Report - srv212043.hoster-test.ru/netflix-it/app/login.php

Report Overview

Submitted URL
srv212043.hoster-test.ru/netflix-it/app/login.php
IP
31.28.24.131
ASN
#12616 Citytelecom LLC
Submitted
2024-04-24 17:37:56
Access
public
Website Title
Netflix
Final URL
srv212043.hoster-test.ru/netflix-it/app/login.php
Tags
netflix phishing
urlquery detections
Phishing - Netflix

Detections

urlquery
17
Network Intrusion Detection
0
Threat Detection Systems
0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
srv212043.hoster-test.ru	unknown	unknown	No data	No data	8.7 kB	448 kB	31.28.24.131
assets.nflxext.com	3871	2011-02-11	2015-07-22	2024-04-24	2.0 kB	279 kB	45.57.90.1

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (2)

	URL	Size	First Seen	Last Seen
	srv212043.hoster-test.ru/netflix-it/app/res/jq.js	294 kB	2023-03-12	2024-05-02
Pretty URL srv212043.hoster-test.ru/netflix-it/app/res/jq.js IP 31.28.24.131 ASN #12616 Citytelecom LLC Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-12 23:28:44 Last Seen2024-05-02 18:57:05 Times Seen464 Hash 1150e561f02aaa2a237a4f200face65d 6afaec62e997d0a42356c71521ef0d157b506757 9d02ee01919145c20b03ee9d3013af7118793dedf5d2c0696a773af90066c953 Loading...

	srv212043.hoster-test.ru/netflix-it/app/login.php	189 B	2023-03-13	2024-04-24
Pretty URL srv212043.hoster-test.ru/netflix-it/app/login.php IP 31.28.24.131 ASN #12616 Citytelecom LLC Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-13 14:57:24 Last Seen2024-04-24 19:38:03 Times Seen21 Hash 6a469f11c4a5081be4f33ce2cfb1d31c 55df182cc2924b98aaef2517ac8f7ba5f62916ce 4116ff509ac7e10472ddf6bf170f7c32ffbdf6a2dc9880e6f9ca039a9e702856 Loading...

HTTP Transactions (20)

URL IP Response Size

srv212043.hoster-test.ru/netflix-it/app/login.php

31.28.24.131

14 kB

URL
srv212043.hoster-test.ru/netflix-it/app/login.php
IP
31.28.24.131:0
ASN
#12616 Citytelecom LLC

File type
HTML document, Unicode text, UTF-8 text, with very long lines (2172), with CRLF line terminators
Size
14 kB (14346 bytes)
Hash
6bde66752f002101a6f56ca683998f95
5f79bb6eb88799797ebc2695c52d3e56e705a901
298542b6d1acdf9b19252ef49976d2ed60cdf8706b69678362a3078c24ba5bcd

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Netflix

HTTP Headers

GET /netflix-it/app/login.php HTTP/1.1
Host: srv212043.hoster-test.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 17:37:30 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/8.1.11
Set-Cookie: PHPSESSID=7r0lq6prr4jlkd3jsv310ss5sl; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Type: text/html; charset=UTF-8
X-Cache: MISS from t0.hoster.ru
X-Cache-Lookup: MISS from t0.hoster.ru:6666
Transfer-Encoding: chunked
Connection: keep-alive

srv212043.hoster-test.ru/personalization/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=css&modalView=login

31.28.24.131

404 Not Found

330 B

URL GET HTTP/1.1
srv212043.hoster-test.ru/personalization/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=css&modalView=login
IP
31.28.24.131:80
ASN
#12616 Citytelecom LLC

Requested by
http://srv212043.hoster-test.ru/netflix-it/app/login.php

File type
HTML document, ASCII text
Size
330 B (330 bytes)
Hash
210f9e3cb03d67ba88d73940a1529768
5024d135e0ff3997798a35b9c3855f347b4ed51f
43068fee4aea4e4198350c5cd54b1556ff3650487a723ee09ba7cf102ea6b2fe

