Report - kamalhadden.com/

Report Overview

Visited public
2025-05-06 14:43:17
Tags
URL
kamalhadden.com/
Finishing URL
kamalhadden.com/
IP / ASN
196.251.83.152
#0
Title
Netflix United Kingdom – Watch TV Programmes Online, Watch Films Online

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
occ-0-300-299.1.nflxso.net	unknown	unknown	No data	No data	6.0 kB	188 kB	37.77.187.177
kamalhadden.com	unknown	unknown	No data	No data	3.7 kB	9.5 MB	196.251.83.152
assets.nflxext.com	3871	unknown	No data	No data	2.1 kB	561 kB	45.57.91.1

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2025-05-04	medium	kamalhadden.com/	Netflix Inc.
2025-05-04	medium	kamalhadden.com/	Netflix Inc.
2025-05-04	medium	kamalhadden.com/	Netflix Inc.
2025-05-04	medium	kamalhadden.com/	Netflix Inc.
2025-05-04	medium	kamalhadden.com/	Netflix Inc.
2025-05-04	medium	kamalhadden.com/	Netflix Inc.
2025-05-04	medium	kamalhadden.com/	Netflix Inc.
2025-05-04	medium	kamalhadden.com/	Netflix Inc.

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (22)

URL IP Response Size

GET kamalhadden.com/Netflix%20United%20Kingdom%20%E2%80%93%20Watch%20TV%20Programmes%20Online,%20Watch%20Films%20Online_files/Netflix_Logo_PMS.png

196.251.83.152

200 OK

16 kB

URL GET
kamalhadden.com/Netflix%20United%20Kingdom%20%E2%80%93%20Watch%20TV%20Programmes%20Online,%20Watch%20Films%20Online_files/Netflix_Logo_PMS.png
IP
196.251.83.152:80
ASN
#0

Requested by
http://kamalhadden.com/

File type
PNG image data, 1801 x 756, 8-bit/color RGBA, non-interlaced
Size
16 kB (16386 bytes)
Hash
dcc4094709a2dc14af288844556ff9b7
0dd0347c55ca4f5332e11d5b742babf8aebf8d6f
675dd7b68acf580f893bec532f5b260b8f984b67734a9a6831334b2ff4aad384

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Netflix Inc.

HTTP Headers

GET /Netflix%20United%20Kingdom%20%E2%80%93%20Watch%20TV%20Programmes%20Online,%20Watch%20Films%20Online_files/Netflix_Logo_PMS.png HTTP/1.1
Host: kamalhadden.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://kamalhadden.com/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 06 May 2025 14:43:05 GMT
Content-Type: image/png
Content-Length: 16386
Last-Modified: Sun, 23 Feb 2025 18:43:00 GMT
Connection: keep-alive
ETag: "67bb6c34-4002"
Expires: Wed, 07 May 2025 14:43:05 GMT
Cache-Control: max-age=86400
Accept-Ranges: bytes

GET assets.nflxext.com/ffe/siteui/vlv3/0cf2c109-3af1-4a9d-87d7-aecfac5fe881/web/GB-en-20250217-TRIFECTA-perspective_ac49c80d-9a13-4ae0-b72e-e23c4d5a0f33_large.jpg

45.57.91.1

200 OK

397 kB

URL GET
assets.nflxext.com/ffe/siteui/vlv3/0cf2c109-3af1-4a9d-87d7-aecfac5fe881/web/GB-en-20250217-TRIFECTA-perspective_ac49c80d-9a13-4ae0-b72e-e23c4d5a0f33_large.jpg
IP
45.57.91.1:443
ASN
#40027 NETFLIX-ASN

Requested by
http://kamalhadden.com/
Certificate
IssuerDigiCert Inc
Subject*.1.nflxso.net
FingerprintDD:A0:13:C0:04:06:E6:A3:D8:34:80:F4:05:B8:6E:28:44:05:A0:A4
ValidityFri, 25 Apr 2025 00:00:00 GMT - Sat, 31 May 2025 00:18:28 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 2000x1125, components 3
Size
397 kB (396829 bytes)
Hash
637acb330299b74db0557bd5fcd683dd
cffb90e9ed613c43ea7ebefeed14d0c81c7b6965
807427c9d560e6bd2c538c2228affe8067fb06879c8300a9ba162f37378e0dd0

HTTP Headers

GET /ffe/siteui/vlv3/0cf2c109-3af1-4a9d-87d7-aecfac5fe881/web/GB-en-20250217-TRIFECTA-perspective_ac49c80d-9a13-4ae0-b72e-e23c4d5a0f33_large.jpg HTTP/1.1
Host: assets.nflxext.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://kamalhadden.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: freenginx
Date: Tue, 06 May 2025 14:43:05 GMT
Content-Type: image/jpeg
Content-Length: 396829
Connection: keep-alive
Content-MD5: Y3rLMwKZt02wVXvV/NaD3Q==
Last-Modified: Wed, 19 Feb 2025 16:31:55 GMT
Cache-Control: max-age=604801
Expires: Tue, 13 May 2025 14:43:06 GMT
Accept-Ranges: bytes

GET occ-0-300-299.1.nflxso.net/dnm/api/v6/mAcAr9TxZIVbINe88xb3Teg5_OA/AAAABaO37olFo3G4jmZKNLl5NnEKjYm12i0VZhx8rAm-Nz2NQv41Rod-VLgPXyU3l_JSP7Xokk8_Sh1JeWc3VaEfE9JGymKI_2k5ku71Rv0-eUG1ANBwVc23QeLa6l7mIO9iOsXL.webp?r=9d7

37.77.187.177

200 OK

10 kB

URL GET
occ-0-300-299.1.nflxso.net/dnm/api/v6/mAcAr9TxZIVbINe88xb3Teg5_OA/AAAABaO37olFo3G4jmZKNLl5NnEKjYm12i0VZhx8rAm-Nz2NQv41Rod-VLgPXyU3l_JSP7Xokk8_Sh1JeWc3VaEfE9JGymKI_2k5ku71Rv0-eUG1ANBwVc23QeLa6l7mIO9iOsXL.webp?r=9d7
IP
37.77.187.177:443
ASN
#2906 AS-SSI

