0com0cast00log-in0.000webhostapp.com Open in urlscan Pro
2a02:4780:dead:ed11::1 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://0com0cast00log-in0.000webhostapp.com/xfinity/au/tes/ver/home/
Submission: On November 30 via automatic, source openphish (November 30th 2017, 9:22:35 am UTC)

Summary HTTP 14 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 4 domains to perform 14 HTTP transactions. The main IP is 2a02:4780:dead:ed11::1, located in Lithuania and belongs to HOSTINGER-AS, LT. The main domain is 0com0cast00log-in0.000webhostapp.com.

This is the only time 0com0cast00log-in0.000webhostapp.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Xfinity (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1	2a02:4780:dea... 2a02:4780:dead:ed11::1	47583 (HOSTINGER-AS) (HOSTINGER-AS)
8	2001:558:fe21... 2001:558:fe21:2:69:252:205:24	7922 (COMCAST-7922) (COMCAST-7922 - Comcast Cable Communications)
1	2a02:26f0:e8:... 2a02:26f0:e8::5c7a:9a38	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	2a02:26f0:11a... 2a02:26f0:11a:389::1b62	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
14	4

1 2a02:4780:dead:ed11::1 (Lithuania)

ASN47583 (HOSTINGER-AS, LT)

0com0cast00log-in0.000webhostapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2001:558:fe21:2:69:252:205:24 (United States)

ASN7922 (COMCAST-7922 - Comcast Cable Communications, LLC, US)

login.comcast.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:e8::5c7a:9a38 (European Union)

ASN20940 (AKAMAI-ASN1, US)

por-img.cimcontent.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:26f0:11a:389::1b62 (European Union)

ASN20940 (AKAMAI-ASN1, US)

sdx.xfinity.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	comcast.net login.comcast.net	45 KB
4	xfinity.com sdx.xfinity.com	112 KB
1	cimcontent.net por-img.cimcontent.net	42 KB
1	000webhostapp.com 0com0cast00log-in0.000webhostapp.com	7 KB
14	4

	Domain	Requested by
8	login.comcast.net	0com0cast00log-in0.000webhostapp.com
4	sdx.xfinity.com	0com0cast00log-in0.000webhostapp.com
1	por-img.cimcontent.net	0com0cast00log-in0.000webhostapp.com
1	0com0cast00log-in0.000webhostapp.com
14	4

This site contains links to these domains. Also see Links.

Domain
businessclass.comcast.net
login.comcast.net
login.comcast.nethttp
login.comcast.nethttps

Subject Issuer	Validity	Valid
login.comcast.net COMODO RSA Organization Validation Secure Server CA	`2016-12-16` - `2018-12-16`	2 years	crt.sh
www.xfinity.comcast.net COMODO RSA Organization Validation Secure Server CA	`2017-09-22` - `2019-09-22`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://0com0cast00log-in0.000webhostapp.com/xfinity/au/tes/ver/home/
Frame ID: 16297.1
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

14
Requests

86 %
HTTPS

100 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

206 kB
Transfer

312 kB
Size

0
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: https://businessclass.comcast.net/?INTCMP=ILC-XfinityCom-MyAccountSigninCTA-BCPSignin01
Title: Sign in now

Search URL Search Domain Scan URL

URL: https://login.comcast.net/
Title: Learn more

Search URL Search Domain Scan URL

URL: https://login.comcast.nethttp//xfinity.comcast.net/siteindex/
Title: Site Map

Search URL Search Domain Scan URL

URL: https://login.comcast.nethttp//xfinity.comcast.net/privacy/
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://login.comcast.nethttp//my.xfinity.com/terms/web/
Title: Terms of Service

Search URL Search Domain Scan URL

URL: https://login.comcast.nethttps//customer.comcast.com/contact-us/
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://login.comcast.net//privacy.truste.com/privacy-seal/Comcast-Cable-Communications-Management,-LLC/validation?rid=bf9d4d6f-2b32-4201-a167-5b55a4451508

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
0com0cast00log-in0.000webhostapp.com/xfinity/au/tes/ver/home/ 17 KB
7 KB 229ms
116ms Document
text/html 2a02:4780:dead:ed11::1
HOSTINGER-AS

