paymnetds-expajsd.20-120-181-158.cprapid.com Open in urlscan Pro
20.120.181.158 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://qrco.de/bfSt7u
Effective URL:
https://paymnetds-expajsd.20-120-181-158.cprapid.com/security-check/signin?verify=cr51_36429
Submission: On October 14 via automatic, source phishtank (October 14th 2024, 1:13:40 am UTC) — Scanned from DE

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 12 HTTP transactions. The main IP is 20.120.181.158, located in United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is paymnetds-expajsd.20-120-181-158.cprapid.com.
TLS certificate: Issued by R10 on October 13th 2024. Valid for: 3 months.

This is the only time paymnetds-expajsd.20-120-181-158.cprapid.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Xfinity (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 1	13.33.187.51 13.33.187.51	16509 (AMAZON-02) (AMAZON-02)
1 11	20.120.181.158 20.120.181.158	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a02:26f0:310... 2a02:26f0:3100:782::30d4	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
12	2

1 13.33.187.51 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-33-187-51.fra60.r.cloudfront.net

qrco.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 20.120.181.158 (United States) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

paymnetds-expajsd.20-120-181-158.cprapid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:3100:782::30d4 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

static.cimcontent.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	cprapid.com 1 redirects paymnetds-expajsd.20-120-181-158.cprapid.com	197 KB
2	cimcontent.net static.cimcontent.net — Cisco Umbrella Rank: 29513	117 KB
1	qrco.de 1 redirects qrco.de — Cisco Umbrella Rank: 85682	369 B
12	3

	Domain	Requested by
11	paymnetds-expajsd.20-120-181-158.cprapid.com	1 redirects paymnetds-expajsd.20-120-181-158.cprapid.com
2	static.cimcontent.net	paymnetds-expajsd.20-120-181-158.cprapid.com
1	qrco.de	1 redirects
12	3

This site contains no links.

Subject Issuer	Validity	Valid
autodiscover.paymnetds-expajsd.20-120-181-158.cprapid.com R10	`2024-10-13` - `2025-01-11`	3 months	crt.sh
static.cimcontent.net COMODO RSA Organization Validation Secure Server CA	`2024-03-19` - `2025-03-19`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://paymnetds-expajsd.20-120-181-158.cprapid.com/security-check/signin?verify=cr51_36429
Frame ID: 3FF34F26AE3C678B68977D81441AF9D2
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in to Xfinity

Page URL History Show full URLs

https://qrco.de/bfSt7u HTTP 302
https://paymnetds-expajsd.20-120-181-158.cprapid.com/?verify HTTP 307
https://paymnetds-expajsd.20-120-181-158.cprapid.com/security-check/signin?verify=cr51_36429 Page URL

