www.netflixsecure.fr Open in urlscan Pro
164.132.145.19 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.netflixsecure.fr/
Submission: On August 01 via automatic, source certstream-suspicious (August 1st 2021, 11:59:35 pm UTC)

Summary HTTP 16 Redirects Links 11 Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 16 HTTP transactions. The main IP is 164.132.145.19, located in France and belongs to OVH, FR. The main domain is www.netflixsecure.fr.
TLS certificate: Issued by R3 on August 1st 2021. Valid for: 3 months.

This is the only time www.netflixsecure.fr was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address	AS Autonomous System
3	164.132.145.19 164.132.145.19	16276 (OVH) (OVH)
6	2a00:86c0:209... 2a00:86c0:2090::1	40027 (NETFLIX-ASN) (NETFLIX-ASN)
2	2a00:1450:400... 2a00:1450:4001:827::2004	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:831::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:812::2003	15169 (GOOGLE) (GOOGLE)
16	5

3 164.132.145.19 (France)

ASN16276 (OVH, FR)

www.netflixsecure.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:86c0:2090::1 (United States)

ASN40027 (NETFLIX-ASN, US)

codex.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
assets.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:827::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:831::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:812::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	nflxext.com codex.nflxext.com assets.nflxext.com	410 KB
5	gstatic.com www.gstatic.com fonts.gstatic.com	193 KB
3	netflixsecure.fr www.netflixsecure.fr	57 KB
2	google.com www.google.com	21 KB
16	4

	Domain	Requested by
3	www.gstatic.com	www.google.com www.gstatic.com
3	assets.nflxext.com	www.netflixsecure.fr codex.nflxext.com
3	codex.nflxext.com	www.netflixsecure.fr
3	www.netflixsecure.fr	www.netflixsecure.fr
2	fonts.gstatic.com	www.google.com
2	www.google.com	www.netflixsecure.fr www.google.com
16	6

This site contains links to these domains. Also see Links.

Domain
facebook.com
policies.google.com
help.netflix.com
optout.aboutads.info
onetrust.com

Subject Issuer	Validity	Valid
netflixsecure.fr R3	`2021-08-01` - `2021-10-30`	3 months	crt.sh
*.1.nflxso.net DigiCert TLS RSA SHA256 2020 CA1	`2021-07-26` - `2021-08-25`	a month	crt.sh
www.google.com GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-07-05` - `2021-09-27`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-06-28` - `2021-09-20`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://www.netflixsecure.fr/
Frame ID: 36E6AC07E31A99EB9A18062AC1E853DE
Requests: 9 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Lf8hrcUAAAAAIpQAFW2VFjtiYnThOjZOA5xvLyR&co=aHR0cHM6Ly93d3cubmV0ZmxpeC5jb206NDQz&hl=fr&v=ecapuzyywmdXQ5gJHS3JQiXe&size=invisible&cb=usfv01vnk6n5
Frame ID: 64BD09CDFD7E35D3AF88E7EDD2533AE3
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

16
Requests

100 %
HTTPS

80 %
IPv6

4
Domains

6
Subdomains

5
IPs

3
Countries

681 kB
Transfer

1360 kB
Size

1
Cookies

11 Outgoing links

These are links going to different origins than the main page.

URL: https://facebook.com/
Title: S'identifier avec Facebook

Search URL Search Domain Scan URL

URL: https://policies.google.com/privacy
Title: Règles de confidentialité

Search URL Search Domain Scan URL

URL: https://policies.google.com/terms
Title: Conditions d'utilisation

Search URL Search Domain Scan URL

URL: https://help.netflix.com/support/412
Title: FAQ

Search URL Search Domain Scan URL

URL: https://help.netflix.com/
Title: Centre d'aide

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/termsofuse
Title: Conditions d'utilisation

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/privacy
Title: Confidentialité

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/corpinfo
Title: Mentions légales

Search URL Search Domain Scan URL

URL: https://help.netflix.com/legal/privacy#cookies
Title: Cookies et publicité en ligne

Search URL Search Domain Scan URL

URL: https://optout.aboutads.info/
Title: ici.

