www-xfintyprotects-com.line.pm Open in urlscan Pro
209.182.194.194 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://gywra.ayyemastore.com/XID-X4DS51878_iambackS
Effective URL:
https://www-xfintyprotects-com.line.pm/section/?apps
Submission: On May 10 via automatic, source phishtank (May 10th 2024, 2:31:21 am UTC) — Scanned from NL

Summary HTTP 9 Redirects Links 77 Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 9 HTTP transactions. The main IP is 209.182.194.194, located in United States and belongs to INMOTION, US. The main domain is www-xfintyprotects-com.line.pm.
TLS certificate: Issued by R3 on May 6th 2024. Valid for: 3 months.

This is the only time www-xfintyprotects-com.line.pm was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Xfinity (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
2	188.114.97.3 188.114.97.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 4	209.182.194.194 209.182.194.194	22611 (INMOTION) (INMOTION)
1	2a02:26f0:480... 2a02:26f0:480:d92::30d4	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2a02:26f0:480... 2a02:26f0:480:36::212:4004	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a02:26f0:480... 2a02:26f0:480:d83::20b	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
9	5

2 188.114.97.3 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)

gywra.ayyemastore.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 209.182.194.194 (United States) 1 redirects

ASN22611 (INMOTION, US)
PTR: vps84344.inmotionhosting.com

www-xfintyprotects-com.line.pm	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:480:d92::30d4 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

static.cimcontent.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:480:36::212:4004 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

login.xfinity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:480:d83::20b (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

assets.xfinity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	line.pm 1 redirects www-xfintyprotects-com.line.pm	421 KB
3	xfinity.com login.xfinity.com — Cisco Umbrella Rank: 29866 assets.xfinity.com — Cisco Umbrella Rank: 38529	32 KB
2	ayyemastore.com gywra.ayyemastore.com	1 KB
1	cimcontent.net static.cimcontent.net — Cisco Umbrella Rank: 30610	30 KB
9	4

	Domain	Requested by
4	www-xfintyprotects-com.line.pm	1 redirects www-xfintyprotects-com.line.pm
2	login.xfinity.com	www-xfintyprotects-com.line.pm
2	gywra.ayyemastore.com
1	assets.xfinity.com	www-xfintyprotects-com.line.pm
1	static.cimcontent.net	www-xfintyprotects-com.line.pm
9	5

This site contains links to these domains. Also see Links.

Domain
www.xfinity.com
www.xfinityprepaid.com
customer.xfinity.com
business.comcast.com
jss.xfinity.com
xfinityconnect.email.comcast.net
connect.xfinity.com
oauth.xfinity.com
my.xfinity.com
xfinity.comcast.net
idm.xfinity.com
corporate.comcast.com
jobs.comcast.com
www.effectv.com
speedtest.xfinity.com
alter.the-colors-sagl.ch
twitter.com
www.facebook.com
www.youtube.com

Subject Issuer	Validity	Valid
ayyemastore.com GTS CA 1P5	`2024-03-20` - `2024-06-18`	3 months	crt.sh
www-xfintyprotects-com.line.pm R3	`2024-05-06` - `2024-08-04`	3 months	crt.sh
static.cimcontent.net COMODO RSA Organization Validation Secure Server CA	`2024-03-19` - `2025-03-19`	a year	crt.sh
login.xfinity.com COMODO RSA Organization Validation Secure Server CA	`2023-10-18` - `2024-10-17`	a year	crt.sh
t.xfinity.com COMODO RSA Organization Validation Secure Server CA	`2024-04-22` - `2025-04-22`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www-xfintyprotects-com.line.pm/section/?apps
Frame ID: 425E77728DD72A1248655DEFE9BDCCFD
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

S᠍ig᠍n in t᠍o Xf᠍ini᠍ty

Page URL History Show full URLs

https://gywra.ayyemastore.com/XID-X4DS51878_iambackS Page URL
https://www-xfintyprotects-com.line.pm/section?apps HTTP 301
https://www-xfintyprotects-com.line.pm/section/?apps Page URL

Page Statistics

9
Requests

100 %
HTTPS

60 %
IPv6

4
Domains

5
Subdomains

5
IPs

3
Countries

483 kB
Transfer

490 kB
Size

2
Cookies

77 Outgoing links

These are links going to different origins than the main page.