Page Statistics

12
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

314 kB
Transfer

413 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://qrco.de/bfSt7u HTTP 302
https://paymnetds-expajsd.20-120-181-158.cprapid.com/?verify HTTP 307
https://paymnetds-expajsd.20-120-181-158.cprapid.com/security-check/signin?verify=cr51_36429 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request signin Show response paymnetds-expajsd.20-120-181-158.cprapid.com/security-check/ Redirect Chain https://qrco.de/bfSt7u https://paymnetds-expajsd.20-120-181-158.cprapid.com/?verify https://paymnetds-expajsd.20-120-181-158.cprapid.com/security-check/signin?verify=cr51_36429	109 KB 9 KB	195ms 195ms	Document text/html	20.120.181.158 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://paymnetds-expajsd.20-120-181-158.cprapid.com/security-check/signin?verify=cr51_36429 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 20.120.181.158 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash `2e4520d1809c27c0844dbdf8d49d433397c0914e86a795921609784c7d6a75a4` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Mon, 14 Oct 2024 01:13:36 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=99 Pragma no-cache Server Apache Transfer-Encoding chunked Vary Accept-Encoding Redirect headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Encoding gzip Content-Type text/html; charset=UTF-8 Date Mon, 14 Oct 2024 01:13:34 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=100 Location https://paymnetds-expajsd.20-120-181-158.cprapid.com/security-check/signin?verify=cr51_36429 Pragma no-cache Server Apache Transfer-Encoding chunked Vary Accept-Encoding
GET H/1.1	404 Not Found	comcast-common.js paymnetds-expajsd.20-120-181-158.cprapid.com/CR51/Assets/kintil/js/	0 0	194ms 193ms	Script text/html	20.120.181.158 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://paymnetds-expajsd.20-120-181-158.cprapid.com/CR51/Assets/kintil/js/comcast-common.js Requested by Host: paymnetds-expajsd.20-120-181-158.cprapid.com URL: https://paymnetds-expajsd.20-120-181-158.cprapid.com/security-check/signin?verify=cr51_36429 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 20.120.181.158 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://paymnetds-expajsd.20-120-181-158.cprapid.com/security-check/signin?verify=cr51_36429 Response headers Keep-Alive timeout=5, max=98 Content-Length 315 Date Mon, 14 Oct 2024 01:13:36 GMT Content-Type text/html; charset=iso-8859-1 Server Apache Connection Keep-Alive
GET H/1.1	200 OK	prism-ui-prism-ui-71fc56d.css paymnetds-expajsd.20-120-181-158.cprapid.com/CR51/Assets/kintil/css/	28 KB 28 KB	380ms 185ms	Stylesheet text/css	20.120.181.158 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://paymnetds-expajsd.20-120-181-158.cprapid.com/CR51/Assets/kintil/css/prism-ui-prism-ui-71fc56d.css Requested by Host: paymnetds-expajsd.20-120-181-158.cprapid.com URL: https://paymnetds-expajsd.20-120-181-158.cprapid.com/security-check/signin?verify=cr51_36429 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 20.120.181.158 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash `7732b415e9d948d679fcb57761cf02030eae505a4645824a837e67ff9454caa5` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://paymnetds-expajsd.20-120-181-158.cprapid.com/security-check/signin?verify=cr51_36429 Response headers Connection Keep-Alive Accept-Ranges bytes Content-Length 28324 Keep-Alive timeout=5, max=97 Date Mon, 14 Oct 2024 01:13:36 GMT Last-Modified Wed, 23 Nov 2022 21:22:16 GMT Content-Type text/css Server Apache
GET H/1.1	200 OK	dist-bundle-71fc56d.css paymnetds-expajsd.20-120-181-158.cprapid.com/CR51/Assets/kintil/css/	36 KB 36 KB	529ms 175ms	Stylesheet text/css	20.120.181.158 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://paymnetds-expajsd.20-120-181-158.cprapid.com/CR51/Assets/kintil/css/dist-bundle-71fc56d.css Requested by Host: paymnetds-expajsd.20-120-181-158.cprapid.com URL: https://paymnetds-expajsd.20-120-181-158.cprapid.com/security-check/signin?verify=cr51_36429 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 20.120.181.158 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash `bd48e1f6c72fa72183b8f4af1fdb7503c8370b8cf5d74286750a0170419a4060` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://paymnetds-expajsd.20-120-181-158.cprapid.com/security-check/signin?verify=cr51_36429 Response headers Connection Keep-Alive Accept-Ranges bytes Content-Length 36472 Keep-Alive timeout=5, max=100 Date Mon, 14 Oct 2024 01:13:36 GMT Last-Modified Thu, 24 Nov 2022 21:36:42 GMT Content-Type text/css Server Apache
GET H/1.1	404 Not Found	prism-ui.esm-71fc56d.js paymnetds-expajsd.20-120-181-158.cprapid.com/CR51/Assets/kintil/js/	0 0	539ms 178ms	Script text/html	20.120.181.158 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://paymnetds-expajsd.20-120-181-158.cprapid.com/CR51/Assets/kintil/js/prism-ui.esm-71fc56d.js Requested by Host: paymnetds-expajsd.20-120-181-158.cprapid.com URL: https://paymnetds-expajsd.20-120-181-158.cprapid.com/security-check/signin?verify=cr51_36429 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 20.120.181.158 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://paymnetds-expajsd.20-120-181-158.cprapid.com Referer https://paymnetds-expajsd.20-120-181-158.cprapid.com/security-check/signin?verify=cr51_36429 Response headers Keep-Alive timeout=5, max=100 Content-Length 315 Date Mon, 14 Oct 2024 01:13:36 GMT Content-Type text/html; charset=iso-8859-1 Server Apache Connection Keep-Alive
GET H/1.1	200 OK	dist-bundle-71fc56d.js Show response paymnetds-expajsd.20-120-181-158.cprapid.com/CR51/Assets/kintil/js/	3 KB 4 KB	355ms 179ms	Script text/javascript	20.120.181.158 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://paymnetds-expajsd.20-120-181-158.cprapid.com/CR51/Assets/kintil/js/dist-bundle-71fc56d.js Requested by Host: paymnetds-expajsd.20-120-181-158.cprapid.com URL: https://paymnetds-expajsd.20-120-181-158.cprapid.com/security-check/signin?verify=cr51_36429 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 20.120.181.158 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash `3881b6dd60b21e24712acb36305369ecb0e49cff3532ba0e04f95f0127415d70` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://paymnetds-expajsd.20-120-181-158.cprapid.com/security-check/signin?verify=cr51_36429 Response headers Connection Keep-Alive Accept-Ranges bytes Content-Length 3572 Keep-Alive timeout=5, max=100 Date Mon, 14 Oct 2024 01:13:36 GMT Last-Modified Tue, 09 Aug 2022 15:11:06 GMT Content-Type text/javascript Server Apache
