{"report_id":"29b64c77-fc5a-47f2-ac3d-32c0923b219e","version":0,"status":"done","tags":["netflix","phishing"],"date":"2026-07-20T12:55:09Z","url":{"schema":"http","addr":"netflixpaymentportal.org","fqdn":"netflixpaymentportal.org","domain":"netflixpaymentportal.org","tld":"org"},"ip":{"addr":"34.214.61.222","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"netflixpaymentportal.org/","fqdn":"netflixpaymentportal.org","domain":"netflixpaymentportal.org","tld":"org"},"title":"Netflix","dom":{"size":26204,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (16622)","md5":"f2424cec64e7d6410a0937326ffdfb7d","sha1":"fc6c5f127550cd36d479cef250c85baba5dfe720","sha256":"d07ea88cc7969487e5d063f7e01e8198fd9f3d76dbc3f494e6b839c579943905","sha512":"ad6c4cc7f722502876540c15ac1eacf6090d8fa7bf21cf7bbaae6858f0e2634f8e1f4d38dba3a8400ed818a5d790d8aa008470b58c90fb4d83e81c41ce1c548f","ssdeep":"384:WWOD05SrGKKJgg8T4xksc64Jysq7v5TnLqqgwRA:AtrGq4xksc64Jysq7v5TnmqgwRA","tlshash":"d6c2c452b10c527c293f9a45eac5772d8124f482df639925b10d049ae9c3ffb34b6be8","dom_hash":"domhashbfd7a1979095b79a11281435695f7e1b","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"netflixpaymentportal.org","fqdn":"netflixpaymentportal.org","domain":"netflixpaymentportal.org","tld":"org"},"ip":{"addr":"34.214.61.222","port":0,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-24T12:55:09Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"netflixpaymentportal.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-20","alert":"Phishing Block","trigger":"netflixpaymentportal.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"netflixpaymentportal.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"netflixpaymentportal.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Netflix","verdict":"phishing","severity":"medium","comment":"Associated with Netflix phishing","tags":["netflix","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Netflix","verdict":"phishing","severity":"medium","comment":"Associated with Netflix phishing","tags":["netflix","phishing"],"meta":null}]},"summary":[{"fqdn":"zite.com","ip":{"addr":"216.150.1.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2002-05-23","domain_rank":1458846,"first_seen":"2025-04-02T02:52:48.511855Z","last_seen":"2026-07-13T23:56:42.411341Z","alert_count":0,"request_count":1,"received_data":310,"sent_data":477,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}]},{"fqdn":"netflixpaymentportal.org","ip":{"addr":"34.214.61.222","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"unknown","domain_rank":0,"first_seen":"No data","last_seen":"No data","alert_count":15,"request_count":3,"received_data":493452,"sent_data":1431,"comment":"","tags":null,"fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"images.fillout.com","ip":{"addr":"104.26.0.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"domain_registered":"2001-05-31","domain_rank":1890711,"first_seen":"2024-05-26T02:27:41Z","last_seen":"2026-07-16T14:36:54.515941Z","alert_count":0,"request_count":2,"received_data":18249,"sent_data":1260,"comment":"","tags":null,"fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}]},{"fqdn":"www.zite.com","ip":{"addr":"216.150.16.193","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"domain_registered":"2002-05-23","domain_rank":0,"first_seen":"2025-12-21T17:21:28.021341Z","last_seen":"2026-07-19T04:13:05.273571Z","alert_count":0,"request_count":1,"received_data":219924,"sent_data":449,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Render","description":"Render is a cloud computing platform that provides a wide range of services, including web hosting, cloud computing, and application development. Render offers several hosting options, including static site hosting, web application hosting, and managed