URL: https://www.xfinity.com/?INTCMP=ILC:MA:GEN:GEN5b9ab8ad1e540

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/internet-service
Title: Overview

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/deals/internet
Title: Internet Deals

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/internet-service/modems-and-routers
Title: Equipment

Search URL Search Domain Scan URL

URL: https://www.xfinityprepaid.com/prepaid-internet
Title: Prepaid Internet

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/internet-service/internet-essentials
Title: Internet Essentials

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/gig
Title: Gig-speed Internet

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/mobile-service
Title: Overview

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/deals/internet-and-mobile
Title: Internet + Mobile Deals

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/digital-cable-tv
Title: Overview

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/digital-cable-tv/x1
Title: X1 TV

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/flex
Title: Flex Streaming

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/nowtv
Title: NOW TV

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/channel-lineup-bundles
Title: Channel Lineup

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/digital-cable-tv/add-channels
Title: Add-on Channels

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/digital-cable-tv/latino
Title: Latino

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/home-security
Title: Overview

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/home-security/professional-monitoring?pc=1
Title: Professional Monitoring

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/home-security/self-protection
Title: Self Protection

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/home-phone-services
Title: Overview

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/home-phone-services/voice-unlimited-features
Title: Features

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/home-phone-services/equipment
Title: Equipment

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/buy/plan/gbboffers?CMP=ILC_shop_dss-myaccount-dev_au
Title: Change Plan

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/deals
Title: Featured Deals

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/offers
Title: Build Your Plan

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/student
Title: Student Offers

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/rewards
Title: Rewards

Search URL Search Domain Scan URL

URL: https://customer.xfinity.com/rewards
Title: Rewards

Search URL Search Domain Scan URL

URL: https://business.comcast.com/?utm_source=dotnet&utm_campaign=gn2
Title: Comcast Business

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/local/store-offers
Title: Find a Store

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/digital/offers/plan-builder
Title: Cart

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/buy/plan/offersFilter?upgrade=true
Title: Cart

Search URL Search Domain Scan URL

URL: https://jss.xfinity.com/securelogin/cima?sc_site=dss-dotcom&continue=https%3A%2F%2Fcustomer.xfinity.com
Title: Sign In

Search URL Search Domain Scan URL

URL: https://customer.xfinity.com/billing
Title: Billing

Search URL Search Domain Scan URL

URL: https://customer.xfinity.com/settings
Title: Account and Identity

Search URL Search Domain Scan URL

URL: https://customer.xfinity.com/
Title: Order history

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/moving
Title: Move to new address

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/moving
Title: Move to new address

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/support
Title: Support

Search URL Search Domain Scan URL

URL: https://xfinityconnect.email.comcast.net/
Title: You have unread emailsCheck Email

Search URL Search Domain Scan URL

URL: https://connect.xfinity.com/voice
Title: You have unread emailsCheck Voicemail

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/stream/
Title: Watch TV Online

Search URL Search Domain Scan URL

URL: https://oauth.xfinity.com/oauth/sp-logout?client_id=shoplearn-web
Title: Sign out

Search URL Search Domain Scan URL

URL: https://customer.xfinity.com/?adobe_mc_ref=https%3A%2F%2Fjss.xfinity.com%2F#/settings/account/linked-accounts
Title: Manage or link accounts

Search URL Search Domain Scan URL

URL: http://my.xfinity.com/terms/web/
Title: Terms of Service

Search URL Search Domain Scan URL

URL: http://xfinity.comcast.net/privacy/
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://customer.xfinity.com/lite
Title: Pay any balance without signing in