GET H/1.1	200 OK	global-xfinity-logo-grey.svg paymnetds-expajsd.20-120-181-158.cprapid.com/CR51/Assets/kintil/fonts/	940 B 1 KB	540ms 177ms	Image image/svg+xml	20.120.181.158 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://paymnetds-expajsd.20-120-181-158.cprapid.com/CR51/Assets/kintil/fonts/global-xfinity-logo-grey.svg Requested by Host: paymnetds-expajsd.20-120-181-158.cprapid.com URL: https://paymnetds-expajsd.20-120-181-158.cprapid.com/security-check/signin?verify=cr51_36429 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 20.120.181.158 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash `4c9cd1e48631c33ecbc59d172f84223c2a43848d6c1d68b176d7dbaef8320916` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://paymnetds-expajsd.20-120-181-158.cprapid.com/security-check/signin?verify=cr51_36429 Response headers Connection Keep-Alive Accept-Ranges bytes Content-Length 940 Keep-Alive timeout=5, max=100 Date Mon, 14 Oct 2024 01:13:36 GMT Last-Modified Wed, 10 Aug 2022 02:42:40 GMT Content-Type image/svg+xml Server Apache
GET H/1.1	200 OK	signin paymnetds-expajsd.20-120-181-158.cprapid.com/security-check/	109 KB 109 KB	537ms 192ms	Image text/html	20.120.181.158 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://paymnetds-expajsd.20-120-181-158.cprapid.com/security-check/signin?verify=cr51_36429 Requested by Host: paymnetds-expajsd.20-120-181-158.cprapid.com URL: https://paymnetds-expajsd.20-120-181-158.cprapid.com/security-check/signin?verify=cr51_36429 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 20.120.181.158 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://paymnetds-expajsd.20-120-181-158.cprapid.com/security-check/signin?verify=cr51_36429 Response headers Transfer-Encoding chunked Cache-Control no-store, no-cache, must-revalidate Content-Encoding gzip Pragma no-cache Connection Keep-Alive Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=99 Date Mon, 14 Oct 2024 01:13:36 GMT Content-Type text/html; charset=UTF-8 Vary Accept-Encoding Server Apache
GET H/1.1	200 OK	global-xfinity-logo-grey.svg paymnetds-expajsd.20-120-181-158.cprapid.com/CR51/Assets/kintil/fonts/	940 B 0	1ms 1ms	Image image/svg+xml	20.120.181.158 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://paymnetds-expajsd.20-120-181-158.cprapid.com/CR51/Assets/kintil/fonts/global-xfinity-logo-grey.svg Requested by Host: paymnetds-expajsd.20-120-181-158.cprapid.com URL: https://paymnetds-expajsd.20-120-181-158.cprapid.com/CR51/Assets/kintil/css/dist-bundle-71fc56d.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 20.120.181.158 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash `4c9cd1e48631c33ecbc59d172f84223c2a43848d6c1d68b176d7dbaef8320916` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://paymnetds-expajsd.20-120-181-158.cprapid.com/CR51/Assets/kintil/css/dist-bundle-71fc56d.css Response headers Accept-Ranges bytes Content-Length 940 Date Mon, 14 Oct 2024 01:13:36 GMT Last-Modified Wed, 10 Aug 2022 02:42:40 GMT Content-Type image/svg+xml Server Apache
GET H2	200	dmsans-regular.woff2 static.cimcontent.net/common-web-assets/fonts/dm-sans/	29 KB 30 KB	424ms 91ms	Font binary/octet-stream	2a02:26f0:3100:782::30d4 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://static.cimcontent.net/common-web-assets/fonts/dm-sans/dmsans-regular.woff2 Requested by Host: paymnetds-expajsd.20-120-181-158.cprapid.com URL: https://paymnetds-expajsd.20-120-181-158.cprapid.com/CR51/Assets/kintil/css/prism-ui-prism-ui-71fc56d.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3100:782::30d4 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AmazonS3 / Resource Hash `40aefc09f33205666c2c42f20d54285147ae9434ef5f8018481950fd67ddcb68` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://paymnetds-expajsd.20-120-181-158.cprapid.com Referer https://paymnetds-expajsd.20-120-181-158.cprapid.com/ Response headers cache-control max-age=31536000 etag "b9d5e5cad821648da76e2fedb6c6a680" x-amz-version-id eqDyU9EIxSCK7CgAZan.68AQPY6LisN8 accept-ranges bytes access-control-allow-origin * content-length 29920 x-amz-cf-id DU8wWsnCKCzEJhGes0mDSixA6kEepKmowD9pGkjMgLrq61FCz62Hmg== date Mon, 14 Oct 2024 01:13:37 GMT content-type binary/octet-stream last-modified Thu, 15 Dec 2022 15:23:00 GMT server AmazonS3 x-amz-cf-pop FRA56-P7 x-amz-server-side-encryption AES256
GET H2	200	xfinitybrown-bold.woff2 static.cimcontent.net/common-web-assets/fonts/xfinity-brown-optimized/	87 KB 87 KB	359ms 27ms	Font binary/octet-stream	2a02:26f0:3100:782::30d4 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://static.cimcontent.net/common-web-assets/fonts/xfinity-brown-optimized/xfinitybrown-bold.woff2 Requested by Host: paymnetds-expajsd.20-120-181-158.cprapid.com URL: https://paymnetds-expajsd.20-120-181-158.cprapid.com/CR51/Assets/kintil/css/prism-ui-prism-ui-71fc56d.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:3100:782::30d4 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AmazonS3 / Resource Hash `69420c9db91c689c4ea04655f57a0bcea09b71003f21cd5e56afa71b80f049f0` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://paymnetds-expajsd.20-120-181-158.cprapid.com Referer https://paymnetds-expajsd.20-120-181-158.cprapid.com/ Response headers cache-control max-age=31536000 etag "ee9034e40cbca864ab03bdfab7ea3f8f" x-amz-version-id y2EIvcDlp9Gel4YtKUTg8DpaFj1iUbzp accept-ranges bytes access-control-allow-origin * content-length 88920 x-amz-cf-id LxF9oiXMDfuHxo_PKm6kOPtEgmjrABxdMKPRXNjl76UDWb9FExeW_Q== date Mon, 14 Oct 2024 01:13:37 GMT content-type binary/octet-stream last-modified Mon, 10 Jun 2024 13:07:55 GMT server AmazonS3 x-amz-cf-pop FRA56-P8 x-amz-server-side-encryption AES256
GET H/1.1	200 OK	favicon-favicon.ico paymnetds-expajsd.20-120-181-158.cprapid.com/CR51/Assets/kintil/favicons/	11 KB 11 KB	185ms 185ms	Other image/x-icon	20.120.181.158 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://paymnetds-expajsd.20-120-181-158.cprapid.com/CR51/Assets/kintil/favicons/favicon-favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 20.120.181.158 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Apache / Resource Hash `aa050de8862f7eaa8ea290eb9612bf949d6a2c8a6ea60ce60df5af3697c89a7d` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://paymnetds-expajsd.20-120-181-158.cprapid.com/security-check/signin?verify=cr51_36429 Response headers Connection Keep-Alive Accept-Ranges bytes Content-Length 11078 Keep-Alive timeout=5, max=98 Date Mon, 14 Oct 2024 01:13:37 GMT Last-Modified Tue, 09 Aug 2022 15:11:02 GMT Content-Type image/x-icon Server Apache

