wwwsrvsxfntyavsmnthbill.line.pm Open in urlscan Pro
50.6.169.52 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://wwwsrvsxfntyavsmnthbill.line.pm/section/login.php
Effective URL:
https://wwwsrvsxfntyavsmnthbill.line.pm/section/index.php?apps=true
Submission: On August 28 via api (August 28th 2024, 1:25:05 am UTC) from US — Scanned from CA

Summary HTTP 7 Redirects Links 77 Behaviour Indicators

Summary

This website contacted 4 IPs in 1 countries across 3 domains to perform 7 HTTP transactions. The main IP is 50.6.169.52, located in United States and belongs to NETWORK-SOLUTIONS-HOSTING, US. The main domain is wwwsrvsxfntyavsmnthbill.line.pm.
TLS certificate: Issued by R11 on July 18th 2024. Valid for: 3 months.

This is the only time wwwsrvsxfntyavsmnthbill.line.pm was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Xfinity (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 4	50.6.169.52 50.6.169.52	19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING)
1	2600:141b:1c0... 2600:141b:1c00:22a3::30d4	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	2600:141b:1c0... 2600:141b:1c00:20::1730:e0af	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2600:141b:1c0... 2600:141b:1c00:229f::20b	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
7	4

4 50.6.169.52 (United States) 1 redirects

ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 50-6-169-52.unifiedlayer.com

wwwsrvsxfntyavsmnthbill.line.pm	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:141b:1c00:22a3::30d4 (Secaucus, United States)

ASN20940 (AKAMAI-ASN1, NL)

static.cimcontent.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:141b:1c00:20::1730:e0af (Secaucus, United States)

ASN20940 (AKAMAI-ASN1, NL)

login.xfinity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:141b:1c00:229f::20b (Secaucus, United States)

ASN20940 (AKAMAI-ASN1, NL)

assets.xfinity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	line.pm 1 redirects wwwsrvsxfntyavsmnthbill.line.pm	436 KB
3	xfinity.com login.xfinity.com — Cisco Umbrella Rank: 42020 assets.xfinity.com — Cisco Umbrella Rank: 41844	32 KB
1	cimcontent.net static.cimcontent.net — Cisco Umbrella Rank: 38344	30 KB
7	3

	Domain	Requested by
4	wwwsrvsxfntyavsmnthbill.line.pm	1 redirects wwwsrvsxfntyavsmnthbill.line.pm
2	login.xfinity.com	wwwsrvsxfntyavsmnthbill.line.pm
1	assets.xfinity.com	wwwsrvsxfntyavsmnthbill.line.pm
1	static.cimcontent.net	wwwsrvsxfntyavsmnthbill.line.pm
7	4

This site contains links to these domains. Also see Links.

Domain
www.xfinity.com
www.xfinityprepaid.com
customer.xfinity.com
business.comcast.com
jss.xfinity.com
xfinityconnect.email.comcast.net
connect.xfinity.com
oauth.xfinity.com
my.xfinity.com
xfinity.comcast.net
idm.xfinity.com
corporate.comcast.com
jobs.comcast.com
www.effectv.com
speedtest.xfinity.com
alter.the-colors-sagl.ch
twitter.com
www.facebook.com
www.youtube.com

Subject Issuer	Validity	Valid
wwwsrvsxfntyavsmnthbill.line.pm R11	`2024-07-18` - `2024-10-16`	3 months	crt.sh
static.cimcontent.net COMODO RSA Organization Validation Secure Server CA	`2024-03-19` - `2025-03-19`	a year	crt.sh
login.xfinity.com COMODO RSA Organization Validation Secure Server CA	`2023-10-18` - `2024-10-17`	a year	crt.sh
t.xfinity.com COMODO RSA Organization Validation Secure Server CA	`2024-06-27` - `2025-06-27`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://wwwsrvsxfntyavsmnthbill.line.pm/section/index.php?apps=true
Frame ID: 2ECF8B50B7119F150ADAC93FB5080933
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