Search URL Search Domain Scan URL

URL: https://idm.xfinity.com/myaccount/lookup?continue=https%3A%2F%2Flogin.xfinity.com%2Flogin%3FmaxAuthnAge%3D900%26r%3Dcomcast.net%26s%3Doauth%26continue%3Dhttps%253A%252F%252Foauth.xfinity.com%252F%252Foauth%252Fauthorize%253Fclient_id%253Dx--d2.prod.new.cmsplatform%2526response_mode%253Dform_post%2526redirect_uri%253Dhttps%25253a%25252f%25252fjss.xfinity.com%25252fsignin-cima%2526response_type%253Dcode%2526scope%253Dopenid%252Bprofile%252Bemail%252Baddress%252Boffline_access%252Bphone%252Burn%25253ambo%25253ascope%25253aaccount%25253aonbehalf%252Burn%25253acsp%25253ascope%25253achannel-lineup%252Burn%25253acima%25253acrs%25253aitem%25253acreate%252BXFN_SC_USER%252BXFN_SSM_ORDER%252BXFN_SOO_QUAP%252Bsoo%25253abilling%252Bxcp%25253aconsent%25253aread%252Bxcp%25253aconsent%25253aaccept%252Bxcp%25253acheckout%25253astatus%25253aget%252Bxcp%25253aacp%25253aenrollment%25253acreate%252Bxcp%25253aacp%25253aenrollment%25253aread%252Bxcp%25253aconsent%25253apresent%252Bxcp%25253aacp%25253aenrollment%25253aupdate%2526state%253DOpenIdConnect.AuthenticationProperties%25253dWKuwNjMPd4CikvgQC8rzxpoDRSoD2q4U0DrpXU1nk1c4xSdOKOUfAy9FyBAuPxA4nbo-pcxCf1jiYkJLlXaHNDe41QHHrQgNO4qFx17UMR26cQ6o6ivPXH2WF04fGmaUv-0daty6QO30lj-Pvsdk0T2km5P__Wj5-y7y39KOAswogigvQblN3-vf8gAxTE_07kHUmbhlut3vrdszXdG5tjvIoH6xEYVHCNQ03gC4vrUwYBn_GaweC3oU-zhlysY4aaK4F3zqWtlz3TUxXaesrA3fdT5ze1KqBGVK-5jmY0Sq2cx5mzG9cB8QNq6NpimpWumxQl5t1KPVBPfhdEKwBnNoDEWReY-9QchbT7n7QzbCpyKJkqsrkjylChx7NaxKlhvhzA%2526max_age%253D900%2526response%253D1%2526reqId%253Dbd9e8a91-b0c1-45ff-a113-d9bd5189fd2a%26client_id%3Dx--d2.prod.new.cmsplatform%26reqId%3Dda2ca7db-b4dc-4f82-ae3c-6740de25a8c1%26rm%3D2%26ui_style%3Dlight&ui_style=light
Title: Find your Xfinity ID

