sosfreeway.com Open in urlscan Pro
68.178.247.189  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response sosfreeway.com/services/direct/appsuit.boxverify/	8 KB 3 KB	344ms 323ms	Document text/html	68.178.247.189 AS-26496-GO-DADDY...
General Check archive.org Show headers Download Go to Full URL http://sosfreeway.com/services/direct/appsuit.boxverify/ Protocol HTTP/1.1 Server 68.178.247.189 , United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US), Reverse DNS ip-68-178-247-189.ip.secureserver.net Software Apache / PHP/7.4.24 Resource Hash 6ee76882cbbcf444ad1b574aac9c955ff56d58d9769c54e45df333c766e2ae97 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers Date Wed, 15 Dec 2021 13:26:04 GMT Server Apache X-Powered-By PHP/7.4.24 Upgrade h2,h2c Connection Upgrade, Keep-Alive Vary Accept-Encoding Content-Encoding gzip Content-Length 2829 Keep-Alive timeout=5 Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	s56960402459371.txt Show response sosfreeway.com/services/direct/appsuit.boxverify/css/	6 KB 2 KB	158ms 157ms	Script text/plain	68.178.247.189 AS-26496-GO-DADDY...
General Check archive.org Show headers Download Go to Full URL http://sosfreeway.com/services/direct/appsuit.boxverify/css/s56960402459371.txt Requested by Host: sosfreeway.com URL: http://sosfreeway.com/services/direct/appsuit.boxverify/ Protocol HTTP/1.1 Server 68.178.247.189 , United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US), Reverse DNS ip-68-178-247-189.ip.secureserver.net Software Apache / Resource Hash f17ff5a6fe7c7f0422b0d9f3c11aabc7fa9d11909ea10f322d788759d9e8c35f Request headers Accept-Language de-DE,de;q=0.9 Referer http://sosfreeway.com/services/direct/appsuit.boxverify/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 13:26:04 GMT Content-Encoding gzip Last-Modified Mon, 11 Mar 2019 15:14:40 GMT Server Apache ETag "2d60a09-177b-583d3080d9800-gzip" Vary Accept-Encoding Content-Type text/plain Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5 Content-Length 1862
GET H/1.1	200 OK	styles-light.css sosfreeway.com/services/direct/appsuit.boxverify/css/	47 KB 11 KB	317ms 317ms	Stylesheet text/css	68.178.247.189 AS-26496-GO-DADDY...
General Check archive.org Show headers Download Go to Full URL http://sosfreeway.com/services/direct/appsuit.boxverify/css/styles-light.css Requested by Host: sosfreeway.com URL: http://sosfreeway.com/services/direct/appsuit.boxverify/ Protocol HTTP/1.1 Server 68.178.247.189 , United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US), Reverse DNS ip-68-178-247-189.ip.secureserver.net Software Apache / Resource Hash 1a7c842e1a53dff43b7c508664bd05a1c0a702024f20d7402b1e8d0c4a6d5ce3 Request headers Accept-Language de-DE,de;q=0.9 Referer http://sosfreeway.com/services/direct/appsuit.boxverify/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 13:26:05 GMT Content-Encoding gzip Last-Modified Mon, 11 Mar 2019 15:14:40 GMT Server Apache ETag "2d60a00-bb42-583d3080d9800-gzip" Vary Accept-Encoding Upgrade h2,h2c Connection Upgrade, Keep-Alive Accept-Ranges bytes Content-Type text/css Keep-Alive timeout=5 Content-Length 11190
GET H/1.1	200 OK	u.gif sosfreeway.com/services/direct/appsuit.boxverify/css/	42 B 334 B	314ms 314ms	Image image/gif	68.178.247.189 AS-26496-GO-DADDY...
