prootech1.aba.ae
Open in
urlscan Pro
85.17.26.65
Malicious Activity!
Public Scan
Effective URL: http://prootech1.aba.ae/5462773fab13523b9790cfe7279060e5/
Submission: On June 12 via manual from AU
Summary
This is the only time prootech1.aba.ae was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Netflix (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 52.72.59.132 52.72.59.132 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
2 12 | 85.17.26.65 85.17.26.65 | 60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands) | |
3 | 2a00:86c0:209... 2a00:86c0:2090::1 | 40027 (NETFLIX-ASN) (NETFLIX-ASN - Netflix Streaming Services Inc.) | |
3 | 2a02:26f0:6c0... 2a02:26f0:6c00:286::33c4 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
3 | 2a03:2880:f02... 2a03:2880:f02d:12:face:b00c:0:3 | 32934 (FACEBOOK) (FACEBOOK - Facebook) | |
1 | 2a03:2880:f11... 2a03:2880:f11c:8083:face:b00c:0:25de | 32934 (FACEBOOK) (FACEBOOK - Facebook) | |
20 | 5 |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-52-72-59-132.compute-1.amazonaws.com
t.dripemail2.com |
ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
PTR: mail.aba.ae
samih.aba.ae | |
prootech1.aba.ae |
ASN40027 (NETFLIX-ASN - Netflix Streaming Services Inc., US)
codex.nflxext.com |
ASN32934 (FACEBOOK - Facebook, Inc., US)
connect.facebook.net | |
staticxx.facebook.com |
ASN32934 (FACEBOOK - Facebook, Inc., US)
www.facebook.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
aba.ae
2 redirects
samih.aba.ae prootech1.aba.ae |
95 KB |
6 |
nflxext.com
codex.nflxext.com assets.nflxext.com |
633 KB |
2 |
facebook.com
staticxx.facebook.com www.facebook.com |
|
2 |
facebook.net
connect.facebook.net |
61 KB |
1 |
dripemail2.com
1 redirects
t.dripemail2.com |
218 B |
20 | 5 |
Domain | Requested by | |
---|---|---|
11 | prootech1.aba.ae |
2 redirects
samih.aba.ae
prootech1.aba.ae codex.nflxext.com |
3 | assets.nflxext.com |
prootech1.aba.ae
|
3 | codex.nflxext.com |
prootech1.aba.ae
|
2 | connect.facebook.net |
prootech1.aba.ae
connect.facebook.net |
1 | www.facebook.com |
connect.facebook.net
|
1 | staticxx.facebook.com |
connect.facebook.net
|
1 | samih.aba.ae | |
1 | t.dripemail2.com | 1 redirects |
20 | 8 |
This site contains links to these domains. Also see Links.
Domain |
---|
help.netflix.com |
www.aba.ae |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.1.nflxso.net DigiCert SHA2 Secure Server CA |
2019-05-08 - 2019-06-24 |
2 months | crt.sh |
1970-01-01 - 1970-01-01 |
a few seconds | crt.sh | |
assets.nflxext.com DigiCert SHA2 Secure Server CA |
2018-03-09 - 2020-03-09 |
2 years | crt.sh |
*.facebook.com DigiCert SHA2 High Assurance Server CA |
2019-04-22 - 2019-07-21 |
3 months | crt.sh |
This page contains 3 frames:
Primary Page:
http://prootech1.aba.ae/5462773fab13523b9790cfe7279060e5/
Frame ID: D33A0BAE35F83263ADA1935C48803562
Requests: 18 HTTP requests in this frame
Frame:
https://staticxx.facebook.com/connect/xd_arbiter.php?version=44
Frame ID: 04545FAE2703B7E78D2D460AA462DD54
Requests: 1 HTTP requests in this frame
Frame:
https://www.facebook.com/connect/ping?client_id=163114453728333&domain=prootech1.aba.ae&origin=1&redirect_uri=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter.php%3Fversion%3D44%23cb%3Df19aea422718564%26domain%3Dprootech1.aba.ae%26origin%3Dhttp%253A%252F%252Fprootech1.aba.ae%252Ff1934393bf34de8%26relation%3Dparent&response_type=token%2Csigned_request&sdk=joey
Frame ID: 7D05008A2A3E31E2CC8959CE836F61C9
Requests: 1 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://t.dripemail2.com/c/eyJhY2NvdW50X2lkIjoiMTQzNTA1NyIsImRlbGl2ZXJ5X2lkIjoiNjg1MzU4OTE4NSIsInVybC...
HTTP 302
http://samih.aba.ae/?__s=jzdtrvetkqnk1qhwuwpb Page URL
-
http://prootech1.aba.ae/
HTTP 302
http://prootech1.aba.ae/5462773fab13523b9790cfe7279060e5 HTTP 301
http://prootech1.aba.ae/5462773fab13523b9790cfe7279060e5/ Page URL
Detected technologies
Nginx (Web Servers) ExpandDetected patterns
- headers server /nginx(?:\/([\d.]+))?/i
Facebook (Widgets) Expand
Detected patterns
- script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- env /^jQuery$/i
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
Title: Questions? Contact us.