General

Check archive.org

Show headers Download Go to

Full URL

http://0com0cast00log-in0.000webhostapp.com/xfinity/au/tes/ver/home/

Protocol

HTTP/1.1

Server

2a02:4780:dead:ed11::1 , Lithuania, ASN47583 (HOSTINGER-AS, LT),

Reverse DNS

Software

awex /

Resource Hash

c42c9dc00c9f5da47295156a5a6065939d1aafd3fedb43bd1138ea4353e6da04

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: 0com0cast00log-in0.000webhostapp.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Cache-Control: no-cache
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Thu, 30 Nov 2017 09:22:46 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: awex
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Xss-Protection: 1; mode=block
X-Request-ID: 8907c319cb6a4fb835f9cb0a143d45e6

GET
H/1.1 200
OK styles-dark.min.css
login.comcast.net/static/css/junket/ 44 KB
10 KB 815ms
114ms Stylesheet
text/css 2001:558:fe21:2:69:252:205:24
Comcast Cable Com...

General

Check archive.org

Show headers Download Go to

Full URL: https://login.comcast.net/static/css/junket/styles-dark.min.css?v=b6291a8
Requested by: Host: 0com0cast00log-in0.000webhostapp.com
URL: http://0com0cast00log-in0.000webhostapp.com/xfinity/au/tes/ver/home/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 2001:558:fe21:2:69:252:205:24 , United States, ASN7922 (COMCAST-7922 - Comcast Cable Communications, LLC, US),
Reverse DNS
Software: Apache /
Resource Hash: d9004ad03ec2d9d946b925a57f4291f70c02e7dbd9e5ddfa4e006352f95e70f3

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: login.comcast.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: http://0com0cast00log-in0.000webhostapp.com/xfinity/au/tes/ver/home/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://0com0cast00log-in0.000webhostapp.com/xfinity/au/tes/ver/home/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Thu, 30 Nov 2017 09:22:21 GMT
Content-Encoding: gzip
Last-Modified: Wed, 22 Nov 2017 20:53:17 GMT
Server: Apache
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=157030255
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=500
Content-Length: 10367
Expires: Mon, 21 Nov 2022 20:53:17 GMT

GET
H/1.1 404
Not Found Mbox.js
login.comcast.net//cdn.comcast.com/~/Media/Javascripts/Omniture/ 0
0 815ms
114ms Script
text/html 2001:558:fe21:2:69:252:205:24
Comcast Cable Com...

General

Check archive.org

Show headers Download Go to

Full URL: https://login.comcast.net//cdn.comcast.com/~/Media/Javascripts/Omniture/Mbox.js?vs=3
Requested by: Host: 0com0cast00log-in0.000webhostapp.com
URL: http://0com0cast00log-in0.000webhostapp.com/xfinity/au/tes/ver/home/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 2001:558:fe21:2:69:252:205:24 , United States, ASN7922 (COMCAST-7922 - Comcast Cable Communications, LLC, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: login.comcast.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: */*
Referer: http://0com0cast00log-in0.000webhostapp.com/xfinity/au/tes/ver/home/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://0com0cast00log-in0.000webhostapp.com/xfinity/au/tes/ver/home/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Thu, 30 Nov 2017 09:22:21 GMT
Content-Encoding: gzip
Server: Apache
Vary: accept-language,accept-charset,Accept-Encoding
Content-Language: en
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Type: text/html; charset=iso-8859-1
Keep-Alive: timeout=5, max=500
Content-Length: 708

GET
H/1.1 200
OK 598b4917a434005b0ffc357c4320926e.png
por-img.cimcontent.net/cms/data/assets/bin-201511/ 42 KB
42 KB 4194ms
1051ms Image
image/png 2a02:26f0:e8::5c7a:9a38
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://por-img.cimcontent.net/cms/data/assets/bin-201511/598b4917a434005b0ffc357c4320926e.png

Requested by

Host: 0com0cast00log-in0.000webhostapp.com
URL: http://0com0cast00log-in0.000webhostapp.com/xfinity/au/tes/ver/home/

Protocol

HTTP/1.1

Server

2a02:26f0:e8::5c7a:9a38 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

nginx /

Resource Hash

f76d476752259cdab42d5d549fa2b1d32f068242e22eff3a57f0d58ec5cdd0cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: por-img.cimcontent.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://0com0cast00log-in0.000webhostapp.com/xfinity/au/tes/ver/home/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://0com0cast00log-in0.000webhostapp.com/xfinity/au/tes/ver/home/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
Last-Modified: Thu, 05 Nov 2015 21:01:00 GMT
Server: nginx
ETag: "563bc38c-a8e6"
Access-Control-Allow-Methods: GET
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: max-age=2592000
Date: Thu, 30 Nov 2017 09:22:25 GMT
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43238

GET
H/1.1 404
Not Found asc
login.comcast.net//privacy-policy.truste.com/privacy-seal/Comcast-Cable-Communications-Management,-LLC/ 0
0 113ms
113ms Script
text/html 2001:558:fe21:2:69:252:205:24
Comcast Cable Com...

