netfilix.sviluppo.host Open in urlscan Pro
149.62.187.89 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://gmx78477470.lt.emlnk9.com/Prod/link-tracker?a=%7C%7C802077541%7C%7C&account=gmx78477470.activehosted.com&email=QAro7sQqH5X...
Effective URL:
https://netfilix.sviluppo.host/fx/CA/login.php
Submission: On May 08 via api (May 8th 2024, 10:54:51 am UTC) from US — Scanned from DE

Summary HTTP 14 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 6 domains to perform 14 HTTP transactions. The main IP is 149.62.187.89, located in Italy and belongs to COLTENGINE COLTENGINE Network, IT. The main domain is netfilix.sviluppo.host.
TLS certificate: Issued by R3 on May 7th 2024. Valid for: 3 months.

This is the only time netfilix.sviluppo.host was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Netflix (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	174.129.160.72 174.129.160.72	14618 (AMAZON-AES) (AMAZON-AES)
8	149.62.187.89 149.62.187.89	47242 (COLTENGIN...) (COLTENGINE COLTENGINE Network)
2	2a04:4e42:400... 2a04:4e42:400::649	54113 (FASTLY) (FASTLY)
2	142.250.74.196 142.250.74.196	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82f::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:86c0:209... 2a00:86c0:2090::1	40027 (NETFLIX-ASN) (NETFLIX-ASN)
14	5

1 174.129.160.72 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-174-129-160-72.compute-1.amazonaws.com

gmx78477470.lt.emlnk9.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 149.62.187.89 (Italy)

ASN47242 (COLTENGINE COLTENGINE Network, IT)
PTR: w3008.shared.host.it

netfilix.sviluppo.host	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a04:4e42:400::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.74.196 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: fra24s02-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:86c0:2090::1 (United States)

ASN40027 (NETFLIX-ASN, US)

assets.nflxext.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	sviluppo.host netfilix.sviluppo.host	339 KB
2	google.com www.google.com — Cisco Umbrella Rank: 2	855 B
2	jquery.com code.jquery.com — Cisco Umbrella Rank: 776	79 KB
1	nflxext.com assets.nflxext.com — Cisco Umbrella Rank: 5734	72 KB
1	gstatic.com www.gstatic.com	203 KB
1	emlnk9.com 1 redirects gmx78477470.lt.emlnk9.com	249 B
14	6

	Domain	Requested by
8	netfilix.sviluppo.host	netfilix.sviluppo.host
2	www.google.com	netfilix.sviluppo.host www.gstatic.com
2	code.jquery.com	netfilix.sviluppo.host
1	assets.nflxext.com	netfilix.sviluppo.host
1	www.gstatic.com	www.google.com
1	gmx78477470.lt.emlnk9.com	1 redirects
14	6

This site contains no links.

Subject Issuer	Validity	Valid
netfilix.sviluppo.host R3	`2024-05-07` - `2024-08-05`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh
*.google.com GTS CA 1C3	`2024-04-16` - `2024-07-09`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-04-16` - `2024-07-09`	3 months	crt.sh
*.1.nflxso.net DigiCert Secure Site ECC CA-1	`2024-05-05` - `2024-06-08`	a month	crt.sh

This page contains 2 frames:

Primary Page: https://netfilix.sviluppo.host/fx/CA/login.php
Frame ID: 9837FF04DA60DAF302DE63C91CB05FDE
Requests: 13 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LflUtQpAAAAACpT8GjDNPlrzFpELdAOBXGDUj3a&co=aHR0cHM6Ly9uZXRmaWxpeC5zdmlsdXBwby5ob3N0OjQ0Mw..&hl=de&v=V6_85qpc2Xf2sbe3xTnRte7m&size=invisible&cb=apwlz85wm03u
Frame ID: 6AF6D26659478548C3D2691DC9A8B843
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Nеtfliх

Page URL History Show full URLs

https://gmx78477470.lt.emlnk9.com/Prod/link-tracker?a=%7C%7C802077541%7C%7C&account=gmx78477470.activehosted.c... HTTP 302
https://netfilix.sviluppo.host/fx/CA/ Page URL
https://netfilix.sviluppo.host/fx/CA/login.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+data-react

