pc2.mypreferences.com
Open in
urlscan Pro
162.253.104.96
Malicious Activity!
Public Scan
Effective URL: https://pc2.mypreferences.com/ComcastPrefCenter/ManagePreferences?params=ZW1haWw9dG9tLmJhcnJldHRAZXJpY3Nzb24uY29tJmN1c3RvbWVyd...
Submission: On April 25 via api from SE — Scanned from SE
Summary
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on July 9th 2021. Valid for: a year.
This is the only time pc2.mypreferences.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Xfinity (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 199.7.200.192 199.7.200.192 | 15334 (RESPONSYS) (RESPONSYS) | |
9 | 162.253.104.96 162.253.104.96 | 20141 (QTS-SUW1-...) (QTS-SUW1-ATL1) | |
2 | 188.114.96.7 188.114.96.7 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 104.89.19.120 104.89.19.120 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
1 | 142.250.186.104 142.250.186.104 | 15169 (GOOGLE) (GOOGLE) | |
3 3 | 69.241.8.130 69.241.8.130 | 7922 (COMCAST-7922) (COMCAST-7922) | |
3 | 96.16.156.156 96.16.156.156 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
16 | 5 |
ASN16625 (AKAMAI-AS, US)
PTR: a104-89-19-120.deploy.static.akamaitechnologies.com
cdn.comcast.com |
ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f8.1e100.net
www.googletagmanager.com |
ASN7922 (COMCAST-7922, US)
PTR: odol-atsec-bos-50.brockton.ma.boston.comcast.net
edge.static-assets.top.comcast.net |
ASN16625 (AKAMAI-AS, US)
PTR: a96-16-156-156.deploy.static.akamaitechnologies.com
static.cimcontent.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
mypreferences.com
pc2.mypreferences.com — Cisco Umbrella Rank: 305391 |
208 KB |
3 |
cimcontent.net
static.cimcontent.net — Cisco Umbrella Rank: 20984 |
86 KB |
3 |
comcast.net
3 redirects
edge.static-assets.top.comcast.net — Cisco Umbrella Rank: 34875 |
1 KB |
2 |
fontawesome.com
use.fontawesome.com — Cisco Umbrella Rank: 822 |
90 KB |
1 |
googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 58 |
42 KB |
1 |
comcast.com
cdn.comcast.com — Cisco Umbrella Rank: 47720 |
821 B |
1 |
xfinity.com
1 redirects
emails.xfinity.com — Cisco Umbrella Rank: 321499 |
2 KB |
16 | 7 |
Domain | Requested by | |
---|---|---|
9 | pc2.mypreferences.com |
pc2.mypreferences.com
|
3 | static.cimcontent.net |
pc2.mypreferences.com
|
3 | edge.static-assets.top.comcast.net | 3 redirects |
2 | use.fontawesome.com |
pc2.mypreferences.com
use.fontawesome.com |
1 | www.googletagmanager.com |
pc2.mypreferences.com
|
1 | cdn.comcast.com |
pc2.mypreferences.com
|
1 | emails.xfinity.com | 1 redirects |
16 | 7 |
This site contains links to these domains. Also see Links.
Domain |
---|
customer.xfinity.com |
www.xfinity.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
pc.mypreferences.com DigiCert SHA2 Extended Validation Server CA |
2021-07-09 - 2022-08-09 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-07-07 - 2022-07-06 |
a year | crt.sh |
xapi.xfinity.com COMODO RSA Organization Validation Secure Server CA |
2022-04-20 - 2023-04-20 |
a year | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2022-04-11 - 2022-07-04 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://pc2.mypreferences.com/ComcastPrefCenter/ManagePreferences?params=ZW1haWw9dG9tLmJhcnJldHRAZXJpY3Nzb24uY29tJmN1c3RvbWVydHlwZT1DdXN0b21lciZzb3VyY2VpZD0yMDIyMDQxNV9BZGhvY19DTV9Vc2VNb3JlTkw%3D
Frame ID: 3FD2F7770EC8E56C99D4562AA2021462
Requests: 16 HTTP requests in this frame
Screenshot
Page Title
Manage Xfinity Communication PreferencesPage URL History Show full URLs
-
https://emails.xfinity.com/pub/cc?_ri_=X0Gzc2X=AQpglLjHJlYQGvI30W8zehn591czdUgk6jULLzfzgMA41S9zff3OetYz...