Requested by
http://kamalhadden.com/
Certificate
IssuerDigiCert Inc
Subject*.1.nflxso.net
Fingerprint81:02:53:AB:4D:DB:0D:CC:66:EB:DA:1F:5E:53:AE:70:FB:19:5D:D7
ValidityMon, 28 Apr 2025 00:00:00 GMT - Mon, 02 Jun 2025 23:29:53 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 197x276, Scaling: [none]x[none], YUV color, decoders should clamp
Size
10 kB (10204 bytes)
Hash
95a7c6aea95c0d8bc33c130378fbfc42
7e1459ac661002d31421a8a59900777d09ec6537
7d072015363ac4535b5e884d0a201489f029bc330d3bb6fd7b0ab1f56200ad55

HTTP Headers

GET /dnm/api/v6/mAcAr9TxZIVbINe88xb3Teg5_OA/AAAABaO37olFo3G4jmZKNLl5NnEKjYm12i0VZhx8rAm-Nz2NQv41Rod-VLgPXyU3l_JSP7Xokk8_Sh1JeWc3VaEfE9JGymKI_2k5ku71Rv0-eUG1ANBwVc23QeLa6l7mIO9iOsXL.webp?r=9d7 HTTP/1.1
Host: occ-0-300-299.1.nflxso.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://kamalhadden.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: freenginx
Date: Tue, 06 May 2025 14:43:05 GMT
Content-Type: image/webp
Content-Length: 10204
Connection: keep-alive
Accept-CH: Device-Memory, Downlink, DPR, ECT, RTT, Save-Data, Viewport-Width, Width
Access-Control-Allow-Origin: *
Cache-Control: max-age=31104000, public, s-maxage=604800
ETag: "95a7c6aea95c0d8bc33c130378fbfc42"
Last-Modified: Wed, 22 Jan 2025 17:00:50 GMT
Timing-Allow-Origin: *
Accept-Ranges: bytes

GET occ-0-300-299.1.nflxso.net/dnm/api/v6/mAcAr9TxZIVbINe88xb3Teg5_OA/AAAABU37dJUebOt3daSfowUpUy7IXr2fSgLX4b5mKvSAY6tJLdQc1PtcW0Dg5J8XuEMIs4uufsjTtzH_1pS0yrXz3lob18BP5F43wKU6N0nJSOuGa05oyNOAg-Sogf6vlQwp9BnM.webp?r=98f

37.77.187.177

200 OK

23 kB

URL GET
occ-0-300-299.1.nflxso.net/dnm/api/v6/mAcAr9TxZIVbINe88xb3Teg5_OA/AAAABU37dJUebOt3daSfowUpUy7IXr2fSgLX4b5mKvSAY6tJLdQc1PtcW0Dg5J8XuEMIs4uufsjTtzH_1pS0yrXz3lob18BP5F43wKU6N0nJSOuGa05oyNOAg-Sogf6vlQwp9BnM.webp?r=98f
IP
37.77.187.177:443
ASN
#2906 AS-SSI

Requested by
http://kamalhadden.com/
Certificate
IssuerDigiCert Inc
Subject*.1.nflxso.net
Fingerprint81:02:53:AB:4D:DB:0D:CC:66:EB:DA:1F:5E:53:AE:70:FB:19:5D:D7
ValidityMon, 28 Apr 2025 00:00:00 GMT - Mon, 02 Jun 2025 23:29:53 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 197x276, Scaling: [none]x[none], YUV color, decoders should clamp
Size
23 kB (23212 bytes)
Hash
427e66049d785e11ed3d296b7e2f0e85
a4e26571bfcb4bb7fd9639c1d4b6f06d22385e15
a8c92e649444aedec3f9b144f8968cf5fb568e065e42dbf38e0f89098af3b997

HTTP Headers

GET /dnm/api/v6/mAcAr9TxZIVbINe88xb3Teg5_OA/AAAABU37dJUebOt3daSfowUpUy7IXr2fSgLX4b5mKvSAY6tJLdQc1PtcW0Dg5J8XuEMIs4uufsjTtzH_1pS0yrXz3lob18BP5F43wKU6N0nJSOuGa05oyNOAg-Sogf6vlQwp9BnM.webp?r=98f HTTP/1.1
Host: occ-0-300-299.1.nflxso.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://kamalhadden.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: freenginx
Date: Tue, 06 May 2025 14:43:05 GMT
Content-Type: image/webp
Content-Length: 23212
Connection: keep-alive
Accept-CH: Device-Memory, Downlink, DPR, ECT, RTT, Save-Data, Viewport-Width, Width
Access-Control-Allow-Origin: *
Cache-Control: max-age=31104000, public, s-maxage=604800
ETag: "427e66049d785e11ed3d296b7e2f0e85"
Last-Modified: Tue, 10 Dec 2024 10:52:37 GMT
Timing-Allow-Origin: *
Accept-Ranges: bytes

GET kamalhadden.com/

196.251.83.152

200 OK

328 kB

URL User Request GET
kamalhadden.com/
IP
196.251.83.152:80
ASN
#0

File type
HTML document, Unicode text, UTF-8 text, with very long lines (8553), with CR, LF line terminators
Size
328 kB (328082 bytes)
Hash
9afb41eee3bb8e91d3a3295d2e229a1c
bc7bf316ec396b4ce8875fca7dfd1cb025f5db34
8afb572500e505ab1b260224baeca0a6b4dd37a2ca57a9d82bb02ae5a8c0123c

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Netflix Inc.

