netflix-6sl.pages.dev Open in urlscan Pro
2606:4700:310c::ac42:2d26 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://netflix-6sl.pages.dev/
Submission: On July 14 via automatic, source certstream-suspicious (July 14th 2023, 1:54:04 pm UTC) — Scanned from DE

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 8 HTTP transactions. The main IP is 2606:4700:310c::ac42:2d26, located in United States and belongs to CLOUDFLARENET, US. The main domain is netflix-6sl.pages.dev.
TLS certificate: Issued by GTS CA 1P5 on July 14th 2023. Valid for: 3 months.

This is the only time netflix-6sl.pages.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address	AS Autonomous System
2	2606:4700:310... 2606:4700:310c::ac42:2d26	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	162.19.58.159 162.19.58.159	16276 (OVH) (OVH)
1	99.86.91.104 99.86.91.104	16509 (AMAZON-02) (AMAZON-02)
8	3

2 2606:4700:310c::ac42:2d26 (United States)

ASN13335 (CLOUDFLARENET, US)

netflix-6sl.pages.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 162.19.58.159 (France)

ASN16276 (OVH, FR)
PTR: ns3096667.ip-162-19-58.eu

i.ibb.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.86.91.104 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-91-104.cdg50.r.cloudfront.net

nius.moviebloc.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	ibb.co i.ibb.co — Cisco Umbrella Rank: 11275	709 KB
2	pages.dev netflix-6sl.pages.dev	4 KB
1	moviebloc.com nius.moviebloc.com	192 KB
8	3

	Domain	Requested by
5	i.ibb.co	netflix-6sl.pages.dev
2	netflix-6sl.pages.dev	netflix-6sl.pages.dev
1	nius.moviebloc.com	netflix-6sl.pages.dev
8	3

This site contains no links.

Subject Issuer	Validity	Valid
netflix-6sl.pages.dev GTS CA 1P5	`2023-07-14` - `2023-10-12`	3 months	crt.sh
i.ibb.co R3	`2023-06-11` - `2023-09-09`	3 months	crt.sh
*.moviebloc.com Amazon RSA 2048 M01	`2023-04-25` - `2024-05-23`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://netflix-6sl.pages.dev/
Frame ID: 6D458073338302E45AAC19502EBF907C
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Netflix-Watch-TV-Show Online Movies Watch Online

Page Statistics

8
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

905 kB
Transfer

913 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
netflix-6sl.pages.dev/ 8 KB
2 KB 76ms
45ms Document
text/html 2606:4700:310c::ac42:2d26
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://netflix-6sl.pages.dev/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:310c::ac42:2d26 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8b9abff5f2bb7d1e0db6d549c860c1a759be337f18203fb592dd9dab3d669d26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=0, must-revalidate
cf-ray: 7e6a4143cb219268-FRA
content-encoding: br
content-type: text/html; charset=utf-8
date: Fri, 14 Jul 2023 13:53:58 GMT
etag: W/"255045bcbe8e91c33b37c94b36e8c30c"
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=04y46EAmY1B8xRG200bJkFwo6qYFxYSZyvYYsfkTlXQJjG%2Ba%2FcNUnNqGNPouYZhNYaH6bXFXXhIGfT4z4KF%2FN5274goQTUcIAqAAHxnFpWzJVyWy%2BR2Zwj90GIYQB6jg1SVTuOIYju6QpRgwSeUxmmUrLj4%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-content-type-options: nosniff

GET
H2 200 style.css
netflix-6sl.pages.dev/css/ 6 KB
2 KB 242ms
241ms Stylesheet
text/css 2606:4700:310c::ac42:2d26
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://netflix-6sl.pages.dev/css/style.css

Requested by

Host: netflix-6sl.pages.dev
URL: https://netflix-6sl.pages.dev/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:310c::ac42:2d26 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5a819535a235e6a14ca1635671be3104e4913c4870106ab0ff52da62bcc1f78f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://netflix-6sl.pages.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 14 Jul 2023 13:53:58 GMT
content-encoding: br
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"07525cee4cac1d6c8a4d1e914f26492d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5JSC4yMl0MvFH4bZNJHaV32fUw7zgla3D%2B7J%2Bz1ww3i4ZY1Z5souA7O3mS1dxdxxwWd%2FVqLdPncGZwO7%2FhBJpt%2BtsRe4PuGNs6LnxjJzy4eyRIr9CHk6Skfpv0fPobOR6DVjEsadXSOSq3BQxhK%2FoYzBe7U%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
cf-ray: 7e6a41441b5b9268-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 logo.png
i.ibb.co/r5krrdz/ 6 KB
6 KB 75ms
17ms Image
image/png 162.19.58.159
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.ibb.co/r5krrdz/logo.png
Requested by: Host: netflix-6sl.pages.dev
URL: https://netflix-6sl.pages.dev/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.19.58.159 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3096667.ip-162-19-58.eu
Software: nginx /
Resource Hash: caf69067b53f840529b7cc3a2494e90878dc9f62307fc458dd893fac746d37a0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://netflix-6sl.pages.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 14 Jul 2023 13:53:58 GMT
last-modified: Tue, 21 May 2019 12:11:24 GMT
server: nginx
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 6332
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 tab-content-1.png
i.ibb.co/J2xDJV7/ 169 KB
170 KB 74ms
17ms Image
image/png 162.19.58.159
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.ibb.co/J2xDJV7/tab-content-1.png
Requested by: Host: netflix-6sl.pages.dev
URL: https://netflix-6sl.pages.dev/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.19.58.159 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3096667.ip-162-19-58.eu
Software: nginx /
Resource Hash: d0a1d3ab0e60382d7cd4c92eea1d6381b9b71b5c403a95877d67fff18ac6779d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://netflix-6sl.pages.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 14 Jul 2023 13:53:58 GMT
last-modified: Tue, 21 May 2019 12:11:25 GMT
server: nginx
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 173496
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 tab-content-2-1.png
i.ibb.co/DpdN7Gn/ 242 KB
243 KB 74ms
17ms Image
image/png 162.19.58.159
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.ibb.co/DpdN7Gn/tab-content-2-1.png
Requested by: Host: netflix-6sl.pages.dev
URL: https://netflix-6sl.pages.dev/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.19.58.159 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3096667.ip-162-19-58.eu
Software: nginx /
Resource Hash: 103646e75938c72c1e14b79899b6a6ae8050f255a35fefadae283e55b2b48127

