injuryattorneyadvisor.com
Open in
urlscan Pro
192.254.185.210
Malicious Activity!
Public Scan
URL:
http://injuryattorneyadvisor.com/comcast/step3.php
Submission: On March 07 via automatic, source openphish
Submission: On March 07 via automatic, source openphish
Summary
This website contacted 2 IPs
in 1 countries
across 2 domains to perform 13 HTTP transactions.
The main IP is 192.254.185.210, located in
Houston, United States and
belongs to UNIFIEDLAYER-AS-1 - Unified Layer, US.
The main domain is injuryattorneyadvisor.com.
This is the only time injuryattorneyadvisor.com was scanned on urlscan.io!
This is the only time injuryattorneyadvisor.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Xfinity (Consumer)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 8 | 192.254.185.210 192.254.185.210 | 46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1 - Unified Layer) | |
| 5 | 104.19.194.102 104.19.194.102 | 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare) | |
| 13 | 2 |
8
192.254.185.210
(Houston, United States)
ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)
ASN46606 (UNIFIEDLAYER-AS-1 - Unified Layer, US)
| injuryattorneyadvisor.com |
5
104.19.194.102
(San Francisco, United States)
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
| cdnjs.cloudflare.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 8 |
injuryattorneyadvisor.com
injuryattorneyadvisor.com |
231 KB |
| 5 |
cloudflare.com
cdnjs.cloudflare.com |
108 KB |
| 13 | 2 |
| Domain | Requested by | |
|---|---|---|
| 8 | injuryattorneyadvisor.com |
injuryattorneyadvisor.com
|
| 5 | cdnjs.cloudflare.com |
injuryattorneyadvisor.com
|
| 13 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid |
|---|
This page contains 1 frames:
Primary Page:
http://injuryattorneyadvisor.com/comcast/step3.php
Frame ID: (F006EF23440875CF1ECAACEC7002DDCB)
Requests: 13 HTTP requests in this frame
Screenshot
Detected technologies
PHP
(Programming Languages)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- url /\.php(?:$|\?)/i
Nginx
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /nginx(?:\/([\d.]+))?/i
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
step3.php
injuryattorneyadvisor.com/comcast/ |
5 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
jquery.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0-beta1/ |
256 KB 78 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
jquery.validate.js
cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.15.0/ |
45 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
additional-methods.js
cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.15.0/ |
38 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
jquery.maskedinput.js
cdnjs.cloudflare.com/ajax/libs/jquery.maskedinput/1.4.1/ |
10 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
jquery.payment.js
cdnjs.cloudflare.com/ajax/libs/jquery.payment/1.3.2/ |
17 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
xf5.png
injuryattorneyadvisor.com/comcast/images/ |
83 KB 83 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
xf6.png
injuryattorneyadvisor.com/comcast/images/ |
127 KB 128 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
xf7.png
injuryattorneyadvisor.com/comcast/images/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
xf4.png
injuryattorneyadvisor.com/comcast/images/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
site.png
injuryattorneyadvisor.com/comcast/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
trust.png
injuryattorneyadvisor.com/comcast/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
confirm.png
injuryattorneyadvisor.com/comcast/images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Xfinity (Consumer)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| unhideBody0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
injuryattorneyadvisor.com
104.19.194.102
192.254.185.210
09342ee8bd6c004c684b8455a484e3fc419f30c11829bffa77ef1cebf1490eba
11f5676d5f674f10ef55fa061e829fbeaee402e25b12b401cf9c149920c172c6
1d95e0e21c160558eb3d2bacd76779048cb600cc04e15264e0835f4f86b4b375
2aecc3e7494318d2398eafe2a6de21c03a52264ddf86c7934758ddbda06864bb
5ebdf115a8334e0cf92812487923409dafcd0df63a4aed23af8236e65af05c62
60499c4335239d51fa6ef40bd909ba8e62a2a468b16b74f0fd9fadac1eee4bbf
78f27c3d7cb5d766466703adc7f7ad7706b7fb05514eec39be0aa253449bd0f8
7ef14a1e070a6a2ec9ff44ccf5e923cb2a460c5861a3db8a9ae1e21557d27020
987ee0c5b51e409308d5aca254a0e4c6921a38d9ee2cda7245a8f7401186cc1b
c5e7ed7aa9bf2d4ab4d682432f402b79729ad678d5a42f39a3a002e77f2a993f
cc26b50ed518c47405060a32400adf3007f1926447cfff89caf56e36c023add7
e41a9756e581ccf7ff62748ae2e3e6089f7700f6ea1b957a0fc7281edc8ac42e
ebcb1a1d3a38464a0232cb83a9cbc1327ce2d980c7041550e6f67852504c85fc