f005.backblazeb2.com
Open in
urlscan Pro
149.137.136.16
Malicious Activity!
Public Scan
URL:
https://f005.backblazeb2.com/file/commnexthoodpie/jdajdgajhs.html
Submission Tags: phishing
Submission: On December 14 via api from US — Scanned from IL
Submission Tags: phishing
Submission: On December 14 via api from US — Scanned from IL
Summary
This website contacted 5 IPs
in 2 countries
across 4 domains to perform 10 HTTP transactions.
The main IP is 149.137.136.16, located in
United States and
belongs to BACKBLAZE, US.
The main domain is f005.backblazeb2.com.
The Cisco Umbrella rank of the primary domain is 225313.
TLS certificate: Issued by R10 on November 15th 2024. Valid for: 3 months.
This is the only time f005.backblazeb2.com was scanned on urlscan.io!
TLS certificate: Issued by R10 on November 15th 2024. Valid for: 3 months.
This is the only time f005.backblazeb2.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Xfinity (Consumer)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 2 | 149.137.136.16 149.137.136.16 | 40401 (BACKBLAZE) (BACKBLAZE) | |
| 1 | 104.102.45.70 104.102.45.70 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
| 4 | 104.102.51.229 104.102.51.229 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
| 1 | 2.23.209.184 2.23.209.184 | 20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.) | |
| 10 | 5 |
2
149.137.136.16
(United States)
ASN40401 (BACKBLAZE, US)
PTR: f005.backblazeb2.com
ASN40401 (BACKBLAZE, US)
PTR: f005.backblazeb2.com
| f005.backblazeb2.com |
1
104.102.45.70
(Frankfurt am Main, Germany)
ASN16625 (AKAMAI-AS, US)
PTR: a104-102-45-70.deploy.static.akamaitechnologies.com
ASN16625 (AKAMAI-AS, US)
PTR: a104-102-45-70.deploy.static.akamaitechnologies.com
| cdn.comcast.com |
4
104.102.51.229
(Frankfurt am Main, Germany)
ASN16625 (AKAMAI-AS, US)
PTR: a104-102-51-229.deploy.static.akamaitechnologies.com
ASN16625 (AKAMAI-AS, US)
PTR: a104-102-51-229.deploy.static.akamaitechnologies.com
| static.cimcontent.net |
1
2.23.209.184
(Frankfurt am Main, Germany)
ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)
PTR: a2-23-209-184.deploy.static.akamaitechnologies.com
ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)
PTR: a2-23-209-184.deploy.static.akamaitechnologies.com
| login.xfinity.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 4 |
cimcontent.net
static.cimcontent.net — Cisco Umbrella Rank: 35873 |
173 KB |
| 2 |
backblazeb2.com
f005.backblazeb2.com — Cisco Umbrella Rank: 225313 |
595 KB |
| 1 |
comcast.com
cdn.comcast.com — Cisco Umbrella Rank: 44868 |
9 KB |
| 1 |
xfinity.com
login.xfinity.com — Cisco Umbrella Rank: 34390 Failed |
1 KB |
| 10 | 4 |
| Domain | Requested by | |
|---|---|---|
| 4 | static.cimcontent.net |
f005.backblazeb2.com
cdn.comcast.com |
| 2 | f005.backblazeb2.com |
f005.backblazeb2.com
|
| 1 | cdn.comcast.com |
f005.backblazeb2.com
|
| 1 | login.xfinity.com |
f005.backblazeb2.com
|
| 10 | 4 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| backblazeb2.com R10 |
2024-11-15 - 2025-02-13 |
3 months | crt.sh |
| xapi.xfinity.com COMODO RSA Organization Validation Secure Server CA |
2024-02-27 - 2025-02-26 |
a year | crt.sh |
| static.cimcontent.net COMODO RSA Organization Validation Secure Server CA |
2024-03-19 - 2025-03-19 |
a year | crt.sh |
| login.xfinity.com COMODO RSA Organization Validation Secure Server CA |
2024-10-01 - 2025-10-01 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://f005.backblazeb2.com/file/commnexthoodpie/jdajdgajhs.html
Frame ID: 556BFBC5CD488AE5498EAB0083C8B978
Requests: 13 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
10 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
jdajdgajhs.html
f005.backblazeb2.com/file/commnexthoodpie/ |
595 KB 595 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
prism-ui-cebc627.css
login.xfinity.com/static/resi/dist/prism-ui/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
bundle-cebc627.css
login.xfinity.com/static/resi/dist/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
cookie-consent.css
cdn.comcast.com/cmp/css/ |
58 KB 9 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
75 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
132 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
xfinity-logo-grey.svg
f005.backblazeb2.com/static/images/global/ |
43 B 43 B |
Image
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
dmsans-medium.woff2
static.cimcontent.net/common-web-assets/fonts/dm-sans/ |
29 KB 29 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
dmsans-regular.woff2
static.cimcontent.net/common-web-assets/fonts/dm-sans/ |
29 KB 30 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
xfinitybrown-regular.woff2
static.cimcontent.net/common-web-assets/fonts/xfinity-brown-optimized/ |
84 KB 85 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
dmsans-bold.woff2
static.cimcontent.net/common-web-assets/fonts/dm-sans/ |
29 KB 29 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
favicon.ico
login.xfinity.com/static/images/favicon/ |
11 KB 1 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- login.xfinity.com
- URL
- https://login.xfinity.com/static/resi/dist/prism-ui/prism-ui-cebc627.css
- Domain
- login.xfinity.com
- URL
- https://login.xfinity.com/static/resi/dist/bundle-cebc627.css
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Xfinity (Consumer)1 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 01 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| login.xfinity.com/ | Name: AWSALBCORS Value: AjKQ7zGcaQRMJhp4ZOC4hJv/J3gliZHx6kFKiWbsQgI46BLANjBX6/pfqwFvrSeFhlcyrpRDj08wHSY2I1yQ+hrGf0/Buzza7xbFqsTbnn+zIsBtzkBmIy+JmAqX |
6 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| Strict-Transport-Security | max-age=63072000 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.comcast.com
f005.backblazeb2.com
login.xfinity.com
static.cimcontent.net
login.xfinity.com
104.102.45.70
104.102.51.229
149.137.136.16
2.23.209.184
3fb963f9586e259a7a6d457659d7a09c695fc870283018b981d4d9b0aabb2c9f
40aefc09f33205666c2c42f20d54285147ae9434ef5f8018481950fd67ddcb68
44e0fc67298d6784f10f9cebec5a0656af66c9567f6ad000a64ecd60466aed79
8f76b4202a5a66eaba4bd9a372bb302287dab1f7b897a141a9f0bb9a10b1018d
aa050de8862f7eaa8ea290eb9612bf949d6a2c8a6ea60ce60df5af3697c89a7d
ac7ab1854db99c8278486132a7cef4a5d4f2992fd59488d02b4a5c5a071407d0
ba240ea7ec387524404af496b860f731833d091555eac1ff149600e4c880eb09
da319dcae9d21873bf2ad8b146767e023772a8f0a4fd7446156b3d61b9c83098
dbdc913afccda63f7888675987f5bd3f341e71ca311f4999e1e557d1ad7d2cda
ebec0a242eb62dac37ad10740e7797b748ff93103796ed6509414a751ce86820
f4fc8ea1d0db62d19b2320e0299afe1c60abc0aacb7ba34d4169d56bcc828fe2