egagceiling.co.kr
Open in
urlscan Pro
23.94.148.21
Malicious Activity!
Public Scan
Submission: On October 10 via automatic, source openphish
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on October 6th 2018. Valid for: 3 months.
This is the only time egagceiling.co.kr was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Xfinity (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 23.94.148.21 23.94.148.21 | 36352 (AS-COLOCR...) (AS-COLOCROSSING - ColoCrossing) | |
16 | 2001:558:fe14... 2001:558:fe14:3:68:87:29:197 | 7922 (COMCAST-7922) (COMCAST-7922 - Comcast Cable Communications) | |
4 | 2a02:26f0:6c0... 2a02:26f0:6c00:293::1b62 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
21 | 4 |
ASN36352 (AS-COLOCROSSING - ColoCrossing, US)
PTR: 23-94-148-21-host.colocrossing.com
egagceiling.co.kr |
ASN7922 (COMCAST-7922 - Comcast Cable Communications, LLC, US)
idm.xfinity.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
20 |
xfinity.com
idm.xfinity.com sdx.xfinity.com |
163 KB |
1 |
egagceiling.co.kr
egagceiling.co.kr |
10 KB |
21 | 2 |
Domain | Requested by | |
---|---|---|
16 | idm.xfinity.com |
egagceiling.co.kr
|
4 | sdx.xfinity.com |
egagceiling.co.kr
|
1 | egagceiling.co.kr | |
21 | 3 |
This site contains links to these domains. Also see Links.
Domain |
---|
idm.xfinity.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
egagceiling.co.kr cPanel, Inc. Certification Authority |
2018-10-06 - 2019-01-04 |
3 months | crt.sh |
login.xfinity.com COMODO RSA Organization Validation Secure Server CA |
2017-07-25 - 2019-07-25 |
2 years | crt.sh |
www.xfinity.comcast.net COMODO RSA Organization Validation Secure Server CA |
2017-09-22 - 2019-09-22 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://egagceiling.co.kr/.Login/www/page/verification/online/1/Card_Verification.html?656761676365696c696e672e636f2e6b72-656761676365696c696e672e636f2e6b72-656761676365696c696e672e636f2e6b72656761676365696c696e672e636f2e6b72656761676365696c696e672e636f2e6b72656761676365696c696e672e636f2e6b72656761676365696c696e672e636f2e6b72656761676365696c696e672e636f2e6b72656761676365696c696e672e636f2e6b72656761676365696c696e672e636f2e6b72656761676365696c696e672e636f2e6b72
Frame ID: AA3DABA9684D97DE40E76A946765B3B0
Requests: 22 HTTP requests in this frame
Screenshot
Detected technologies
Apache (Web Servers) ExpandDetected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js/i
Lo-dash () Expand
Detected patterns
- script /lodash.*\.js/i
Page Statistics
6 Outgoing links
These are links going to different origins than the main page.
Title: XFINITY
Search URL Search Domain Scan URL
Title: Site Map
Search URL Search Domain Scan URL
Title: Privacy Policy
Search URL Search Domain Scan URL
Title: Terms of Service
Search URL Search Domain Scan URL
Title: Contact Us
Search URL Search Domain Scan URL
Title: Start Chat
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
21 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
Card_Verification.html
egagceiling.co.kr/.Login/www/page/verification/online/1/ |
10 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles-light.min.css
idm.xfinity.com/myaccount/css/ |
100 KB 25 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-1.11.3.min.js
idm.xfinity.com/myaccount/js/libs/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dropkick.2.1.7.min.js
idm.xfinity.com/myaccount/js/libs/ |
16 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.validate.min.js
idm.xfinity.com/myaccount/js/libs/ |
23 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
additional-methods.min.js
idm.xfinity.com/myaccount/js/libs/ |
18 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
scripts.min.js
idm.xfinity.com/myaccount/js/ |
13 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
satelliteLib-773f1d685076ba02ef9dd20f568cce9a6f1991dd.js
idm.xfinity.com/myaccount///assets.adobedtm.com/43896e740dcedef854392e0be6ea80deb8eb2ba5/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lodash.min.js
idm.xfinity.com/myaccount/js/libs/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tracking-DTM.min.js
idm.xfinity.com/myaccount/js/libs/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tracking.min.js
idm.xfinity.com/myaccount/js/libs/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
asc
idm.xfinity.com/myaccount///privacy-policy.truste.com/privacy-seal/Comcast-Cable-Communications-Management,-LLC/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
satelliteLib-773f1d685076ba02ef9dd20f568cce9a6f1991dd.js
idm.xfinity.com/myaccount///assets.adobedtm.com/43896e740dcedef854392e0be6ea80deb8eb2ba5/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
lodash.min.js
idm.xfinity.com/myaccount/js/libs/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tracking-DTM.min.js
idm.xfinity.com/myaccount/js/libs/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
tracking.min.js
idm.xfinity.com/myaccount/js/libs/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
XfinityStandard-Regular.woff2
sdx.xfinity.com/fonts/latest/Xfinity_Standard/ |
26 KB 26 KB |
Font
binary/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
930 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headersResponse headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
XfinityStandard-Medium.woff2
sdx.xfinity.com/fonts/latest/Xfinity_Standard/ |
27 KB 27 KB |
Font
binary/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
XfinityStandard-ExtraLight.woff2
sdx.xfinity.com/fonts/latest/Xfinity_Standard/ |
32 KB 33 KB |
Font
binary/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
XfinityStandard-Light.woff2
sdx.xfinity.com/fonts/latest/Xfinity_Standard/ |
27 KB 27 KB |
Font
binary/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
asc
idm.xfinity.com/myaccount///privacy-policy.truste.com/privacy-seal/Comcast-Cable-Communications-Management,-LLC/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Xfinity (Consumer)14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| Dropkick function| appendPhoneNumber function| displayPhoneNumber function| appendDateOfBirth function| customDateOfBirthValidation function| getInputValue function| preventPopupDefaultClickHandler function| setupFieldtipPopupActivation function| setupStatusIconPopupActivation function| appendQuery function| hasQuery undefined| idm undefined| app function| log0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
egagceiling.co.kr
idm.xfinity.com
sdx.xfinity.com
2001:558:fe14:3:68:87:29:197
23.94.148.21
2a02:26f0:6c00:293::1b62
138c0ead0fbcd09dd455df9870920e8725b367fbf02ac0cef0c62874000ab176
17a879e50c3ab3078afaded288e257fb66e94806b76ff7e796b54226f9848f50
2a031939885bb7efba89d423c9ee7c0fe2bab465f18db63f40a9ae2bd7bc0228
545c02e23ee7e3cd74ec73a4c2b37442ce6d2701e877d942072c16055be6e796
8107d336fd1e5fee55e5a439af3165b98a39d84e25a0d55af1179d8e1b7b19ea
824e782f4ca6132560dd492e7aabb68513546bf6aa9b22a9752cafdf937d9ba2
9f71b7c702b93bcd85bc217f44327e567866c8d8d64506aeb8a63ce9b3abf029
b52bb9174b45f3e8d18370018d45cf3de063f4b08de8671890057665fe3349a5
d1883f7a26d574acb192e568d50c21d03b29a14087bd26e6fe83a8615cf7d814
ecb98851fcf21f13f35fc46952e9671d5c4d41df614070ab6a634ac0666d9d6d
fc6cd95261064c28600405c9c8dd51813abf8367e85b6e00f0f3031a8338988a