Search URL Search Domain Scan URL

URL: https://onetrust.com/poweredbyonetrust

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.netflixsecure.fr/ 355 KB
57 KB 472ms
315ms Document
text/html 164.132.145.19
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.netflixsecure.fr/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 164.132.145.19 , France, ASN16276 (OVH, FR),
Reverse DNS
Software: nginx / PHP/7.4.21 PleskLin
Resource Hash: 5e5f23172c5ed732f049a572d26091fc15b59660d3778ce135faf81026b664b2

Request headers

:method: GET
:authority: www.netflixsecure.fr
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

server: nginx
date: Sun, 01 Aug 2021 23:59:15 GMT
content-type: text/html; charset=UTF-8
content-length: 57984
x-powered-by: PHP/7.4.21 PleskLin
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
set-cookie: PHPSESSID=jnfbateamkf9thi7q1vurnnqo5; path=/
vary: Accept-Encoding
content-encoding: gzip

GET
H2 404 WebsiteDetect
www.netflixsecure.fr/personalization/cl2/freeform/ 0
0 64ms
63ms Stylesheet
text/html 164.132.145.19
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.netflixsecure.fr/personalization/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=css&modalView=login
Requested by: Host: www.netflixsecure.fr
URL: https://www.netflixsecure.fr/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 164.132.145.19 , France, ASN16276 (OVH, FR),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

:path: /personalization/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=css&modalView=login
pragma: no-cache
cookie: PHPSESSID=jnfbateamkf9thi7q1vurnnqo5
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: www.netflixsecure.fr
referer: https://www.netflixsecure.fr/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.netflixsecure.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 01 Aug 2021 23:59:15 GMT
content-encoding: br
last-modified: Sun, 01 Aug 2021 23:29:29 GMT
server: nginx
etag: W/"328-5c887d30497cb"
content-type: text/html

GET
H/1.1 200
OK none
codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-v6ef6668d/css/css/less%7Ccore%7Cerror-page.less/1/avrytF4Dps9xCE/none/true/ 11 KB
3 KB 26ms
6ms Stylesheet
text/css 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-v6ef6668d/css/css/less%7Ccore%7Cerror-page.less/1/avrytF4Dps9xCE/none/true/none

Requested by

Host: www.netflixsecure.fr
URL: https://www.netflixsecure.fr/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

d9bac1aefff045998fd064ed279defcd96c37a53ee0ee3816d1ebab19c1ff739

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.netflixsecure.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 01 Aug 2021 23:59:15 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Content-Type: text/css; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=16070400
req_id: 15c59d92-e235-47aa-be11-136f32010151
Connection: keep-alive
Timing-Allow-Origin: https://www.netflix.com
Content-Length: 2595
Expires: Mon, 31 Jan 2022 19:04:13 GMT

GET
H/1.1 200
OK none
codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-v6ef6668d/css/css/less%7Clogin%7CloginBase.less,less%7Cpages%7Clogin%7CLogin.less/1/avrytF4Dps9xCE/none/true/ 132 KB
22 KB 27ms
6ms Stylesheet
text/css 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-v6ef6668d/css/css/less%7Clogin%7CloginBase.less,less%7Cpages%7Clogin%7CLogin.less/1/avrytF4Dps9xCE/none/true/none

Requested by

Host: www.netflixsecure.fr
URL: https://www.netflixsecure.fr/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

4b27429d411b25e69d402d57928be186a16ece667fd2a68ea3556802a3b6690b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.netflixsecure.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 01 Aug 2021 23:59:15 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Content-Type: text/css; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=16070400
req_id: adcb8498-ed8a-4cc2-a585-8d15638b44bb
Connection: keep-alive
Timing-Allow-Origin: https://www.netflix.com
Content-Length: 21835
Expires: Mon, 31 Jan 2022 19:01:48 GMT