HTTP Headers

GET / HTTP/1.1
Host: kamalhadden.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 06 May 2025 14:43:05 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip

GET occ-0-300-299.1.nflxso.net/dnm/api/v6/mAcAr9TxZIVbINe88xb3Teg5_OA/AAAABSLuNKpu0OhZoJt4f0hUtnx1Ss4Uxwr164MVW1jCCDDrC_xprOydVCo5nn2Gyqj4ksd5aIxBsUVH8yc6uUdJCwSwga_j1yKVXSo.webp?r=50c

37.77.187.177

200 OK

15 kB

URL GET
occ-0-300-299.1.nflxso.net/dnm/api/v6/mAcAr9TxZIVbINe88xb3Teg5_OA/AAAABSLuNKpu0OhZoJt4f0hUtnx1Ss4Uxwr164MVW1jCCDDrC_xprOydVCo5nn2Gyqj4ksd5aIxBsUVH8yc6uUdJCwSwga_j1yKVXSo.webp?r=50c
IP
37.77.187.177:443
ASN
#2906 AS-SSI

Requested by
http://kamalhadden.com/
Certificate
IssuerDigiCert Inc
Subject*.1.nflxso.net
Fingerprint81:02:53:AB:4D:DB:0D:CC:66:EB:DA:1F:5E:53:AE:70:FB:19:5D:D7
ValidityMon, 28 Apr 2025 00:00:00 GMT - Mon, 02 Jun 2025 23:29:53 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 197x276, Scaling: [none]x[none], YUV color, decoders should clamp
Size
15 kB (15250 bytes)
Hash
a632101c19cff54b58d79216d5603db8
c42b0262d2cfc4edf77eed12625095ac8c73430c
559099f3960b57a326e18076f6e70056ea5cd5288687c7430fb58175665fa9b3

HTTP Headers

GET /dnm/api/v6/mAcAr9TxZIVbINe88xb3Teg5_OA/AAAABSLuNKpu0OhZoJt4f0hUtnx1Ss4Uxwr164MVW1jCCDDrC_xprOydVCo5nn2Gyqj4ksd5aIxBsUVH8yc6uUdJCwSwga_j1yKVXSo.webp?r=50c HTTP/1.1
Host: occ-0-300-299.1.nflxso.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://kamalhadden.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: freenginx
Date: Tue, 06 May 2025 14:43:05 GMT
Content-Type: image/webp
Content-Length: 15250
Connection: keep-alive
Accept-CH: Device-Memory, Downlink, DPR, ECT, RTT, Save-Data, Viewport-Width, Width
Access-Control-Allow-Origin: *
Cache-Control: max-age=31104000, public, s-maxage=604800
ETag: "a632101c19cff54b58d79216d5603db8"
Last-Modified: Wed, 28 Aug 2024 19:51:57 GMT
Timing-Allow-Origin: *
Accept-Ranges: bytes

GET occ-0-300-299.1.nflxso.net/dnm/api/v6/mAcAr9TxZIVbINe88xb3Teg5_OA/AAAABavQmAg_jAE44WP1bN7gRGPYh72wThBDEYx3rZ1lLkcvl8BSF854E-vjkCI-j-UCaau4mtcHOcd2YCfQRzUGWU9fGKULcsOjO_3FU3DUf9J1ekNXsUHHa0W44SndSN28mCeP.webp?r=52c

37.77.187.177

200 OK

21 kB

URL GET
occ-0-300-299.1.nflxso.net/dnm/api/v6/mAcAr9TxZIVbINe88xb3Teg5_OA/AAAABavQmAg_jAE44WP1bN7gRGPYh72wThBDEYx3rZ1lLkcvl8BSF854E-vjkCI-j-UCaau4mtcHOcd2YCfQRzUGWU9fGKULcsOjO_3FU3DUf9J1ekNXsUHHa0W44SndSN28mCeP.webp?r=52c
IP
37.77.187.177:443
ASN
#2906 AS-SSI

Requested by
http://kamalhadden.com/
Certificate
IssuerDigiCert Inc
Subject*.1.nflxso.net
Fingerprint81:02:53:AB:4D:DB:0D:CC:66:EB:DA:1F:5E:53:AE:70:FB:19:5D:D7
ValidityMon, 28 Apr 2025 00:00:00 GMT - Mon, 02 Jun 2025 23:29:53 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 197x276, Scaling: [none]x[none], YUV color, decoders should clamp
Size
21 kB (21284 bytes)
Hash
4e5db0f01799ebd82763e4508002e780
1b456747ef6c17d5d427f1e3f5e971ae74255cde
a7c338d75f207c1508f112019e0cef6307f2d5f1c42900c32dbd6a312d327442

HTTP Headers

GET /dnm/api/v6/mAcAr9TxZIVbINe88xb3Teg5_OA/AAAABavQmAg_jAE44WP1bN7gRGPYh72wThBDEYx3rZ1lLkcvl8BSF854E-vjkCI-j-UCaau4mtcHOcd2YCfQRzUGWU9fGKULcsOjO_3FU3DUf9J1ekNXsUHHa0W44SndSN28mCeP.webp?r=52c HTTP/1.1
Host: occ-0-300-299.1.nflxso.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://kamalhadden.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: freenginx
Date: Tue, 06 May 2025 14:43:05 GMT
Content-Type: image/webp
Content-Length: 21284
Connection: keep-alive
Accept-CH: Device-Memory, Downlink, DPR, ECT, RTT, Save-Data, Viewport-Width, Width
Access-Control-Allow-Origin: *
Cache-Control: max-age=31104000, public, s-maxage=604800
ETag: "4e5db0f01799ebd82763e4508002e780"
Last-Modified: Sun, 26 Jan 2025 20:31:31 GMT
Timing-Allow-Origin: *
Accept-Ranges: bytes

GET assets.nflxext.com/ffe/siteui/fonts/netflix-sans/v3/NetflixSans_W_Bd.woff2

45.57.91.1

200 OK

55 kB

URL GET
assets.nflxext.com/ffe/siteui/fonts/netflix-sans/v3/NetflixSans_W_Bd.woff2
IP
45.57.91.1:443
ASN
#40027 NETFLIX-ASN

Requested by
http://kamalhadden.com/
Certificate
IssuerDigiCert Inc
Subject*.1.nflxso.net
Fingerprint30:D9:71:DF:B3:12:58:ED:06:93:F1:DA:8A:E5:95:1D:D5:B7:64:5E
ValiditySun, 20 Apr 2025 00:00:00 GMT - Sat, 24 May 2025 00:43:17 GMT