databases.","website":"https://render.com","common_platform_enumeration":"","icon":"Render.svg","categories":["PaaS"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}]},{"fqdn":"workflows.fillout.com","ip":{"addr":"216.24.57.8","port":443,"asn":397273,"as":"RENDER","country":"United States","country_code":"US"},"domain_registered":"2001-05-31","domain_rank":0,"first_seen":"2026-02-28T08:30:29.563675Z","last_seen":"2026-07-16T14:36:54.511873Z","alert_count":0,"request_count":1,"received_data":1252,"sent_data":579,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Render","description":"Render is a cloud computing platform that provides a wide range of services, including web hosting, cloud computing, and application development. Render offers several hosting options, including static site hosting, web application hosting, and managed databases.","website":"https://render.com","common_platform_enumeration":"","icon":"Render.svg","categories":["PaaS"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Netflix","verdict":"phishing","severity":"medium","comment":"Associated with Netflix phishing","tags":["netflix","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"zite.com/app-runtime.js","fqdn":"zite.com","domain":"zite.com","tld":"com"},"ip":{"addr":"216.150.1.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"833f88ea4290c20376aeacfaa3c507da","sha1":"3f4a0b9972992a1be8217a9af7110360e70f88b1","sha256":"2a5f807669121ab31dc6cb2ee5755442e51679c809fe1e266d7119ce766a36c5","sha512":"826fbcf803462d7a02f32a458da5859da0658cb825fd8c9059d7a1db4d916b19fcfb80be8e66a056e5033418d2a4b7b35c5887aa8895098465991c99057ebc06","ssdeep":"3072:GkPTeg9MPX1NDXYXuEX+tdPSAx8MYP6adPDWdmVJIYV+/Ik2LXn88JDyfjQd8dFb:/kDqMHtKDP6aRa4VJIYWIk2LXn8ezib","tlshash":"be243ab53375343743de11eaa0ba5204f278482a940a845cf26cd8ae3f79d5a61f7f78","size":218434,"data":"","first_seen":"2026-06-13T21:07:44.695572Z","last_seen":"2026-07-20T12:55:26.572828Z","times_seen":8,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"netflixpaymentportal.org/","fqdn":"netflixpaymentportal.org","domain":"netflixpaymentportal.org","tld":"org"},"ip":{"addr":"34.214.61.222","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"165bdb193a754bbe01b6999aae9acaa4","sha1":"c468b93e89413673ea771bc9183ece1f53307a6a","sha256":"79720b78769565ff4fb53255a5df77308549085c2c427939d51e8fb9ef2fa949","sha512":"1d30a8f70688438229a61aa066acf2ba2ed1703c38556e78518bd1db4fc62fb78f77b1248d9983167786907dbeb78a3fe895e04498566265170ef5e26e046c1d","ssdeep":"","tlshash":"bc8004750040443504d0070041571f11531c0c55414314405044410534410031075545","size":30,"data":"","first_seen":"2025-10-01T10:08:39.111289Z","last_seen":"2026-07-20T12:55:26.581164Z","times_seen":18,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"netflixpaymentportal.org/","fqdn":"netflixpaymentportal.org","domain":"netflixpaymentportal.org","tld":"org"},"ip":{"addr":"34.214.61.222","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"c7e8f968b8c7fc7830a6ee16312bde06","sha1":"7493c678a0dfcf35def0e4399bd303c1189d2c38","sha256":"66bd9b24495fa8435ba9274fe59500df288bd4b2c7fc3e544fcf89a5b4155b05","sha512":"c5ee14c022dd58e6e7061653610374481359b57aba9de31c402d98b45309c741ec833a726d432c32bf6ca6c3556315a8237bdb093ce8fe66971b28cbef418e4a","ssdeep":"","tlshash":"c3b01273078168a05e5f9a8c549eaa47e5175cdbd56164b110cc540d21efce2114a6d9","size":109,"data":"","first_seen":"2026-07-20T12:55:14.688742Z","last_seen":"2026-07-20T12:55:26.582154Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"netflixpaymentportal.org/assets/index-CKt25DD6.js","fqdn":"netflixpaymentportal.org","domain":"netflixpaymentportal.org","tld":"org"},"ip":{"addr":"34.214.61.222","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":false,"md5":"98e47e696fb2c718eec6a1a4cfd16209","sha1":"5ee5c5b2e2353e6526156f8311a947c7a86a002f","sha256":"b594291779bb53cbdd498aa7248a5b30f385ba1ac61967755c34de379ea4d395","sha512":"bb835a2065f6f3fe948615bf2449d52b287f9b041a07f091bdf38420d0f3a1cac4a6bbb4b578a05a1d95ef1fb5e401569cdf0827cccb0283b9bffc9ff6dd5a