S᠍ig᠍n in t᠍o Xf᠍ini᠍ty

Page URL History Show full URLs

http://wwwsrvsxfntyavsmnthbill.line.pm/section/login.php HTTP 307
https://wwwsrvsxfntyavsmnthbill.line.pm/section/login.php HTTP 302
https://wwwsrvsxfntyavsmnthbill.line.pm/section/index.php?apps=true Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

7
Requests

100 %
HTTPS

75 %
IPv6

3
Domains

4
Subdomains

4
IPs

1
Countries

481 kB
Transfer

490 kB
Size

2
Cookies

77 Outgoing links

These are links going to different origins than the main page.

URL: https://www.xfinity.com/?INTCMP=ILC:MA:GEN:GEN5b9ab8ad1e540

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/internet-service
Title: Overview

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/deals/internet
Title: Internet Deals

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/internet-service/modems-and-routers
Title: Equipment

Search URL Search Domain Scan URL

URL: https://www.xfinityprepaid.com/prepaid-internet
Title: Prepaid Internet

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/internet-service/internet-essentials
Title: Internet Essentials

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/gig
Title: Gig-speed Internet

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/mobile-service
Title: Overview

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/deals/internet-and-mobile
Title: Internet + Mobile Deals

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/digital-cable-tv
Title: Overview

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/digital-cable-tv/x1
Title: X1 TV

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/flex
Title: Flex Streaming

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/nowtv
Title: NOW TV

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/channel-lineup-bundles
Title: Channel Lineup

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/digital-cable-tv/add-channels
Title: Add-on Channels

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/digital-cable-tv/latino
Title: Latino

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/home-security
Title: Overview

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/home-security/professional-monitoring?pc=1
Title: Professional Monitoring

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/home-security/self-protection
Title: Self Protection

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/home-phone-services
Title: Overview

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/home-phone-services/voice-unlimited-features
Title: Features

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/home-phone-services/equipment
Title: Equipment

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/buy/plan/gbboffers?CMP=ILC_shop_dss-myaccount-dev_au
Title: Change Plan

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/deals
Title: Featured Deals

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/offers
Title: Build Your Plan

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/student
Title: Student Offers

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/rewards
Title: Rewards

Search URL Search Domain Scan URL

URL: https://customer.xfinity.com/rewards
Title: Rewards

Search URL Search Domain Scan URL

URL: https://business.comcast.com/?utm_source=dotnet&utm_campaign=gn2
Title: Comcast Business

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/local/store-offers
Title: Find a Store

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/digital/offers/plan-builder
Title: Cart

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/buy/plan/offersFilter?upgrade=true
Title: Cart

Search URL Search Domain Scan URL

URL: https://jss.xfinity.com/securelogin/cima?sc_site=dss-dotcom&continue=https%3A%2F%2Fcustomer.xfinity.com
Title: Sign In

Search URL Search Domain Scan URL

URL: https://customer.xfinity.com/billing
Title: Billing

Search URL Search Domain Scan URL

URL: https://customer.xfinity.com/settings
Title: Account and Identity

Search URL Search Domain Scan URL

URL: https://customer.xfinity.com/
Title: Order history

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/moving
Title: Move to new address

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/moving
Title: Move to new address

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/support
Title: Support

Search URL Search Domain Scan URL

URL: https://xfinityconnect.email.comcast.net/
Title: You have unread emailsCheck Email

Search URL Search Domain Scan URL

URL: https://connect.xfinity.com/voice
Title: You have unread emailsCheck Voicemail

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/stream/
Title: Watch TV Online

Search URL Search Domain Scan URL

URL: https://oauth.xfinity.com/oauth/sp-logout?client_id=shoplearn-web
Title: Sign out

Search URL Search Domain Scan URL

URL: https://customer.xfinity.com/?adobe_mc_ref=https%3A%2F%2Fjss.xfinity.com%2F#/settings/account/linked-accounts
Title: Manage or link accounts

