{"report_id":"8d9b4e71-878f-4bf0-aeba-fa9420f8d8dc","version":0,"status":"done","tags":["netflix","phishing"],"date":"2026-09-07T00:38:52Z","url":{"schema":"http","addr":"mysubcription-neftlix.com/","fqdn":"mysubcription-neftlix.com","domain":"mysubcription-neftlix.com","tld":"com"},"ip":{"addr":"141.11.243.3","port":0,"asn":201120,"as":"Lebex First International Trading","country":"Lebanon","country_code":"LB"},"final":{"url":{"schema":"https","addr":"mysubcription-neftlix.com/","fqdn":"mysubcription-neftlix.com","domain":"mysubcription-neftlix.com","tld":"com"},"title":"Netflix","dom":{"size":8311,"mime_type":"text/html; charset=utf-8","magic":"HTML document, ASCII text, with very long lines (3343), with CRLF, LF line terminators","md5":"c40b8022bc2be758981836b4ae684eb5","sha1":"b004969ac04044c94a75811a1560e3ac325047ef","sha256":"6403da986773dbb9aa006506b5025ba943589a28b7037679690755f014c46f61","sha512":"3833f93648cba081893ff0ad6b99383d6cf906518c4a420770d76e9157512cd380eb8fd9d104d532499713d6406cf5d004b13677b80b7391646ece05980fc600","ssdeep":"96:nYrM7/NTz3CKUpqzH+ILUc24TO+8wARi3BZOmOMKf8BG/LLRVAlD0AyMGgbAK:YrM7/cKUw0bn+IgBUNbqeTiD0vRK","tlshash":"1f02d55c611c066f9723866fb162be78a57f4357ee63984476fc06240fa5c90cd18cbb","dom_hash":"domhashad99eeec555670c50d6c21ebf1cced9a","first_seen":"2026-09-07T00:31:06.886592Z","last_seen":"2026-09-07T00:38:53.062356Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"mysubcription-neftlix.com/","fqdn":"mysubcription-neftlix.com","domain":"mysubcription-neftlix.com","tld":"com"},"ip":{"addr":"141.11.243.3","port":0,"asn":201120,"as":"Lebex First International Trading","country":"Lebanon","country_code":"LB"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-12T00:38:52Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"mysubcription-neftlix.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"mysubcription-neftlix.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"mysubcription-neftlix.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"mysubcription-neftlix.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Netflix","verdict":"phishing","severity":"medium","comment":"Associated with Netflix phishing","tags":["netflix","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Netflix","verdict":"phishing","severity":"medium","comment":"Associated with Netflix phishing","tags":["netflix","phishing"],"meta":null}]},"summary":[{"fqdn":"fonts.googleapis.com","ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"domain_registered":"2005-01-25","domain_rank":313,"first_seen":"2012-05-23T12:41:44Z","last_seen":"2026-09-06T22:43:29.329928Z","alert_count":0,"request_count":1,"received_data":3239,"sent_data":534,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}]},{"fqdn":"mysubcription-neftlix.com","ip":{"addr":"141.11.243.3","port":443,"asn":201120,"as":"Lebex First International Trading","country":"Lebanon","country_code":"LB"},"domain_registered":"2026-09-05","domain_rank":0,"first_seen":"2026-09-07T00:31:02.701237Z","last_seen":"2026-09-07T00:31:02.701237Z","alert_count":40,"request_count":8,"received_data":687668,"sent_data":4106,"comment":"","tags":null,"fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Netflix","verdict":"phishing","severity":"medium","comment":"Associated with Netflix phishing","tags":["netflix","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"mysubcription-neftlix.com/assets/index-C5lOAt95.js","fqdn":"mysubcription-neftlix.com","domain":"mysubcription-neftlix.com","tld":"com"},"ip":{"addr":"141.11.243.3","port":443,"asn":201120,"as":"Lebex First International