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Netflix

HTTP Headers

GET /personalization/cl2/freeform/WebsiteDetect?source=wwwhead&fetchType=css&modalView=login HTTP/1.1
Host: srv212043.hoster-test.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://srv212043.hoster-test.ru/netflix-it/app/login.php
Cookie: PHPSESSID=7r0lq6prr4jlkd3jsv310ss5sl
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Date: Wed, 24 Apr 2024 17:37:30 GMT
Server: Apache/2.2.15 (CentOS)
Content-Length: 330
Content-Type: text/html; charset=iso-8859-1
X-Cache: MISS from t0.hoster.ru
X-Cache-Lookup: MISS from t0.hoster.ru:6666
Connection: keep-alive

srv212043.hoster-test.ru/netflix-it/app/css/loginBase.6b02118817e957e7abed.css

31.28.24.131

200 OK

44 kB

URL GET HTTP/1.1
srv212043.hoster-test.ru/netflix-it/app/css/loginBase.6b02118817e957e7abed.css
IP
31.28.24.131:80
ASN
#12616 Citytelecom LLC

Requested by
http://srv212043.hoster-test.ru/netflix-it/app/login.php

File type
ASCII text, with very long lines (43116)
Size
44 kB (44531 bytes)
Hash
a35af264c8999b28cd96378398f22369
cfd9bddf858a9d4e296449dca53c1aea5ecce60f
ebdf640c52c18e29163711ed4a20123bb7aaca05f0a9f970f9934c0fe04093ba

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Netflix

HTTP Headers

GET /netflix-it/app/css/loginBase.6b02118817e957e7abed.css HTTP/1.1
Host: srv212043.hoster-test.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://srv212043.hoster-test.ru/netflix-it/app/login.php
Cookie: PHPSESSID=7r0lq6prr4jlkd3jsv310ss5sl
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 17:37:30 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Sun, 21 Apr 2024 14:26:19 GMT
ETag: "ce68c2-adf3-6169c1abcc5b6"
Accept-Ranges: bytes
Content-Length: 44531
Content-Type: text/css
X-Cache: MISS from t0.hoster.ru
X-Cache-Lookup: HIT from t0.hoster.ru:6666
Connection: keep-alive

srv212043.hoster-test.ru/netflix-it/app/css/Login.e1bf4c53a34d8e135356.css

31.28.24.131

200 OK

91 kB

URL GET HTTP/1.1
srv212043.hoster-test.ru/netflix-it/app/css/Login.e1bf4c53a34d8e135356.css
IP
31.28.24.131:80
ASN
#12616 Citytelecom LLC

Requested by
http://srv212043.hoster-test.ru/netflix-it/app/login.php

File type
ASCII text, with very long lines (65536), with no line terminators
Size
91 kB (90657 bytes)
Hash
4891fc672c5d6a07ab93dc7a04d2c4ac
4db6653e0c7abee8937992b317cb876232ad8914
3c58414ee70fa3910656eaa8d1347ac89114c692c71555d23d0e9d2e0559b5a3

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Netflix

HTTP Headers

GET /netflix-it/app/css/Login.e1bf4c53a34d8e135356.css HTTP/1.1
Host: srv212043.hoster-test.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://srv212043.hoster-test.ru/netflix-it/app/login.php
Cookie: PHPSESSID=7r0lq6prr4jlkd3jsv310ss5sl
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 17:37:30 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Sun, 21 Apr 2024 14:26:19 GMT
ETag: "ce68c1-16221-6169c1abcb616"
Accept-Ranges: bytes
Content-Length: 90657
Content-Type: text/css
X-Cache: MISS from t0.hoster.ru
X-Cache-Lookup: HIT from t0.hoster.ru:6666
Connection: keep-alive

srv212043.hoster-test.ru/netflix-it/app/res/jq.js

31.28.24.131

294 kB

URL
srv212043.hoster-test.ru/netflix-it/app/res/jq.js
IP
31.28.24.131:0
ASN
#12616 Citytelecom LLC

File type
JavaScript source, ASCII text
Size
294 kB (293671 bytes)
Hash
1150e561f02aaa2a237a4f200face65d
6afaec62e997d0a42356c71521ef0d157b506757
9d02ee01919145c20b03ee9d3013af7118793dedf5d2c0696a773af90066c953