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

14
Requests

100 %
HTTPS

50 %
IPv6

6
Domains

6
Subdomains

5
IPs

3
Countries

694 kB
Transfer

1580 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://gmx78477470.lt.emlnk9.com/Prod/link-tracker?a=%7C%7C802077541%7C%7C&account=gmx78477470.activehosted.com&email=QAro7sQqH5XOxaX5TBS5f0PMsuU7C&iat=1715118612&redirectUrl=aHR0cHMlM0ElMkYlMkZuZXRmaWxpeC5zdmlsdXBwby5ob3N0JTJGZnglMkZDQSUyRg==&sig=D8fiVNcrv8pkJsqZnHeZgNzJQTXvhGMPF1T9mMgPALwr HTTP 302
https://netfilix.sviluppo.host/fx/CA/ Page URL
https://netfilix.sviluppo.host/fx/CA/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://gmx78477470.lt.emlnk9.com/Prod/link-tracker?a=%7C%7C802077541%7C%7C&account=gmx78477470.activehosted.com&email=QAro7sQqH5XOxaX5TBS5f0PMsuU7C&iat=1715118612&redirectUrl=aHR0cHMlM0ElMkYlMkZuZXRmaWxpeC5zdmlsdXBwby5ob3N0JTJGZnglMkZDQSUyRg==&sig=D8fiVNcrv8pkJsqZnHeZgNzJQTXvhGMPF1T9mMgPALwr HTTP 302
https://netfilix.sviluppo.host/fx/CA/

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/ Show response
netfilix.sviluppo.host/fx/CA/
Redirect Chain

https://gmx78477470.lt.emlnk9.com/Prod/link-tracker?a=%7C%7C802077541%7C%7C&account=gmx78477470.activehosted.com&email=QAro7sQqH5XOxaX5TBS5f0PMsuU7C&iat=1715118612&redirectUrl=aHR0cHMlM0ElMkYlMkZuZ...
https://netfilix.sviluppo.host/fx/CA/

1 KB
884 B

212ms
120ms

Document
text/html

149.62.187.89
COLTENGINE COLTEN...

General

Check archive.org

Show headers Download Go to

Full URL: https://netfilix.sviluppo.host/fx/CA/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 149.62.187.89 , Italy, ASN47242 (COLTENGINE COLTENGINE Network, IT),
Reverse DNS: w3008.shared.host.it
Software: nginx / PHP/7.4.33
Resource Hash: 9b9cb8044396768dcce88374504efd2c48992db8fdaea0255ecd2f8ce7153fd0

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
cache-control: no-store, no-cache, must-revalidate
content-encoding: br
content-length: 416
content-type: text/html; charset=UTF-8
date: Wed, 08 May 2024 10:54:39 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: nginx
vary: Accept-Encoding,User-Agent
x-powered-by: PHP/7.4.33

Redirect headers

content-length: 0
content-type: application/json
date: Wed, 08 May 2024 10:54:45 GMT
location: https://netfilix.sviluppo.host/fx/CA/
x-amz-apigw-id: Xcr-cGojIAMEKQA=
x-amzn-requestid: 27221c2f-d180-4aa7-88f1-4f115c1ad7f5
x-amzn-trace-id: Root=1-663b59f5-0ac657962e9b05355cb17660;Parent=3b6b555000320355;Sampled=0;lineage=12ce62b2:0
x-robots-tag: noindex

GET
H2 200 jquery-3.3.1.js Show response
code.jquery.com/ 265 KB
79 KB 83ms
22ms Script
application/javascript 2a04:4e42:400::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.3.1.js
Requested by: Host: netfilix.sviluppo.host
URL: https://netfilix.sviluppo.host/fx/CA/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:400::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: d8aa24ecc6cecb1a60515bc093f1c9da38a0392612d9ab8ae0f7f36e6eee1fad

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://netfilix.sviluppo.host/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 08 May 2024 10:54:46 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 20363483
x-cache: HIT, HIT
content-length: 80268
x-served-by: cache-lga21980-LGA, cache-fra-etou8220082-FRA
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1715165686.128951,VS0,VE0
etag: W/"28feccc0-42587"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 10089, 6572

GET
H3 200 api.js Show response
www.google.com/recaptcha/ 1 KB
855 B 77ms
32ms Script
text/javascript 142.250.74.196
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js

Requested by

Host: netfilix.sviluppo.host
URL: https://netfilix.sviluppo.host/fx/CA/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.196 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f4.1e100.net

Software

GSE /

Resource Hash

b4a87969c4cc52d70e75db24b6bda485dbb1beef9ab5c4074e4020176ea1713b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://netfilix.sviluppo.host/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 08 May 2024 10:54:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Wed, 08 May 2024 10:54:46 GMT