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://netflix-6sl.pages.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 14 Jul 2023 13:53:58 GMT
last-modified: Tue, 21 May 2019 12:11:26 GMT
server: nginx
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 247810
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 tab-content-2-2.png
i.ibb.co/R3r1SPX/ 119 KB
120 KB 74ms
18ms Image
image/png 162.19.58.159
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.ibb.co/R3r1SPX/tab-content-2-2.png
Requested by: Host: netflix-6sl.pages.dev
URL: https://netflix-6sl.pages.dev/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.19.58.159 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3096667.ip-162-19-58.eu
Software: nginx /
Resource Hash: 55bc0f00df3c8622dc3ea9146aadf47791ea0730f1a98f452f4843366bc894b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://netflix-6sl.pages.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 14 Jul 2023 13:53:58 GMT
last-modified: Tue, 21 May 2019 12:11:26 GMT
server: nginx
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 122232
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 tab-content-2-3.png
i.ibb.co/gDhnwWn/ 170 KB
170 KB 74ms
18ms Image
image/png 162.19.58.159
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.ibb.co/gDhnwWn/tab-content-2-3.png
Requested by: Host: netflix-6sl.pages.dev
URL: https://netflix-6sl.pages.dev/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.19.58.159 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3096667.ip-162-19-58.eu
Software: nginx /
Resource Hash: fcb40d090bcfa2ef6b71c945cc84cb6c339b8b5b053df9e7d759961257dd9b8d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://netflix-6sl.pages.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 14 Jul 2023 13:53:58 GMT
last-modified: Tue, 21 May 2019 12:11:26 GMT
server: nginx
access-control-allow-methods: GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 174061
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 291f9bd9f824afb1e2c5d8ee235bdb0a.jpg
nius.moviebloc.com/news/20230405/org/ 191 KB
192 KB 1397ms
1328ms Image
image/jpeg 99.86.91.104
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nius.moviebloc.com/news/20230405/org/291f9bd9f824afb1e2c5d8ee235bdb0a.jpg
Requested by: Host: netflix-6sl.pages.dev
URL: https://netflix-6sl.pages.dev/css/style.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.91.104 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-91-104.cdg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 07fa336b0966afaaf169251c886b56886bcbcae47e978183dabf8ca55c591d2c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://netflix-6sl.pages.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date: Fri, 14 Jul 2023 13:54:00 GMT
via: 1.1 cf04af0068b2a5085b05bea6fffb0856.cloudfront.net (CloudFront)
last-modified: Tue, 04 Apr 2023 20:51:03 GMT
server: AmazonS3
x-amz-cf-pop: CDG50-C1
etag: "77f2f8692b8d6d9273dd0a423355a101"
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
content-type: image/jpeg
accept-ranges: bytes
content-length: 196081
x-amz-cf-id: QkTTa-ynmIip-6B9VrNXCaU9pXEJ9wIrPqM_PArr1agISqPu9Jbsbg==

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

i.ibb.co
netflix-6sl.pages.dev
nius.moviebloc.com
162.19.58.159
2606:4700:310c::ac42:2d26
99.86.91.104
07fa336b0966afaaf169251c886b56886bcbcae47e978183dabf8ca55c591d2c
103646e75938c72c1e14b79899b6a6ae8050f255a35fefadae283e55b2b48127
55bc0f00df3c8622dc3ea9146aadf47791ea0730f1a98f452f4843366bc894b9
5a819535a235e6a14ca1635671be3104e4913c4870106ab0ff52da62bcc1f78f
8b9abff5f2bb7d1e0db6d549c860c1a759be337f18203fb592dd9dab3d669d26
caf69067b53f840529b7cc3a2494e90878dc9f62307fc458dd893fac746d37a0
d0a1d3ab0e60382d7cd4c92eea1d6381b9b71b5c403a95877d67fff18ac6779d
fcb40d090bcfa2ef6b71c945cc84cb6c339b8b5b053df9e7d759961257dd9b8d

netflix-6sl.pages.dev Open in urlscan Pro 2606:4700:310c::ac42:2d26 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

8 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

3 IPs

2 Countries

905 kBTransfer

913 kBSize

0 Cookies

0 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

netflix-6sl.pages.dev Open in urlscan Pro
2606:4700:310c::ac42:2d26 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

905 kB
Transfer

913 kB
Size

0
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!