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Netflix

HTTP Headers

GET /netflix-it/app/res/jq.js HTTP/1.1
Host: srv212043.hoster-test.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://srv212043.hoster-test.ru/netflix-it/app/login.php
Cookie: PHPSESSID=7r0lq6prr4jlkd3jsv310ss5sl
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 17:37:30 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Sun, 21 Apr 2024 14:26:20 GMT
ETag: "ce68d5-47b27-6169c1ac5d216"
Accept-Ranges: bytes
Content-Length: 293671
Content-Type: text/javascript
X-Cache: MISS from t0.hoster.ru
X-Cache-Lookup: HIT from t0.hoster.ru:6666
Connection: keep-alive

assets.nflxext.com/ffe/siteui/vlv3/594f8025-139a-4a35-b58d-4ecf8fdc507c/44774345-3321-4303-8337-18d24bd261f2/IT-it-20240108-popsignuptwoweeks-perspective_alpha_website_medium.jpg

45.57.90.1

200 OK

193 kB

URL GET HTTP/1.1
assets.nflxext.com/ffe/siteui/vlv3/594f8025-139a-4a35-b58d-4ecf8fdc507c/44774345-3321-4303-8337-18d24bd261f2/IT-it-20240108-popsignuptwoweeks-perspective_alpha_website_medium.jpg
IP
45.57.90.1:443
ASN
#40027 NETFLIX-ASN

Requested by
http://srv212043.hoster-test.ru/netflix-it/app/login.php
Certificate
IssuerDigiCert Inc
Subject*.1.nflxso.net
FingerprintA0:32:B8:7B:25:3F:38:95:AB:21:97:D8:F0:71:16:3D:2C:D0:7B:6B
ValidityFri, 05 Apr 2024 00:00:00 GMT - Sun, 05 May 2024 23:43:42 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 2000x1125, components 3
Size
193 kB (192712 bytes)
Hash
2ddcb84902c54e283a2d2c8ba6b679ad
7adf0da693cf2c975389e61be3cea5ac4c0e43ba
8e3e566684fc6ccc2b6755d4a5e79bd6d1abc6420066f3123e96853e4a20e8d9

HTTP Headers

GET /ffe/siteui/vlv3/594f8025-139a-4a35-b58d-4ecf8fdc507c/44774345-3321-4303-8337-18d24bd261f2/IT-it-20240108-popsignuptwoweeks-perspective_alpha_website_medium.jpg HTTP/1.1
Host: assets.nflxext.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://srv212043.hoster-test.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 24 Apr 2024 17:37:30 GMT
Content-Type: image/jpeg
Content-Length: 192712
Connection: keep-alive
Content-MD5: Ldy4SQLFTig6LSyLprZ5rQ==
Last-Modified: Wed, 10 Jan 2024 14:52:17 GMT
Cache-Control: max-age=604801
Expires: Wed, 01 May 2024 17:37:31 GMT
Accept-Ranges: bytes

assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-93.woff

45.57.90.1

200 OK

74 kB

URL GET HTTP/1.1
assets.nflxext.com/ffe/siteui/fonts/nf-icon-v1-93.woff
IP
45.57.90.1:443
ASN
#40027 NETFLIX-ASN

Requested by
http://srv212043.hoster-test.ru/netflix-it/app/login.php
Certificate
IssuerDigiCert Inc
Subject*.1.nflxso.net
FingerprintF2:C1:BA:EF:55:99:AC:C4:16:49:85:D4:FE:02:84:EA:40:3D:58:C6
ValidityTue, 02 Apr 2024 00:00:00 GMT - Sat, 04 May 2024 23:53:25 GMT

File type
Web Open Font Format, CFF, length 73572, version 0.0
Size
74 kB (73572 bytes)
Hash
7cf6156cc481244b5a254362d7b73f00
4391003d1cb06d2bd1921a5813a57604fa7d9935
98713b53a74ebe7e326353080c5f1653e83af61d6363c0b3c4c67d6d24197b4d