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Xfinity (Consumer)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			paymnetds-expajsd.20-120-181-158.cprapid.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 09606b66be53e1d2891b420b4ac355dc

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://paymnetds-expajsd.20-120-181-158.cprapid.com/CR51/Assets/kintil/js/comcast-common.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://paymnetds-expajsd.20-120-181-158.cprapid.com/CR51/Assets/kintil/js/prism-ui.esm-71fc56d.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

paymnetds-expajsd.20-120-181-158.cprapid.com
qrco.de
static.cimcontent.net
13.33.187.51
20.120.181.158
2a02:26f0:3100:782::30d4
2e4520d1809c27c0844dbdf8d49d433397c0914e86a795921609784c7d6a75a4
3881b6dd60b21e24712acb36305369ecb0e49cff3532ba0e04f95f0127415d70
40aefc09f33205666c2c42f20d54285147ae9434ef5f8018481950fd67ddcb68
4c9cd1e48631c33ecbc59d172f84223c2a43848d6c1d68b176d7dbaef8320916
69420c9db91c689c4ea04655f57a0bcea09b71003f21cd5e56afa71b80f049f0
7732b415e9d948d679fcb57761cf02030eae505a4645824a837e67ff9454caa5
aa050de8862f7eaa8ea290eb9612bf949d6a2c8a6ea60ce60df5af3697c89a7d
bd48e1f6c72fa72183b8f4af1fdb7503c8370b8cf5d74286750a0170419a4060
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

paymnetds-expajsd.20-120-181-158.cprapid.com Open in urlscan Pro 20.120.181.158 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

12 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

2 IPs

2 Countries

314 kBTransfer

413 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

1 Cookies

2 Console Messages

Indicators

paymnetds-expajsd.20-120-181-158.cprapid.com Open in urlscan Pro
20.120.181.158 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

2
IPs

2
Countries

314 kB
Transfer

413 kB
Size

1
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!