Search URL Search Domain Scan URL

URL: https://idm.xfinity.com/myaccount/create-uid?continue=https%3A%2F%2Flogin.xfinity.com%2Flogin%3FmaxAuthnAge%3D900%26r%3Dcomcast.net%26s%3Doauth%26continue%3Dhttps%253A%252F%252Foauth.xfinity.com%252F%252Foauth%252Fauthorize%253Fclient_id%253Dx--d2.prod.new.cmsplatform%2526response_mode%253Dform_post%2526redirect_uri%253Dhttps%25253a%25252f%25252fjss.xfinity.com%25252fsignin-cima%2526response_type%253Dcode%2526scope%253Dopenid%252Bprofile%252Bemail%252Baddress%252Boffline_access%252Bphone%252Burn%25253ambo%25253ascope%25253aaccount%25253aonbehalf%252Burn%25253acsp%25253ascope%25253achannel-lineup%252Burn%25253acima%25253acrs%25253aitem%25253acreate%252BXFN_SC_USER%252BXFN_SSM_ORDER%252BXFN_SOO_QUAP%252Bsoo%25253abilling%252Bxcp%25253aconsent%25253aread%252Bxcp%25253aconsent%25253aaccept%252Bxcp%25253acheckout%25253astatus%25253aget%252Bxcp%25253aacp%25253aenrollment%25253acreate%252Bxcp%25253aacp%25253aenrollment%25253aread%252Bxcp%25253aconsent%25253apresent%252Bxcp%25253aacp%25253aenrollment%25253aupdate%2526state%253DOpenIdConnect.AuthenticationProperties%25253dWKuwNjMPd4CikvgQC8rzxpoDRSoD2q4U0DrpXU1nk1c4xSdOKOUfAy9FyBAuPxA4nbo-pcxCf1jiYkJLlXaHNDe41QHHrQgNO4qFx17UMR26cQ6o6ivPXH2WF04fGmaUv-0daty6QO30lj-Pvsdk0T2km5P__Wj5-y7y39KOAswogigvQblN3-vf8gAxTE_07kHUmbhlut3vrdszXdG5tjvIoH6xEYVHCNQ03gC4vrUwYBn_GaweC3oU-zhlysY4aaK4F3zqWtlz3TUxXaesrA3fdT5ze1KqBGVK-5jmY0Sq2cx5mzG9cB8QNq6NpimpWumxQl5t1KPVBPfhdEKwBnNoDEWReY-9QchbT7n7QzbCpyKJkqsrkjylChx7NaxKlhvhzA%2526max_age%253D900%2526response%253D1%2526reqId%253Dbd9e8a91-b0c1-45ff-a113-d9bd5189fd2a%26client_id%3Dx--d2.prod.new.cmsplatform%26reqId%3Dda2ca7db-b4dc-4f82-ae3c-6740de25a8c1%26rm%3D2%26ui_style%3Dlight&ui_style=light
Title: Create a new Xfinity ID

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/stream/collection/sports

Search URL Search Domain Scan URL

URL: https://corporate.comcast.com/company
Title: About Comcast

Search URL Search Domain Scan URL

URL: https://business.comcast.com/
Title: Comcast Business

Search URL Search Domain Scan URL

URL: https://jobs.comcast.com/
Title: Careers

Search URL Search Domain Scan URL

URL: https://corporate.comcast.com/press
Title: Press Room

Search URL Search Domain Scan URL

URL: https://corporate.comcast.com/
Title: Corporate Site

Search URL Search Domain Scan URL

URL: https://www.effectv.com/?utm_source=xfinity&utm_medium=referral&utm_campaign=advertise_with_us&utm_content=footer
Title: Advertise with Us

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/site-map
Title: Sitemap

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/bill-pay
Title: View and Pay Bill

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/hub
Title: Discover Xfinity

Search URL Search Domain Scan URL

URL: https://speedtest.xfinity.com/
Title: Run Internet Speed Test

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/local/
Title: Service in my Area

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/internet-service/wifi
Title: NOW Wifi

Search URL Search Domain Scan URL

URL: https://corporate.comcast.com/hub/customer-experience
Title: Customer Guarantee

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/policies
Title: Customer Agreements and Policies

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/corporate/legal/visitoragreement
Title: Visitor Agreement

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/policies/internet-broadband-disclosures
Title: Xfinity Internet Broadband Disclosures

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/privacy
Title: Privacy Center

Search URL Search Domain Scan URL

URL: https://corporate.comcast.com/impact
Title: Social Responsibility

Search URL Search Domain Scan URL

URL: https://alter.the-colors-sagl.ch/
Title: Español

Search URL Search Domain Scan URL

URL: https://twitter.com/XFINITY

Search URL Search Domain Scan URL

URL: https://www.facebook.com/xfinity

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/xfinity?feature=results_main0

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/terms
Title: Web Terms Of Service

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/privacy/policy/staterights#california
Title: CA Notice at Collection

Search URL Search Domain Scan URL

URL: http://www.xfinity.com/privacy/policy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/privacy/manage-preference
Title: Your Privacy Choices

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/adinformation
Title: Ad Choices

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://gywra.ayyemastore.com/XID-X4DS51878_iambackS Page URL
https://www-xfintyprotects-com.line.pm/section?apps HTTP 301
https://www-xfintyprotects-com.line.pm/section/?apps Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 XID-X4DS51878_iambackS Show response
gywra.ayyemastore.com/ 97 B
526 B 538ms
502ms Document
text/html 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://gywra.ayyemastore.com/XID-X4DS51878_iambackS
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 709bc56bdbf2786c3c0b73db53017fd6487f641562bc6d2042520af46cc6ba56

Request headers

Accept-Language: nl-NL,nl;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8816831c185606c2-AMS
content-encoding: br
content-type: text/html; charset=UTF-8
date: Fri, 10 May 2024 02:31:17 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HXLkhoAacSKh%2Ft04zyQh6b3E5CPc3q96pw%2BzrFnpMGR0Qe2yCahVyD%2BsDdomNZvqF7zBNbhTT%2FLkpF%2BTAi7BiGN3LrWFtVUxE3OWYoq7XiPa%2FDxJgy%2BZimQe%2B35WTexylQIgUim9J0Q%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H/1.1

200
OK

Primary Request / Show response
www-xfintyprotects-com.line.pm/section/
Redirect Chain

https://www-xfintyprotects-com.line.pm/section?apps
https://www-xfintyprotects-com.line.pm/section/?apps

243 KB
243 KB

311ms
311ms

Document
text/html

209.182.194.194
INMOTION

General

Check archive.org

Show headers Download Go to

Full URL: https://www-xfintyprotects-com.line.pm/section/?apps
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.182.194.194 , United States, ASN22611 (INMOTION, US),
Reverse DNS: vps84344.inmotionhosting.com
Software: Apache /
Resource Hash: fb7b1c55026ae079072394b06df2e4cd107f17fe16c4ccbc93ac20e08ad584c2

Request headers

Accept-Language: nl-NL,nl;q=0.9;q=0.9
Referer: https://gywra.ayyemastore.com/XID-X4DS51878_iambackS
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Cache-Control: no-store, no-cache, must-revalidate
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Fri, 10 May 2024 02:31:18 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive: timeout=5, max=99
Pragma: no-cache
Server: Apache
Transfer-Encoding: chunked

Redirect headers

Connection: Keep-Alive
Content-Length: 260
Content-Type: text/html; charset=iso-8859-1
Date: Fri, 10 May 2024 02:31:18 GMT
Keep-Alive: timeout=5, max=100
Location: https://www-xfintyprotects-com.line.pm/section/?apps
Server: Apache

GET
H3 200 favicon.ico
gywra.ayyemastore.com/ 97 B
531 B 507ms
507ms Other
text/html 188.114.97.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://gywra.ayyemastore.com/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://gywra.ayyemastore.com/XID-X4DS51878_iambackS
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 10 May 2024 02:31:18 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Fri, 10 May 2024 00:25:06 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GSJL3jvdAfpb%2Bq2eyq%2F6wne0exG1AUOBU5K6bO4do3jUvhCUThhjUAwqWXiXxqsxglThFpR0MvCrj3bhtJ9wGed8OlqI7wiMpXNO2hmDjtBb9LTbUeaHUiQxbWFAM0UXBwQPaEoBf6M%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=UTF-8
cache-control: max-age=14400
cf-ray: 8816831f5a2e06c2-AMS
alt-svc: h3=":443"; ma=86400

GET
H/1.1 200
OK prism-ui-3a99e7e.css
www-xfintyprotects-com.line.pm/section/css/ 67 KB
67 KB 482ms
162ms Stylesheet
text/css 209.182.194.194
INMOTION

General

Check archive.org

Show headers Download Go to

Full URL: https://www-xfintyprotects-com.line.pm/section/css/prism-ui-3a99e7e.css
Requested by: Host: www-xfintyprotects-com.line.pm
URL: https://www-xfintyprotects-com.line.pm/section/?apps
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.182.194.194 , United States, ASN22611 (INMOTION, US),
Reverse DNS: vps84344.inmotionhosting.com
Software: Apache /
Resource Hash: fba8ff747e294c69c1a8dc31a5e63b3d50e69ae18fd8370032e3d15638e5451b

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www-xfintyprotects-com.line.pm/section/?apps
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Fri, 10 May 2024 02:31:19 GMT
Last-Modified: Tue, 21 Nov 2023 00:42:04 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 68105

GET
H/1.1 200
OK bundle-3a99e7e.css
www-xfintyprotects-com.line.pm/section/css/ 110 KB
110 KB 483ms
163ms Stylesheet
text/css 209.182.194.194
INMOTION

General

Check archive.org

Show headers Download Go to

Full URL: https://www-xfintyprotects-com.line.pm/section/css/bundle-3a99e7e.css
Requested by: Host: www-xfintyprotects-com.line.pm
URL: https://www-xfintyprotects-com.line.pm/section/?apps
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 209.182.194.194 , United States, ASN22611 (INMOTION, US),
Reverse DNS: vps84344.inmotionhosting.com
Software: Apache /
Resource Hash: 6a436dc04735f8b8ff82fe5fcc8eaab3a70865e34106542e593ddf343b83a833

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www-xfintyprotects-com.line.pm/section/?apps
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Fri, 10 May 2024 02:31:19 GMT
Last-Modified: Wed, 22 Nov 2023 21:46:22 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 112560

GET
H2 200 dmsans-regular.woff2
static.cimcontent.net/common-web-assets/fonts/dm-sans/ 29 KB
30 KB 259ms
23ms Font
binary/octet-stream 2a02:26f0:480:d92::30d4
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cimcontent.net/common-web-assets/fonts/dm-sans/dmsans-regular.woff2
Requested by: Host: www-xfintyprotects-com.line.pm
URL: https://www-xfintyprotects-com.line.pm/section/?apps
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:d92::30d4 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 40aefc09f33205666c2c42f20d54285147ae9434ef5f8018481950fd67ddcb68

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www-xfintyprotects-com.line.pm/
Origin: https://www-xfintyprotects-com.line.pm
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: .VwE8.xtYrLeNhxXddGrHq9UFI6lm0d0
date: Fri, 10 May 2024 02:31:19 GMT
last-modified: Wed, 20 Sep 2023 04:13:23 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P8
etag: "b9d5e5cad821648da76e2fedb6c6a680"
x-amz-server-side-encryption: AES256
content-type: binary/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 29920
x-amz-cf-id: OxaXkpkmkIil3Ql79oi-scNczgBKevRqEotqD5-R657cozYvkjpVcw==

GET
H2 200 xfinity-logo-grey.svg
login.xfinity.com/static/images/global/ 939 B
1 KB 809ms
326ms Image
image/svg+xml 2a02:26f0:480:36::212:4004
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://login.xfinity.com/static/images/global/xfinity-logo-grey.svg

Requested by

Host: www-xfintyprotects-com.line.pm
URL: https://www-xfintyprotects-com.line.pm/section/css/bundle-3a99e7e.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:480:36::212:4004 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

15334e1a1a24d9f0f0a3daaedc6f438e3bdd6ef11d7fefb7d37e3208094c7089

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www-xfintyprotects-com.line.pm/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
date: Fri, 10 May 2024 02:31:20 GMT
last-modified: Fri, 03 May 2024 16:25:56 GMT
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 539
expires: Fri, 10 May 2024 02:31:20 GMT

GET
H2 200 Xfinity%20Refreshed%20SIPs%20Live%20Sports_Live%20Sports%20960x1200%20.jpg
assets.xfinity.com/assets/cima/login/default/ad/ 29 KB
30 KB 147ms
49ms Image
image/avif 2a02:26f0:480:d83::20b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.xfinity.com/assets/cima/login/default/ad/Xfinity%20Refreshed%20SIPs%20Live%20Sports_Live%20Sports%20960x1200%20.jpg
Requested by: Host: www-xfintyprotects-com.line.pm
URL: https://www-xfintyprotects-com.line.pm/section/css/bundle-3a99e7e.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:480:d83::20b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Akamai Image Manager /
Resource Hash: 614fca8206cb1fe724406e8dd702a88afd1becaeb87b6026126301258babc5b0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www-xfintyprotects-com.line.pm/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 10 May 2024 02:31:19 GMT
last-modified: Sat, 13 Jan 2024 18:15:47 GMT
server: Akamai Image Manager
etag: "b57b9f3c64fcda5af3ee2df9d7fddefd"
content-type: image/avif
cache-control: private, no-transform, max-age=1777752
server-timing: cdn-cache; desc=HIT, edge; dur=24, origin; dur=0, ak_p; desc="1715308279910_34911175_108493361_2454_1934_22_47_219";dur=1
x-robots-tag: index, follow
content-length: 30114
expires: Thu, 30 May 2024 16:20:31 GMT

GET
H2 200 favicon.ico
login.xfinity.com/static/images/favicon/ 11 KB
1 KB 852ms
380ms Other
image/x-icon 2a02:26f0:480:36::212:4004
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://login.xfinity.com/static/images/favicon/favicon.ico

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:480:36::212:4004 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

aa050de8862f7eaa8ea290eb9612bf949d6a2c8a6ea60ce60df5af3697c89a7d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://www-xfintyprotects-com.line.pm/
Accept-Language: nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
date: Fri, 10 May 2024 02:31:20 GMT
last-modified: Fri, 03 May 2024 16:25:56 GMT
vary: Accept-Encoding
content-type: image/x-icon
accept-ranges: bytes
content-length: 998

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Xfinity (Consumer)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			www-xfintyprotects-com.line.pm/	1969-12-31 23:59:59	Name: PHPSESSID Value: 0c3f4a4eb0b4795ec9aefd130b174967
			login.xfinity.com/	1970-01-20 20:38:33	Name: AWSALBCORS Value: FM+piX2HNitfHIuKVMhWzdYwi4176QYT7edy9Cz4ZYoe0yeO3zmeOi0eqJ2CdIk/cs2JYb3zKyObX/CodYYMTttxubJzwSe/vXQYNSimVQzHTYszAj62y5Z9s3jA

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://www-xfintyprotects-com.line.pm/section/?apps Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www-xfintyprotects-com.line.pm/section/?apps Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.xfinity.com
gywra.ayyemastore.com
login.xfinity.com
static.cimcontent.net
www-xfintyprotects-com.line.pm
188.114.97.3
209.182.194.194
2a02:26f0:480:36::212:4004
2a02:26f0:480:d83::20b
2a02:26f0:480:d92::30d4
15334e1a1a24d9f0f0a3daaedc6f438e3bdd6ef11d7fefb7d37e3208094c7089
40aefc09f33205666c2c42f20d54285147ae9434ef5f8018481950fd67ddcb68
614fca8206cb1fe724406e8dd702a88afd1becaeb87b6026126301258babc5b0
6a436dc04735f8b8ff82fe5fcc8eaab3a70865e34106542e593ddf343b83a833
709bc56bdbf2786c3c0b73db53017fd6487f641562bc6d2042520af46cc6ba56
aa050de8862f7eaa8ea290eb9612bf949d6a2c8a6ea60ce60df5af3697c89a7d
fb7b1c55026ae079072394b06df2e4cd107f17fe16c4ccbc93ac20e08ad584c2
fba8ff747e294c69c1a8dc31a5e63b3d50e69ae18fd8370032e3d15638e5451b

www-xfintyprotects-com.line.pm Open in urlscan Pro 209.182.194.194 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

9 Requests

100 %HTTPS

60 %IPv6

4 Domains

5 Subdomains

5 IPs

3 Countries

483 kBTransfer

490 kBSize

2 Cookies

77 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

2 Cookies

2 Console Messages

Indicators

www-xfintyprotects-com.line.pm Open in urlscan Pro
209.182.194.194 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

60 %
IPv6

4
Domains

5
Subdomains

5
IPs

3
Countries

483 kB
Transfer

490 kB
Size

2
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!