File type
Web Open Font Format (Version 2), TrueType, length 55228, version 2.6554
Size
55 kB (55228 bytes)
Hash
88c69f2f77619fc71f22d83643f98645
9074bca7ca0541efd221d12d30a33e3b74cf824b
6cc71e5053b6599423f3ba402e6e50c04907b9ba93c3211a56dd32e3a2e6cf4d

HTTP Headers

GET /ffe/siteui/fonts/netflix-sans/v3/NetflixSans_W_Bd.woff2 HTTP/1.1
Host: assets.nflxext.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://kamalhadden.com
DNT: 1
Connection: keep-alive
Referer: http://kamalhadden.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: freenginx
Date: Tue, 06 May 2025 14:43:06 GMT
Content-Type: font/woff2
Content-Length: 55228
Connection: keep-alive
Content-MD5: iMafL3dhn8cfItg2Q/mGRQ==
Last-Modified: Thu, 17 Jan 2019 20:16:30 GMT
Cache-Control: max-age=604801
Expires: Tue, 13 May 2025 14:43:07 GMT
Access-Control-Allow-Origin: *
Accept-Ranges: bytes

GET occ-0-300-299.1.nflxso.net/dnm/api/v6/mAcAr9TxZIVbINe88xb3Teg5_OA/AAAABTU8p8yu4Z_R9h_C_jTAvk4BqsCfT-nuRwVFdEHralokj1ljn1Ez-Bii2oI9zDtJF0TSdLZyoNDiw4e3uvL1XH6vJeqemOshHZp6_N485bj0Et6EjZZFIuMm8xYKqyLnPDVv.webp?r=14c

37.77.187.177

200 OK

11 kB

URL GET
occ-0-300-299.1.nflxso.net/dnm/api/v6/mAcAr9TxZIVbINe88xb3Teg5_OA/AAAABTU8p8yu4Z_R9h_C_jTAvk4BqsCfT-nuRwVFdEHralokj1ljn1Ez-Bii2oI9zDtJF0TSdLZyoNDiw4e3uvL1XH6vJeqemOshHZp6_N485bj0Et6EjZZFIuMm8xYKqyLnPDVv.webp?r=14c
IP
37.77.187.177:443
ASN
#2906 AS-SSI

Requested by
http://kamalhadden.com/
Certificate
IssuerDigiCert Inc
Subject*.1.nflxso.net
Fingerprint81:02:53:AB:4D:DB:0D:CC:66:EB:DA:1F:5E:53:AE:70:FB:19:5D:D7
ValidityMon, 28 Apr 2025 00:00:00 GMT - Mon, 02 Jun 2025 23:29:53 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 197x276, Scaling: [none]x[none], YUV color, decoders should clamp
Size
11 kB (10634 bytes)
Hash
b27495d2dae69fc1158d9d7501161c27
3fdae32e1595262461758d41661da26d892d0232
8c0c0a66303222ab671f946f41c7913a8ebf94a9a0de921cf354206d050702a9

HTTP Headers

GET /dnm/api/v6/mAcAr9TxZIVbINe88xb3Teg5_OA/AAAABTU8p8yu4Z_R9h_C_jTAvk4BqsCfT-nuRwVFdEHralokj1ljn1Ez-Bii2oI9zDtJF0TSdLZyoNDiw4e3uvL1XH6vJeqemOshHZp6_N485bj0Et6EjZZFIuMm8xYKqyLnPDVv.webp?r=14c HTTP/1.1
Host: occ-0-300-299.1.nflxso.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://kamalhadden.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: freenginx
Date: Tue, 06 May 2025 14:43:05 GMT
Content-Type: image/webp
Content-Length: 10634
Connection: keep-alive
Accept-CH: Device-Memory, Downlink, DPR, ECT, RTT, Save-Data, Viewport-Width, Width
Access-Control-Allow-Origin: *
Cache-Control: max-age=31104000, public, s-maxage=604800
ETag: "b27495d2dae69fc1158d9d7501161c27"
Last-Modified: Mon, 30 Dec 2024 17:41:20 GMT
Timing-Allow-Origin: *
Accept-Ranges: bytes

GET kamalhadden.com/Netflix%20United%20Kingdom%20%E2%80%93%20Watch%20TV%20Programmes%20Online,%20Watch%20Films%20Online_files/nmhpFrameworkClient.63c951dc4e30ea9d7a5f.js.%D0%91%D0%B5%D0%B7%20%D0%BD%D0%B0%D0%B7%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F

196.251.83.152

200 OK

9.2 MB

URL GET
kamalhadden.com/Netflix%20United%20Kingdom%20%E2%80%93%20Watch%20TV%20Programmes%20Online,%20Watch%20Films%20Online_files/nmhpFrameworkClient.63c951dc4e30ea9d7a5f.js.%D0%91%D0%B5%D0%B7%20%D0%BD%D0%B0%D0%B7%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F
IP
196.251.83.152:80
ASN
#0

Requested by
http://kamalhadden.com/

File type
JavaScript source, ASCII text, with very long lines (65536), with no line terminators
Size
9.2 MB (9184618 bytes)
Hash
ce1bb7c00c0829a2b3518971a23e159c
8a4189b4c41f38cfed78f9ed2e71110d52e612bc
7b45c926bcb6c470d84bffcaff5c5b11e2abf09e6f38564b67954d539ef98f4f

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Netflix Inc.