HTTP 302
https://pc2.mypreferences.com/ComcastPrefCenter/ManagePreferences?params=ZW1haWw9dG9tLmJhcnJldHRAZXJpY3Nzb... Page URL
Detected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Font Awesome (Font Scripts) Expand
Detected patterns
- <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
- (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Google Tag Manager (Tag Managers) Expand
Detected patterns
- googletagmanager\.com/ns\.html[^>]+></iframe>
- <!-- (?:End )?Google Tag Manager -->
- googletagmanager\.com/gtm\.js
Modernizr (JavaScript Libraries) Expand
Detected patterns
- ([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js
jQuery (JavaScript Libraries) Expand
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
Title: My Account
Search URL Search Domain Scan URL
Title: Join now.
Search URL Search Domain Scan URL
Title: Privacy Policy
Search URL Search Domain Scan URL
Title: Cal.Civ.Code § 1798.135: Do Not Sell My Info
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://emails.xfinity.com/pub/cc?_ri_=X0Gzc2X=AQpglLjHJlYQGvI30W8zehn591czdUgk6jULLzfzgMA41S9zff3OetYzaeIkPfzczcJoNy5HzcXebbed4YX2JFdIzaVXtpKX=UWTTRRDY&_ei_=EM6hiIRZ6IbTRQzpp7EgfWDv5wmb7wtZr_HKt4Y9565l73Y_PqZSaCEhvHs0mzNqB-gBgO3tuO3UzGxLd8-XUq76ZMc933xI6KE-OcN9i_7_vZ1nKFQzNpaL4RiL4mq9EOJepBHBH9Ka2UvEZBYn0GLwNUHY2xz2kUL42HrGepOz_rtUraFFsI1UbGpel71SoUC4JYl4W2WtLGWL_smg5J9SgOlmq3yPRKoTyTNkZs0ywiDMvzVv9oZGFgDomc-ADpmBGgKKXGDCMykhj-oxH82uaBqLlD92KAzCIiEW68WkZ5uRD4q4CWZESjsxf-PMkjrVFhI2a2AcIg4PNNtIvanJiLDuHJs-nXaVJxWO_k2Fu6Hdc2cWZ9bJcJfi_Qe20F-fHzrKHCGjujCQOiwpBb7qu3ZxxTGEmQ8hbSzboZjeQHWD2afx4Tn-2OOgPr-hE_wzXoHG2wxkBEyl1mJqhCLCqT4we6iZbG9s6GeJs6reYBc1T6Y4dzbzVXwM_aDP0Piz1FNU9lOse-TtoVqZsY_oSEAa1z01g9qN7HatpAlx1r8OUW-49ECnftnzPXOJP0dktV6U7S1q_gvQg_uRVcpOX-f3acXfXlSVaNsrIciNssq1FLQuXCGLajkd05OMD5rtJIfSUWhrjZ3wI3oozAXs5whyk4aNShpJTeRPSb7WozXlmydmbRfIl19-BgzJ8NL7XyrXIVzebtgDcRgrlvwNMTBmIobf43Gvo6I5-SQVDrqcWbl_UO5rQyQhkswr_GUV7l175wyyYbsTn5gp2lDl6befan1hS8wop8AANAlSm0V5cehAoCjToC_rGm4mG4JiweCBUDhovuY3ay-iY-JWtpW7p1xb3DNkwK8Q9w2MvVOBWxMoZSaHC5Up-9R-LxNpa49dZ4tzK8sV-bU-H_7IlsXJmg23RUou0nudtzcNmKNZN_LicFyiqBbpC3pHW6moRHsINgF3XWvjP5u-W0o.&_di_=7h3h3h4s6a6v5gd63dl8uce1vp5qk0osfpcqaq4m6q0ksip94m6g
HTTP 302
https://pc2.mypreferences.com/ComcastPrefCenter/ManagePreferences?params=ZW1haWw9dG9tLmJhcnJldHRAZXJpY3Nzb24uY29tJmN1c3RvbWVydHlwZT1DdXN0b21lciZzb3VyY2VpZD0yMDIyMDQxNV9BZGhvY19DTV9Vc2VNb3JlTkw%3D Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 11- https://edge.static-assets.top.comcast.net/staticsites/fonts/latest/Xfinity_Standard/XfinityStandard-Light.woff2 HTTP 301
- https://static.cimcontent.net/staticsites/fonts/latest/Xfinity_Standard/XfinityStandard-Light.woff2
- https://edge.static-assets.top.comcast.net/staticsites/fonts/latest/Xfinity_Standard/XfinityStandard-ExtraLight.woff2 HTTP 301
- https://static.cimcontent.net/staticsites/fonts/latest/Xfinity_Standard/XfinityStandard-ExtraLight.woff2