General

Check archive.org

Show headers Download Go to

Full URL: https://login.comcast.net//privacy-policy.truste.com/privacy-seal/Comcast-Cable-Communications-Management,-LLC/asc?rid=b537c389-7be1-4331-bb73-03a71788bc12
Requested by: Host: 0com0cast00log-in0.000webhostapp.com
URL: http://0com0cast00log-in0.000webhostapp.com/xfinity/au/tes/ver/home/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 2001:558:fe21:2:69:252:205:24 , United States, ASN7922 (COMCAST-7922 - Comcast Cable Communications, LLC, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: login.comcast.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: */*
Referer: http://0com0cast00log-in0.000webhostapp.com/xfinity/au/tes/ver/home/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://0com0cast00log-in0.000webhostapp.com/xfinity/au/tes/ver/home/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Thu, 30 Nov 2017 09:22:21 GMT
Content-Encoding: gzip
Server: Apache
Vary: accept-language,accept-charset,Accept-Encoding
Content-Language: en
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Type: text/html; charset=iso-8859-1
Keep-Alive: timeout=5, max=499
Content-Length: 708

GET
H/1.1 404
Not Found seal
login.comcast.net//privacy-policy.truste.com/privacy-seal/Comcast-Cable-Communications-Management,-LLC/ 1 KB
0 343ms
112ms Image
text/html 2001:558:fe21:2:69:252:205:24
Comcast Cable Com...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://login.comcast.net//privacy-policy.truste.com/privacy-seal/Comcast-Cable-Communications-Management,-LLC/seal?rid=9426d53b-42b1-4587-8d55-c57322ccb60d
Requested by: Host: 0com0cast00log-in0.000webhostapp.com
URL: http://0com0cast00log-in0.000webhostapp.com/xfinity/au/tes/ver/home/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 2001:558:fe21:2:69:252:205:24 , United States, ASN7922 (COMCAST-7922 - Comcast Cable Communications, LLC, US),
Reverse DNS
Software: Apache /
Resource Hash: f0622232666bb2fb8356f40266aaa8c02448e3c5f82103da3139d781ca0cd722

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: login.comcast.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: image/webp,image/apng,image/*,*/*;q=0.8
Referer: http://0com0cast00log-in0.000webhostapp.com/xfinity/au/tes/ver/home/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://0com0cast00log-in0.000webhostapp.com/xfinity/au/tes/ver/home/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Thu, 30 Nov 2017 09:22:21 GMT
Content-Encoding: gzip
Server: Apache
Vary: accept-language,accept-charset,Accept-Encoding
Content-Language: en
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Type: text/html; charset=iso-8859-1
Keep-Alive: timeout=5, max=500
Content-Length: 708

GET
H/1.1 200
OK jquery-1.7.min.js Show response
login.comcast.net/static/js/libs/ 92 KB
32 KB 121ms
121ms Script
text/javascript 2001:558:fe21:2:69:252:205:24
Comcast Cable Com...

General

Check archive.org

Show headers Download Go to

Full URL: https://login.comcast.net/static/js/libs/jquery-1.7.min.js
Requested by: Host: 0com0cast00log-in0.000webhostapp.com
URL: http://0com0cast00log-in0.000webhostapp.com/xfinity/au/tes/ver/home/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 2001:558:fe21:2:69:252:205:24 , United States, ASN7922 (COMCAST-7922 - Comcast Cable Communications, LLC, US),
Reverse DNS
Software: Apache /
Resource Hash: ff4e4975ef403004f8fe8e59008db7ad47f54b10d84c72eb90e728d1ec9157ce

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: login.comcast.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: */*
Referer: http://0com0cast00log-in0.000webhostapp.com/xfinity/au/tes/ver/home/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://0com0cast00log-in0.000webhostapp.com/xfinity/au/tes/ver/home/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Thu, 30 Nov 2017 09:22:21 GMT
Content-Encoding: gzip
Last-Modified: Wed, 22 Nov 2017 20:46:14 GMT
Server: Apache
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=157029832
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=499
Content-Length: 33274
Expires: Mon, 21 Nov 2022 20:46:14 GMT

GET
H/1.1 200
OK scripts-responsive.min.js Show response
login.comcast.net/static/js/ 5 KB
2 KB 114ms
113ms Script
text/javascript 2001:558:fe21:2:69:252:205:24
Comcast Cable Com...