HTTP Headers

GET /Netflix%20United%20Kingdom%20%E2%80%93%20Watch%20TV%20Programmes%20Online,%20Watch%20Films%20Online_files/nmhpFrameworkClient.63c951dc4e30ea9d7a5f.js.%D0%91%D0%B5%D0%B7%20%D0%BD%D0%B0%D0%B7%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F HTTP/1.1
Host: kamalhadden.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://kamalhadden.com/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 06 May 2025 14:43:05 GMT
Content-Type: text/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Sun, 23 Feb 2025 18:43:00 GMT
ETag: "8c256a-62ed397cc7500-gzip"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip

GET kamalhadden.com/Netflix%20United%20Kingdom%20%E2%80%93%20Watch%20TV%20Programmes%20Online,%20Watch%20Films%20Online_files/nmhp.07cf894df0721aee7630.css

196.251.83.152

200 OK

5.4 kB

URL GET
kamalhadden.com/Netflix%20United%20Kingdom%20%E2%80%93%20Watch%20TV%20Programmes%20Online,%20Watch%20Films%20Online_files/nmhp.07cf894df0721aee7630.css
IP
196.251.83.152:80
ASN
#0

Requested by
http://kamalhadden.com/

File type
ASCII text, with very long lines (5373), with no line terminators
Size
5.4 kB (5373 bytes)
Hash
16acb9e97b54c793dd3a9ed0c88c0abb
c33f8fe051b47e5f6d0d491f37324ef8bd1846ee
027d990afbc9ba262d14b15c18bf46844b2ccfebd1827f1224d9daecbf5c9dcf

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Netflix Inc.

HTTP Headers

GET /Netflix%20United%20Kingdom%20%E2%80%93%20Watch%20TV%20Programmes%20Online,%20Watch%20Films%20Online_files/nmhp.07cf894df0721aee7630.css HTTP/1.1
Host: kamalhadden.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://kamalhadden.com/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 06 May 2025 14:43:05 GMT
Content-Type: text/css
Last-Modified: Sun, 23 Feb 2025 18:43:00 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"67bb6c34-14fd"
Expires: Wed, 07 May 2025 14:43:05 GMT
Cache-Control: max-age=86400
Content-Encoding: gzip

GET kamalhadden.com/Netflix%20United%20Kingdom%20%E2%80%93%20Watch%20TV%20Programmes%20Online,%20Watch%20Films%20Online_files/powered_by_logo.svg

196.251.83.152

200 OK

5.2 kB

URL GET
kamalhadden.com/Netflix%20United%20Kingdom%20%E2%80%93%20Watch%20TV%20Programmes%20Online,%20Watch%20Films%20Online_files/powered_by_logo.svg
IP
196.251.83.152:80
ASN
#0

Requested by
http://kamalhadden.com/

File type
SVG Scalable Vector Graphics image
Size
5.2 kB (5194 bytes)
Hash
63e737d3544164d2b7f4fbca416ac807
030370aa38715e4c41589633f69d0bfe8255d46c
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Netflix Inc.

HTTP Headers

GET /Netflix%20United%20Kingdom%20%E2%80%93%20Watch%20TV%20Programmes%20Online,%20Watch%20Films%20Online_files/powered_by_logo.svg HTTP/1.1
Host: kamalhadden.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://kamalhadden.com/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 06 May 2025 14:43:05 GMT
Content-Type: image/svg+xml
Last-Modified: Sun, 23 Feb 2025 18:43:00 GMT
Transfer-Encoding: chunked
Connection: keep-alive
ETag: W/"67bb6c34-144a"
Expires: Wed, 07 May 2025 14:43:05 GMT
Cache-Control: max-age=86400
Content-Encoding: gzip

GET kamalhadden.com/Netflix%20United%20Kingdom%20%E2%80%93%20Watch%20TV%20Programmes%20Online,%20Watch%20Films%20Online_files/saved_resource.html

196.251.83.152

200 OK

149 B

URL GET
kamalhadden.com/Netflix%20United%20Kingdom%20%E2%80%93%20Watch%20TV%20Programmes%20Online,%20Watch%20Films%20Online_files/saved_resource.html
IP
196.251.83.152:80
ASN
#0

Requested by
http://kamalhadden.com/

File type
HTML document, ASCII text
Size
149 B (149 bytes)
Hash
3c2ccda97c47ede0b1c91b11efd575ea
0a348c4b61c961aba7618f909beb87f740a81983
97f9b10039b05e1af4a3c9b778fc72ba44cf68a376e4ec1d55f2558f16cf3e50

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Netflix Inc.

HTTP Headers

GET /Netflix%20United%20Kingdom%20%E2%80%93%20Watch%20TV%20Programmes%20Online,%20Watch%20Films%20Online_files/saved_resource.html HTTP/1.1
Host: kamalhadden.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://kamalhadden.com/
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Tue, 06 May 2025 14:43:05 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Content-Encoding: gzip

GET occ-0-300-299.1.nflxso.net/dnm/api/v6/mAcAr9TxZIVbINe88xb3Teg5_OA/AAAABTsIHqmKvuiJaunFg-3M7eRlEBPik8Un-eqTK-od9x48LzeGITagPm82bIopTRvyhIEMehQNdXN2qfj0AVpDTMhftqYStaCieJdbO-jfhSkFUVGBs9eYkpkjdzOj_UCKZi53.webp?r=06c

37.77.187.177

200 OK

15 kB

URL GET
occ-0-300-299.1.nflxso.net/dnm/api/v6/mAcAr9TxZIVbINe88xb3Teg5_OA/AAAABTsIHqmKvuiJaunFg-3M7eRlEBPik8Un-eqTK-od9x48LzeGITagPm82bIopTRvyhIEMehQNdXN2qfj0AVpDTMhftqYStaCieJdbO-jfhSkFUVGBs9eYkpkjdzOj_UCKZi53.webp?r=06c
IP
37.77.187.177:443
ASN
#2906 AS-SSI

Requested by
http://kamalhadden.com/
Certificate
IssuerDigiCert Inc
Subject*.1.nflxso.net
Fingerprint81:02:53:AB:4D:DB:0D:CC:66:EB:DA:1F:5E:53:AE:70:FB:19:5D:D7
ValidityMon, 28 Apr 2025 00:00:00 GMT - Mon, 02 Jun 2025 23:29:53 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 197x276, Scaling: [none]x[none], YUV color, decoders should clamp
Size
15 kB (14690 bytes)
Hash
edfade4e2943207cf5b0792eea26b72b
0345dda258ef8762580120959d37d59b0c9a0d4a
81bc878cd4d42a87ea311aca51615792a0f4a4bad0c5c693ee801e6c549a3914