Trading","country":"Lebanon","country_code":"LB"},"introduction_type":"scriptElement","is_inline":false,"md5":"125c764d7dd8adf02284f8077eccd438","sha1":"faab8dcb51b5d0ee644b73a1b0430a338df4f42e","sha256":"1863458083c201feea92e0ec09126372d460ba6f21cc17988c00a51c79a8584e","sha512":"64d1108e3403e9ec36f3434c3c20b0c4b07c01f27166a21bc616a9d3e1c81e41926622f42dc7e91c1af4862c133c4b42eb429207475850bc470b6f6e98682b04","ssdeep":"3072:t2vG+UA08ZDvTS/7fkwqUGQpOsiJRaq/83TwGfIsxgcRVPhwlnyVN8OhvqMqvYe:te1ZDvujQgFSsxg6VPGQN8OhG","tlshash":"58546de87166b6666ba302f110bf1007b23d1d27684d8460b22cfc5a67f5449a1bbffd","size":303451,"data":"","first_seen":"2026-09-03T14:47:20.515711Z","last_seen":"2026-09-07T08:36:29.542629Z","times_seen":5,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"fonts.googleapis.com/css2?family=Inter:wght@100..900\u0026display=swap","fqdn":"fonts.googleapis.com","domain":"fonts.googleapis.com","tld":"googleapis.com"},"ip":{"addr":"142.250.178.106","port":443,"asn":15169,"as":"GOOGLE","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://mysubcription-neftlix.com/","date":"2026-09-07T00:38:22.867Z","timestamp":1788741502867,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"upload.video.google.com","organization":""},"issuer":{"commonName":"WE2","organization":"Google Trust Services"},"validity":{"start":"Mon, 10 Aug 2026 08:39:11 GMT","end":"Mon, 02 Nov 2026 08:39:10 GMT"},"fingerprint":{"sha1":"97:55:92:07:19:C2:C2:85:E6:88:C9:C8:47:76:A5:6A:F2:45:6E:8D","sha256":"04:DC:D7:95:F1:60:AD:D7:D0:1C:2C:83:57:A1:87:FF:3E:5F:D7:B4:AC:EF:0D:A5:1F:03:CD:E3:6E:05:0A:2F"}}},"request":{"raw":"GET /css2?family=Inter:wght@100..900\u0026display=swap HTTP/1.1\r\nHost: fonts.googleapis.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mysubcription-neftlix.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/css; charset=utf-8\r\nvary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\naccess-control-allow-origin: *\r\ntiming-allow-origin: *\r\nlink: \u003chttps://fonts.gstatic.com\u003e; rel=preconnect; crossorigin\r\nstrict-transport-security: max-age=31536000\r\nexpires: Mon, 07 Sep 2026 00:38:22 GMT\r\ndate: Mon, 07 Sep 2026 00:38:22 GMT\r\ncache-control: private, max-age=86400\r\ncross-origin-opener-policy: same-origin-allow-popups\r\ncross-origin-resource-policy: cross-origin\r\ncontent-encoding: gzip\r\nserver: ESF\r\nx-xss-protection: 0\r\nx-frame-options: SAMEORIGIN\r\nx-content-type-options: nosniff\r\nalt-svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":2555,"size_decoded":1313,"mime_type":"text/css; charset=utf-8","magic":"ASCII text","md5":"3fcf63d91b46adf99bd3db1a56530254","sha1":"62f7d93d0b191e1e8464958268f225f51dd1752d","sha256":"63867a7c4bb197935b85ada1c4bcbc95951598dfb736b24132f0a43e5e5e365c","sha512":"16d25c5cc841006ca8e86ef334efb051054257e6990275a3a0d1e25f9adc6c665b65ff9083dfc9c409d84b69365a26eb9ba875431ca75765743b70902e684d14","ssdeep":"","tlshash":"0451ab92002ba404ab931dc233cf7f3aaece50856085d2b96ffd1dc65cead66436875d","first_seen":"2025-09-10T17:57:06.167004Z","last_seen":"2026-09-21T15:22:31.565458Z","times_seen":31140,"resource_available":true,"data":null}},"time_used":83,"timings":{"blocked":-1,"dns":2,"connect":14,"send":0,"wait":35,"receive":0,"ssl":32},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"mysubcription-neftlix.com/fonts/NetflixSans_W_Bd.woff2","fqdn":"mysubcription-neftlix.com","domain":"mysubcription-neftlix.com","tld":"com"},"ip":{"addr":"141.11.243.3","port":443,"asn":201120,"as":"Lebex First International Trading","country":"Lebanon","country_code":"LB"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://mysubcription-neftlix.com/","date":"2026-09-07T00:38:23.004Z","timestamp":1788741503004,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.mysubcription-neftlix.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 06 Sep 2026 03:51:49 GMT","end":"Sat, 05 Dec 2026 03:51:48 GMT"},"fingerprint":{"sha1":"05:99:2B:FE:75:DB:10:EC:44:C8:6A:CD:63:76:63:B0:3A:B4:2A:42","sha256":"58:7A:8E:0B:D8:85:F3:A2:DE:60:7E:4E:BD:BC:6F:90:F0:BC:82:E1:CA:83:B7:F1:25:29:26:CF:15:BC:8A:7A"}}},"request":{"raw":"GET /fonts/NetflixSans_W_Bd.woff2 HTTP/1.1\r\nHost: mysubcription-neftlix.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mysubcription-neftlix.com/assets/index-Dk9tFDM9.