Search URL Search Domain Scan URL

URL: http://my.xfinity.com/terms/web/
Title: Terms of Service

Search URL Search Domain Scan URL

URL: http://xfinity.comcast.net/privacy/
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://customer.xfinity.com/lite
Title: Pay any balance without signing in

Search URL Search Domain Scan URL

URL: https://idm.xfinity.com/myaccount/lookup?continue=https%3A%2F%2Flogin.xfinity.com%2Flogin%3FmaxAuthnAge%3D900%26r%3Dcomcast.net%26s%3Doauth%26continue%3Dhttps%253A%252F%252Foauth.xfinity.com%252F%252Foauth%252Fauthorize%253Fclient_id%253Dx--d2.prod.new.cmsplatform%2526response_mode%253Dform_post%2526redirect_uri%253Dhttps%25253a%25252f%25252fjss.xfinity.com%25252fsignin-cima%2526response_type%253Dcode%2526scope%253Dopenid%252Bprofile%252Bemail%252Baddress%252Boffline_access%252Bphone%252Burn%25253ambo%25253ascope%25253aaccount%25253aonbehalf%252Burn%25253acsp%25253ascope%25253achannel-lineup%252Burn%25253acima%25253acrs%25253aitem%25253acreate%252BXFN_SC_USER%252BXFN_SSM_ORDER%252BXFN_SOO_QUAP%252Bsoo%25253abilling%252Bxcp%25253aconsent%25253aread%252Bxcp%25253aconsent%25253aaccept%252Bxcp%25253acheckout%25253astatus%25253aget%252Bxcp%25253aacp%25253aenrollment%25253acreate%252Bxcp%25253aacp%25253aenrollment%25253aread%252Bxcp%25253aconsent%25253apresent%252Bxcp%25253aacp%25253aenrollment%25253aupdate%2526state%253DOpenIdConnect.AuthenticationProperties%25253dWKuwNjMPd4CikvgQC8rzxpoDRSoD2q4U0DrpXU1nk1c4xSdOKOUfAy9FyBAuPxA4nbo-pcxCf1jiYkJLlXaHNDe41QHHrQgNO4qFx17UMR26cQ6o6ivPXH2WF04fGmaUv-0daty6QO30lj-Pvsdk0T2km5P__Wj5-y7y39KOAswogigvQblN3-vf8gAxTE_07kHUmbhlut3vrdszXdG5tjvIoH6xEYVHCNQ03gC4vrUwYBn_GaweC3oU-zhlysY4aaK4F3zqWtlz3TUxXaesrA3fdT5ze1KqBGVK-5jmY0Sq2cx5mzG9cB8QNq6NpimpWumxQl5t1KPVBPfhdEKwBnNoDEWReY-9QchbT7n7QzbCpyKJkqsrkjylChx7NaxKlhvhzA%2526max_age%253D900%2526response%253D1%2526reqId%253Dbd9e8a91-b0c1-45ff-a113-d9bd5189fd2a%26client_id%3Dx--d2.prod.new.cmsplatform%26reqId%3Dda2ca7db-b4dc-4f82-ae3c-6740de25a8c1%26rm%3D2%26ui_style%3Dlight&ui_style=light
Title: Find your Xfinity ID