HTTP Headers

GET /dnm/api/v6/mAcAr9TxZIVbINe88xb3Teg5_OA/AAAABTsIHqmKvuiJaunFg-3M7eRlEBPik8Un-eqTK-od9x48LzeGITagPm82bIopTRvyhIEMehQNdXN2qfj0AVpDTMhftqYStaCieJdbO-jfhSkFUVGBs9eYkpkjdzOj_UCKZi53.webp?r=06c HTTP/1.1
Host: occ-0-300-299.1.nflxso.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://kamalhadden.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: freenginx
Date: Tue, 06 May 2025 14:43:05 GMT
Content-Type: image/webp
Content-Length: 14690
Connection: keep-alive
Accept-CH: Device-Memory, Downlink, DPR, ECT, RTT, Save-Data, Viewport-Width, Width
Access-Control-Allow-Origin: *
Cache-Control: max-age=31104000, public, s-maxage=604800
ETag: "edfade4e2943207cf5b0792eea26b72b"
Last-Modified: Wed, 25 Dec 2024 07:10:34 GMT
Timing-Allow-Origin: *
Accept-Ranges: bytes

GET occ-0-300-299.1.nflxso.net/dnm/api/v6/mAcAr9TxZIVbINe88xb3Teg5_OA/AAAABeGuoJYxxzEeYpu2ldZYYkf5aZUk8snKZoH7PWo_oXwkXdw8KY9noCfu96rzWCPS_FGZlrfAmnqFBNDOdrS25JZA_NtX7TPyK6ynBjsYnIgZCKIJNrWmGGaMrxr34UHpQ3TQ.webp?r=c11

37.77.187.177

200 OK

20 kB

URL GET
occ-0-300-299.1.nflxso.net/dnm/api/v6/mAcAr9TxZIVbINe88xb3Teg5_OA/AAAABeGuoJYxxzEeYpu2ldZYYkf5aZUk8snKZoH7PWo_oXwkXdw8KY9noCfu96rzWCPS_FGZlrfAmnqFBNDOdrS25JZA_NtX7TPyK6ynBjsYnIgZCKIJNrWmGGaMrxr34UHpQ3TQ.webp?r=c11
IP
37.77.187.177:443
ASN
#2906 AS-SSI

Requested by
http://kamalhadden.com/
Certificate
IssuerDigiCert Inc
Subject*.1.nflxso.net
Fingerprint81:02:53:AB:4D:DB:0D:CC:66:EB:DA:1F:5E:53:AE:70:FB:19:5D:D7
ValidityMon, 28 Apr 2025 00:00:00 GMT - Mon, 02 Jun 2025 23:29:53 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 197x276, Scaling: [none]x[none], YUV color, decoders should clamp
Size
20 kB (20298 bytes)
Hash
5079837d56e8d110799922850e2210be
efb3dd1c8ff0b6f46a8a35d53285ee560558bfaa
56f94b0ca841b0435e457f7787bdf6f48c2b55d2548c34834936a5d2ac6d5bf5

HTTP Headers

GET /dnm/api/v6/mAcAr9TxZIVbINe88xb3Teg5_OA/AAAABeGuoJYxxzEeYpu2ldZYYkf5aZUk8snKZoH7PWo_oXwkXdw8KY9noCfu96rzWCPS_FGZlrfAmnqFBNDOdrS25JZA_NtX7TPyK6ynBjsYnIgZCKIJNrWmGGaMrxr34UHpQ3TQ.webp?r=c11 HTTP/1.1
Host: occ-0-300-299.1.nflxso.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://kamalhadden.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: freenginx
Date: Tue, 06 May 2025 14:43:05 GMT
Content-Type: image/webp
Content-Length: 20298
Connection: keep-alive
Accept-CH: Device-Memory, Downlink, DPR, ECT, RTT, Save-Data, Viewport-Width, Width
Access-Control-Allow-Origin: *
Cache-Control: max-age=31104000, public, s-maxage=604800
ETag: "5079837d56e8d110799922850e2210be"
Last-Modified: Wed, 27 Nov 2024 20:57:24 GMT
Timing-Allow-Origin: *
Accept-Ranges: bytes

GET occ-0-300-299.1.nflxso.net/dnm/api/v6/mAcAr9TxZIVbINe88xb3Teg5_OA/AAAABfrTNpdbD-J0q4s8TuOvCNliGzEXVBShsRixPInXiRezLJD7jjYIX5Vr5PKf65K2K9AvUwFMHccvHLsLjYEx0qcXW6oA6-u3mTVKB_IidVIocPd6ga93PgYS2gXXffz0z6QG.webp?r=ea8

37.77.187.177

200 OK

27 kB

URL GET
occ-0-300-299.1.nflxso.net/dnm/api/v6/mAcAr9TxZIVbINe88xb3Teg5_OA/AAAABfrTNpdbD-J0q4s8TuOvCNliGzEXVBShsRixPInXiRezLJD7jjYIX5Vr5PKf65K2K9AvUwFMHccvHLsLjYEx0qcXW6oA6-u3mTVKB_IidVIocPd6ga93PgYS2gXXffz0z6QG.webp?r=ea8
IP
37.77.187.177:443
ASN
#2906 AS-SSI

Requested by
http://kamalhadden.com/
Certificate
IssuerDigiCert Inc
Subject*.1.nflxso.net
Fingerprint81:02:53:AB:4D:DB:0D:CC:66:EB:DA:1F:5E:53:AE:70:FB:19:5D:D7
ValidityMon, 28 Apr 2025 00:00:00 GMT - Mon, 02 Jun 2025 23:29:53 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 197x276, Scaling: [none]x[none], YUV color, decoders should clamp
Size
27 kB (27422 bytes)
Hash
5a1b30b313d18143b7993c4931b7597a
fa9aeaa255322d8eec7b781c8e91f1ad4426996c
a15f66bb40089074e1f08be521d2024e8257933068783c1427a5906760e9c7f7