1e","ssdeep":"6144:JwOxYQba1UFKT85qDP69XQdaPUSWliutSetiRDCpO7Ifke2qTkd:Dk1oDoiFQkPal/TiRDC1E","tlshash":"71947cc8b0a6656997e745e1907f120372393902b40ec468b12decea7bb510e71b7fbd","size":430822,"data":"","first_seen":"2026-07-20T12:55:14.672653Z","last_seen":"2026-07-20T12:55:26.577701Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"zite.com/app-runtime.js","fqdn":"zite.com","domain":"zite.com","tld":"com"},"ip":{"addr":"216.150.1.1","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://netflixpaymentportal.org/","date":"2026-07-20T12:54:42.154Z","timestamp":1784552082154,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"zite.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Thu, 18 Jun 2026 08:03:07 GMT","end":"Wed, 16 Sep 2026 08:03:06 GMT"},"fingerprint":{"sha1":"8F:AB:C7:7F:E7:E0:2B:6A:90:86:2C:67:7E:9E:77:2E:21:47:DA:A0","sha256":"D8:31:69:14:C1:07:4B:48:B6:B6:9B:74:6A:C6:38:B5:F6:6A:35:04:E9:7F:21:7C:44:31:99:43:24:97:A8:F7"}}},"request":{"raw":"GET /app-runtime.js HTTP/1.1\r\nHost: zite.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://netflixpaymentportal.org/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 307 \r\ncache-control: public, max-age=0, must-revalidate\r\ncontent-type: text/plain\r\ndate: Mon, 20 Jul 2026 12:54:42 GMT\r\nlocation: https://www.zite.com/app-runtime.js\r\nserver: Vercel\r\nstrict-transport-security: max-age=63072000\r\nx-vercel-id: arn1::vn967-1784552082188-b998e9105ba8\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"307","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":0,"size_decoded":0,"mime_type":"application/javascript; charset=UTF-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-21T23:24:28.748346Z","times_seen":17434361,"resource_available":true,"data":null}},"time_used":56,"timings":{"blocked":-1,"dns":4,"connect":1,"send":0,"wait":23,"receive":0,"ssl":28},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"netflixpaymentportal.org/assets/index-CKt25DD6.js","fqdn":"netflixpaymentportal.org","domain":"netflixpaymentportal.org","tld":"org"},"ip":{"addr":"34.214.61.222","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://netflixpaymentportal.org/","date":"2026-07-20T12:54:42.156Z","timestamp":1784552082156,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"netflixpaymentportal.org","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 18:06:51 GMT","end":"Sat, 17 Oct 2026 18:06:50 GMT"},"fingerprint":{"sha1":"A9:48:9D:28:B9:E2:34:B8:11:FE:48:7E:4B:CA:D2:B9:A6:E0:20:44","sha256":"AC:55:65:4B:62:C1:37:C3:CA:A5:99:2A:E8:D4:B7:56:9E:1A:19:3C:D2:41:0F:D6:DE:CF:33:7A:61:12:7D:EE"}}},"request":{"raw":"GET /assets/index-CKt25DD6.js HTTP/1.1\r\nHost: netflixpaymentportal.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://netflixpaymentportal.org/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=0, must-revalidate\r\ncf-cache-status: HIT\r\ncf-ray: a1e21db1fc1c884d-PDX\r\ncontent-encoding: br\r\ncontent-type: application/javascript\r\ndate: Mon, 20 Jul 2026 12:54:42 GMT\r\netag: W/\"b594291779bb53cbdd498aa7248a5b30\"\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=SvrZOUq6g9jAFfQyhszChwBVsysLKTJTaiWGE9rVZiTUPI0%2BvttzS9Cktm4BU5FBfZom%2FxRaeqxDw0ns8rvW2QND4Kg1COzUrA6ZnmK32xM97e%2BhcgG%2BkcZVJ87f\"}]}\r\nserver: cloudflare\r\nvia: 2.0 Caddy\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":430822,"size_decoded":133481,"mime_type":"application/javascript","magic":"JavaScript source, ASCII text, with very long lines (37621)","md5":"98e47e696fb2c718eec6a1a4cfd16209","sha1":"5ee5c5b2e2353e6526156f8311a947c7a86a002f","sha256":"b594291779bb53cbdd498aa7248a5b30f385ba1ac61967755c34de379ea4d395","sha512":"bb835a2065f6f3fe948615bf2449d52b287f9b041a07f091bdf38420d0f3a1cac4a6bbb4b578a05a1d95ef1fb5e401569cdf0827cccb0283b9bffc9ff6dd5a1e","ssdeep":"6144:JwOxYQba1UFKT85qDP69XQdaPUSWliutSetiRDCpO7Ifke2qTkd:Dk1oDoiFQkPal/TiRDC1E","tlshash":"71947cc8b0a6656997e745e1907f120372393902b40ec468b12decea7bb510e71b7fbd","first_seen":"2026-07-20T12:55:14.672653Z","last_seen":"2026-07-20T12:55:26.577701Z","times_seen":2,"resource_available":true,"data":null}},"time_used":362,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":362,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"netflixpaymentportal.