login1.qnrxfintykdcomcast.tech
Open in
urlscan Pro
2606:4700:20::681a:be7
Malicious Activity!
Public Scan
Effective URL: https://login1.qnrxfintykdcomcast.tech/
Submission: On July 19 via api from US — Scanned from CH
Summary
TLS certificate: Issued by WE1 on July 5th 2024. Valid for: 3 months.
This is the only time login1.qnrxfintykdcomcast.tech was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Xfinity (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
4 | 2606:4700:20:... 2606:4700:20::681a:be7 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 104.18.94.41 104.18.94.41 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 104.18.95.41 104.18.95.41 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
8 | 4 |
ASN13335 (CLOUDFLARENET, US)
login1.qnrxfintykdcomcast.tech |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
qnrxfintykdcomcast.tech
login1.qnrxfintykdcomcast.tech |
157 KB |
2 |
cloudflare.com
challenges.cloudflare.com — Cisco Umbrella Rank: 3877 |
15 KB |
8 | 2 |
Domain | Requested by | |
---|---|---|
4 | login1.qnrxfintykdcomcast.tech |
login1.qnrxfintykdcomcast.tech
|
2 | challenges.cloudflare.com |
login1.qnrxfintykdcomcast.tech
challenges.cloudflare.com |
8 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.cloudflare.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
qnrxfintykdcomcast.tech WE1 |
2024-07-05 - 2024-10-03 |
3 months | crt.sh |
challenges.cloudflare.com E5 |
2024-07-17 - 2024-10-15 |
3 months | crt.sh |
This page contains 2 frames:
Primary Page:
https://login1.qnrxfintykdcomcast.tech/
Frame ID: 66D21E25AAB028A568F625787E67D923
Requests: 8 HTTP requests in this frame
Frame:
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/y5dqs/0x4AAAAAAAAjq6WYeRDKmebM/light/fbE/normal/auto/
Frame ID: 3473AF613EA6105E463ED4F461A5154E
Requests: 1 HTTP requests in this frame
Screenshot
Page Title
Just a moment...Page URL History Show full URLs
-
http://login1.qnrxfintykdcomcast.tech/
HTTP 307
https://login1.qnrxfintykdcomcast.tech/ Page URL
Page Statistics
1 Outgoing links
These are links going to different origins than the main page.
Title: Cloudflare
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://login1.qnrxfintykdcomcast.tech/
HTTP 307
https://login1.qnrxfintykdcomcast.tech/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
login1.qnrxfintykdcomcast.tech/ Redirect Chain
|
149 KB 56 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
939 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
v1
login1.qnrxfintykdcomcast.tech/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/ |
88 KB 34 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
api.js
challenges.cloudflare.com/turnstile/v0/b/bbfecc7f1c71/ |
43 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET BLOB |
b58bbf97-9f80-45c8-b26c-8938944b5def
https://login1.qnrxfintykdcomcast.tech/ |
13 B 0 |
Other
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
login1.qnrxfintykdcomcast.tech/ |
146 KB 53 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
cece5a6e1bd6f91
login1.qnrxfintykdcomcast.tech/cdn-cgi/challenge-platform/h/b/flow/ov1/1849903229:1721391077:lheNBUd6kxuwxfFxTsIa2d6GQ4ZONOd-tubECBKdR_Q/8a5aea89fc63662d/ |
17 KB 13 KB |
XHR
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
/
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/y5dqs/0x4AAAAAAAAjq6WYeRDKmebM/light/fbE/normal/auto/ Frame 3473 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET BLOB |
4321f342-d619-4435-84d3-0530dc289ff7
https://login1.qnrxfintykdcomcast.tech/ |
80 B 0 |
Other
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Xfinity (Consumer)19 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery object| _cf_chl_opt function| BNnn4 function| dHNZt7 function| ooiEk3 boolean| BHZR0 function| yBrQw2 function| gfNxB8 function| tlPF8 object| KbqQ2 object| fqpQ7 function| ebSg5 object| JwIp7 number| cvLh2 object| angular object| turnstile boolean| bSFP6 string| lHEy20 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
challenges.cloudflare.com
login1.qnrxfintykdcomcast.tech
104.18.94.41
104.18.95.41
2606:4700:20::681a:be7
00fdceb9adca6c9aaefdddc35c3086d97230ff170dc8c427b1cc9b25b5087e29
15334e1a1a24d9f0f0a3daaedc6f438e3bdd6ef11d7fefb7d37e3208094c7089
3a979bb0389d5f41d39f8d21343c35375f5b1efa0713b07560e04fecbf965e67
3b4413787d7b32bfd01680f4dcdd3d54a9463be7bac436c4b5b6b65ab5d6d15f
8860e7fef89219a219cb11d18bd8e4a322f32072613f86e935e7fe162ab69c04
a20ae8f3421682042d681bb7d09a6285bed4fc7bc03fedc91178576dd175490b
a7e1f4c9e6f73d6f3ab56217b38ff5ff4b51aa63ee11733c3b771c0b7f690610
f3418640c1204265881221580b9d1554424f6ed49549d408da50c690ab29f400