HTTP Headers

GET /dnm/api/v6/mAcAr9TxZIVbINe88xb3Teg5_OA/AAAABfrTNpdbD-J0q4s8TuOvCNliGzEXVBShsRixPInXiRezLJD7jjYIX5Vr5PKf65K2K9AvUwFMHccvHLsLjYEx0qcXW6oA6-u3mTVKB_IidVIocPd6ga93PgYS2gXXffz0z6QG.webp?r=ea8 HTTP/1.1
Host: occ-0-300-299.1.nflxso.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://kamalhadden.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: freenginx
Date: Tue, 06 May 2025 14:43:05 GMT
Content-Type: image/webp
Content-Length: 27422
Connection: keep-alive
Accept-CH: Device-Memory, Downlink, DPR, ECT, RTT, Save-Data, Viewport-Width, Width
Access-Control-Allow-Origin: *
Cache-Control: max-age=31104000, public, s-maxage=604800
ETag: "5a1b30b313d18143b7993c4931b7597a"
Last-Modified: Fri, 24 Jan 2025 01:16:17 GMT
Timing-Allow-Origin: *
Accept-Ranges: bytes

GET kamalhadden.com/

0.0.0.0

0 B

URL User Request GET
kamalhadden.com/
IP
0.0.0.0:0
ASN
#0

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Netflix Inc.

HTTP Headers

GET / HTTP/1.1
Host: kamalhadden.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

GET occ-0-300-299.1.nflxso.net/dnm/api/v6/mAcAr9TxZIVbINe88xb3Teg5_OA/AAAABezWa2TJ4ABj0RubXJZMd38cSU7J40k6JaPS-KCoEzoW3MBj4XtVR3x1Ll2Q5S1Dwwm-4oXcrA1qKd9rZX4SM6OYYalkQDMCvJTC0jNj5oPXfQ_Wb_4auP3pwmd3GNz0zOZ7.webp?r=160

37.77.187.177

200 OK

19 kB

URL GET
occ-0-300-299.1.nflxso.net/dnm/api/v6/mAcAr9TxZIVbINe88xb3Teg5_OA/AAAABezWa2TJ4ABj0RubXJZMd38cSU7J40k6JaPS-KCoEzoW3MBj4XtVR3x1Ll2Q5S1Dwwm-4oXcrA1qKd9rZX4SM6OYYalkQDMCvJTC0jNj5oPXfQ_Wb_4auP3pwmd3GNz0zOZ7.webp?r=160
IP
37.77.187.177:443
ASN
#2906 AS-SSI

Requested by
http://kamalhadden.com/
Certificate
IssuerDigiCert Inc
Subject*.1.nflxso.net
Fingerprint81:02:53:AB:4D:DB:0D:CC:66:EB:DA:1F:5E:53:AE:70:FB:19:5D:D7
ValidityMon, 28 Apr 2025 00:00:00 GMT - Mon, 02 Jun 2025 23:29:53 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 197x276, Scaling: [none]x[none], YUV color, decoders should clamp
Size
19 kB (19060 bytes)
Hash
f79766bbbb75c5866c4fd8659aeee74e
90a42ffe73094be5935d3460f032ab71ffa0268d
002ca18c5611d3511521fd5c0a95356560d0f4e3170cd8c07566637c35c7a2c4

HTTP Headers

GET /dnm/api/v6/mAcAr9TxZIVbINe88xb3Teg5_OA/AAAABezWa2TJ4ABj0RubXJZMd38cSU7J40k6JaPS-KCoEzoW3MBj4XtVR3x1Ll2Q5S1Dwwm-4oXcrA1qKd9rZX4SM6OYYalkQDMCvJTC0jNj5oPXfQ_Wb_4auP3pwmd3GNz0zOZ7.webp?r=160 HTTP/1.1
Host: occ-0-300-299.1.nflxso.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://kamalhadden.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: freenginx
Date: Tue, 06 May 2025 14:43:05 GMT
Content-Type: image/webp
Content-Length: 19060
Connection: keep-alive
Accept-CH: Device-Memory, Downlink, DPR, ECT, RTT, Save-Data, Viewport-Width, Width
Access-Control-Allow-Origin: *
Cache-Control: max-age=31104000, public, s-maxage=604800
ETag: "f79766bbbb75c5866c4fd8659aeee74e"
Last-Modified: Fri, 31 Jan 2025 21:11:47 GMT
Timing-Allow-Origin: *
Accept-Ranges: bytes

GET assets.nflxext.com/ffe/siteui/fonts/netflix-sans/v3/NetflixSans_W_Rg.woff2

45.57.91.1

200 OK

53 kB

URL GET
assets.nflxext.com/ffe/siteui/fonts/netflix-sans/v3/NetflixSans_W_Rg.woff2
IP
45.57.91.1:443
ASN
#40027 NETFLIX-ASN

Requested by
http://kamalhadden.com/
Certificate
IssuerDigiCert Inc
Subject*.1.nflxso.net
Fingerprint30:D6:1D:4A:A5:C7:99:67:4F:76:77:2A:44:E8:E8:42:42:5A:CB:55
ValidityMon, 07 Apr 2025 00:00:00 GMT - Tue, 13 May 2025 00:01:50 GMT

File type
Web Open Font Format (Version 2), TrueType, length 53304, version 2.6554
Size
53 kB (53304 bytes)
Hash
0bf3177f1fed6d953178221fba43c7e8
83d9f039f1ba7209321c7da72d3dc6a9aa5e2ab3
c0bceb927c506dce9f6e6f5f570e641ad580b9554be06f61508a4aee32380167