Search URL Search Domain Scan URL

URL: https://idm.xfinity.com/myaccount/create-uid?continue=https%3A%2F%2Flogin.xfinity.com%2Flogin%3FmaxAuthnAge%3D900%26r%3Dcomcast.net%26s%3Doauth%26continue%3Dhttps%253A%252F%252Foauth.xfinity.com%252F%252Foauth%252Fauthorize%253Fclient_id%253Dx--d2.prod.new.cmsplatform%2526response_mode%253Dform_post%2526redirect_uri%253Dhttps%25253a%25252f%25252fjss.xfinity.com%25252fsignin-cima%2526response_type%253Dcode%2526scope%253Dopenid%252Bprofile%252Bemail%252Baddress%252Boffline_access%252Bphone%252Burn%25253ambo%25253ascope%25253aaccount%25253aonbehalf%252Burn%25253acsp%25253ascope%25253achannel-lineup%252Burn%25253acima%25253acrs%25253aitem%25253acreate%252BXFN_SC_USER%252BXFN_SSM_ORDER%252BXFN_SOO_QUAP%252Bsoo%25253abilling%252Bxcp%25253aconsent%25253aread%252Bxcp%25253aconsent%25253aaccept%252Bxcp%25253acheckout%25253astatus%25253aget%252Bxcp%25253aacp%25253aenrollment%25253acreate%252Bxcp%25253aacp%25253aenrollment%25253aread%252Bxcp%25253aconsent%25253apresent%252Bxcp%25253aacp%25253aenrollment%25253aupdate%2526state%253DOpenIdConnect.AuthenticationProperties%25253dWKuwNjMPd4CikvgQC8rzxpoDRSoD2q4U0DrpXU1nk1c4xSdOKOUfAy9FyBAuPxA4nbo-pcxCf1jiYkJLlXaHNDe41QHHrQgNO4qFx17UMR26cQ6o6ivPXH2WF04fGmaUv-0daty6QO30lj-Pvsdk0T2km5P__Wj5-y7y39KOAswogigvQblN3-vf8gAxTE_07kHUmbhlut3vrdszXdG5tjvIoH6xEYVHCNQ03gC4vrUwYBn_GaweC3oU-zhlysY4aaK4F3zqWtlz3TUxXaesrA3fdT5ze1KqBGVK-5jmY0Sq2cx5mzG9cB8QNq6NpimpWumxQl5t1KPVBPfhdEKwBnNoDEWReY-9QchbT7n7QzbCpyKJkqsrkjylChx7NaxKlhvhzA%2526max_age%253D900%2526response%253D1%2526reqId%253Dbd9e8a91-b0c1-45ff-a113-d9bd5189fd2a%26client_id%3Dx--d2.prod.new.cmsplatform%26reqId%3Dda2ca7db-b4dc-4f82-ae3c-6740de25a8c1%26rm%3D2%26ui_style%3Dlight&ui_style=light
Title: Create a new Xfinity ID

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/stream/collection/sports

Search URL Search Domain Scan URL

URL: https://corporate.comcast.com/company
Title: About Comcast

Search URL Search Domain Scan URL

URL: https://business.comcast.com/
Title: Comcast Business

Search URL Search Domain Scan URL

URL: https://jobs.comcast.com/
Title: Careers

Search URL Search Domain Scan URL

URL: https://corporate.comcast.com/press
Title: Press Room

Search URL Search Domain Scan URL

URL: https://corporate.comcast.com/
Title: Corporate Site

Search URL Search Domain Scan URL

URL: https://www.effectv.com/?utm_source=xfinity&utm_medium=referral&utm_campaign=advertise_with_us&utm_content=footer
Title: Advertise with Us

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/site-map
Title: Sitemap

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/bill-pay
Title: View and Pay Bill

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/hub
Title: Discover Xfinity

Search URL Search Domain Scan URL

URL: https://speedtest.xfinity.com/
Title: Run Internet Speed Test

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/local/
Title: Service in my Area

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/learn/internet-service/wifi
Title: NOW Wifi

Search URL Search Domain Scan URL

URL: https://corporate.comcast.com/hub/customer-experience
Title: Customer Guarantee

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/policies
Title: Customer Agreements and Policies

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/corporate/legal/visitoragreement
Title: Visitor Agreement

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/policies/internet-broadband-disclosures
Title: Xfinity Internet Broadband Disclosures

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/privacy
Title: Privacy Center