GET
H2 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/ 509 KB
203 KB 72ms
22ms Script
text/javascript 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

352a6d9b12a5ae3949d370ff42a338ba8bb6ff455d9ba995b1755fb7b99e8824

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://netfilix.sviluppo.host/
Origin: https://netfilix.sviluppo.host
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 08 May 2024 10:07:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2864
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 207268
x-xss-protection: 0
last-modified: Mon, 22 Apr 2024 21:03:35 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 08 May 2025 10:07:02 GMT

GET
H3 200 anchor
www.google.com/recaptcha/api2/ Frame 6AF6 0
0 90ms
49ms Document
text/html 142.250.74.196
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LflUtQpAAAAACpT8GjDNPlrzFpELdAOBXGDUj3a&co=aHR0cHM6Ly9uZXRmaWxpeC5zdmlsdXBwby5ob3N0OjQ0Mw..&hl=de&v=V6_85qpc2Xf2sbe3xTnRte7m&size=invisible&cb=apwlz85wm03u

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.196 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f4.1e100.net

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-N81gfk2eLjih1FqujECL_g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://netfilix.sviluppo.host/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-N81gfk2eLjih1FqujECL_g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 08 May 2024 10:54:46 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 404 favicon.ico
netfilix.sviluppo.host/ 1 KB
2 KB 41ms
40ms Other
text/html 149.62.187.89
COLTENGINE COLTEN...

General

Check archive.org

Show headers Download Go to

Full URL: https://netfilix.sviluppo.host/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 149.62.187.89 , Italy, ASN47242 (COLTENGINE COLTENGINE Network, IT),
Reverse DNS: w3008.shared.host.it
Software: nginx /
Resource Hash: 4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://netfilix.sviluppo.host/fx/CA/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Wed, 08 May 2024 10:54:40 GMT
server: nginx
vary: User-Agent
content-type: text/html
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 1251

POST
H3 200 Primary Request login.php Show response
netfilix.sviluppo.host/fx/CA/ 8 KB
3 KB 66ms
66ms Document
text/html 149.62.187.89
COLTENGINE COLTEN...

General

Check archive.org

Show headers Download Go to

Full URL: https://netfilix.sviluppo.host/fx/CA/login.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 149.62.187.89 , Italy, ASN47242 (COLTENGINE COLTENGINE Network, IT),
Reverse DNS: w3008.shared.host.it
Software: LiteSpeed / PHP/7.4.33
Resource Hash: d16033b9a8bacb1f59e82d691f8163fd64bcd4a08f13fce9af87b696c0273269

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Content-Type: application/x-www-form-urlencoded
Origin: https://netfilix.sviluppo.host
Referer: https://netfilix.sviluppo.host/fx/CA/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
cache-control: no-store, no-cache, must-revalidate
content-encoding: br
content-length: 2344
content-type: text/html; charset=UTF-8
date: Wed, 08 May 2024 10:54:42 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: LiteSpeed
vary: Accept-Encoding,User-Agent
x-powered-by: PHP/7.4.33

GET
H3 200 style.css
netfilix.sviluppo.host/fx/CA/assets/ 124 KB
17 KB 31ms
31ms Stylesheet
text/css 149.62.187.89
COLTENGINE COLTEN...

General

Check archive.org

Show headers Download Go to

Full URL: https://netfilix.sviluppo.host/fx/CA/assets/style.css
Requested by: Host: netfilix.sviluppo.host
URL: https://netfilix.sviluppo.host/fx/CA/login.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 149.62.187.89 , Italy, ASN47242 (COLTENGINE COLTENGINE Network, IT),
Reverse DNS: w3008.shared.host.it
Software: LiteSpeed /
Resource Hash: 154e9866c94f43a17d75aed32adc27020f95f614232f8b3cfedd7fc4bf2a48d3

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://netfilix.sviluppo.host/fx/CA/login.php
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 08 May 2024 10:54:42 GMT
content-encoding: br
last-modified: Fri, 07 May 2021 16:34:34 GMT
server: LiteSpeed
etag: "1f043-60956c1a-a8e703a484c1965b;br"
vary: Accept-Encoding,User-Agent
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 17519
expires: Wed, 15 May 2024 10:54:42 GMT

GET
H2 200 jquery-3.3.1.js Show response
code.jquery.com/ 265 KB
0 83ms
22ms Script
application/javascript 2a04:4e42:400::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.3.1.js
Requested by: Host: netfilix.sviluppo.host
URL: https://netfilix.sviluppo.host/fx/CA/login.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:400::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: d8aa24ecc6cecb1a60515bc093f1c9da38a0392612d9ab8ae0f7f36e6eee1fad