HTTP Headers

GET /ffe/siteui/fonts/nf-icon-v1-93.woff HTTP/1.1
Host: assets.nflxext.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://srv212043.hoster-test.ru
DNT: 1
Connection: keep-alive
Referer: http://srv212043.hoster-test.ru/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 24 Apr 2024 17:37:30 GMT
Content-Type: font/woff
Content-Length: 73572
Connection: keep-alive
Content-MD5: fPYVbMSBJEtaJUNi17c/AA==
Last-Modified: Mon, 29 Jan 2018 01:50:51 GMT
Cache-Control: max-age=604801
Expires: Wed, 01 May 2024 17:37:31 GMT
Access-Control-Allow-Origin: *
Accept-Ranges: bytes

assets.nflxext.com/us/ffe/siteui/common/icons/nficon2016.png

45.57.90.1

1.8 kB

URL
assets.nflxext.com/us/ffe/siteui/common/icons/nficon2016.png
IP
45.57.90.1:0
ASN
#40027 NETFLIX-ASN

Certificate
IssuerDigiCert Inc
Subject*.1.nflxso.net
FingerprintA0:32:B8:7B:25:3F:38:95:AB:21:97:D8:F0:71:16:3D:2C:D0:7B:6B
ValidityFri, 05 Apr 2024 00:00:00 GMT - Sun, 05 May 2024 23:43:42 GMT

File type
PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Size
1.8 kB (1755 bytes)
Hash
3d194514babc5d7d010308a0f808ca51
867e51e9b4a474c19da52d6454076c007a9d01f2
7341f7b8b0ae3c0da4aea559efc31f0b53d9db9dd291664fdcf7d618fd95ed8a

HTTP Headers

GET /us/ffe/siteui/common/icons/nficon2016.png HTTP/1.1
Host: assets.nflxext.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://srv212043.hoster-test.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 24 Apr 2024 17:37:31 GMT
Content-Type: image/png
Content-Length: 1755
Connection: keep-alive
Content-MD5: PRlFFLq8XX0BAwig+AjKUQ==
Last-Modified: Tue, 21 Jun 2016 22:29:33 GMT
Cache-Control: max-age=604801
Expires: Wed, 01 May 2024 17:37:32 GMT
Accept-Ranges: bytes

assets.nflxext.com/us/ffe/siteui/common/icons/nficon2023.ico

45.57.90.1

9.9 kB

URL
assets.nflxext.com/us/ffe/siteui/common/icons/nficon2023.ico
IP
45.57.90.1:0
ASN
#40027 NETFLIX-ASN

Certificate
IssuerDigiCert Inc
Subject*.1.nflxso.net
FingerprintA0:32:B8:7B:25:3F:38:95:AB:21:97:D8:F0:71:16:3D:2C:D0:7B:6B
ValidityFri, 05 Apr 2024 00:00:00 GMT - Sun, 05 May 2024 23:43:42 GMT

File type
MS Windows icon resource - 1 icon, 48x48, 32 bits/pixel
Size
9.9 kB (9854 bytes)
Hash
58f54d9ea15176671802bebeee4da4cb
4ba1cb97814772435962f3ac25af0def81851735
9c5f7722c5df8eb24dda20ecc01c9f73e3103e10052fd980da4e7d9f753a97d3

HTTP Headers

GET /us/ffe/siteui/common/icons/nficon2023.ico HTTP/1.1
Host: assets.nflxext.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://srv212043.hoster-test.ru/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Wed, 24 Apr 2024 17:37:31 GMT
Content-Type: image/x-icon
Content-Length: 9854
Connection: keep-alive
Content-MD5: WPVNnqFRdmcYAr6+7k2kyw==
Last-Modified: Thu, 31 Aug 2023 18:57:29 GMT
Cache-Control: max-age=604801
Expires: Wed, 01 May 2024 17:37:32 GMT
Accept-Ranges: bytes

srv212043.hoster-test.ru/netflix-it/panel/fetch.php

31.28.24.131

200 OK

1 B

URL POST HTTP/1.1
srv212043.hoster-test.ru/netflix-it/panel/fetch.php
IP
31.28.24.131:80
ASN
#12616 Citytelecom LLC

Requested by
http://srv212043.hoster-test.ru/netflix-it/app/login.php

File type
very short file (no magic)
Size
1 B (1 bytes)
Hash
cfcd208495d565ef66e7dff9f98764da
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Netflix