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:38:23 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 05 Sep 2026 17:52:55 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 55228\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nContent-Type: font/woff2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":55228,"size_decoded":55472,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 55228, version 2.6554","md5":"88c69f2f77619fc71f22d83643f98645","sha1":"9074bca7ca0541efd221d12d30a33e3b74cf824b","sha256":"6cc71e5053b6599423f3ba402e6e50c04907b9ba93c3211a56dd32e3a2e6cf4d","sha512":"de6df301e13db3cfb0bac64a2dd79fa2cb629bf3b47be2bd5548d4bf967460b5ef104c1b4d6f862ee053390482e1275503f517e4f57ce5ca0a184e158817468f","ssdeep":"1536:3adOtIySeasYqT9Xa/AwOrmGTKnhl0z3iM:3zIFsvxa/1DG+nRM","tlshash":"1b43026229a3519c001fac3b4c935b5445d50ac9a2ba085617cc2cfe9efe73cb664ecd","first_seen":"2023-05-08T17:27:26Z","last_seen":"2026-09-20T10:34:32.399792Z","times_seen":775,"resource_available":false,"data":null}},"time_used":86,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":33,"receive":53,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"mysubcription-neftlix.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"mysubcription-neftlix.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"mysubcription-neftlix.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"mysubcription-neftlix.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Netflix","verdict":"phishing","severity":"medium","comment":"Associated with Netflix phishing","tags":["netflix","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"mysubcription-neftlix.com/fonts/NetflixSans_W_Rg.woff2","fqdn":"mysubcription-neftlix.com","domain":"mysubcription-neftlix.com","tld":"com"},"ip":{"addr":"141.11.243.3","port":443,"asn":201120,"as":"Lebex First International Trading","country":"Lebanon","country_code":"LB"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://mysubcription-neftlix.com/","date":"2026-09-07T00:38:23.005Z","timestamp":1788741503005,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.mysubcription-neftlix.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 06 Sep 2026 03:51:49 GMT","end":"Sat, 05 Dec 2026 03:51:48 GMT"},"fingerprint":{"sha1":"05:99:2B:FE:75:DB:10:EC:44:C8:6A:CD:63:76:63:B0:3A:B4:2A:42","sha256":"58:7A:8E:0B:D8:85:F3:A2:DE:60:7E:4E:BD:BC:6F:90:F0:BC:82:E1:CA:83:B7:F1:25:29:26:CF:15:BC:8A:7A"}}},"request":{"raw":"GET /fonts/NetflixSans_W_Rg.woff2 HTTP/1.1\r\nHost: mysubcription-neftlix.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mysubcription-neftlix.com/assets/index-Dk9tFDM9.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:38:23 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 05 Sep 2026 17:52:55 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 53304\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: font/woff2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":53304,"size_decoded":53549,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 53304, version 2.6554","md5":"0bf3177f1fed6d953178221fba43c7e8","sha1":"83d9f039f1ba7209321c7da72d3dc6a9aa5e2ab3","sha256":"c0bceb927c506dce9f6e6f5f570e641ad580b9554be06f61508a4aee32380167","sha512":"76ebfc377313354b469aca9695cdc28bb76e8ff015156d0f2ddbb45c763d4822808014e8e742ba3dfa447981bbdd2b7603e852c77b78aa52ff8de452094ecf0c","ssdeep":"1536:t21aKxDJpWmqPuw/L5muh28j0JPVMib83e50+kPmb:t20uonjYm20MVM28uDIQ","tlshash":"d83301020c97d667910cca53e475a6bfbcc0c7c09a68d0d91a3ddb779b4b0ca8c9ea06","first_seen":"2023-05-02T12:35:36Z","last_seen":"2026-09-20T10:34:55.238743Z","times_seen":2656,"resource_available":false,"data":null}},"time_used":134,"timings":{"blocked":-1,"dns":0,"connect":25,"send":0,"wait":27,"receive":51,"ssl":31},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"mysubcription-neftlix.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"mysubcription-neftlix.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"mysubcription-neftlix.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"mysubcription-neftlix.