www.safebrowse.io
Open in
urlscan Pro
2600:9000:21f3:5a00:2:bd35:ec40:93a1
Malicious Activity!
Public Scan
URL:
https://www.safebrowse.io/warn.html?url=http
Submission: On July 21 via api from US — Scanned from DE
Submission: On July 21 via api from US — Scanned from DE
Summary
This website contacted 2 IPs
in 2 countries
across 3 domains to perform 10 HTTP transactions.
The main IP is 2600:9000:21f3:5a00:2:bd35:ec40:93a1, located in
United States and
belongs to AMAZON-02, US.
The main domain is www.safebrowse.io.
The Cisco Umbrella rank of the primary domain is 225372.
TLS certificate: Issued by COMODO RSA Organization Validation Se... on April 11th 2024. Valid for: a year.
This is the only time www.safebrowse.io was scanned on urlscan.io!
TLS certificate: Issued by COMODO RSA Organization Validation Se... on April 11th 2024. Valid for: a year.
This is the only time www.safebrowse.io was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Xfinity (Consumer)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 9 | 2600:9000:21f... 2600:9000:21f3:5a00:2:bd35:ec40:93a1 | 16509 (AMAZON-02) (AMAZON-02) | |
| 1 1 | 2001:558:fe02... 2001:558:fe02::74 | 7922 (COMCAST-7922) (COMCAST-7922) | |
| 1 | 2a02:26f0:480... 2a02:26f0:480:d92::30d4 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
| 10 | 2 |
1
2a02:26f0:480:d92::30d4
(Frankfurt am Main, Germany)
ASN20940 (AKAMAI-ASN1, NL)
ASN20940 (AKAMAI-ASN1, NL)
| static.cimcontent.net |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 9 |
safebrowse.io
www.safebrowse.io — Cisco Umbrella Rank: 225372 |
310 KB |
| 1 |
cimcontent.net
static.cimcontent.net — Cisco Umbrella Rank: 38344 |
27 KB |
| 1 |
comcast.net
1 redirects
edge.static-assets.top.comcast.net — Cisco Umbrella Rank: 85269 |
453 B |
| 10 | 3 |
| Domain | Requested by | |
|---|---|---|
| 9 | www.safebrowse.io |
www.safebrowse.io
|
| 1 | static.cimcontent.net |
www.safebrowse.io
|
| 1 | edge.static-assets.top.comcast.net | 1 redirects |
| 10 | 3 |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.safebrowse.io COMODO RSA Organization Validation Secure Server CA |
2024-04-11 - 2025-04-11 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.safebrowse.io/warn.html?url=http
Frame ID: 165841F0C285F257E5CDD042969D4C63
Requests: 10 HTTP requests in this frame
1 Outgoing links
These are links going to different origins than the main page.
URL: http://http/
Title: Proceed Anyway
Title: Proceed Anyway
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 7- https://edge.static-assets.top.comcast.net/staticsites/fonts/latest/Xfinity_Standard/XfinityStandard-Light.woff2 HTTP 301
- https://static.cimcontent.net/staticsites/fonts/latest/Xfinity_Standard/XfinityStandard-Light.woff2
10 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
warn.html
www.safebrowse.io/ |
3 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
theme-xdns-security.min.css
www.safebrowse.io/css/ |
2 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.js
www.safebrowse.io/js/jquery/ |
261 KB 262 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
class.min.js
www.safebrowse.io/js/class/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery.jquery-encoder.min.js
www.safebrowse.io/js/jquery-encoder/ |
14 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
purify.min.js
www.safebrowse.io/js/dom-purify/ |
18 KB 18 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
warn.js
www.safebrowse.io/js/ |
2 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
icon_enhanced-security-no-threats.svg
www.safebrowse.io/img/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
XfinityStandard-Light.woff2
static.cimcontent.net/staticsites/fonts/latest/Xfinity_Standard/ Redirect Chain
|
27 KB 27 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
favicon.ico
www.safebrowse.io/ |
1 KB 1 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Xfinity (Consumer)9 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery function| Class function| DOMPurify function| validURL function| getUrlParamValue function| removeToken function| prependMissingHttp function| render0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
edge.static-assets.top.comcast.net
static.cimcontent.net
www.safebrowse.io
2001:558:fe02::74
2600:9000:21f3:5a00:2:bd35:ec40:93a1
2a02:26f0:480:d92::30d4
200db542016a7037a6911f83c9cd51916b0e1e4416fc553faa76ec35cf6c1f57
2c5a2d264308f6c151d5dff66eb835371c50657bd14fcc907c25e0759391b445
35d6e6e27335bc6aa9db9daa7ec1dd91d24dcf71ae080c127792d27404a78e58
3d7c472344dda8575363db8b0e222fc1df6ea81fdf12ec791b925dc6027eaf90
3f7988848629a37276f40ffca86c8f305fe29a635900e6a196e459c4e58e16e0
4dc02f52216eee33e946e81e21860f951e2f5d47b54a7615209b02071ce3480c
bcd728f07447b2826147629ca50d1e4a6f2cfcd8813a1400dd61a6dc0551a5fd
f2bac02ac2474097a9f25cb37d52340787899944d4963f8b1ea9cf610cd33e30
fc6cd95261064c28600405c9c8dd51813abf8367e85b6e00f0f3031a8338988a
ff8d1b0a7ac6581fb3038b5bae8c777b75d991a262b7692112063c0fccfa4eae