General Check archive.org Show headers Download Go to Show image Full URL http://sosfreeway.com/services/direct/appsuit.boxverify/css/u.gif Requested by Host: sosfreeway.com URL: http://sosfreeway.com/services/direct/appsuit.boxverify/ Protocol HTTP/1.1 Server 68.178.247.189 , United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US), Reverse DNS ip-68-178-247-189.ip.secureserver.net Software Apache / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers Accept-Language de-DE,de;q=0.9 Referer http://sosfreeway.com/services/direct/appsuit.boxverify/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 13:26:05 GMT Last-Modified Mon, 11 Mar 2019 15:14:40 GMT Server Apache ETag "2d609fc-2a-583d3080d9800" Upgrade h2,h2c Connection Upgrade, Keep-Alive Accept-Ranges bytes Content-Type image/gif Keep-Alive timeout=5 Content-Length 42
GET H/1.1	200 OK	event.gif sosfreeway.com/services/direct/appsuit.boxverify/css/	42 B 334 B	316ms 316ms	Image image/gif	68.178.247.189 AS-26496-GO-DADDY...
General Check archive.org Show headers Download Go to Show image Full URL http://sosfreeway.com/services/direct/appsuit.boxverify/css/event.gif Requested by Host: sosfreeway.com URL: http://sosfreeway.com/services/direct/appsuit.boxverify/ Protocol HTTP/1.1 Server 68.178.247.189 , United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US), Reverse DNS ip-68-178-247-189.ip.secureserver.net Software Apache / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers Accept-Language de-DE,de;q=0.9 Referer http://sosfreeway.com/services/direct/appsuit.boxverify/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 13:26:05 GMT Last-Modified Mon, 11 Mar 2019 15:14:40 GMT Server Apache ETag "2d60a05-2a-583d3080d9800" Upgrade h2,h2c Connection Upgrade, Keep-Alive Accept-Ranges bytes Content-Type image/gif Keep-Alive timeout=5 Content-Length 42
GET H/1.1	200 OK	1552309210.jpg sosfreeway.com/services/direct/appsuit.boxverify/css/	98 KB 99 KB	159ms 159ms	Image image/jpeg	68.178.247.189 AS-26496-GO-DADDY...
General Check archive.org Show headers Download Go to Show image Full URL http://sosfreeway.com/services/direct/appsuit.boxverify/css/1552309210.jpg Requested by Host: sosfreeway.com URL: http://sosfreeway.com/services/direct/appsuit.boxverify/ Protocol HTTP/1.1 Server 68.178.247.189 , United States, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US), Reverse DNS ip-68-178-247-189.ip.secureserver.net Software Apache / Resource Hash 312f962a0529345cc501c80eca1d0915a4d8bca3eee122fbcf2399c4b45fe5a5 Request headers Accept-Language de-DE,de;q=0.9 Referer http://sosfreeway.com/services/direct/appsuit.boxverify/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Date Wed, 15 Dec 2021 13:26:05 GMT Last-Modified Mon, 11 Mar 2019 22:27:12 GMT Server Apache ETag "2d609f9-18934-583d912e9b000" Content-Type image/jpeg Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5 Content-Length 100660
GET DATA	200 OK	truncated /	933 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 4bd9c8ed57b1dd8fddcc2910170e9b81b40f7b628e272924e88a98f45ebb9aea Request headers Accept-Language de-DE,de;q=0.9 Referer http://sosfreeway.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	3 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 58fd862aaa51daaa186ee3fecfd805c0f8eea09146e9c7deb44a3f30a1ad01b5 Request headers Accept-Language de-DE,de;q=0.9 Referer http://sosfreeway.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	XfinityStandard-Regular.woff2 sdx.xfinity.com/fonts/latest/Xfinity_Standard/	26 KB 26 KB	162ms 8ms	Font font/woff2	2a02:26f0:7100:187::1b62 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://sdx.xfinity.com/fonts/latest/Xfinity_Standard/XfinityStandard-Regular.woff2 Requested by Host: sosfreeway.com URL: http://sosfreeway.com/services/direct/appsuit.boxverify/css/styles-light.