General

Check archive.org

Show headers Download Go to

Full URL: https://login.comcast.net/static/js/scripts-responsive.min.js
Requested by: Host: 0com0cast00log-in0.000webhostapp.com
URL: http://0com0cast00log-in0.000webhostapp.com/xfinity/au/tes/ver/home/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 2001:558:fe21:2:69:252:205:24 , United States, ASN7922 (COMCAST-7922 - Comcast Cable Communications, LLC, US),
Reverse DNS
Software: Apache /
Resource Hash: b5439f2201a5409ff05248df13222508874e0f8dbbeff94ed4045dd991368bd9

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: login.comcast.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: */*
Referer: http://0com0cast00log-in0.000webhostapp.com/xfinity/au/tes/ver/home/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://0com0cast00log-in0.000webhostapp.com/xfinity/au/tes/ver/home/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Thu, 30 Nov 2017 09:22:21 GMT
Content-Encoding: gzip
Last-Modified: Wed, 22 Nov 2017 20:53:17 GMT
Server: Apache
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=157030255
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=498
Content-Length: 1935
Expires: Mon, 21 Nov 2022 20:53:17 GMT

GET
H/1.1 404
Not Found omniture.js
login.comcast.net/static/js/ 0
0 231ms
117ms Script
text/html 2001:558:fe21:2:69:252:205:24
Comcast Cable Com...

General

Check archive.org

Show headers Download Go to

Full URL: https://login.comcast.net/static/js/omniture.js?v=b6291a8
Requested by: Host: 0com0cast00log-in0.000webhostapp.com
URL: http://0com0cast00log-in0.000webhostapp.com/xfinity/au/tes/ver/home/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 2001:558:fe21:2:69:252:205:24 , United States, ASN7922 (COMCAST-7922 - Comcast Cable Communications, LLC, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: login.comcast.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: */*
Referer: http://0com0cast00log-in0.000webhostapp.com/xfinity/au/tes/ver/home/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://0com0cast00log-in0.000webhostapp.com/xfinity/au/tes/ver/home/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Thu, 30 Nov 2017 09:22:21 GMT
Content-Encoding: gzip
Server: Apache
Vary: accept-language,accept-charset,Accept-Encoding
Content-Language: en
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Type: text/html; charset=iso-8859-1
Keep-Alive: timeout=5, max=497
Content-Length: 708

GET
H/1.1 200
OK XfinityStandard-Thin.woff2
sdx.xfinity.com/fonts/latest/Xfinity_Standard/ 32 KB
32 KB 2322ms
607ms Font
application/octet-stream 2a02:26f0:11a:389::1b62
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://sdx.xfinity.com/fonts/latest/Xfinity_Standard/XfinityStandard-Thin.woff2

Requested by

Host: 0com0cast00log-in0.000webhostapp.com
URL: http://0com0cast00log-in0.000webhostapp.com/xfinity/au/tes/ver/home/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:11a:389::1b62 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

nginx /

Resource Hash

44f222333b4c6396b38f2e06dc73d385d243e2b36a30914fd10b6ddb4e831017

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Pragma: no-cache
Origin: http://0com0cast00log-in0.000webhostapp.com
Accept-Encoding: gzip, deflate
Host: sdx.xfinity.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: */*
Referer: https://login.comcast.net/static/css/junket/styles-dark.min.css?v=b6291a8
Connection: keep-alive
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Referer: https://login.comcast.net/static/css/junket/styles-dark.min.css?v=b6291a8
Origin: http://0com0cast00log-in0.000webhostapp.com