Search URL Search Domain Scan URL

URL: https://corporate.comcast.com/impact
Title: Social Responsibility

Search URL Search Domain Scan URL

URL: https://alter.the-colors-sagl.ch/
Title: Español

Search URL Search Domain Scan URL

URL: https://twitter.com/XFINITY

Search URL Search Domain Scan URL

URL: https://www.facebook.com/xfinity

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/xfinity?feature=results_main0

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/terms
Title: Web Terms Of Service

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/privacy/policy/staterights#california
Title: CA Notice at Collection

Search URL Search Domain Scan URL

URL: http://www.xfinity.com/privacy/policy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/privacy/manage-preference
Title: Your Privacy Choices

Search URL Search Domain Scan URL

URL: https://www.xfinity.com/adinformation
Title: Ad Choices

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://wwwsrvsxfntyavsmnthbill.line.pm/section/login.php HTTP 307
https://wwwsrvsxfntyavsmnthbill.line.pm/section/login.php HTTP 302
https://wwwsrvsxfntyavsmnthbill.line.pm/section/index.php?apps=true Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request index.php Show response
wwwsrvsxfntyavsmnthbill.line.pm/section/
Redirect Chain

http://wwwsrvsxfntyavsmnthbill.line.pm/section/login.php
https://wwwsrvsxfntyavsmnthbill.line.pm/section/login.php
https://wwwsrvsxfntyavsmnthbill.line.pm/section/index.php?apps=true

243 KB
243 KB

484ms
484ms

Document
text/html

50.6.169.52
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://wwwsrvsxfntyavsmnthbill.line.pm/section/index.php?apps=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 50.6.169.52 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 50-6-169-52.unifiedlayer.com
Software: Apache /
Resource Hash: 0c7b18e796a594925cd95c5c97b54fc0ea86fb94371cfd6db01458db8c60b151

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

cache-control: no-store, no-cache, must-revalidate
content-type: text/html; charset=UTF-8
date: Wed, 28 Aug 2024 01:24:25 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
server: Apache

Redirect headers

cache-control: no-store, no-cache, must-revalidate
content-type: text/html; charset=UTF-8
date: Wed, 28 Aug 2024 01:24:24 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
location: ./index.php?apps=true
pragma: no-cache
server: Apache

GET
H2 200 prism-ui-3a99e7e.css
wwwsrvsxfntyavsmnthbill.line.pm/section/css/ 67 KB
67 KB 72ms
72ms Stylesheet
text/css 50.6.169.52
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://wwwsrvsxfntyavsmnthbill.line.pm/section/css/prism-ui-3a99e7e.css
Requested by: Host: wwwsrvsxfntyavsmnthbill.line.pm
URL: https://wwwsrvsxfntyavsmnthbill.line.pm/section/index.php?apps=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 50.6.169.52 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 50-6-169-52.unifiedlayer.com
Software: Apache /
Resource Hash: fba8ff747e294c69c1a8dc31a5e63b3d50e69ae18fd8370032e3d15638e5451b

Request headers

Referer: https://wwwsrvsxfntyavsmnthbill.line.pm/section/index.php?apps=true
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 28 Aug 2024 01:24:25 GMT
last-modified: Tue, 21 Nov 2023 12:42:04 GMT
server: Apache
accept-ranges: bytes
content-length: 68105
content-type: text/css

GET
H2 200 bundle-3a99e7e.css
wwwsrvsxfntyavsmnthbill.line.pm/section/css/ 110 KB
110 KB 110ms
109ms Stylesheet
text/css 50.6.169.52
NETWORK-SOLUTIONS...

