{"report_id":"1b82d1a1-d279-4f3a-94dc-9b630140cdb6","version":0,"status":"done","tags":["netflix","phishing"],"date":"2026-09-30T15:44:15Z","url":{"schema":"https","addr":"strab.org/home/","fqdn":"strab.org","domain":"strab.org","tld":"org"},"ip":{"addr":"74.208.236.236","port":0,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"strab.org/home/","fqdn":"strab.org","domain":"strab.org","tld":"org"},"title":"Netflix","dom":{"size":1574776,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (65536), with no line terminators","md5":"21418afbf9a48e36cf91f2c862e406c9","sha1":"f8f28318b05de13752ffe547a6c879efe9913de3","sha256":"5088989ee43ed39bde65529a550768b18c0a9752c22c9b9370282d50f6dc3847","sha512":"92a69609fc972c74ead339646517a651307f94eda0189a7d7b224ede543c689e17cb7cd76873ec0dd464ecc87f12d0eeb37487a31912fe0a9625bbda7cb67a0d","ssdeep":"24576:wMQvHjAdxkfAqd60sOtI0ZE2wFfc9wYJ8Y1YwW4zeiCEN+v:wMuAEmxjFfnT46f8+v","tlshash":"1f75e172a9651ab99a935cecb6dcb4085e206d33dd7c61c4afc9016407dffe2b21638c","dom_hash":"domhashc80adb0f0e693186cce9f83d8fd75339","first_seen":"2026-09-30T15:44:23.543097Z","last_seen":"2026-09-30T15:44:23.543097Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"strab.org/home/","fqdn":"strab.org","domain":"strab.org","tld":"org"},"ip":{"addr":"74.208.236.236","port":0,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"tags":["openphish"],"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-11-04T15:44:15Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-30","alert":"Phishing Block","trigger":"strab.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-30","alert":"Sinkholed","trigger":"strab.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-30","alert":"Sinkholed","trigger":"strab.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Netflix","verdict":"phishing","severity":"medium","comment":"Associated with Netflix phishing","tags":["netflix","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Netflix","verdict":"phishing","severity":"medium","comment":"Associated with Netflix phishing","tags":["netflix","phishing"],"meta":null}]},"summary":[{"fqdn":"strab.org","ip":{"addr":"74.208.236.236","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"domain_registered":"2006-05-02","domain_rank":0,"first_seen":"2026-09-30T15:44:16.501527Z","last_seen":"2026-09-30T15:44:16.501527Z","alert_count":4,"request_count":1,"received_data":1574346,"sent_data":483,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Netflix","verdict":"phishing","severity":"medium","comment":"Associated with Netflix phishing","tags":["netflix","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"strab.org/home/","fqdn":"strab.org","domain":"strab.org","tld":"org"},"ip":{"addr":"74.208.236.236","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"9e93ff0ef576a6b505fa84c06855c5e7","sha1":"93400a7ed9d56d82307a72f70f3073948567c99d","sha256":"8b9aed1e99399c5b3ffd4bf946c896269cac2f4860ff9fb41f6df5861a86963f","sha512":"ad3457fe45c2919fc79eeb186c88738c20da60a7656d0de29c773a09adc20dbca55379605378a256059d641d84065e31441021ce2424f4aafcba532ac6083b6b","ssdeep":"192:O7cmbGy0zd05tqTOvb7eo5VbLQ58pkZny5YqoN7PcS:YGANGcVbLQ586ZyZgES","tlshash":"aad1643b7b10263e5aa129f9aecb40455eb96aa0086580e8c45cc84732f9de4477dffc","size":6699,"data":"","first_seen":"2026-09-30T15:44:23.545479Z","last_seen":"2026-09-30T15:44:23.545479Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"strab.org/home/","fqdn":"strab.org","domain":"strab.org","tld":"org"},"ip":{"addr":"74.208.236.236","port":443,"asn":8560,"as":"IONOS SE","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-30T15:43:41.757Z","timestamp":1790783021757,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.strab.org","organization":""},"issuer":{"commonName":"Sectigo Public Server Authentication CA DV R36","organization":"Sectigo Limited"},"validity":{"start":"Tue, 29 Sep 2026 00:00:00 GMT","end":"Sun, 28 Mar 2027 23:59:59 GMT"},"fingerprint":{"sha1":"D3:B9:E4:D1:D0:BF:7C:FB:FC:AE:1B:E7:BC:DC:99:46:BF:11:3C:FB","sha256":"6D:D2:79:81:5D:11:39:C9:21:B4:AA:21:8B:E1:A7:C7:BE:99:06:09:89:54:09:69:07:07:C9:F9:6F:A8:E5:7C"}}},"request":{"raw":"GET /home/ HTTP/1.1\r\nHost: strab.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/html; charset=UTF-8\r\nx-ws-origin: available\r\nx-ws-ratelimit-limit: 1000\r\nx-ws-ratelimit-remaining: 999\r\ndate: Wed, 30 Sep 2026 15:43:47 GMT\r\nserver: Apache\r\nexpires: Thu, 19 Nov 1981 08:52:00 GMT\r\ncache-control: no-store, no-cache, must-revalidate\r\npragma: no-cache\r\nset-cookie: PHPSESSID=f9cc098826eb62cc59b432736025b649; path=/\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":[{"name":"PHPSESSID","value":"f9cc098826eb62cc59b432736025b649","quoted":false,"path":"/","secure":false,"http_only":false,"same_site":"","partitioned":false,"raw":"PHPSESSID=f9cc098826eb62cc59b432736025b649; path=/"}],"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]},{"name":"PHP","description":"PHP is a general-purpose scripting language used for web development.","website":"https://php.net","common_platform_enumeration":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","icon":"PHP.svg","categories":["Programming languages"]}],"data":{"size":1573937,"size_decoded":1045930,"mime_type":"text/html; charset=UTF-8","magic":"HTML document, ASCII text, with very long lines (65536), with no line terminators","md5":"9ecd57a57b4170f67f5d058dc3376274","sha1":"6ff457cd8724457f47a187b70eb7cb8c43d18516","sha256":"557d3f181ac0d1026cf9b52a6be0245620f8ca239e2e8f73d9bb3ca5f2820e7a","sha512":"71bf0dafec4b6218e83a045148506bfad097c7cf175088abe38245dc07d703448b685c5bd01392ca039d28f027e97ce56e7ab22fdef2b12c904570be2095da82","ssdeep":"24576:bMQvHjAdxkfAqd6gsOtI0ZE2wFfc9wYJ8Y1YwW/:bMuAEGxjFfnT/","tlshash":"6525233a0c557e1f4fd9c718647ba9653d300ee7fc348defe28111e49a9bb40882a796","first_seen":"2026-09-30T15:44:23.544438Z","last_seen":"2026-09-30T15:44:23.544438Z","times_seen":1,"resource_available":true,"data":null}},"time_used":7166,"timings":{"blocked":-1,"dns":151,"connect":113,"send":0,"wait":1121,"receive":0,"ssl":5780},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-30","alert":"Phishing Block","trigger":"strab.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-30","alert":"Sinkholed","trigger":"strab.org","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-30","alert":"Sinkholed","trigger":"strab.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Netflix","verdict":"phishing","severity":"medium","comment":"Associated with Netflix phishing","tags":["netflix","phishing"],"meta":null}]}}]}