Search URL Search Domain Scan URL
Title: Terms of Use
Search URL Search Domain Scan URL
Title: Privacy Statement
Search URL Search Domain Scan URL
Title: استضافة مجانية
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://t.dripemail2.com/c/eyJhY2NvdW50X2lkIjoiMTQzNTA1NyIsImRlbGl2ZXJ5X2lkIjoiNjg1MzU4OTE4NSIsInVybCI6Imh0dHA6Ly9zYW1paC5hYmEuYWUvP19fcz1qemR0cnZldGtxbmsxcWh3dXdwYiM0NCJ9
HTTP 302
http://samih.aba.ae/?__s=jzdtrvetkqnk1qhwuwpb Page URL
-
http://prootech1.aba.ae/
HTTP 302
http://prootech1.aba.ae/5462773fab13523b9790cfe7279060e5 HTTP 301
http://prootech1.aba.ae/5462773fab13523b9790cfe7279060e5/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://t.dripemail2.com/c/eyJhY2NvdW50X2lkIjoiMTQzNTA1NyIsImRlbGl2ZXJ5X2lkIjoiNjg1MzU4OTE4NSIsInVybCI6Imh0dHA6Ly9zYW1paC5hYmEuYWUvP19fcz1qemR0cnZldGtxbmsxcWh3dXdwYiM0NCJ9 HTTP 302
- http://samih.aba.ae/?__s=jzdtrvetkqnk1qhwuwpb
- http://connect.facebook.net/en_TN/sdk.js HTTP 307
- https://connect.facebook.net/en_TN/sdk.js
20 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
/
samih.aba.ae/ Redirect Chain
|
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
/
prootech1.aba.ae/5462773fab13523b9790cfe7279060e5/ Redirect Chain
|
325 KB 82 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
none
codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-js-mk-v4f11faf7/js/js/bootstrap.js,common%7Cbootstrap.js/2/4_034v4t4e4x084a4B4Z060u004-4A4o4D4y0e4R4P4N4j4C4r4F19024V/bck/true/ |
9 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
none
codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-js-mk-v4f11faf7/js/js/components%7Clogin%7CloginControllerClient.js/2/4_034v4t4e4x084a4B4Z060u004-4A4o4D4y0e4R4P4N4j4C4r4F19024V/l/true/ |
704 KB 207 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
WebsiteDetect
prootech1.aba.ae/personalization/cl2/freeform/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
none
codex.nflxext.com/%5E2.0.0/truthBundle/webui/0.0.1-shakti-css-v4f11faf7/css/css/less%7Clogin%7CloginBase.less,less%7Cpages%7Clogin%7CLogin.less/2/0C0Q040K090z0J0U0X0R0L0P0W0-/none/true/ |
124 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
TN-en-20190107-popsignuptwoweeks-perspective_alpha_website_large.jpg
assets.nflxext.com/ffe/siteui/vlv3/faece66f-91c3-4323-a7ed-e623d8343fca/9bdf17be-214c-45c0-b0e3-18f6f3bfdc49/ |
327 KB 328 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
FB-f-Logo__blue_57.png
assets.nflxext.com/ffe/siteui/login/images/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
WebsiteDetect
prootech1.aba.ae/personalization/cl2/freeform/ |
4 KB 2 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
WebsiteScreen
prootech1.aba.ae/personalization/cl2/freeform/ |
4 KB 2 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
nf-icon-v1-93.woff
assets.nflxext.com/ffe/siteui/fonts/ |
72 KB 72 KB |
Font
font/woff |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sdk.js
connect.facebook.net/en_TN/ Redirect Chain
|
3 KB 2 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
log
prootech1.aba.ae/personalization/ |
4 KB 2 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sdk.js
connect.facebook.net/en_US/ |
196 KB 59 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
xd_arbiter.php
staticxx.facebook.com/connect/ Frame 0454 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ping
www.facebook.com/connect/ Frame 7D05 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
cl2
prootech1.aba.ae/personalization/ |
4 KB 2 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
cl2
prootech1.aba.ae/personalization/ |
4 KB 2 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
cl2
prootech1.aba.ae/personalization/ |
4 KB 2 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
cl2
prootech1.aba.ae/personalization/ |
4 KB 2 KB |
XHR
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Netflix (Online)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask object| netflix object| Codex object| C object| global object| process object| util function| jQuery object| jQuery1111009998296775472904 function| fbAsyncInit object| FB1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.prootech1.aba.ae/ | Name: cL Value: 1560310408472%7C156031040851368135%7C156031040877115304%7C%7C4%7Cnull |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
assets.nflxext.com
codex.nflxext.com
connect.facebook.net
prootech1.aba.ae
samih.aba.ae
staticxx.facebook.com
t.dripemail2.com
www.facebook.com
2a00:86c0:2090::1
2a02:26f0:6c00:286::33c4
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f11c:8083:face:b00c:0:25de
52.72.59.132
85.17.26.65
039427134d14b04119c045daf63466e97f9a487d4db0f366a97b564230477df4
2d416c417de8c418e5c8451048704e9aad3d94fbe3ba7cd517e4999d6ed743a5
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
4c1a62bbb34d8cd720bb020d3ce720521a7afb10f74a34acd747dc8538bf26ee
54c3b9aea31ce4e69b88c40eb72aaaf16ae1c13f849dcf0ec632ecdc27039511
73fb154c2581c52ba4f55f14aa41534766727395138af7a894cc8e86974d17fa
9716b63ffd417f9970a15e2656074217d22dbe559ffe8babb64770d2134e7cb6
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
9ec49af20fead8d3448f7edd62de8a334dec284eb42cf007a5fa6ad114e0c4a1
e56a58c3dfacede41da51f47095cecefef99a66da6e9b3dee22150391289c3f4
e927e7c314f7cda8ee4dcff87b18b356084ba56e2dd38b011f2b59804760c042