GET
H/1.1 200
OK FR-fr-20210719-popsignuptwoweeks-perspective_alpha_website_large.jpg
assets.nflxext.com/ffe/siteui/vlv3/9c5457b8-9ab0-4a04-9fc1-e608d5670f1a/4d477afb-f452-42fc-879f-8c97f5b66dbe/ 307 KB
307 KB 28ms
6ms Image
image/jpeg 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.nflxext.com/ffe/siteui/vlv3/9c5457b8-9ab0-4a04-9fc1-e608d5670f1a/4d477afb-f452-42fc-879f-8c97f5b66dbe/FR-fr-20210719-popsignuptwoweeks-perspective_alpha_website_large.jpg
Requested by: Host: www.netflixsecure.fr
URL: https://www.netflixsecure.fr/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: d964e693f725d8f156dfa25536c43521e441f5ae0c709cd4cdd5feca2c4ce4a3

Request headers

Referer: https://www.netflixsecure.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 01 Aug 2021 23:59:15 GMT
Last-Modified: Wed, 21 Jul 2021 13:26:51 GMT
Server: nginx
Content-MD5: oMxCX/ZFWDJP7xcPZjUWeQ==
Content-Type: image/jpeg
Cache-Control: max-age=604801
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 314112
Expires: Wed, 28 Jul 2021 13:33:20 GMT

GET
H/1.1 200
OK FB-f-Logo__blue_57.png
assets.nflxext.com/ffe/siteui/login/images/ 1 KB
2 KB 30ms
16ms Image
image/png 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.nflxext.com/ffe/siteui/login/images/FB-f-Logo__blue_57.png
Requested by: Host: www.netflixsecure.fr
URL: https://www.netflixsecure.fr/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece

Request headers

Referer: https://www.netflixsecure.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 01 Aug 2021 23:59:15 GMT
Last-Modified: Thu, 30 Jun 2016 17:48:49 GMT
Server: nginx
Content-MD5: ozykfvEQtuPsUIa4d2QH0w==
Content-Type: image/png
Cache-Control: max-age=604801
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1455
Expires: Fri, 26 Jun 2020 23:42:40 GMT

GET
H/1.1 200
OK none Show response
codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-js-v6ef6668d/js/js/bootstrap.js,common%7Cbootstrap.js/2/0b3g022T2L2V052I2_3f070l003h2Y3b2Q302W3a2N2-320a013c0W/bck/true/ 9 KB
4 KB 6ms
6ms Script
application/javascript 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-js-v6ef6668d/js/js/bootstrap.js,common%7Cbootstrap.js/2/0b3g022T2L2V052I2_3f070l003h2Y3b2Q302W3a2N2-320a013c0W/bck/true/none

Requested by

Host: www.netflixsecure.fr
URL: https://www.netflixsecure.fr/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

a0eb42520982efbbc3c8d31bd13cfcaa41760f0508c5d7af4c9f060636dab456

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.netflixsecure.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 01 Aug 2021 23:59:15 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: nginx
Content-Type: application/javascript; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=16070400
req_id: b5e717ca-b56c-4e6b-8e21-e0f15d154557
Connection: keep-alive
Timing-Allow-Origin: https://www.netflix.com
Content-Length: 3631
Expires: Mon, 31 Jan 2022 22:17:19 GMT

GET
H2 200 script_main.js Show response
www.netflixsecure.fr/ 2 KB
514 B 63ms
63ms Script
application/javascript 164.132.145.19
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://www.netflixsecure.fr/script_main.js
Requested by: Host: www.netflixsecure.fr
URL: https://www.netflixsecure.fr/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 164.132.145.19 , France, ASN16276 (OVH, FR),
Reverse DNS
Software: nginx / PleskLin
Resource Hash: 67fecb1739c6ae742e247a8347a75af39f1575c9e2dab8ff829a9bcd3e4fa773

Request headers

:path: /script_main.js
pragma: no-cache
cookie: PHPSESSID=jnfbateamkf9thi7q1vurnnqo5
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: www.netflixsecure.fr
referer: https://www.netflixsecure.fr/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://www.netflixsecure.fr/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 01 Aug 2021 23:59:15 GMT
content-encoding: br
etag: W/"610705fa-62f"
last-modified: Sun, 01 Aug 2021 20:37:14 GMT
server: nginx
x-powered-by: PleskLin
content-type: application/javascript