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Netflix","verdict":"phishing","severity":"medium","comment":"Associated with Netflix phishing","tags":["netflix","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"mysubcription-neftlix.com/fonts/NetflixSans_W_Md.woff2","fqdn":"mysubcription-neftlix.com","domain":"mysubcription-neftlix.com","tld":"com"},"ip":{"addr":"141.11.243.3","port":443,"asn":201120,"as":"Lebex First International Trading","country":"Lebanon","country_code":"LB"},"is_navigation_request":false,"resource_type":"font","requested_by":"https://mysubcription-neftlix.com/","date":"2026-09-07T00:38:23.006Z","timestamp":1788741503006,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.mysubcription-neftlix.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 06 Sep 2026 03:51:49 GMT","end":"Sat, 05 Dec 2026 03:51:48 GMT"},"fingerprint":{"sha1":"05:99:2B:FE:75:DB:10:EC:44:C8:6A:CD:63:76:63:B0:3A:B4:2A:42","sha256":"58:7A:8E:0B:D8:85:F3:A2:DE:60:7E:4E:BD:BC:6F:90:F0:BC:82:E1:CA:83:B7:F1:25:29:26:CF:15:BC:8A:7A"}}},"request":{"raw":"GET /fonts/NetflixSans_W_Md.woff2 HTTP/1.1\r\nHost: mysubcription-neftlix.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: identity\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mysubcription-neftlix.com/assets/index-Dk9tFDM9.css\r\nSec-Fetch-Dest: font\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:38:23 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 05 Sep 2026 17:52:55 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 53940\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: font/woff2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":53940,"size_decoded":54185,"mime_type":"font/woff2","magic":"Web Open Font Format (Version 2), TrueType, length 53940, version 2.6554","md5":"ea769921b0cfa4fc6d4d1a2e0b1fa5ff","sha1":"34dcd2875c9752ebba6f894eb8d410e4958cc1b4","sha256":"9ac2bd03fcde501b3f30f47ab1fae62161f87808ea6411f38e8feaa4bbddc42e","sha512":"f0ee2f0c81a8253783306602b3d430be4ff2a33e075ab77cce6834d5a6452f2c64e7d395aa98b92d694d53ffc8da2bf5226528faf62de3a687911dfc279c39cb","ssdeep":"1536:cQYyppexSSgX9x6olOQ26mZJ/F6EIHhFsgHFkW/:cjw9X9/Yplg5HhrlkW/","tlshash":"7633f1039fcf714a08b7be7facca496b6059cdb7986a025fde3f498490117025a41e37","first_seen":"2023-05-02T12:35:36Z","last_seen":"2026-09-20T10:34:55.270804Z","times_seen":2533,"resource_available":false,"data":null}},"time_used":155,"timings":{"blocked":-1,"dns":0,"connect":29,"send":0,"wait":31,"receive":59,"ssl":37},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"mysubcription-neftlix.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"mysubcription-neftlix.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"mysubcription-neftlix.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"mysubcription-neftlix.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Netflix","verdict":"phishing","severity":"medium","comment":"Associated with Netflix phishing","tags":["netflix","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"mysubcription-neftlix.com/","fqdn":"mysubcription-neftlix.com","domain":"mysubcription-neftlix.com","tld":"com"},"ip":{"addr":"141.11.243.3","port":443,"asn":201120,"as":"Lebex First International Trading","country":"Lebanon","country_code":"LB"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-07T00:38:22.281Z","timestamp":1788741502281,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.mysubcription-neftlix.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 06 Sep 2026 03:51:49 GMT","end":"Sat, 05 Dec 2026 03:51:48 GMT"},"fingerprint":{"sha1":"05:99:2B:FE:75:DB:10:EC:44:C8:6A:CD:63:76:63:B0:3A:B4:2A:42","sha256":"58:7A:8E:0B:D8:85:F3:A2:DE:60:7E:4E:BD:BC:6F:90:F0:BC:82:E1:CA:83:B7:F1:25:29:26:CF:15:BC:8A:7A"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: mysubcription-neftlix.