85 KB	104ms 50ms	Image image/jpeg	2a00:86c0:2090::1 NETFLIX-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://assets.nflxext.com/ffe/siteui/acquisition/login/login-the-crown_2-1500x1000.jpg Requested by Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/none.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US), Reverse DNS Software nginx / Resource Hash `baafd74a4cb4dc594b614eeb45c7267bb1af729d9271752460348ece16532d04` Request headers accept-language jp-JP,jp;q=0.9 Referer http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Sun, 02 Apr 2023 12:24:47 GMT Last-Modified Mon, 24 Oct 2016 20:49:51 GMT Server nginx Content-MD5 5GY/BZWwL7HDlH/B8V64Eg== Content-Type image/jpeg Cache-Control max-age=604801 Connection keep-alive Accept-Ranges bytes Content-Length 86226 Expires Sun, 09 Apr 2023 12:24:48 GMT
GET H/1.1	200 OK	nf-icon-v1-93.woff assets.nflxext.com/ffe/siteui/fonts/ Frame 04D6	72 KB 72 KB	90ms 39ms	Font font/woff	2a00:86c0:2090::1 NETFLIX-ASN
General Check archive.org Show headers Download Go to Full URL https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-93.woff Requested by Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/none.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US), Reverse DNS Software nginx / Resource Hash `98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d` Request headers Referer http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ Origin http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Response headers Date Sun, 02 Apr 2023 12:24:47 GMT Last-Modified Mon, 29 Jan 2018 01:50:51 GMT Server nginx Content-MD5 fPYVbMSBJEtaJUNi17c/AA== Content-Type font/woff Access-Control-Allow-Origin * Cache-Control max-age=604801 Connection keep-alive Accept-Ranges bytes Content-Length 73572 Expires Sun, 09 Apr 2023 12:24:48 GMT
GET H/1.1	200 OK	xaOI6zd9HW9.html Show response gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/ Frame FD6F	42 KB 42 KB	325ms 325ms	Document text/html	52.219.140.128 AMAZON-02
General Check archive.org Show headers Download Go to Full URL http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/xaOI6zd9HW9.html Requested by Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ Protocol HTTP/1.1 Server 52.219.140.128 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS s3-website.eu-central-1.amazonaws.com Software AmazonS3 / Resource Hash `d9013ca6d10e27a1c53881852fd9bc126a0f92eb0392f7138acae4bf8947e2f3` Request headers Referer http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 accept-language jp-JP,jp;q=0.9 Response headers Content-Length 42738 Content-Type text/html Date Sun, 02 Apr 2023 12:24:49 GMT ETag "f061cabded8c9c295e49b9e27e2963a8" Last-Modified Wed, 13 Jul 2022 13:31:14 GMT Server AmazonS3 x-amz-id-2 JNaSh15ZrlurBPHmXroGNwS4NdgsTWozDOyS1CBCvDSa+HDFLH9Oo88M13Skk0p8Dzh5UsGEsGs= x-amz-request-id Z5HBAF3GWRQB7VD9
POST H/1.1	405 Method Not Allowed	log Show response gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ichnaea/ Frame 04D6	422 B 745 B	275ms 275ms	XHR text/html	52.219.140.128 AMAZON-02
General Check archive.org Show headers Download Go to Full URL http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ichnaea/log Requested by Host: gal-phishing-tests.s3-website.eu-central-1.amazonaws.com URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/none_002.js Protocol HTTP/1.1 Server 52.219.140.128 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS s3-website.eu-central-1.amazonaws.com Software AmazonS3 / Resource Hash `bea999591aa72ef684284168f01f2000ef9662d70629998a14fb415ba3fc36fe` Request headers Accept / X-Netflix.ichnaea.request.type UiRequest Referer http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/ X-Requested-With XMLHttpRequest accept-language jp-JP,jp;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36 Content-Type application/json Response headers Date Sun, 02 Apr 2023 12:24:47 GMT Server AmazonS3 x-amz-request-id Z5H2N1RQRVT6RS6W Allow GET, HEAD, OPTIONS Content-Type text/html; charset=utf-8 Connection close Content-Length 422 x-amz-id-2 NPEy49tMUi3uzroGPV9Gs2ydMjfPUrSlN1E3ixcAvHy2rsJTCU+pfNpLLnv0qIG+uia/LaOfUlI=

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 boolean| credentialless

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/	1969-12-31 23:59:59	Name: cL Value: 1680438288590%7C168043828861928815%7C16804382883230959%7C%7C4%7CUNPYKR5TOVFFFKE6OU2YTRLYFY

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/real_pages/Netflix/Netflix_files/WebsiteDetect.asc Message: Failed to load resource: the server responded with a status of 403 (Forbidden)
network	error	URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ichnaea/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=js&modalView=login Message: Failed to load resource: the server responded with a status of 403 (Forbidden)
network	error	URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ichnaea/cl2/freeform/WebsiteScreen?source=wwwhead&fetchType=js&winw=1600&winh=1200&screenw=1600&screenh=1200&ratio=1 Message: Failed to load resource: the server responded with a status of 403 (Forbidden)
network	error	URL: http://gal-phishing-tests.s3-website.eu-central-1.amazonaws.com/ichnaea/log Message: Failed to load resource: the server responded with a status of 405 (Method Not Allowed)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.nflxext.com
gal-phishing-tests.s3-website.eu-central-1.amazonaws.com
2a00:86c0:2090::1
52.219.140.128
36d6338e657cdef8022ef6782c4a709216a661166abaf141cd55e9286d774fda
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
453cb42bea6ee7a9e76e6441176bbc990d7dc38962b341d5b31675b1fc8e7912
53a882090787933350210770e49c74e0f80e5ffb75b7dc284955b92e896aafe6
601553a598f6c89f43b5f373d84fdf182db3af0acd6df215f9e4f62ee6c4dcb6
80cde3594c656f48a5b7af53e394b15e6189893b36e65dac5074d903644529a3
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
abfe0e1b195380596a8d28abb2d472cc1cc670ac7f8a9582ca45bf3fb1b0950f
b80453ac29600e451c30db7cfef0c3485a8736be7877239a323077eaeb545ad6
baafd74a4cb4dc594b614eeb45c7267bb1af729d9271752460348ece16532d04
bea999591aa72ef684284168f01f2000ef9662d70629998a14fb415ba3fc36fe
d69b388d3d3c136484970f6ee5e1ebb2dfe51fbd4af2ea731d8de40cfce3816e
d9013ca6d10e27a1c53881852fd9bc126a0f92eb0392f7138acae4bf8947e2f3

gal-phishing-tests.s3-website.eu-central-1.amazonaws.com Open in urlscan Pro 52.219.140.128 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

14 Requests

14 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

1438 kBTransfer

1434 kBSize

1 Cookies

0 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

1 Cookies

4 Console Messages

Indicators

gal-phishing-tests.s3-website.eu-central-1.amazonaws.com Open in urlscan Pro
52.219.140.128 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

14 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

1438 kB
Transfer

1434 kB
Size

1
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!