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-20","alert":"Phishing Block","trigger":"netflixpaymentportal.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"netflixpaymentportal.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"netflixpaymentportal.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Netflix","verdict":"phishing","severity":"medium","comment":"Associated with Netflix phishing","tags":["netflix","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"images.fillout.com/orgid-775054/flowpublicid-ovzy8n4gjw/pwa/72da30a0b956c78d/apple-touch-icon.png","fqdn":"images.fillout.com","domain":"fillout.com","tld":"com"},"ip":{"addr":"104.26.0.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://netflixpaymentportal.org/","date":"2026-07-20T12:54:42.942Z","timestamp":1784552082942,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.fillout.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 08 Jun 2026 03:29:35 GMT","end":"Sun, 06 Sep 2026 03:29:34 GMT"},"fingerprint":{"sha1":"EE:A7:23:71:45:0B:BC:C6:41:19:3E:80:17:9F:EE:BB:D8:A0:94:BE","sha256":"B3:F2:05:4A:D0:FE:9B:02:10:72:D4:1E:70:47:D5:C8:3F:C1:F7:4E:D4:76:71:E0:F8:31:55:7F:3B:06:72:A3"}}},"request":{"raw":"GET /orgid-775054/flowpublicid-ovzy8n4gjw/pwa/72da30a0b956c78d/apple-touch-icon.png HTTP/1.1\r\nHost: images.fillout.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://netflixpaymentportal.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Mon, 20 Jul 2026 12:54:46 GMT\r\ncontent-type: image/png\r\ncontent-length: 5924\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Sun, 19 Jul 2026 18:54:28 GMT\r\netag: \"31821c5335b277939ff8f0f3991d9b60\"\r\nx-amz-server-side-encryption: AES256\r\ncache-control: public, max-age=31536000, immutable\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 04c4f064943f75498361739eb063cb7a.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: OSL50-P1\r\nx-amz-cf-id: xvehb0yB_EXp0QRZGwa4-Eaz_JIQBFAecl-uC4mGfQmEnjV6daYVXg==\r\nage: 64147\r\nvary: Origin\r\ncf-cache-status: MISS\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=WWmec9RgwYjen3m%2BO6FXuoSriW8UOcChGkwVqSrHcL4JtnZ%2BnsRlOJbCi18SMzNNEtZxTZXWQvQXTfqDjVFCH9T00AVGWBZNazx234Gl4FRCzfvKTYSrArvTwzGKZ7GcdhTyJg%3D%3D\"}]}\r\ncf-ray: a1e21dcb1cfa120a-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":5924,"size_decoded":6865,"mime_type":"image/png","magic":"PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced","md5":"31821c5335b277939ff8f0f3991d9b60","sha1":"295bf6968dbade4834443bdc26c001084c89f8c2","sha256":"147d27f5119d3b4dddb24c1e8dc31c26c0b9ac1da257160528fbfced1375642c","sha512":"32509119c8421f19d4c8007feb588cae9b6da26a88999ad0a6f8bf32e7eb1a1c2a42faf4121dd1e35962a41cc6197a1e70ca1ebd0c0f6df4d4491b630cefc9e6","ssdeep":"96:SX0PuZ6q97SJGpOgk4PJQMrzjarIvnAKPGPSIDjos7KRkZAE+D2kAvzn:1IJTkcQWqrcAaASSoLE+ikAD","tlshash":"e8c16fe488430ffd279c4ef6c5e0d64386916b5ffd00d661382a404b696c12d565eb6f","first_seen":"2026-06-15T00:58:56.395315Z","last_seen":"2026-07-20T12:55:26.580494Z","times_seen":3,"resource_available":false,"data":null}},"time_used":3366,"timings":{"blocked":-1,"dns":5,"connect":2,"send":0,"wait":47,"receive":0,"ssl":3311},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"netflixpaymentportal.org/assets/index-DzaFSyfy.css","fqdn":"netflixpaymentportal.org","domain":"netflixpaymentportal.org","tld":"org"},"ip":{"addr":"34.214.61.222","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://netflixpaymentportal.org/","date":"2026-07-20T12:54:42.158Z","timestamp":1784552082158,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"netflixpaymentportal.org","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 18:06:51 GMT","end":"Sat, 17 Oct 2026 18:06:50 GMT"},"fingerprint":{"sha1":"A9:48:9D:28:B9:E2:34:B8:11:FE:48:7E:4B:CA:D2:B9:A6:E0:20:44","sha256":"AC:55:65:4B:62:C1:37:C3:CA:A5:99:2A:E8:D4:B7:56:9E:1A:19:3C:D2:41:0F:D6:DE:CF:33:7A:61:12:7D:EE"}}},"request":{"raw":"GET /assets/index-DzaFSyfy.css HTTP/1.1\r\nHost: netflixpaymentportal.