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:38:22 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 05 Sep 2026 17:52:55 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 454\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/html\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":454,"size_decoded":696,"mime_type":"text/html","magic":"HTML document, ASCII text, with CRLF, CR, LF line terminators","md5":"baafa2de99b8ffa7f32b5e45b0ac0b72","sha1":"a4d62e975ae9730194e5b9bbde51cb0e34722937","sha256":"a8c9672afa0340051fc70473a99ecc32201fb9d39d55df31b7aba10baa15401e","sha512":"d5789f2d91b8efe168494ac7667c70ada141b012cec7259a0eb87773c522c8aea4664c183f41a928b3d5dd6cc7f4d7d72fcad44efb6ca0a5bb32b05e2ac62a0f","ssdeep":"","tlshash":"99f05c9608c14c5a037047647e92f10c6697e784838e6f5074e6607b2dc6786cddb568","first_seen":"2026-09-03T14:47:20.514078Z","last_seen":"2026-09-07T08:36:29.541744Z","times_seen":5,"resource_available":true,"data":null}},"time_used":99,"timings":{"blocked":-1,"dns":13,"connect":25,"send":0,"wait":28,"receive":0,"ssl":33},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"mysubcription-neftlix.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"mysubcription-neftlix.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"mysubcription-neftlix.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"mysubcription-neftlix.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Netflix","verdict":"phishing","severity":"medium","comment":"Associated with Netflix phishing","tags":["netflix","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"mysubcription-neftlix.com/assets/index-C5lOAt95.js","fqdn":"mysubcription-neftlix.com","domain":"mysubcription-neftlix.com","tld":"com"},"ip":{"addr":"141.11.243.3","port":443,"asn":201120,"as":"Lebex First International Trading","country":"Lebanon","country_code":"LB"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://mysubcription-neftlix.com/","date":"2026-09-07T00:38:22.551Z","timestamp":1788741502551,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.mysubcription-neftlix.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 06 Sep 2026 03:51:49 GMT","end":"Sat, 05 Dec 2026 03:51:48 GMT"},"fingerprint":{"sha1":"05:99:2B:FE:75:DB:10:EC:44:C8:6A:CD:63:76:63:B0:3A:B4:2A:42","sha256":"58:7A:8E:0B:D8:85:F3:A2:DE:60:7E:4E:BD:BC:6F:90:F0:BC:82:E1:CA:83:B7:F1:25:29:26:CF:15:BC:8A:7A"}}},"request":{"raw":"GET /assets/index-C5lOAt95.js HTTP/1.1\r\nHost: mysubcription-neftlix.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mysubcription-neftlix.com/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:38:22 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 05 Sep 2026 17:52:55 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 303451\r\nKeep-Alive: timeout=5, max=99\r\nConnection: Keep-Alive\r\nContent-Type: text/javascript\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":303451,"size_decoded":303701,"mime_type":"text/javascript","magic":"JavaScript source, ASCII text, with very long lines (37534)","md5":"125c764d7dd8adf02284f8077eccd438","sha1":"faab8dcb51b5d0ee644b73a1b0430a338df4f42e","sha256":"1863458083c201feea92e0ec09126372d460ba6f21cc17988c00a51c79a8584e","sha512":"64d1108e3403e9ec36f3434c3c20b0c4b07c01f27166a21bc616a9d3e1c81e41926622f42dc7e91c1af4862c133c4b42eb429207475850bc470b6f6e98682b04","ssdeep":"3072:t2vG+UA08ZDvTS/7fkwqUGQpOsiJRaq/83TwGfIsxgcRVPhwlnyVN8OhvqMqvYe:te1ZDvujQgFSsxg6VPGQN8OhG","tlshash":"58546de87166b6666ba302f110bf1007b23d1d27684d8460b22cfc5a67f5449a1bbffd","first_seen":"2026-09-03T14:47:20.515711Z","last_seen":"2026-09-07T08:36:29.542629Z","times_seen":5,"resource_available":true,"data":null}},"time_used":129,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":27,"receive":102,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"mysubcription-neftlix.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"mysubcription-neftlix.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"mysubcription-neftlix.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"mysubcription-neftlix.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Netflix","verdict":"phishing","severity":"medium","comment":"Associated with Netflix phishing","tags":["netflix","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"mysubcription-neftlix.com/assets/index-Dk9tFDM9.css","fqdn":"mysubcription-neftlix.com","domain":"mysubcription-neftlix.com","tld":"com"},"ip":{"addr":"141.11.243.3","port":443,"asn":201120,"as":"Lebex First International Trading","country":"Lebanon","country_code":"LB"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://mysubcription-neftlix.com/","date":"2026-09-07T00:38:22.552Z","timestamp":1788741502552,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.mysubcription-neftlix.