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://netfilix.sviluppo.host/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 08 May 2024 10:54:46 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 20363483
x-cache: HIT, HIT
content-length: 80268
x-served-by: cache-lga21980-LGA, cache-fra-etou8220082-FRA
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1715165686.128951,VS0,VE0
etag: W/"28feccc0-42587"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 10089, 6572

GET
H3 200 index.js Show response
netfilix.sviluppo.host/fx/CA/assets/ 2 KB
623 B 37ms
37ms Script
application/javascript 149.62.187.89
COLTENGINE COLTEN...

General

Check archive.org

Show headers Download Go to

Full URL: https://netfilix.sviluppo.host/fx/CA/assets/index.js
Requested by: Host: netfilix.sviluppo.host
URL: https://netfilix.sviluppo.host/fx/CA/login.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 149.62.187.89 , Italy, ASN47242 (COLTENGINE COLTENGINE Network, IT),
Reverse DNS: w3008.shared.host.it
Software: LiteSpeed /
Resource Hash: bd135a106fbe23520bfd0bb67b70beba02b5f2f8a9ba3a8e7c83d7489db4986f

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://netfilix.sviluppo.host/fx/CA/login.php
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 08 May 2024 10:54:42 GMT
content-encoding: br
last-modified: Fri, 07 May 2021 16:34:52 GMT
server: LiteSpeed
etag: "9da-60956c2c-46bef99eac325b5;br"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 550
expires: Wed, 15 May 2024 10:54:42 GMT

GET
H3 200 US-en-20190311-popsignuptwoweeks-perspective_alpha_website_large.jpg
netfilix.sviluppo.host/fx/CA/assets/ 313 KB
313 KB 38ms
38ms Image
image/jpeg 149.62.187.89
COLTENGINE COLTEN...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://netfilix.sviluppo.host/fx/CA/assets/US-en-20190311-popsignuptwoweeks-perspective_alpha_website_large.jpg
Requested by: Host: netfilix.sviluppo.host
URL: https://netfilix.sviluppo.host/fx/CA/login.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 149.62.187.89 , Italy, ASN47242 (COLTENGINE COLTENGINE Network, IT),
Reverse DNS: w3008.shared.host.it
Software: LiteSpeed /
Resource Hash: 73eccdc610db4f6f4fa210b27dc2e1ab70b439bf65525a8364c35b9045ef5d49

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://netfilix.sviluppo.host/fx/CA/login.php
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 08 May 2024 10:54:42 GMT
last-modified: Fri, 07 May 2021 16:33:56 GMT
server: LiteSpeed
etag: "4e2c5-60956bf4-ff72732cc6c29b7d;;;"
vary: User-Agent
content-type: image/jpeg
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 320197
expires: Wed, 15 May 2024 10:54:42 GMT

GET
H3 200 FB-f-Logo__blue_57.png
netfilix.sviluppo.host/fx/CA/assets/ 1 KB
1 KB 37ms
37ms Image
image/png 149.62.187.89
COLTENGINE COLTEN...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://netfilix.sviluppo.host/fx/CA/assets/FB-f-Logo__blue_57.png
Requested by: Host: netfilix.sviluppo.host
URL: https://netfilix.sviluppo.host/fx/CA/login.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 149.62.187.89 , Italy, ASN47242 (COLTENGINE COLTENGINE Network, IT),
Reverse DNS: w3008.shared.host.it
Software: LiteSpeed /
Resource Hash: 3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://netfilix.sviluppo.host/fx/CA/login.php
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 08 May 2024 10:54:42 GMT
last-modified: Fri, 07 May 2021 16:34:54 GMT
server: LiteSpeed
etag: "5af-60956c2e-5940c6326da1c214;;;"
vary: User-Agent
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 1455
expires: Wed, 15 May 2024 10:54:42 GMT

GET
H/1.1 200
OK nf-icon-v1-93.woff
assets.nflxext.com/ffe/siteui/fonts/ 72 KB
72 KB 89ms
22ms Font
font/woff 2a00:86c0:2090::1
NETFLIX-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-93.woff
Requested by: Host: netfilix.sviluppo.host
URL: https://netfilix.sviluppo.host/fx/CA/assets/style.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:86c0:2090::1 , United States, ASN40027 (NETFLIX-ASN, US),
Reverse DNS
Software: nginx /
Resource Hash: 98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://netfilix.sviluppo.host/
Origin: https://netfilix.sviluppo.host
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 08 May 2024 10:54:48 GMT
Last-Modified: Mon, 29 Jan 2018 01:50:51 GMT
Server: nginx
Content-MD5: fPYVbMSBJEtaJUNi17c/AA==
Content-Type: font/woff
Access-Control-Allow-Origin: *
Cache-Control: max-age=604801
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 73572
Expires: Wed, 15 May 2024 10:54:49 GMT

GET
H3 200 nficon2016.ico
netfilix.sviluppo.host/fx/CA/assets/ 17 KB
1 KB 31ms
31ms Other
image/x-icon 149.62.187.89
COLTENGINE COLTEN...

General

Check archive.org

Show headers Download Go to

Full URL: https://netfilix.sviluppo.host/fx/CA/assets/nficon2016.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 149.62.187.89 , Italy, ASN47242 (COLTENGINE COLTENGINE Network, IT),
Reverse DNS: w3008.shared.host.it
Software: LiteSpeed /
Resource Hash: abe8012eb65c0dc0ac3e87dcc1e60e1908ebd8f12b7c47a5df1856f7a7bb1edd

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://netfilix.sviluppo.host/fx/CA/login.php
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 08 May 2024 10:54:42 GMT
content-encoding: br
last-modified: Fri, 07 May 2021 16:34:46 GMT
server: LiteSpeed
etag: "423e-60956c26-ed7582e78d5a5fb4;br"
vary: Accept-Encoding,User-Agent
content-type: image/x-icon
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 1391
expires: Wed, 15 May 2024 10:54:42 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Netflix (Online)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www.google.com/recaptcha	1970-01-21 00:45:17	Name: _GRECAPTCHA Value: 09AKDSkeazDVPlzFB-3e6UyCfgzuYvuF4YILCApjVKQFHk3vjFrevU3s7Hj7SAggwj0bCwjvaq-_OaNKK1k9cNDnY
			netfilix.sviluppo.host/	1969-12-31 23:59:59	Name: PHPSESSID Value: 482345d065a1bfb8159388335abb1cfc

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://netfilix.sviluppo.host/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()
other	warning	URL: https://netfilix.sviluppo.host/fx/CA/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://netfilix.sviluppo.host/fx/CA/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.nflxext.com
code.jquery.com
gmx78477470.lt.emlnk9.com
netfilix.sviluppo.host
www.google.com
www.gstatic.com
142.250.74.196
149.62.187.89
174.129.160.72
2a00:1450:4001:82f::2003
2a00:86c0:2090::1
2a04:4e42:400::649
154e9866c94f43a17d75aed32adc27020f95f614232f8b3cfedd7fc4bf2a48d3
352a6d9b12a5ae3949d370ff42a338ba8bb6ff455d9ba995b1755fb7b99e8824
3e49d9dc43267590184389ab3da0cb9f7308c9c848667dab109a0f7c73450ece
4c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896
73eccdc610db4f6f4fa210b27dc2e1ab70b439bf65525a8364c35b9045ef5d49
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d
9b9cb8044396768dcce88374504efd2c48992db8fdaea0255ecd2f8ce7153fd0
abe8012eb65c0dc0ac3e87dcc1e60e1908ebd8f12b7c47a5df1856f7a7bb1edd
b4a87969c4cc52d70e75db24b6bda485dbb1beef9ab5c4074e4020176ea1713b
bd135a106fbe23520bfd0bb67b70beba02b5f2f8a9ba3a8e7c83d7489db4986f
d16033b9a8bacb1f59e82d691f8163fd64bcd4a08f13fce9af87b696c0273269
d8aa24ecc6cecb1a60515bc093f1c9da38a0392612d9ab8ae0f7f36e6eee1fad

netfilix.sviluppo.host Open in urlscan Pro 149.62.187.89 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

50 %IPv6

6 Domains

6 Subdomains

5 IPs

3 Countries

694 kBTransfer

1580 kBSize

2 Cookies

0 Outgoing links

Page URL History

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

2 JavaScript Global Variables

2 Cookies

3 Console Messages

Indicators

netfilix.sviluppo.host Open in urlscan Pro
149.62.187.89 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

50 %
IPv6

6
Domains

6
Subdomains

5
IPs

3
Countries

694 kB
Transfer

1580 kB
Size

2
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!