General

Check archive.org

Show headers Download Go to

Full URL: https://wwwsrvsxfntyavsmnthbill.line.pm/section/css/bundle-3a99e7e.css
Requested by: Host: wwwsrvsxfntyavsmnthbill.line.pm
URL: https://wwwsrvsxfntyavsmnthbill.line.pm/section/index.php?apps=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 50.6.169.52 , United States, ASN19871 (NETWORK-SOLUTIONS-HOSTING, US),
Reverse DNS: 50-6-169-52.unifiedlayer.com
Software: Apache /
Resource Hash: 6a436dc04735f8b8ff82fe5fcc8eaab3a70865e34106542e593ddf343b83a833

Request headers

Referer: https://wwwsrvsxfntyavsmnthbill.line.pm/section/index.php?apps=true
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

date: Wed, 28 Aug 2024 01:24:25 GMT
last-modified: Thu, 23 Nov 2023 09:46:22 GMT
server: Apache
accept-ranges: bytes
content-length: 112560
content-type: text/css

GET
H2 200 dmsans-regular.woff2
static.cimcontent.net/common-web-assets/fonts/dm-sans/ 29 KB
30 KB 436ms
73ms Font
binary/octet-stream 2600:141b:1c00:22a3::30d4
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cimcontent.net/common-web-assets/fonts/dm-sans/dmsans-regular.woff2
Requested by: Host: wwwsrvsxfntyavsmnthbill.line.pm
URL: https://wwwsrvsxfntyavsmnthbill.line.pm/section/index.php?apps=true
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:22a3::30d4 Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 40aefc09f33205666c2c42f20d54285147ae9434ef5f8018481950fd67ddcb68

Request headers

Referer: https://wwwsrvsxfntyavsmnthbill.line.pm/
Origin: https://wwwsrvsxfntyavsmnthbill.line.pm
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-amz-version-id: .VwE8.xtYrLeNhxXddGrHq9UFI6lm0d0
date: Wed, 28 Aug 2024 01:25:00 GMT
last-modified: Wed, 20 Sep 2023 04:13:23 GMT
server: AmazonS3
x-amz-cf-pop: EWR53-C2
etag: "b9d5e5cad821648da76e2fedb6c6a680"
x-amz-server-side-encryption: AES256
content-type: binary/octet-stream
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
content-length: 29920
x-amz-cf-id: SJi6RaovLQOu7_kApDvPZ1wZtypBgPXrYSmPX5RXI2-untE8NOh3Iw==

GET
H2 200 xfinity-logo-grey.svg
login.xfinity.com/static/images/global/ 939 B
1 KB 433ms
167ms Image
image/svg+xml 2600:141b:1c00:20::1730:e0af
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://login.xfinity.com/static/images/global/xfinity-logo-grey.svg

Requested by

Host: wwwsrvsxfntyavsmnthbill.line.pm
URL: https://wwwsrvsxfntyavsmnthbill.line.pm/section/css/bundle-3a99e7e.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:1c00:20::1730:e0af Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

15334e1a1a24d9f0f0a3daaedc6f438e3bdd6ef11d7fefb7d37e3208094c7089

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://wwwsrvsxfntyavsmnthbill.line.pm/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
date: Wed, 28 Aug 2024 01:25:00 GMT
last-modified: Wed, 21 Aug 2024 17:15:50 GMT
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 539
expires: Wed, 28 Aug 2024 01:25:00 GMT

GET
H2 200 Xfinity%20Refreshed%20SIPs%20Live%20Sports_Live%20Sports%20960x1200%20.jpg
assets.xfinity.com/assets/cima/login/default/ad/ 29 KB
30 KB 491ms
155ms Image
image/avif 2600:141b:1c00:229f::20b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.xfinity.com/assets/cima/login/default/ad/Xfinity%20Refreshed%20SIPs%20Live%20Sports_Live%20Sports%20960x1200%20.jpg
Requested by: Host: wwwsrvsxfntyavsmnthbill.line.pm
URL: https://wwwsrvsxfntyavsmnthbill.line.pm/section/css/bundle-3a99e7e.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2600:141b:1c00:229f::20b Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Akamai Image Manager /
Resource Hash: 614fca8206cb1fe724406e8dd702a88afd1becaeb87b6026126301258babc5b0