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:7100:187::1b62 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AmazonS3 / Resource Hash 138c0ead0fbcd09dd455df9870920e8725b367fbf02ac0cef0c62874000ab176 Request headers Referer http://sosfreeway.com/ Origin http://sosfreeway.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-amz-version-id kLBQWhXkUwwuS0hOSKJ2GQ_XrNE.oQFF last-modified Fri, 24 Jan 2020 21:23:01 GMT server AmazonS3 x-amz-cf-pop HAM50-C1 etag "e3e79cd377b28c1e7ffea64b194136cf" content-type font/woff2 access-control-allow-origin * cache-control max-age=2503287 date Wed, 15 Dec 2021 13:26:05 GMT accept-ranges bytes content-length 26768 x-amz-cf-id ctZL8Pg3IhvrpcZankHvK2jcGZd-lg3Qh7CFpSsydjwACWiNyZowcg==
GET H2	200	XfinityStandard-Light.woff2 sdx.xfinity.com/fonts/latest/Xfinity_Standard/	27 KB 27 KB	161ms 14ms	Font font/woff2	2a02:26f0:7100:187::1b62 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://sdx.xfinity.com/fonts/latest/Xfinity_Standard/XfinityStandard-Light.woff2 Requested by Host: sosfreeway.com URL: http://sosfreeway.com/services/direct/appsuit.boxverify/css/styles-light.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:7100:187::1b62 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AmazonS3 / Resource Hash fc6cd95261064c28600405c9c8dd51813abf8367e85b6e00f0f3031a8338988a Request headers Referer http://sosfreeway.com/ Origin http://sosfreeway.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-amz-version-id wnCwOacXycelzt78IMkr55wWB9WkMd2W last-modified Fri, 24 Jan 2020 21:23:01 GMT server AmazonS3 x-amz-cf-pop FRA56-C1 etag "f05d3ebe80809d82ab14d62a79da544e" content-type font/woff2 access-control-allow-origin * cache-control max-age=2083590 date Wed, 15 Dec 2021 13:26:05 GMT accept-ranges bytes content-length 27420 x-amz-cf-id bYmz0I1vaM5GlInNQB155MmTXOlERyiAfUiexu31wfyjiZ74md2Wcg==
GET H2	200	XfinityStandard-Medium.woff2 sdx.xfinity.com/fonts/latest/Xfinity_Standard/	27 KB 27 KB	166ms 18ms	Font font/woff2	2a02:26f0:7100:187::1b62 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://sdx.xfinity.com/fonts/latest/Xfinity_Standard/XfinityStandard-Medium.woff2 Requested by Host: sosfreeway.com URL: http://sosfreeway.com/services/direct/appsuit.boxverify/css/styles-light.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:7100:187::1b62 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AmazonS3 / Resource Hash 2a031939885bb7efba89d423c9ee7c0fe2bab465f18db63f40a9ae2bd7bc0228 Request headers Referer http://sosfreeway.com/ Origin http://sosfreeway.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers x-amz-version-id 6t4RA2DS89tdf_2IK5vrc9JAOKCy9A40 last-modified Fri, 24 Jan 2020 21:23:01 GMT server AmazonS3 x-amz-cf-pop HAM50-C1 etag "13709eac065721ba8cd0e2d1b6fa8026" content-type font/woff2 access-control-allow-origin * cache-control max-age=2322826 date Wed, 15 Dec 2021 13:26:05 GMT accept-ranges bytes content-length 27152 x-amz-cf-id qhwXRxv5bPLv8RtgaUOkKlMoW9umpZr5V38czexi03jdRSToNLk_zg==

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Xfinity (Consumer)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler function| ValidateLogin

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

sdx.xfinity.com
sosfreeway.com
2a02:26f0:7100:187::1b62
68.178.247.189
138c0ead0fbcd09dd455df9870920e8725b367fbf02ac0cef0c62874000ab176
1a7c842e1a53dff43b7c508664bd05a1c0a702024f20d7402b1e8d0c4a6d5ce3
2a031939885bb7efba89d423c9ee7c0fe2bab465f18db63f40a9ae2bd7bc0228
312f962a0529345cc501c80eca1d0915a4d8bca3eee122fbcf2399c4b45fe5a5
4bd9c8ed57b1dd8fddcc2910170e9b81b40f7b628e272924e88a98f45ebb9aea
58fd862aaa51daaa186ee3fecfd805c0f8eea09146e9c7deb44a3f30a1ad01b5
6ee76882cbbcf444ad1b574aac9c955ff56d58d9769c54e45df333c766e2ae97
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f17ff5a6fe7c7f0422b0d9f3c11aabc7fa9d11909ea10f322d788759d9e8c35f
fc6cd95261064c28600405c9c8dd51813abf8367e85b6e00f0f3031a8338988a