- https://edge.static-assets.top.comcast.net/staticsites/fonts/latest/Xfinity_Standard/XfinityStandard-Regular.woff2 HTTP 301
- https://static.cimcontent.net/staticsites/fonts/latest/Xfinity_Standard/XfinityStandard-Regular.woff2
16 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
ManagePreferences
pc2.mypreferences.com/ComcastPrefCenter/ Redirect Chain
|
58 KB 58 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
all.css
use.fontawesome.com/releases/v5.6.3/css/ |
52 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.css
pc2.mypreferences.com/ComcastPrefCenter/Content/ |
143 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
site.css
pc2.mypreferences.com/ComcastPrefCenter/Content/ |
30 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
modernizr-2.8.3.js
pc2.mypreferences.com/ComcastPrefCenter/Scripts/ |
50 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
E020F7373720426891AC068F01DA5A2A
cdn.comcast.com/-/media/ |
944 B 821 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gtm.js
www.googletagmanager.com/ |
109 KB 42 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-3.3.1.js
pc2.mypreferences.com/ComcastPrefCenter/Scripts/ |
265 KB 79 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
bootstrap.js
pc2.mypreferences.com/ComcastPrefCenter/Scripts/ |
68 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
sessionStorageManager.js
pc2.mypreferences.com/ComcastPrefCenter/Scripts/ |
372 B 832 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.validate.min.js
pc2.mypreferences.com/ComcastPrefCenter/Scripts/ |
23 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
preferences.js
pc2.mypreferences.com/ComcastPrefCenter/Scripts/ |
15 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
XfinityStandard-Light.woff2
static.cimcontent.net/staticsites/fonts/latest/Xfinity_Standard/ Redirect Chain
|
27 KB 27 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
XfinityStandard-ExtraLight.woff2
static.cimcontent.net/staticsites/fonts/latest/Xfinity_Standard/ Redirect Chain
|
32 KB 33 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
XfinityStandard-Regular.woff2
static.cimcontent.net/staticsites/fonts/latest/Xfinity_Standard/ Redirect Chain
|
26 KB 26 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fa-solid-900.woff2
use.fontawesome.com/releases/v5.6.3/webfonts/ |
77 KB 78 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Xfinity (Consumer)12 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| structuredClone object| oncontextlost object| oncontextrestored function| getScreenDetails object| dataLayer object| html5 object| Modernizr object| google_tag_manager function| $ function| jQuery function| SessionStoreManager function| AddAntiForgeryToken4 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.xfinity.com/pub | Name: 6.interact5.Mnn.....N.N... Value: _ri_=X0Gzc2X%3DAQpglLjHJlYQGvI30W8zehn591czdUgk6jULLzfzgMA41S9zff3OetYzaeIkPfzczcJoNy5HzcXebbed4YX2JFdIzaVXtpKX%3DUWTTRRDY&_ei_=EM6hiIRZ6IbTRQzpp7EgfWDv5wmb7wtZr_HKt4Y9565l73Y_PqZSaCEhvHs0mzNqB-gBgO3tuO3UzGxLd8-XUq76ZMc933xI6KE-OcN9i_7_vZ1nKFQzNpaL4RiL4mq9EOJepBHBH9Ka2UvEZBYn0GLwNUHY2xz2kUL42HrGepOz_rtUraFFsI1UbGpel71SoUC4JYl4W2WtLGWL_smg5J9SgOlmq3yPRKoTyTNkZs0ywiDMvzVv9oZGFgDomc-ADpmBGgKKXGDCMykhj-oxH82uaBqLlD92KAzCIiEW68WkZ5uRD4q4CWZESjsxf-PMkjrVFhI2a2AcIg4PNNtIvanJiLDuHJs-nXaVJxWO_k2Fu6Hdc2cWZ9bJcJfi_Qe20F-fHzrKHCGjujCQOiwpBb7qu3ZxxTGEmQ8hbSzboZjeQHWD2afx4Tn-2OOgPr-hE_wzXoHG2wxkBEyl1mJqhCLCqT4we6iZbG9s6GeJs6reYBc1T6Y4dzbzVXwM_aDP0Piz1FNU9lOse-TtoVqZsY_oSEAa1z01g9qN7HatpAlx1r8OUW-49ECnftnzPXOJP0dktV6U7S1q_gvQg_uRVcpOX-f3acXfXlSVaNsrIciNssq1FLQuXCGLajkd05OMD5rtJIfSUWhrjZ3wI3oozAXs5whyk4aNShpJTeRPSb7WozXlmydmbRfIl19-BgzJ8NL7XyrXIVzebtgDcRgrlvwNMTBmIobf43Gvo6I5-SQVDrqcWbl_UO5rQyQhkswr_GUV7l175wyyYbsTn5gp2lDl6befan1hS8wop8AANAlSm0V5cehAoCjToC_rGm4mG4JiweCBUDhovuY3ay-iY-JWtpW7p1xb3DNkwK8Q9w2MvVOBWxMoZSaHC5Up-9R-LxNpa49dZ4tzK8sV-bU-H_7IlsXJmg23RUou0nudtzcNmKNZN_LicFyiqBbpC3pHW6moRHsINgF3XWvjP5u-W0o |
|
pc2.mypreferences.com/ | Name: __RequestVerificationToken_L0NvbWNhc3RQcmVmQ2VudGVy0 Value: 21sAutcWyb5iDOv__Et_Alk48bjRjoCVwMYakli0rbk4Qe7JYHv-nN0kQLsApU6BYG-rPLC0LvCALBpEWwQTqK4uiY9UXT2GEfveiSOPFdU1 |
|
pc2.mypreferences.com/ | Name: BIGipServerZSfR4CX9T8H3asIHr8Tmug Value: !C+n9tsUeXnqVv4KmE7I3W0fiXX2bmCq5rrJ2CAClXeswrYnK5+Q9EZUoWWRMznT1NqIWTtpzXSZ4UQ8= |
|
.pc2.mypreferences.com/ | Name: TS01b2ef0f Value: 0141bd2f0ae1f3cf69b9508db5bb4d3a109f41b0fb1ba009b6f5564af745814a19ad82914ba3bbe1fc69d40d49665a505c21affcb2 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=16070400; includeSubDomains |
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdn.comcast.com
edge.static-assets.top.comcast.net
emails.xfinity.com
pc2.mypreferences.com
static.cimcontent.net
use.fontawesome.com
www.googletagmanager.com
104.89.19.120
142.250.186.104
162.253.104.96
188.114.96.7
199.7.200.192
69.241.8.130
96.16.156.156
0abe8deb334de1ba743b04d0399e99eba336afed9da72fc4c0a302c99f9238c8
138c0ead0fbcd09dd455df9870920e8725b367fbf02ac0cef0c62874000ab176
14baf9730293b1f7df6a576da16dcb8302f1afc8522a9bd1d85a0e593609806f
17a879e50c3ab3078afaded288e257fb66e94806b76ff7e796b54226f9848f50
18b7b2800d8021623da60e9337e38d3f173f69de6890163ec580896ced9b942e
3fc775a41de34dbe8d1e1d3b537638eac0a15a7b37dcf0bfc734f6fd6cf4c9ab
481a0574246e281316ffa0e15399bf5388bb81ae550ce0401a0353b6bb2d1e5a
7dfc3ef73c1284c7aff3c5cdac3812d212c8b899037d7860c8ba20a1defb9a7f
7e630d90c7234b0df1729f62b8f9e4bbfaf293d91a5a0ac46df25f2a6759e39a
8107d336fd1e5fee55e5a439af3165b98a39d84e25a0d55af1179d8e1b7b19ea
8f6e1abd2d0c7965b33e2520eb20b841fd3ed6a39c9292808e8d192e86e5b359
b666c3a42a8e2d7266ebdd704056a99a4808e9182bebf2ad62dcf8b888e87815
c2545dcc0cc96f3ad07614be05a69aac6ce0bffa473cb6e9bb59394459d9c48c
d8aa24ecc6cecb1a60515bc093f1c9da38a0392612d9ab8ae0f7f36e6eee1fad
f419ad7a4477f36ce73c74a23dce784150ca38fa5075a8e06109709cbb716903
fc6cd95261064c28600405c9c8dd51813abf8367e85b6e00f0f3031a8338988a