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 06 Sep 2026 03:51:49 GMT","end":"Sat, 05 Dec 2026 03:51:48 GMT"},"fingerprint":{"sha1":"05:99:2B:FE:75:DB:10:EC:44:C8:6A:CD:63:76:63:B0:3A:B4:2A:42","sha256":"58:7A:8E:0B:D8:85:F3:A2:DE:60:7E:4E:BD:BC:6F:90:F0:BC:82:E1:CA:83:B7:F1:25:29:26:CF:15:BC:8A:7A"}}},"request":{"raw":"GET /assets/index-Dk9tFDM9.css HTTP/1.1\r\nHost: mysubcription-neftlix.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mysubcription-neftlix.com/\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:38:22 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 05 Sep 2026 17:52:55 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 19327\r\nKeep-Alive: timeout=5, max=100\r\nConnection: Keep-Alive\r\nContent-Type: text/css\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":19327,"size_decoded":19570,"mime_type":"text/css","magic":"ASCII text, with very long lines (19326)","md5":"8f158b5a366c17aff5005612aaf01f5d","sha1":"3e915065b9141fbcd00d4d226bdafb97c3d887ca","sha256":"88dd99c504b250c88869be0c69e3b502b5ab745f06d25f5bdac9310b5cb45590","sha512":"4a3cf8faee7b1772f45f7528394c35f05ca86ddf8dd3eae52d4b19548f48799bd0de3d6575505d4548eed9fce9aad77f64b2cc2a5fafef77c829959d67610cd5","ssdeep":"192:hxwOW9JyW9Jy9NP6RHsfVsfNsf8sf4sfDsfRWcAs1ZLKaSapL05/1TeZNUrxSsfn:rwCNP6RvWCI00TeZNUr3eBG","tlshash":"2092a91d6b18103f6c6784f6f2d4fa4d7119b1c1ef3a5afab9820500afd23b61d96708","first_seen":"2026-09-03T14:47:20.521552Z","last_seen":"2026-09-07T08:36:29.544345Z","times_seen":5,"resource_available":true,"data":null}},"time_used":122,"timings":{"blocked":-1,"dns":0,"connect":28,"send":0,"wait":29,"receive":31,"ssl":34},"alerts":{"ids":null,"analyzer":[{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"mysubcription-neftlix.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"mysubcription-neftlix.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"mysubcription-neftlix.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"mysubcription-neftlix.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Netflix","verdict":"phishing","severity":"medium","comment":"Associated with Netflix phishing","tags":["netflix","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"mysubcription-neftlix.com/assets/background-BEz5IgON.png","fqdn":"mysubcription-neftlix.com","domain":"mysubcription-neftlix.com","tld":"com"},"ip":{"addr":"141.11.243.3","port":443,"asn":201120,"as":"Lebex First International Trading","country":"Lebanon","country_code":"LB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mysubcription-neftlix.com/","date":"2026-09-07T00:38:22.995Z","timestamp":1788741502995,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.mysubcription-neftlix.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 06 Sep 2026 03:51:49 GMT","end":"Sat, 05 Dec 2026 03:51:48 GMT"},"fingerprint":{"sha1":"05:99:2B:FE:75:DB:10:EC:44:C8:6A:CD:63:76:63:B0:3A:B4:2A:42","sha256":"58:7A:8E:0B:D8:85:F3:A2:DE:60:7E:4E:BD:BC:6F:90:F0:BC:82:E1:CA:83:B7:F1:25:29:26:CF:15:BC:8A:7A"}}},"request":{"raw":"GET /assets/background-BEz5IgON.png HTTP/1.1\r\nHost: mysubcription-neftlix.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mysubcription-neftlix.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:38:23 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 05 Sep 2026 17:52:55 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 198254\r\nKeep-Alive: timeout=5, max=98\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":198254,"size_decoded":198498,"mime_type":"image/png","magic":"PNG image data, 1280 x 800, 8-bit/color RGBA, non-interlaced","md5":"18f4ac7ff79e4be92ae7aed378b5eaaf","sha1":"6e558bccc6d209a4a10bb3295668da0fa0807e51","sha256":"6621f4544a0ebcfd965571df19e0e1d8c85df8a7d6acfb9dc2b44c77884aaa72","sha512":"37b42fb06541c7858c6f1b8b215f3215f297408d900dca7b598c2fcde7b4f698a1adfb13d783bdd38c62afd91d076a5996ce7624d8b6317877585cb3625fd96b","ssdeep":"3072:Qd4bITot6GlDeilLGYHclEsEvqttC5TatmITZ+rwqC9k624BbO1W1arZzcmQPFvt:QycTo6GBrlDSEy7XpT0dGzBCQzht","tlshash":"ed142384019ee27a77c5977d69d67988f89a2c3eed3b67b720c387601a97c3c6e01006","first_seen":"2025-10-24T02:29:45.994298Z","last_seen":"2026-09-07T08:36:29.546099Z","times_seen":62,"resource_available":false,"data":null}},"time_used":53,"timings":{"blocked":1,"dns":0,"connect":0,"send":0,"wait":26,"receive":26,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"mysubcription-neftlix.