HTTP Headers

POST /netflix-it/panel/fetch.php HTTP/1.1
Host: srv212043.hoster-test.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 8
Origin: http://srv212043.hoster-test.ru
DNT: 1
Connection: keep-alive
Referer: http://srv212043.hoster-test.ru/netflix-it/app/login.php
Cookie: PHPSESSID=7r0lq6prr4jlkd3jsv310ss5sl
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 17:37:32 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/8.1.11
Content-Type: text/html; charset=UTF-8
X-Cache: MISS from t0.hoster.ru
X-Cache-Lookup: MISS from t0.hoster.ru:6666
Transfer-Encoding: chunked
Connection: keep-alive

srv212043.hoster-test.ru/netflix-it/panel/fetch.php

31.28.24.131

200 OK

1 B

URL POST HTTP/1.1
srv212043.hoster-test.ru/netflix-it/panel/fetch.php
IP
31.28.24.131:80
ASN
#12616 Citytelecom LLC

Requested by
http://srv212043.hoster-test.ru/netflix-it/app/login.php

File type
very short file (no magic)
Size
1 B (1 bytes)
Hash
cfcd208495d565ef66e7dff9f98764da
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Netflix

HTTP Headers

POST /netflix-it/panel/fetch.php HTTP/1.1
Host: srv212043.hoster-test.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 8
Origin: http://srv212043.hoster-test.ru
DNT: 1
Connection: keep-alive
Referer: http://srv212043.hoster-test.ru/netflix-it/app/login.php
Cookie: PHPSESSID=7r0lq6prr4jlkd3jsv310ss5sl
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 17:37:34 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/8.1.11
Content-Type: text/html; charset=UTF-8
X-Cache: MISS from t0.hoster.ru
X-Cache-Lookup: MISS from t0.hoster.ru:6666
Transfer-Encoding: chunked
Connection: keep-alive

srv212043.hoster-test.ru/netflix-it/panel/fetch.php

31.28.24.131

200 OK

1 B

URL POST HTTP/1.1
srv212043.hoster-test.ru/netflix-it/panel/fetch.php
IP
31.28.24.131:80
ASN
#12616 Citytelecom LLC

Requested by
http://srv212043.hoster-test.ru/netflix-it/app/login.php

File type
very short file (no magic)
Size
1 B (1 bytes)
Hash
cfcd208495d565ef66e7dff9f98764da
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Netflix

HTTP Headers

POST /netflix-it/panel/fetch.php HTTP/1.1
Host: srv212043.hoster-test.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 8
Origin: http://srv212043.hoster-test.ru
DNT: 1
Connection: keep-alive
Referer: http://srv212043.hoster-test.ru/netflix-it/app/login.php
Cookie: PHPSESSID=7r0lq6prr4jlkd3jsv310ss5sl
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 17:37:36 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/8.1.11
Content-Type: text/html; charset=UTF-8
X-Cache: MISS from t0.hoster.ru
X-Cache-Lookup: MISS from t0.hoster.ru:6666
Transfer-Encoding: chunked
Connection: keep-alive

srv212043.hoster-test.ru/netflix-it/panel/fetch.php

31.28.24.131

200 OK

1 B

URL POST HTTP/1.1
srv212043.hoster-test.ru/netflix-it/panel/fetch.php
IP
31.28.24.131:80
ASN
#12616 Citytelecom LLC

Requested by
http://srv212043.hoster-test.ru/netflix-it/app/login.php

File type
very short file (no magic)
Size
1 B (1 bytes)
Hash
cfcd208495d565ef66e7dff9f98764da
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Netflix

HTTP Headers

POST /netflix-it/panel/fetch.php HTTP/1.1
Host: srv212043.hoster-test.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 8
Origin: http://srv212043.hoster-test.ru
DNT: 1
Connection: keep-alive
Referer: http://srv212043.hoster-test.ru/netflix-it/app/login.php
Cookie: PHPSESSID=7r0lq6prr4jlkd3jsv310ss5sl
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 17:37:38 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/8.1.11
Content-Type: text/html; charset=UTF-8
X-Cache: MISS from t0.hoster.ru
X-Cache-Lookup: MISS from t0.hoster.ru:6666
Transfer-Encoding: chunked
Connection: keep-alive

srv212043.hoster-test.ru/netflix-it/panel/fetch.php

31.28.24.131

200 OK

1 B

URL POST HTTP/1.1
srv212043.hoster-test.ru/netflix-it/panel/fetch.php
IP
31.28.24.131:80
ASN
#12616 Citytelecom LLC

Requested by
http://srv212043.hoster-test.ru/netflix-it/app/login.php

File type
very short file (no magic)
Size
1 B (1 bytes)
Hash
cfcd208495d565ef66e7dff9f98764da
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Netflix

HTTP Headers

POST /netflix-it/panel/fetch.php HTTP/1.1
Host: srv212043.hoster-test.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 8
Origin: http://srv212043.hoster-test.ru
DNT: 1
Connection: keep-alive
Referer: http://srv212043.hoster-test.ru/netflix-it/app/login.php
Cookie: PHPSESSID=7r0lq6prr4jlkd3jsv310ss5sl
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 17:37:40 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/8.1.11
Content-Type: text/html; charset=UTF-8
X-Cache: MISS from t0.hoster.ru
X-Cache-Lookup: MISS from t0.hoster.ru:6666
Transfer-Encoding: chunked
Connection: keep-alive

srv212043.hoster-test.ru/netflix-it/panel/fetch.php

31.28.24.131

200 OK

1 B

URL POST HTTP/1.1
srv212043.hoster-test.ru/netflix-it/panel/fetch.php
IP
31.28.24.131:80
ASN
#12616 Citytelecom LLC

Requested by
http://srv212043.hoster-test.ru/netflix-it/app/login.php

File type
very short file (no magic)
Size
1 B (1 bytes)
Hash
cfcd208495d565ef66e7dff9f98764da
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Netflix

HTTP Headers

POST /netflix-it/panel/fetch.php HTTP/1.1
Host: srv212043.hoster-test.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 8
Origin: http://srv212043.hoster-test.ru
DNT: 1
Connection: keep-alive
Referer: http://srv212043.hoster-test.ru/netflix-it/app/login.php
Cookie: PHPSESSID=7r0lq6prr4jlkd3jsv310ss5sl
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 17:37:42 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/8.1.11
Content-Type: text/html; charset=UTF-8
X-Cache: MISS from t0.hoster.ru
X-Cache-Lookup: MISS from t0.hoster.ru:6666
Transfer-Encoding: chunked
Connection: keep-alive

srv212043.hoster-test.ru/netflix-it/panel/fetch.php

31.28.24.131

200 OK

1 B

URL POST HTTP/1.1
srv212043.hoster-test.ru/netflix-it/panel/fetch.php
IP
31.28.24.131:80
ASN
#12616 Citytelecom LLC

Requested by
http://srv212043.hoster-test.ru/netflix-it/app/login.php

File type
very short file (no magic)
Size
1 B (1 bytes)
Hash
cfcd208495d565ef66e7dff9f98764da
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Netflix

HTTP Headers

POST /netflix-it/panel/fetch.php HTTP/1.1
Host: srv212043.hoster-test.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 8
Origin: http://srv212043.hoster-test.ru
DNT: 1
Connection: keep-alive
Referer: http://srv212043.hoster-test.ru/netflix-it/app/login.php
Cookie: PHPSESSID=7r0lq6prr4jlkd3jsv310ss5sl
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 17:37:44 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/8.1.11
Content-Type: text/html; charset=UTF-8
X-Cache: MISS from t0.hoster.ru
X-Cache-Lookup: MISS from t0.hoster.ru:6666
Transfer-Encoding: chunked
Connection: keep-alive

srv212043.hoster-test.ru/netflix-it/panel/fetch.php

31.28.24.131

200 OK

1 B

URL POST HTTP/1.1
srv212043.hoster-test.ru/netflix-it/panel/fetch.php
IP
31.28.24.131:80
ASN
#12616 Citytelecom LLC

Requested by
http://srv212043.hoster-test.ru/netflix-it/app/login.php

File type
very short file (no magic)
Size
1 B (1 bytes)
Hash
cfcd208495d565ef66e7dff9f98764da
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Netflix

HTTP Headers

POST /netflix-it/panel/fetch.php HTTP/1.1
Host: srv212043.hoster-test.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 8
Origin: http://srv212043.hoster-test.ru
DNT: 1
Connection: keep-alive
Referer: http://srv212043.hoster-test.ru/netflix-it/app/login.php
Cookie: PHPSESSID=7r0lq6prr4jlkd3jsv310ss5sl
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 17:37:46 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/8.1.11
Content-Type: text/html; charset=UTF-8
X-Cache: MISS from t0.hoster.ru
X-Cache-Lookup: MISS from t0.hoster.ru:6666
Transfer-Encoding: chunked
Connection: keep-alive

srv212043.hoster-test.ru/netflix-it/panel/fetch.php

31.28.24.131

200 OK

1 B

URL POST HTTP/1.1
srv212043.hoster-test.ru/netflix-it/panel/fetch.php
IP
31.28.24.131:80
ASN
#12616 Citytelecom LLC

Requested by
http://srv212043.hoster-test.ru/netflix-it/app/login.php

File type
very short file (no magic)
Size
1 B (1 bytes)
Hash
cfcd208495d565ef66e7dff9f98764da
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Netflix

HTTP Headers

POST /netflix-it/panel/fetch.php HTTP/1.1
Host: srv212043.hoster-test.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 8
Origin: http://srv212043.hoster-test.ru
DNT: 1
Connection: keep-alive
Referer: http://srv212043.hoster-test.ru/netflix-it/app/login.php
Cookie: PHPSESSID=7r0lq6prr4jlkd3jsv310ss5sl
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 17:37:48 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/8.1.11
Content-Type: text/html; charset=UTF-8
X-Cache: MISS from t0.hoster.ru
X-Cache-Lookup: MISS from t0.hoster.ru:6666
Transfer-Encoding: chunked
Connection: keep-alive

srv212043.hoster-test.ru/netflix-it/panel/fetch.php

31.28.24.131

200 OK

1 B

URL POST HTTP/1.1
srv212043.hoster-test.ru/netflix-it/panel/fetch.php
IP
31.28.24.131:80
ASN
#12616 Citytelecom LLC

Requested by
http://srv212043.hoster-test.ru/netflix-it/app/login.php

File type
very short file (no magic)
Size
1 B (1 bytes)
Hash
cfcd208495d565ef66e7dff9f98764da
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Netflix

HTTP Headers

POST /netflix-it/panel/fetch.php HTTP/1.1
Host: srv212043.hoster-test.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 8
Origin: http://srv212043.hoster-test.ru
DNT: 1
Connection: keep-alive
Referer: http://srv212043.hoster-test.ru/netflix-it/app/login.php
Cookie: PHPSESSID=7r0lq6prr4jlkd3jsv310ss5sl
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 17:37:50 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/8.1.11
Content-Type: text/html; charset=UTF-8
X-Cache: MISS from t0.hoster.ru
X-Cache-Lookup: MISS from t0.hoster.ru:6666
Transfer-Encoding: chunked
Connection: keep-alive

srv212043.hoster-test.ru/netflix-it/panel/fetch.php

31.28.24.131

200 OK

1 B

URL POST HTTP/1.1
srv212043.hoster-test.ru/netflix-it/panel/fetch.php
IP
31.28.24.131:80
ASN
#12616 Citytelecom LLC

Requested by
http://srv212043.hoster-test.ru/netflix-it/app/login.php

File type
very short file (no magic)
Size
1 B (1 bytes)
Hash
cfcd208495d565ef66e7dff9f98764da
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Netflix

HTTP Headers

POST /netflix-it/panel/fetch.php HTTP/1.1
Host: srv212043.hoster-test.ru
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 8
Origin: http://srv212043.hoster-test.ru
DNT: 1
Connection: keep-alive
Referer: http://srv212043.hoster-test.ru/netflix-it/app/login.php
Cookie: PHPSESSID=7r0lq6prr4jlkd3jsv310ss5sl
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 24 Apr 2024 17:37:52 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/8.1.11
Content-Type: text/html; charset=UTF-8
X-Cache: MISS from t0.hoster.ru
X-Cache-Lookup: MISS from t0.hoster.ru:6666
Transfer-Encoding: chunked
Connection: keep-alive

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (2)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (20)

URL

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers

URL GET HTTP/1.1

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

File type