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://netflixpaymentportal.org/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=0, must-revalidate\r\ncf-cache-status: HIT\r\ncf-ray: a1e21db1fc21884d-PDX\r\ncontent-encoding: br\r\ncontent-type: text/css\r\ndate: Mon, 20 Jul 2026 12:54:42 GMT\r\netag: W/\"90430b2966288dc92bf85fe1c6615e86\"\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=vtXVCIF%2B0PcEp3b1tJBn4al1tZjvitLtdbbzdUiD8tEQDSYeyyQK209gQ5V39EZnTZVVSz67dH6g4%2BPUhpKY%2BH46kdtv%2FFVOtoazW%2FZlUEdWzB8UfJ7imJNScGN6\"}]}\r\nserver: cloudflare\r\nvia: 2.0 Caddy\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":58577,"size_decoded":11456,"mime_type":"text/css","magic":"ASCII text, with very long lines (58576)","md5":"9cee0e573dd1453925b9b123ed2c164c","sha1":"05f1ac7a1e817c572e2755413458fa4d1d1ab93e","sha256":"90430b2966288dc92bf85fe1c6615e862545a324cd23b52699730cf0ecfd954f","sha512":"6a31422a7c57b91a8b47204be042c93a2b4162b52b2cfedc6250778023552d3aa8b62b070a1aa795536f6f767da51940e5a7ce05f17705dc27034c3761661cd6","ssdeep":"1536:3hhU9YJkzB8GOeHGWj/n378VQZkt5F0C4s4:3hhUUkt8GOeHGG/n378VQZkt5FOs4","tlshash":"0c43751ab919a13e2c2790f883dcb5ec610af0c0de3a05f5be9b81216ad37f61db7554","first_seen":"2026-07-20T12:55:14.678469Z","last_seen":"2026-07-20T12:55:26.57924Z","times_seen":2,"resource_available":false,"data":null}},"time_used":192,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":192,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"netflixpaymentportal.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"netflixpaymentportal.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"netflixpaymentportal.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-20","alert":"Phishing Block","trigger":"netflixpaymentportal.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Netflix","verdict":"phishing","severity":"medium","comment":"Associated with Netflix phishing","tags":["netflix","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"www.zite.com/app-runtime.js","fqdn":"www.zite.com","domain":"zite.com","tld":"com"},"ip":{"addr":"216.150.16.193","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://netflixpaymentportal.org/","date":"2026-07-20T12:54:42.215Z","timestamp":1784552082215,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.zite.com","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 17 Jun 2026 07:06:48 GMT","end":"Tue, 15 Sep 2026 07:06:47 GMT"},"fingerprint":{"sha1":"4E:BE:A7:28:3F:06:64:0D:2D:A8:C8:70:74:12:62:53:E6:ED:01:C5","sha256":"0C:C1:BD:98:8C:25:CA:F6:30:B7:02:DD:ED:AE:F5:75:D4:53:1B:FE:E1:37:EB:36:43:32:A0:13:79:C9:9C:37"}}},"request":{"raw":"GET /app-runtime.js HTTP/1.1\r\nHost: www.zite.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://netflixpaymentportal.org/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\naccept-ranges: bytes\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: Content-Type\r\naccess-control-allow-methods: GET\r\naccess-control-allow-origin: *\r\ncache-control: no-cache, no-store, must-revalidate\r\ncf-cache-status: DYNAMIC\r\ncf-ray: a1e21db29dd609b1-ARN\r\ncontent-encoding: br\r\ncontent-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests\r\ncontent-type: application/javascript; charset=UTF-8\r\ncross-origin-embedder-policy: require-corp\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: cross-origin\r\ndate: Mon, 20 Jul 2026 12:54:42 GMT\r\netag: W/\"35542-19f6b77cc28\"\r\nexpect-ct: max-age=0\r\nlast-modified: Thu, 16 Jul 2026 15:07:21 GMT\r\norigin-agent-cluster: ?1\r\nreferrer-policy: no-referrer\r\nrndr-id: 14d532f5-eb80-4abd\r\nserver: Vercel\r\nset-cookie: geo-country=NO; Path=/; SameSite=lax\r\nstrict-transport-security: max-age=15552000; includeSubDomains\r\nvary: Origin, Accept-Encoding\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\nx-download-options: noopen\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-render-origin-server: Render\r\nx-vercel-cache: MISS\r\nx-vercel-id: arn1::gfd9r-1784552082250-7010f056b30d\r\nx-xss-protection: 0\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Render","description":"Render is a cloud computing platform that provides a wide range of services, including web hosting, cloud computing, and application development. Render offers several hosting options, including static site hosting, web application hosting, and managed databases.","website":"https://render.com","common_platform_enumeration":"","icon":"Render.svg","categories":["PaaS"]},{"name":"Vercel","description":"Vercel is a cloud platform for static frontends and serverless functions.","website":"https://vercel.com","common_platform_enumeration":"","icon":"vercel.svg","categories":["PaaS"]}],"data":{"size":218434,"size_decoded":73566,"mime_type":"application/javascript; charset=UTF-8","magic":"data","md5":"833f88ea4290c20376aeacfaa3c507da","sha1":"3f4a0b9972992a1be8217a9af7110360e70f88b1","sha256":"2a5f807669121ab31dc6cb2ee5755442e51679c809fe1e266d7119ce766a36c5","sha512":"826fbcf803462d7a02f32a458da5859da0658cb825fd8c9059d7a1db4d916b19fcfb80be8e66a056e5033418d2a4b7b35c5887aa8895098465991c99057ebc06","ssdeep":"3072:GkPTeg9MPX1NDXYXuEX+tdPSAx8MYP6adPDWdmVJIYV+/Ik2LXn88JDyfjQd8dFb:/kDqMHtKDP6aRa4VJIYWIk2LXn8ezib","tlshash":"be243ab53375343743de11eaa0ba5204f278482a940a845cf26cd8ae3f79d5a61f7f78","first_seen":"2026-06-13T21:07:44.695572Z","last_seen":"2026-07-20T12:55:26.572828Z","times_seen":8,"resource_available":true,"data":null}},"time_used":339,"timings":{"blocked":0,"dns":5,"connect":1,"send":0,"wait":305,"receive":0,"ssl":28},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"images.fillout.com/orgid-775054/flowpublicid-ovzy8n4gjw/widgetid-default/dcZuwSjktk7wxzK8ZYoJHF/netflix_logo_icon_170919.webp","fqdn":"images.fillout.com","domain":"fillout.com","tld":"com"},"ip":{"addr":"104.26.0.150","port":443,"asn":13335,"as":"CLOUDFLARENET","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://netflixpaymentportal.org/","date":"2026-07-20T12:54:42.943Z","timestamp":1784552082943,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"*.fillout.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Mon, 08 Jun 2026 03:29:35 GMT","end":"Sun, 06 Sep 2026 03:29:34 GMT"},"fingerprint":{"sha1":"EE:A7:23:71:45:0B:BC:C6:41:19:3E:80:17:9F:EE:BB:D8:A0:94:BE","sha256":"B3:F2:05:4A:D0:FE:9B:02:10:72:D4:1E:70:47:D5:C8:3F:C1:F7:4E:D4:76:71:E0:F8:31:55:7F:3B:06:72:A3"}}},"request":{"raw":"GET /orgid-775054/flowpublicid-ovzy8n4gjw/widgetid-default/dcZuwSjktk7wxzK8ZYoJHF/netflix_logo_icon_170919.webp HTTP/1.1\r\nHost: images.fillout.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://netflixpaymentportal.org/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Mon, 20 Jul 2026 12:54:43 GMT\r\ncontent-type: image/webp\r\ncontent-length: 10450\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nlast-modified: Sun, 19 Jul 2026 18:56:07 GMT\r\netag: \"032ecb4d67ae3306de40af8906caef19\"\r\nx-amz-server-side-encryption: AES256\r\naccept-ranges: bytes\r\nserver: cloudflare\r\nx-cache: Hit from cloudfront\r\nvia: 1.1 47aa568d2540a3c9253b8ee06de70b0c.cloudfront.net (CloudFront)\r\nx-amz-cf-pop: ARN53-P3\r\nx-amz-cf-id: 5Tymhnw4g7c-lUyjPW5musuPhoFHOnGSTfngAsEhaLPYnl0Vsp0w4Q==\r\nage: 27295\r\nvary: Origin\r\ncache-control: max-age=14400\r\ncf-cache-status: REVALIDATED\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=8Z1k9FsgZe2cWCct5PidaNyIB8%2F8E56Wo9TN8TW%2FrlcoS5mFd4yuahVE0LqD%2BFqjILFDJYtMNVZ746WxwBh1A8%2FugeZycjW2WSW4ynJ%2Bq14X341eYXlxNC9Hckjh9vztXGYEGQ%3D%3D\"}]}\r\ncf-ray: a1e21db67be8120a-OSL\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Amazon CloudFront","description":"Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.","website":"https://aws.amazon.com/cloudfront/","common_platform_enumeration":"","icon":"Amazon Cloudfront.svg","categories":["CDN"]},{"name":"Amazon Web Services","description":"Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.","website":"https://aws.amazon.com/","common_platform_enumeration":"","icon":"Amazon Web Services.svg","categories":["PaaS"]}],"data":{"size":10450,"size_decoded":11384,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"032ecb4d67ae3306de40af8906caef19","sha1":"e158daeda94c6f7557316678070a9ebbc4aa2906","sha256":"79b8c638071cf91eb8cfcee7e1ca9e670b81f5f663e749f5c913cb756589cd82","sha512":"e07732357dd8e626213142ddaa695b2b89db22d5803cf589a629aad9bc10324bf365980da4133b6885e0471027b0b13ab4f20f92cc84be5467e48ecc4ab26ff0","ssdeep":"192:OvuPedAVt4yMa2mNRvcEMAwd1gxpYj/EHLcoQDRipUpCxSK7Rn:auPeS4yMa2mNlcCsDEYzDRipU5Kl","tlshash":"d922b07343b0c4d10fb1b1026084fa79c6eba5c9dbd6adec445294feeb68787e069911","first_seen":"2025-05-29T10:24:52.52363Z","last_seen":"2026-07-20T12:55:26.574478Z","times_seen":19,"resource_available":false,"data":null}},"time_used":137,"timings":{"blocked":0,"dns":4,"connect":1,"send":0,"wait":121,"receive":0,"ssl":10},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"workflows.fillout.com/public/zite/analytics","fqdn":"workflows.fillout.com","domain":"fillout.com","tld":"com"},"ip":{"addr":"216.24.57.8","port":443,"asn":397273,"as":"RENDER","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"beacon","requested_by":"https://netflixpaymentportal.org/","date":"2026-07-20T12:54:48.000Z","timestamp":1784552088000,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"workflows.fillout.com","organization":""},"issuer":{"commonName":"WE1","organization":"Google Trust Services"},"validity":{"start":"Mon, 08 Jun 2026 09:07:24 GMT","end":"Sun, 06 Sep 2026 10:07:17 GMT"},"fingerprint":{"sha1":"7B:73:54:33:59:6C:EF:AE:8F:A3:F0:EA:D2:F5:0D:F5:A0:86:39:DC","sha256":"BB:48:B5:4E:8A:EB:07:CF:01:9D:03:5C:40:4A:2D:D4:0B:7B:EE:7A:05:77:B6:7A:67:3B:F1:20:FD:BA:70:A6"}}},"request":{"raw":"OPTIONS /public/zite/analytics HTTP/1.1\r\nHost: workflows.fillout.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nAccess-Control-Request-Method: POST\r\nAccess-Control-Request-Headers: content-type\r\nReferer: https://netflixpaymentportal.org/\r\nOrigin: https://netflixpaymentportal.org\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: empty\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=4\r\n\r\n","headers":null,"cookies":null,"method":"OPTIONS"},"response":{"raw":"HTTP/2 204 \r\ndate: Mon, 20 Jul 2026 12:54:51 GMT\r\naccess-control-allow-credentials: true\r\naccess-control-allow-headers: content-type\r\naccess-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE,ETag\r\naccess-control-allow-origin: https://netflixpaymentportal.org\r\ncontent-security-policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests\r\ncross-origin-embedder-policy: require-corp\r\ncross-origin-opener-policy: same-origin\r\ncross-origin-resource-policy: same-origin\r\nexpect-ct: max-age=0\r\norigin-agent-cluster: ?1\r\nreferrer-policy: no-referrer\r\nrndr-id: f0802ef9-3523-4e70\r\nserver: cloudflare\r\nstrict-transport-security: max-age=15552000; includeSubDomains\r\nvary: Origin, Access-Control-Request-Headers\r\nx-content-type-options: nosniff\r\nx-dns-prefetch-control: off\r\nx-download-options: noopen\r\nx-frame-options: SAMEORIGIN\r\nx-permitted-cross-domain-policies: none\r\nx-render-origin-server: Render\r\nx-xss-protection: 0\r\ncf-cache-status: DYNAMIC\r\ncf-ray: a1e21de9ddddb517-OSL\r\nalt-svc: h3=\":443\"; ma=86400\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"204","status_text":"","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]},{"name":"Render","description":"Render