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"mysubcription-neftlix.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"mysubcription-neftlix.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"mysubcription-neftlix.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Netflix","verdict":"phishing","severity":"medium","comment":"Associated with Netflix phishing","tags":["netflix","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"mysubcription-neftlix.com/nficon2016.png","fqdn":"mysubcription-neftlix.com","domain":"mysubcription-neftlix.com","tld":"com"},"ip":{"addr":"141.11.243.3","port":443,"asn":201120,"as":"Lebex First International Trading","country":"Lebanon","country_code":"LB"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://mysubcription-neftlix.com/","date":"2026-09-07T00:38:23.165Z","timestamp":1788741503165,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.mysubcription-neftlix.com","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Sun, 06 Sep 2026 03:51:49 GMT","end":"Sat, 05 Dec 2026 03:51:48 GMT"},"fingerprint":{"sha1":"05:99:2B:FE:75:DB:10:EC:44:C8:6A:CD:63:76:63:B0:3A:B4:2A:42","sha256":"58:7A:8E:0B:D8:85:F3:A2:DE:60:7E:4E:BD:BC:6F:90:F0:BC:82:E1:CA:83:B7:F1:25:29:26:CF:15:BC:8A:7A"}}},"request":{"raw":"GET /nficon2016.png HTTP/1.1\r\nHost: mysubcription-neftlix.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://mysubcription-neftlix.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nDate: Mon, 07 Sep 2026 00:38:23 GMT\r\nServer: Apache\r\nLast-Modified: Sat, 05 Sep 2026 17:52:55 GMT\r\nAccept-Ranges: bytes\r\nContent-Length: 1755\r\nKeep-Alive: timeout=5, max=97\r\nConnection: Keep-Alive\r\nContent-Type: image/png\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Apache HTTP Server","description":"Apache is a free and open-source cross-platform web server software.","website":"https://httpd.apache.org/","common_platform_enumeration":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","icon":"Apache.svg","categories":["Web servers"]}],"data":{"size":1755,"size_decoded":1997,"mime_type":"image/png","magic":"PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced","md5":"3d194514babc5d7d010308a0f808ca51","sha1":"867e51e9b4a474c19da52d6454076c007a9d01f2","sha256":"7341f7b8b0ae3c0da4aea559efc31f0b53d9db9dd291664fdcf7d618fd95ed8a","sha512":"0f74161fa4324dab47e9152d8f771357506935ff028790c08d99bcb84d56ffe148995334e7da079a641994395d19b94615473846b932e44152a21c6ea6b7fc17","ssdeep":"","tlshash":"e731e9e05118afda2ce916cc091244bcdd5b6616c815dad1ecc9b4f82800f0ff5d5d9e","first_seen":"2023-04-21T18:59:15Z","last_seen":"2026-09-21T01:25:45.419078Z","times_seen":3056,"resource_available":false,"data":null}},"time_used":26,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":26,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"mysubcription-neftlix.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"ultradns","sensor_type":"DNS","title":"DigiCert UltraDNS","description":"DigiCert UltraDNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"mysubcription-neftlix.com","verdict":"malicious","severity":"medium","comment":"","link":"https://vercara.digicert.com/ultra-dns-public","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-07","alert":"Sinkholed","trigger":"mysubcription-neftlix.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-07","alert":"Phishing Block","trigger":"mysubcription-neftlix.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Netflix","verdict":"phishing","severity":"medium","comment":"Associated with Netflix phishing","tags":["netflix","phishing"],"meta":null}]}}]}