Response headers

Strict-Transport-Security: max-age=31536000
Last-Modified: Tue, 10 Oct 2017 00:22:52 GMT
Server: nginx
ETag: "63971dfcbf18dc975adf178d85295f9c"
Access-Control-Allow-Methods: GET
Content-Type: application/octet-stream
Access-Control-Allow-Origin: *
Cache-Control: max-age=2592000
Date: Thu, 30 Nov 2017 09:22:23 GMT
x-amz-replication-status: COMPLETED
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 33252

GET
H/1.1 200
OK XfinityStandard-Light.woff2
sdx.xfinity.com/fonts/latest/Xfinity_Standard/ 27 KB
27 KB 1727ms
13ms Font
application/octet-stream 2a02:26f0:11a:389::1b62
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://sdx.xfinity.com/fonts/latest/Xfinity_Standard/XfinityStandard-Light.woff2

Requested by

Host: 0com0cast00log-in0.000webhostapp.com
URL: http://0com0cast00log-in0.000webhostapp.com/xfinity/au/tes/ver/home/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:11a:389::1b62 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

nginx /

Resource Hash

fc6cd95261064c28600405c9c8dd51813abf8367e85b6e00f0f3031a8338988a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Pragma: no-cache
Origin: http://0com0cast00log-in0.000webhostapp.com
Accept-Encoding: gzip, deflate
Host: sdx.xfinity.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: */*
Referer: https://login.comcast.net/static/css/junket/styles-dark.min.css?v=b6291a8
Connection: keep-alive
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Referer: https://login.comcast.net/static/css/junket/styles-dark.min.css?v=b6291a8
Origin: http://0com0cast00log-in0.000webhostapp.com

Response headers

Strict-Transport-Security: max-age=31536000
Last-Modified: Tue, 10 Oct 2017 00:22:51 GMT
Server: nginx
ETag: "f05d3ebe80809d82ab14d62a79da544e"
Access-Control-Allow-Methods: GET
Content-Type: application/octet-stream
Access-Control-Allow-Origin: *
Cache-Control: max-age=2592000
Date: Thu, 30 Nov 2017 09:22:23 GMT
x-amz-replication-status: COMPLETED
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 27420

GET
H/1.1 200
OK XfinityStandard-Regular.woff2
sdx.xfinity.com/fonts/latest/Xfinity_Standard/ 26 KB
26 KB 1726ms
15ms Font
application/octet-stream 2a02:26f0:11a:389::1b62
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://sdx.xfinity.com/fonts/latest/Xfinity_Standard/XfinityStandard-Regular.woff2

Requested by

Host: 0com0cast00log-in0.000webhostapp.com
URL: http://0com0cast00log-in0.000webhostapp.com/xfinity/au/tes/ver/home/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:11a:389::1b62 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

nginx /

Resource Hash

138c0ead0fbcd09dd455df9870920e8725b367fbf02ac0cef0c62874000ab176

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Pragma: no-cache
Origin: http://0com0cast00log-in0.000webhostapp.com
Accept-Encoding: gzip, deflate
Host: sdx.xfinity.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: */*
Referer: https://login.comcast.net/static/css/junket/styles-dark.min.css?v=b6291a8
Connection: keep-alive
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Referer: https://login.comcast.net/static/css/junket/styles-dark.min.css?v=b6291a8
Origin: http://0com0cast00log-in0.000webhostapp.com

Response headers

Strict-Transport-Security: max-age=31536000
Last-Modified: Tue, 10 Oct 2017 00:22:52 GMT
Server: nginx
ETag: "e3e79cd377b28c1e7ffea64b194136cf"
Access-Control-Allow-Methods: GET
Content-Type: application/octet-stream
Access-Control-Allow-Origin: *
Cache-Control: max-age=2592000
Date: Thu, 30 Nov 2017 09:22:23 GMT
x-amz-replication-status: COMPLETED
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 26768

GET
H/1.1 200
OK XfinityStandard-Medium.woff2
sdx.xfinity.com/fonts/latest/Xfinity_Standard/ 27 KB
27 KB 1722ms
13ms Font
application/octet-stream 2a02:26f0:11a:389::1b62
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://sdx.xfinity.com/fonts/latest/Xfinity_Standard/XfinityStandard-Medium.woff2