GET
H/1.1 200
OK nf-icon-v1-93.woff
assets.nflxext.com/ffe/siteui/fonts/ 72 KB
72 KB 19ms
6ms Font
font/woff 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-93.woff
Requested by: Host: codex.nflxext.com
URL: https://codex.nflxext.com/%5E3.0.0/truthBundle/webui/1.22.5-shakti-css-v6ef6668d/css/css/less%7Clogin%7CloginBase.less,less%7Cpages%7Clogin%7CLogin.less/1/avrytF4Dps9xCE/none/true/none
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d

Request headers

Origin: https://www.netflixsecure.fr
Referer: https://codex.nflxext.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 01 Aug 2021 23:59:15 GMT
Last-Modified: Mon, 29 Jan 2018 01:50:51 GMT
Server: nginx
Content-MD5: fPYVbMSBJEtaJUNi17c/AA==
Content-Type: font/woff
Access-Control-Allow-Origin: *
Cache-Control: max-age=604801
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 73572
Expires: Sat, 08 May 2021 16:30:28 GMT

GET
H2 200 anchor Show response
www.google.com/recaptcha/enterprise/ Frame 64BD 41 KB
21 KB 27ms
26ms Document
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Lf8hrcUAAAAAIpQAFW2VFjtiYnThOjZOA5xvLyR&co=aHR0cHM6Ly93d3cubmV0ZmxpeC5jb206NDQz&hl=fr&v=ecapuzyywmdXQ5gJHS3JQiXe&size=invisible&cb=usfv01vnk6n5

Requested by

Host: www.netflixsecure.fr
URL: https://www.netflixsecure.fr/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

4adb481e5bf18f9860dce2cb1ca6ad81c7b69db0f075d9a7de0f115d83c38afc

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-rVedcOPO1ju1bwaOPiyhNA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/enterprise/anchor?ar=1&k=6Lf8hrcUAAAAAIpQAFW2VFjtiYnThOjZOA5xvLyR&co=aHR0cHM6Ly93d3cubmV0ZmxpeC5jb206NDQz&hl=fr&v=ecapuzyywmdXQ5gJHS3JQiXe&size=invisible&cb=usfv01vnk6n5
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.netflixsecure.fr/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.netflixsecure.fr/

Response headers

content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sun, 01 Aug 2021 23:59:15 GMT
content-security-policy: script-src 'report-sample' 'nonce-rVedcOPO1ju1bwaOPiyhNA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 21284
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/ecapuzyywmdXQ5gJHS3JQiXe/ Frame 64BD 52 KB
26 KB 25ms
6ms Stylesheet
text/css 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/ecapuzyywmdXQ5gJHS3JQiXe/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Lf8hrcUAAAAAIpQAFW2VFjtiYnThOjZOA5xvLyR&co=aHR0cHM6Ly93d3cubmV0ZmxpeC5jb206NDQz&hl=fr&v=ecapuzyywmdXQ5gJHS3JQiXe&size=invisible&cb=usfv01vnk6n5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5fe20047c1cc1be61a786d56c5c02b96453b9c60656d6c8429a1add79017e47f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 01 Aug 2021 21:43:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 8156
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25732
x-xss-protection: 0
last-modified: Mon, 26 Jul 2021 00:05:58 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 01 Aug 2022 21:43:19 GMT

GET
H2 200 recaptcha__fr.js Show response
www.gstatic.com/recaptcha/releases/ecapuzyywmdXQ5gJHS3JQiXe/ Frame 64BD 346 KB
134 KB 32ms
13ms Script
text/javascript 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/ecapuzyywmdXQ5gJHS3JQiXe/recaptcha__fr.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ecd43cd9cfc0ae28425362d588115d30ecc84f07c2afa33631da747918ba461c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 17:21:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 542282
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 137514
x-xss-protection: 0
last-modified: Mon, 26 Jul 2021 00:05:58 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 26 Jul 2022 17:21:13 GMT