HTTP Headers

GET /ffe/siteui/fonts/netflix-sans/v3/NetflixSans_W_Rg.woff2 HTTP/1.1
Host: assets.nflxext.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://kamalhadden.com
DNT: 1
Connection: keep-alive
Referer: http://kamalhadden.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: freenginx
Date: Tue, 06 May 2025 14:43:06 GMT
Content-Type: font/woff2
Content-Length: 53304
Connection: keep-alive
Content-MD5: C/MXfx/tbZUxeCIfukPH6A==
Last-Modified: Thu, 17 Jan 2019 20:16:30 GMT
Cache-Control: max-age=604801
Expires: Tue, 13 May 2025 14:43:07 GMT
Access-Control-Allow-Origin: *
Accept-Ranges: bytes

GET assets.nflxext.com/ffe/siteui/fonts/netflix-sans/v3/NetflixSans_W_Md.woff2

45.57.91.1

200 OK

54 kB

URL GET
assets.nflxext.com/ffe/siteui/fonts/netflix-sans/v3/NetflixSans_W_Md.woff2
IP
45.57.91.1:443
ASN
#40027 NETFLIX-ASN

Requested by
http://kamalhadden.com/
Certificate
IssuerDigiCert Inc
Subject*.1.nflxso.net
FingerprintB1:05:5D:C3:4A:8F:6C:A7:0A:58:96:79:85:8C:6C:85:94:F9:78:55
ValidityFri, 02 May 2025 00:00:00 GMT - Fri, 06 Jun 2025 00:23:45 GMT

File type
Web Open Font Format (Version 2), TrueType, length 53940, version 2.6554
Size
54 kB (53940 bytes)
Hash
ea769921b0cfa4fc6d4d1a2e0b1fa5ff
34dcd2875c9752ebba6f894eb8d410e4958cc1b4
9ac2bd03fcde501b3f30f47ab1fae62161f87808ea6411f38e8feaa4bbddc42e

HTTP Headers

GET /ffe/siteui/fonts/netflix-sans/v3/NetflixSans_W_Md.woff2 HTTP/1.1
Host: assets.nflxext.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: http://kamalhadden.com
DNT: 1
Connection: keep-alive
Referer: http://kamalhadden.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: freenginx
Date: Tue, 06 May 2025 14:43:06 GMT
Content-Type: font/woff2
Content-Length: 53940
Connection: keep-alive
Content-MD5: 6naZIbDPpPxtTRouCx+l/w==
Last-Modified: Thu, 17 Jan 2019 20:16:30 GMT
Cache-Control: max-age=604801
Expires: Tue, 13 May 2025 14:43:07 GMT
Access-Control-Allow-Origin: *
Accept-Ranges: bytes

GET kamalhadden.com/favicon.ico

196.251.83.152

404 Not Found

277 B

URL GET
kamalhadden.com/favicon.ico
IP
196.251.83.152:80
ASN
#0

Requested by
http://kamalhadden.com/

File type
HTML document, ASCII text
Size
277 B (277 bytes)
Hash
4b4fc8e8c19c87e01c9280cf360fe7b6
9d32b7d5cf1bd0810bbdc451414ac56df9342bf3
09e6b41f77eb6b61ad14fbc498ad87f7d7d98b0bb79188d5eaa2aeedffe01190

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Netflix Inc.

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: kamalhadden.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://kamalhadden.com/
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 404 Not Found
Server: nginx
Date: Tue, 06 May 2025 14:43:06 GMT
Content-Type: text/html; charset=iso-8859-1
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip

GET occ-0-300-299.1.nflxso.net/dnm/api/v6/mAcAr9TxZIVbINe88xb3Teg5_OA/AAAABdx56sMItZaMHSmmvLFUg-KIn2QQmU4m4zdCT2n3_Z8lT4a2KehRTcj7bN8qC_xpxoitxo9Lf_DTwjYMfYs4eU8-cA--jxX_Tcw.webp?r=dbc

37.77.187.177

200 OK

22 kB

URL GET
occ-0-300-299.1.nflxso.net/dnm/api/v6/mAcAr9TxZIVbINe88xb3Teg5_OA/AAAABdx56sMItZaMHSmmvLFUg-KIn2QQmU4m4zdCT2n3_Z8lT4a2KehRTcj7bN8qC_xpxoitxo9Lf_DTwjYMfYs4eU8-cA--jxX_Tcw.webp?r=dbc
IP
37.77.187.177:443
ASN
#2906 AS-SSI

Requested by
http://kamalhadden.com/
Certificate
IssuerDigiCert Inc
Subject*.1.nflxso.net
Fingerprint81:02:53:AB:4D:DB:0D:CC:66:EB:DA:1F:5E:53:AE:70:FB:19:5D:D7
ValidityMon, 28 Apr 2025 00:00:00 GMT - Mon, 02 Jun 2025 23:29:53 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 197x276, Scaling: [none]x[none], YUV color, decoders should clamp
Size
22 kB (21508 bytes)
Hash
1392e35233c4aae7662bd2832803cd86
720a9caf1d0dbda80cc2af6e2660035602df57ab
4c55693eb270671a3bbdaba6e1f66d3762d2015bbc64ea3673c2259122c55c10

HTTP Headers

GET /dnm/api/v6/mAcAr9TxZIVbINe88xb3Teg5_OA/AAAABdx56sMItZaMHSmmvLFUg-KIn2QQmU4m4zdCT2n3_Z8lT4a2KehRTcj7bN8qC_xpxoitxo9Lf_DTwjYMfYs4eU8-cA--jxX_Tcw.webp?r=dbc HTTP/1.1
Host: occ-0-300-299.1.nflxso.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://kamalhadden.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: freenginx
Date: Tue, 06 May 2025 14:43:05 GMT
Content-Type: image/webp
Content-Length: 21508
Connection: keep-alive
Accept-CH: Device-Memory, Downlink, DPR, ECT, RTT, Save-Data, Viewport-Width, Width
Access-Control-Allow-Origin: *
Cache-Control: max-age=31104000, public, s-maxage=604800
ETag: "1392e35233c4aae7662bd2832803cd86"
Last-Modified: Wed, 28 Aug 2024 19:48:58 GMT
Timing-Allow-Origin: *
Accept-Ranges: bytes

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (22)

URL GET

IP

ASN

Requested by

File type

Size

Hash

Detections

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate