payupdate-xfinitya18bd559c14da1a7b21b292c08c3e3.redirectme.net
Open in
urlscan Pro
23.99.200.144
Malicious Activity!
Public Scan
URL:
http://payupdate-xfinitya18bd559c14da1a7b21b292c08c3e3.redirectme.net/connect.communication.appsuite/login
Submission: On October 26 via manual from AT — Scanned from DE
Submission: On October 26 via manual from AT — Scanned from DE
Summary
This website contacted 2 IPs
in 2 countries
across 2 domains to perform 13 HTTP transactions.
The main IP is 23.99.200.144, located in
Des Moines, United States and
belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US.
The main domain is payupdate-xfinitya18bd559c14da1a7b21b292c08c3e3.redirectme.net.
This is the only time payupdate-xfinitya18bd559c14da1a7b21b292c08c3e3.redirectme.net was scanned on urlscan.io!
This is the only time payupdate-xfinitya18bd559c14da1a7b21b292c08c3e3.redirectme.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Xfinity (Consumer)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 11 | 23.99.200.144 23.99.200.144 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
| 2 | 2a02:26f0:170... 2a02:26f0:1700:38d::30d4 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
| 13 | 2 |
11
23.99.200.144
(Des Moines, United States)
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
| payupdate-xfinitya18bd559c14da1a7b21b292c08c3e3.redirectme.net |
2
2a02:26f0:1700:38d::30d4
(Frankfurt am Main, Germany)
ASN20940 (AKAMAI-ASN1, NL)
ASN20940 (AKAMAI-ASN1, NL)
| static.cimcontent.net |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 11 |
redirectme.net
payupdate-xfinitya18bd559c14da1a7b21b292c08c3e3.redirectme.net |
673 KB |
| 2 |
cimcontent.net
static.cimcontent.net — Cisco Umbrella Rank: 21023 |
59 KB |
| 13 | 2 |
| Domain | Requested by | |
|---|---|---|
| 11 | payupdate-xfinitya18bd559c14da1a7b21b292c08c3e3.redirectme.net |
payupdate-xfinitya18bd559c14da1a7b21b292c08c3e3.redirectme.net
|
| 2 | static.cimcontent.net |
payupdate-xfinitya18bd559c14da1a7b21b292c08c3e3.redirectme.net
|
| 13 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| static.cimcontent.net COMODO RSA Organization Validation Secure Server CA |
2022-04-06 - 2023-04-06 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://payupdate-xfinitya18bd559c14da1a7b21b292c08c3e3.redirectme.net/connect.communication.appsuite/login
Frame ID: 4D0BFA7221411EE182BD68FB72272E9B
Requests: 13 HTTP requests in this frame
Screenshot
Page Title
Sign in to XfinityDetected technologies
Bootstrap
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
login
payupdate-xfinitya18bd559c14da1a7b21b292c08c3e3.redirectme.net/connect.communication.appsuite/ |
88 KB 88 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
prism-ui-1dd2967.css
payupdate-xfinitya18bd559c14da1a7b21b292c08c3e3.redirectme.net/connect.communication.appsuite/Assets/css/ |
28 KB 28 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bundle-1dd2967.css
payupdate-xfinitya18bd559c14da1a7b21b292c08c3e3.redirectme.net/connect.communication.appsuite/Assets/css/ |
26 KB 26 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.min.js
payupdate-xfinitya18bd559c14da1a7b21b292c08c3e3.redirectme.net/connect.communication.appsuite/Assets/js/ |
85 KB 85 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.inputmask.bundle.js
payupdate-xfinitya18bd559c14da1a7b21b292c08c3e3.redirectme.net/connect.communication.appsuite/Assets/js/ |
175 KB 175 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.min.js
payupdate-xfinitya18bd559c14da1a7b21b292c08c3e3.redirectme.net/connect.communication.appsuite/Assets/js/ |
48 KB 48 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
popper.min.js
payupdate-xfinitya18bd559c14da1a7b21b292c08c3e3.redirectme.net/connect.communication.appsuite/Assets/js/ |
19 KB 19 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-3.2.1.slim.min.js
payupdate-xfinitya18bd559c14da1a7b21b292c08c3e3.redirectme.net/connect.communication.appsuite/Assets/js/ |
68 KB 68 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.min2.js
payupdate-xfinitya18bd559c14da1a7b21b292c08c3e3.redirectme.net/connect.communication.appsuite/Assets/js/ |
84 KB 84 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.min2.js
payupdate-xfinitya18bd559c14da1a7b21b292c08c3e3.redirectme.net/connect.communication.appsuite/Assets/js/ |
50 KB 50 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
xfinity-logo-grey.svg
payupdate-xfinitya18bd559c14da1a7b21b292c08c3e3.redirectme.net/connect.communication.appsuite/Assets/images/ |
939 B 1 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
dmsans-medium.woff2
static.cimcontent.net/common-web-assets/fonts/dm-sans/ |
29 KB 30 KB |
Font
binary/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
dmsans-regular.woff2
static.cimcontent.net/common-web-assets/fonts/dm-sans/ |
29 KB 30 KB |
Font
binary/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Xfinity (Consumer)14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch object| navigation function| $ function| jQuery function| Inputmask object| bootstrap function| Popper string| rdrt string| f0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
payupdate-xfinitya18bd559c14da1a7b21b292c08c3e3.redirectme.net
static.cimcontent.net
23.99.200.144
2a02:26f0:1700:38d::30d4
15334e1a1a24d9f0f0a3daaedc6f438e3bdd6ef11d7fefb7d37e3208094c7089
40aefc09f33205666c2c42f20d54285147ae9434ef5f8018481950fd67ddcb68
4f3faeec469294b610f6ca82aa1cc2b3368fd56611b31c551c2ee224feadb411
70dae469f94f214b589d53521b903830a08b4fb589d47a4c269a83c79116886a
7115ce0d4120ffaa79b4d845d61e12b3ff2681ac8377558a17da2a9483d89459
7732b415e9d948d679fcb57761cf02030eae505a4645824a837e67ff9454caa5
8e09aa31f396ea41d698f437dc5fc7125e931d400eb2873f5b68ef78c1e6f3a6
a94921b8ec98200b57722e3d0c10cecbb63886c2839e2ff63b8c5b7525bd93d1
b00834c17c50af103e353ef86a69d90bbcaa819ed92b4d6ed670a425514e3c3a
b142bc85b90a80b67c922f0e8b885ddd950c22b36c61016e6756a49988f6962c
d1550d30e03f777fb25a2761e42fd8640fc2891fe3f8319524e5a0f17ede803d
da319dcae9d21873bf2ad8b146767e023772a8f0a4fd7446156b3d61b9c83098
eea61b8b1b43f47f634156d1562716911aecfa98d24de8acbce563c29743fd0d