Requested by

Host: 0com0cast00log-in0.000webhostapp.com
URL: http://0com0cast00log-in0.000webhostapp.com/xfinity/au/tes/ver/home/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:11a:389::1b62 , European Union, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

nginx /

Resource Hash

2a031939885bb7efba89d423c9ee7c0fe2bab465f18db63f40a9ae2bd7bc0228

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Pragma: no-cache
Origin: http://0com0cast00log-in0.000webhostapp.com
Accept-Encoding: gzip, deflate
Host: sdx.xfinity.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: */*
Referer: https://login.comcast.net/static/css/junket/styles-dark.min.css?v=b6291a8
Connection: keep-alive
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Referer: https://login.comcast.net/static/css/junket/styles-dark.min.css?v=b6291a8
Origin: http://0com0cast00log-in0.000webhostapp.com

Response headers

Strict-Transport-Security: max-age=31536000
Last-Modified: Tue, 10 Oct 2017 00:22:51 GMT
Server: nginx
ETag: "13709eac065721ba8cd0e2d1b6fa8026"
Access-Control-Allow-Methods: GET
Content-Type: application/octet-stream
Access-Control-Allow-Origin: *
Cache-Control: max-age=2592000
Date: Thu, 30 Nov 2017 09:22:23 GMT
x-amz-replication-status: COMPLETED
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 27152

GET
H/1.1 404
Not Found omniture.js
login.comcast.net/static/js/ 0
0 113ms
113ms Script
text/html 2001:558:fe21:2:69:252:205:24
Comcast Cable Com...

General

Check archive.org

Show headers Download Go to

Full URL: https://login.comcast.net/static/js/omniture.js?v=b6291a8
Requested by: Host: 0com0cast00log-in0.000webhostapp.com
URL: http://0com0cast00log-in0.000webhostapp.com/xfinity/au/tes/ver/home/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 2001:558:fe21:2:69:252:205:24 , United States, ASN7922 (COMCAST-7922 - Comcast Cable Communications, LLC, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: login.comcast.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept: */*
Referer: http://0com0cast00log-in0.000webhostapp.com/xfinity/au/tes/ver/home/
Connection: keep-alive
Cache-Control: no-cache
Referer: http://0com0cast00log-in0.000webhostapp.com/xfinity/au/tes/ver/home/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date: Thu, 30 Nov 2017 09:22:21 GMT
Content-Encoding: gzip
Server: Apache
Vary: accept-language,accept-charset,Accept-Encoding
Content-Language: en
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Type: text/html; charset=iso-8859-1
Keep-Alive: timeout=5, max=498
Content-Length: 708

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Xfinity (Consumer)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery object| login object| shared

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0com0cast00log-in0.000webhostapp.com
login.comcast.net
por-img.cimcontent.net
sdx.xfinity.com
2001:558:fe21:2:69:252:205:24
2a02:26f0:11a:389::1b62
2a02:26f0:e8::5c7a:9a38
2a02:4780:dead:ed11::1
138c0ead0fbcd09dd455df9870920e8725b367fbf02ac0cef0c62874000ab176
2a031939885bb7efba89d423c9ee7c0fe2bab465f18db63f40a9ae2bd7bc0228
44f222333b4c6396b38f2e06dc73d385d243e2b36a30914fd10b6ddb4e831017
b5439f2201a5409ff05248df13222508874e0f8dbbeff94ed4045dd991368bd9
c42c9dc00c9f5da47295156a5a6065939d1aafd3fedb43bd1138ea4353e6da04
d9004ad03ec2d9d946b925a57f4291f70c02e7dbd9e5ddfa4e006352f95e70f3
f0622232666bb2fb8356f40266aaa8c02448e3c5f82103da3139d781ca0cd722
f76d476752259cdab42d5d549fa2b1d32f068242e22eff3a57f0d58ec5cdd0cc
fc6cd95261064c28600405c9c8dd51813abf8367e85b6e00f0f3031a8338988a
ff4e4975ef403004f8fe8e59008db7ad47f54b10d84c72eb90e728d1ec9157ce

0com0cast00log-in0.000webhostapp.com Open in urlscan Pro 2a02:4780:dead:ed11::1 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

14 Requests

86 %HTTPS

100 %IPv6

4 Domains

4 Subdomains

4 IPs

3 Countries

206 kBTransfer

312 kBSize

0 Cookies

7 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

0com0cast00log-in0.000webhostapp.com Open in urlscan Pro
2a02:4780:dead:ed11::1 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

86 %
HTTPS

100 %
IPv6

4
Domains

4
Subdomains

4
IPs

3
Countries

206 kB
Transfer

312 kB
Size

0
Cookies

14 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!