URL: https://cmp.cws.xfinity.com/utility/tracking/trac=king/ClickedUrl?targetId=3DarLTreZZF-0tPKcPmCi2-FOwwgd5Fnx0-tKimefC83nsk-5...
Submission Tags: phishing
Submission: On August 04 via api from US — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 2 HTTP transactions. The main IP is 2a02:26f0:ab00:382::2c06, located in Frankfurt am Main, Germany and belongs to AKAMAI-ASN1, NL. The main domain is cmp.cws.xfinity.com. The Cisco Umbrella rank of the primary domain is 241758.
TLS certificate: Issued by COMODO RSA Organization Validation Se... on April 4th 2024. Valid for: a year.
This is the only time cmp.cws.xfinity.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 2a02:26f0:ab0... 20940 (AKAMAI-ASN1)
2 1
Apex Domain
Subdomains
Transfer
2 xfinity.com
cmp.cws.xfinity.com — Cisco Umbrella Rank: 241758
425 B
2 1
Domain Requested by
2 cmp.cws.xfinity.com
2 1

This site contains no links.

Subject Issuer Validity Valid
*.cws.xfinity.com
COMODO RSA Organization Validation Secure Server CA
2024-04-04 -
2025-04-04
a year crt.sh

This page contains 1 frames:

Primary Page: https://cmp.cws.xfinity.com/utility/tracking/trac=king/ClickedUrl?targetId=3DarLTreZZF-0tPKcPmCi2-FOwwgd5Fnx0-tKimefC83nsk-5d=xLdqRzapeNn_mip_103&serverId=3Dc3po&templateId=3DNS0mR-KVprh0-xYSzJj8-f5Ks1=BGK-7k6klk5h2nzfu8&targetUrl=3Dhttps://Google.com/amp/qrco.de/xL15Ze2gNjdcX=a94hROKa8pVcwaVwnT2k
Frame ID: 991CC948170AD82D8D17436737685EDF
Requests: 2 HTTP requests in this frame

Screenshot


Page Statistics

2
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

0 kB
Transfer

0 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

2 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request ClickedUrl
cmp.cws.xfinity.com/utility/tracking/trac=king/
16 B
212 B
Document
General
Full URL
https://cmp.cws.xfinity.com/utility/tracking/trac=king/ClickedUrl?targetId=3DarLTreZZF-0tPKcPmCi2-FOwwgd5Fnx0-tKimefC83nsk-5d=xLdqRzapeNn_mip_103&serverId=3Dc3po&templateId=3DNS0mR-KVprh0-xYSzJj8-f5Ks1=BGK-7k6klk5h2nzfu8&targetUrl=3Dhttps://Google.com/amp/qrco.de/xL15Ze2gNjdcX=a94hROKa8pVcwaVwnT2k
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:ab00:382::2c06 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
e50904972996b97686ec1f65a0e5e69de3c30254c4ecd839be7b83bb211f3e53
Security Headers
Name Value
Strict-Transport-Security max-age=86400 ; includeSubDomains

Request headers

Upgrade-Insecure-Requests
1
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

content-length
16
content-type
application/json
date
Sun, 04 Aug 2024 16:10:41 GMT
strict-transport-security
max-age=86400 ; includeSubDomains
x-amz-apigw-id
b_cwREfboAMEZJg=
x-amzn-errortype
InvalidQueryStringException
x-amzn-requestid
8a4769f0-ca79-46bc-9416-02c06056de0d
favicon.ico
cmp.cws.xfinity.com/
23 B
213 B
Other
General
Full URL
https://cmp.cws.xfinity.com/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:ab00:382::2c06 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
12a22880bc2e59f8278b4a5e547567f0aa14d020ea456598267fa00208cfebc5
Security Headers
Name Value
Strict-Transport-Security max-age=86400 ; includeSubDomains

Request headers

Referer
https://cmp.cws.xfinity.com/utility/tracking/trac=king/ClickedUrl?targetId=3DarLTreZZF-0tPKcPmCi2-FOwwgd5Fnx0-tKimefC83nsk-5d=xLdqRzapeNn_mip_103&serverId=3Dc3po&templateId=3DNS0mR-KVprh0-xYSzJj8-f5Ks1=BGK-7k6klk5h2nzfu8&targetUrl=3Dhttps://Google.com/amp/qrco.de/xL15Ze2gNjdcX=a94hROKa8pVcwaVwnT2k
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date
Sun, 04 Aug 2024 16:10:41 GMT
x-amzn-errortype
ForbiddenException
strict-transport-security
max-age=86400 ; includeSubDomains
x-amzn-requestid
a8c80f9e-0963-4bb1-acf5-dd9e1cabc835
content-length
23
x-amz-apigw-id
b_cwTFmdoAMESkA=
content-type
application/json

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

2 Console Messages

Source Level URL
Text
network error URL: https://cmp.cws.xfinity.com/utility/tracking/trac=king/ClickedUrl?targetId=3DarLTreZZF-0tPKcPmCi2-FOwwgd5Fnx0-tKimefC83nsk-5d=xLdqRzapeNn_mip_103&serverId=3Dc3po&templateId=3DNS0mR-KVprh0-xYSzJj8-f5Ks1=BGK-7k6klk5h2nzfu8&targetUrl=3Dhttps://Google.com/amp/qrco.de/xL15Ze2gNjdcX=a94hROKa8pVcwaVwnT2k
Message:
Failed to load resource: the server responded with a status of 400 ()
network error URL: https://cmp.cws.xfinity.com/favicon.ico
Message:
Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=86400 ; includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cmp.cws.xfinity.com
2a02:26f0:ab00:382::2c06
12a22880bc2e59f8278b4a5e547567f0aa14d020ea456598267fa00208cfebc5
e50904972996b97686ec1f65a0e5e69de3c30254c4ecd839be7b83bb211f3e53