GET
H3-29 200 logo_48.png
www.gstatic.com/recaptcha/api2/ Frame 64BD 2 KB
2 KB 14ms
13ms Image
image/png 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/logo_48.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/ecapuzyywmdXQ5gJHS3JQiXe/styles__ltr.css

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.gstatic.com/recaptcha/releases/ecapuzyywmdXQ5gJHS3JQiXe/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 23:34:05 GMT
x-content-type-options: nosniff
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
age: 519911
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
content-type: image/png
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2228
x-xss-protection: 0
expires: Mon, 02 Aug 2021 23:34:05 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 64BD 15 KB
15 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.google.com
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 26 Jul 2021 21:27:21 GMT
x-content-type-options: nosniff
age: 527515
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Jul 2022 21:27:21 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 64BD 15 KB
15 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://www.google.com
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 27 Jul 2021 14:26:18 GMT
x-content-type-options: nosniff
age: 466378
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15552
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 27 Jul 2022 14:26:18 GMT

GET
H3-29 200 webworker.js
www.google.com/recaptcha/enterprise/ Frame 64BD 102 B
130 B 15ms
15ms Other
text/javascript 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/enterprise/webworker.js?hl=fr&v=ecapuzyywmdXQ5gJHS3JQiXe

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

ec8a39857a3b316e00a70f3f0452602b4fc27612c38cdef9c4485b06a38066b7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Lf8hrcUAAAAAIpQAFW2VFjtiYnThOjZOA5xvLyR&co=aHR0cHM6Ly93d3cubmV0ZmxpeC5jb206NDQz&hl=fr&v=ecapuzyywmdXQ5gJHS3JQiXe&size=invisible&cb=usfv01vnk6n5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 01 Aug 2021 23:59:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 110
x-xss-protection: 1; mode=block
expires: Sun, 01 Aug 2021 23:59:16 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.netflixsecure.fr/	1969-12-31 23:59:59	Name: PHPSESSID Value: jnfbateamkf9thi7q1vurnnqo5

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.nflxext.com
codex.nflxext.com
fonts.gstatic.com
www.google.com
www.gstatic.com
www.netflixsecure.fr
164.132.145.19
2a00:1450:4001:812::2003
2a00:1450:4001:827::2004
2a00:1450:4001:831::2003
2a00:86c0:2090::1
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
4adb481e5bf18f9860dce2cb1ca6ad81c7b69db0f075d9a7de0f115d83c38afc
4b27429d411b25e69d402d57928be186a16ece667fd2a68ea3556802a3b6690b
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
5e5f23172c5ed732f049a572d26091fc15b59660d3778ce135faf81026b664b2
5fe20047c1cc1be61a786d56c5c02b96453b9c60656d6c8429a1add79017e47f
67fecb1739c6ae742e247a8347a75af39f1575c9e2dab8ff829a9bcd3e4fa773
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
a0eb42520982efbbc3c8d31bd13cfcaa41760f0508c5d7af4c9f060636dab456
d964e693f725d8f156dfa25536c43521e441f5ae0c709cd4cdd5feca2c4ce4a3
d9bac1aefff045998fd064ed279defcd96c37a53ee0ee3816d1ebab19c1ff739
ec8a39857a3b316e00a70f3f0452602b4fc27612c38cdef9c4485b06a38066b7
ecd43cd9cfc0ae28425362d588115d30ecc84f07c2afa33631da747918ba461c

www.netflixsecure.fr Open in urlscan Pro 164.132.145.19 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

16 Requests

100 %HTTPS

80 %IPv6

4 Domains

6 Subdomains

5 IPs

3 Countries

681 kBTransfer

1360 kBSize

1 Cookies

11 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

19 JavaScript Global Variables

1 Cookies

Indicators

www.netflixsecure.fr Open in urlscan Pro
164.132.145.19 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

80 %
IPv6

4
Domains

6
Subdomains

5
IPs

3
Countries

681 kB
Transfer

1360 kB
Size

1
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!