Request headers

Referer: https://wwwsrvsxfntyavsmnthbill.line.pm/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 112
date: Wed, 28 Aug 2024 01:25:00 GMT
last-modified: Sat, 13 Jan 2024 18:15:47 GMT
x-serial: 1757
server: Akamai Image Manager
x-check-cacheable: YES
x-edgeconnect-midmile-rtt: 65
etag: "b57b9f3c64fcda5af3ee2df9d7fddefd"
content-type: image/avif
cache-control: private, no-transform, max-age=1551605
server-timing: cdn-cache; desc=HIT, edge; dur=52, ak_p; desc="1724808299958_389699919_44684183_5181_18177_38_148_219";dur=1
x-robots-tag: index, follow
content-length: 30114
expires: Sun, 15 Sep 2024 00:25:05 GMT

GET
H2 200 favicon.ico
login.xfinity.com/static/images/favicon/ 11 KB
1 KB 58ms
57ms Other
image/x-icon 2600:141b:1c00:20::1730:e0af
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://login.xfinity.com/static/images/favicon/favicon.ico

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:141b:1c00:20::1730:e0af Secaucus, United States, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

aa050de8862f7eaa8ea290eb9612bf949d6a2c8a6ea60ce60df5af3697c89a7d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://wwwsrvsxfntyavsmnthbill.line.pm/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
date: Wed, 28 Aug 2024 01:25:00 GMT
last-modified: Wed, 21 Aug 2024 17:15:50 GMT
vary: Accept-Encoding
content-type: image/x-icon
accept-ranges: bytes
content-length: 998

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Xfinity (Consumer)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			wwwsrvsxfntyavsmnthbill.line.pm/	1969-12-31 23:59:59	Name: PHPSESSID Value: f15da531372d5b7b5cbf8dca5e5dbe2d
			login.xfinity.com/	1970-01-20 23:16:53	Name: AWSALBCORS Value: W7Mu8qrrKGE5J59+tmL+fciJhUxtb+70pVowR6MZd+0Xcs+pkd1AgIj1+7sJ2a8WvMqZ7+jRsfhzV3mh2hWNrwEc5g4lW30rSFjUuXnDb6xucOWK5pbC3d2pvE5J

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.xfinity.com
login.xfinity.com
static.cimcontent.net
wwwsrvsxfntyavsmnthbill.line.pm
2600:141b:1c00:20::1730:e0af
2600:141b:1c00:229f::20b
2600:141b:1c00:22a3::30d4
50.6.169.52
0c7b18e796a594925cd95c5c97b54fc0ea86fb94371cfd6db01458db8c60b151
15334e1a1a24d9f0f0a3daaedc6f438e3bdd6ef11d7fefb7d37e3208094c7089
40aefc09f33205666c2c42f20d54285147ae9434ef5f8018481950fd67ddcb68
614fca8206cb1fe724406e8dd702a88afd1becaeb87b6026126301258babc5b0
6a436dc04735f8b8ff82fe5fcc8eaab3a70865e34106542e593ddf343b83a833
aa050de8862f7eaa8ea290eb9612bf949d6a2c8a6ea60ce60df5af3697c89a7d
fba8ff747e294c69c1a8dc31a5e63b3d50e69ae18fd8370032e3d15638e5451b

wwwsrvsxfntyavsmnthbill.line.pm Open in urlscan Pro 50.6.169.52 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

7 Requests

100 %HTTPS

75 %IPv6

3 Domains

4 Subdomains

4 IPs

1 Countries

481 kBTransfer

490 kBSize

2 Cookies

77 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

2 Cookies

Indicators

wwwsrvsxfntyavsmnthbill.line.pm Open in urlscan Pro
50.6.169.52 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

100 %
HTTPS

75 %
IPv6

3
Domains

4
Subdomains

4
IPs

1
Countries

481 kB
Transfer

490 kB
Size

2
Cookies

7 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!