is a cloud computing platform that provides a wide range of services, including web hosting, cloud computing, and application development. Render offers several hosting options, including static site hosting, web application hosting, and managed databases.","website":"https://render.com","common_platform_enumeration":"","icon":"Render.svg","categories":["PaaS"]}],"data":{"size":0,"size_decoded":1252,"mime_type":"text/plain","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-21T23:24:28.748346Z","times_seen":17434361,"resource_available":true,"data":null}},"time_used":3353,"timings":{"blocked":0,"dns":44,"connect":1,"send":0,"wait":177,"receive":0,"ssl":3131},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"netflixpaymentportal.org/","fqdn":"netflixpaymentportal.org","domain":"netflixpaymentportal.org","tld":"org"},"ip":{"addr":"34.214.61.222","port":443,"asn":16509,"as":"AMAZON-02","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-20T12:54:40.983Z","timestamp":1784552080983,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"netflixpaymentportal.org","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 19 Jul 2026 18:06:51 GMT","end":"Sat, 17 Oct 2026 18:06:50 GMT"},"fingerprint":{"sha1":"A9:48:9D:28:B9:E2:34:B8:11:FE:48:7E:4B:CA:D2:B9:A6:E0:20:44","sha256":"AC:55:65:4B:62:C1:37:C3:CA:A5:99:2A:E8:D4:B7:56:9E:1A:19:3C:D2:41:0F:D6:DE:CF:33:7A:61:12:7D:EE"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: netflixpaymentportal.org\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nalt-svc: h3=\":443\"; ma=2592000\r\ncache-control: public, max-age=0, must-revalidate\r\ncf-cache-status: HIT\r\ncf-ray: a1e21dae7f28884d-PDX\r\ncontent-encoding: br\r\ncontent-type: text/html\r\ndate: Mon, 20 Jul 2026 12:54:41 GMT\r\nnel: {\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=J%2B0ayMQhfuc%2FMTVBKf3nUoaEALMq1qdjSG8mhMWmEIKL%2F%2B2X4Hs987uLNcBN9UsNruxINlAmSDCj3QYuOR1GbUeSOEE%2BulBdSnK0rkbf1EbzbPcVXcWEirs6hac6\"}]}\r\nserver: cloudflare\r\nvia: 2.0 Caddy\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Cloudflare","description":"Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.","website":"https://www.cloudflare.com","common_platform_enumeration":"","icon":"CloudFlare.svg","categories":["CDN"]}],"data":{"size":2134,"size_decoded":1294,"mime_type":"text/html","magic":"HTML document, ASCII text, with very long lines (1779)","md5":"feb74f4c55a36f30388f9e0121e11822","sha1":"cb227d6f55eab4d3432a0f2dd2699fc79a2bf370","sha256":"fb47172072ecb2462575419a6740e84cbd314379b7d02cef3fe5e5b1c28e291d","sha512":"a43d9c3a60b289da0f53e8fce96abf981127c93b56f0a5f51726c5f5530cb5ef5e3f02065975f4581abc438eb64b62fc7fb6dd95be2cdf50b3b47d72fe737d58","ssdeep":"","tlshash":"434132736a14d80d27740679a8e3f44e896bd18fc8516c61f2c4619e1ef1ee5c8773b2","first_seen":"2026-07-20T12:55:14.685107Z","last_seen":"2026-07-20T12:55:26.575871Z","times_seen":2,"resource_available":true,"data":null}},"time_used":804,"timings":{"blocked":-1,"dns":89,"connect":169,"send":0,"wait":197,"receive":0,"ssl":349},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"netflixpaymentportal.org","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-20","alert":"Phishing Block","trigger":"netflixpaymentportal.org","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"netflixpaymentportal.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"cira_dns","sensor_type":"DNS","title":"CIRA Canadian Shield DNS","description":"CIRA Canadian Shield DNS","scan_date":"2026-07-20","alert":"Sinkholed","trigger":"netflixpaymentportal.org","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cira.ca/en/canadian-shield/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Netflix","verdict":"phishing","severity":"medium","comment":"Associated with Netflix phishing","tags":["netflix","phishing"],"meta":null}]}}]}