![](/screenshots/3ebb67ea-e012-4646-9f63-34347eb6e6e8.png)
gastrophoria.com
Open in
urlscan Pro
64.6.254.96
Malicious Activity!
Public Scan
Submission: On March 16 via api from US — Scanned from US
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on July 30th 2023. Valid for: 3 months.
This is the only time gastrophoria.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Xfinity (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 64.6.254.96 64.6.254.96 | 11989 (WEBINT) (WEBINT) | |
1 1 | 2001:558:fe36... 2001:558:fe36:100::1a | 7922 (COMCAST-7922) (COMCAST-7922) | |
1 | 2600:141b:1c0... 2600:141b:1c00:38f::30d4 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
2 | 13.225.214.68 13.225.214.68 | 16509 (AMAZON-02) (AMAZON-02) | |
1 | 2606:4700::68... 2606:4700::6811:180e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
3 | 2600:141b:1c0... 2600:141b:1c00:2296::1b62 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
9 | 6 |
ASN7922 (COMCAST-7922, US)
edge.static-assets.top.comcast.net |
ASN20940 (AKAMAI-ASN1, NL)
static.cimcontent.net |
ASN16509 (AMAZON-02, US)
PTR: server-13-225-214-68.ewr50.r.cloudfront.net
privacy-policy.truste.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
xfinity.com
sdx.xfinity.com — Cisco Umbrella Rank: 69086 |
80 KB |
2 |
truste.com
privacy-policy.truste.com — Cisco Umbrella Rank: 11973 |
5 KB |
2 |
gastrophoria.com
gastrophoria.com |
56 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 253 |
64 KB |
1 |
cimcontent.net
static.cimcontent.net — Cisco Umbrella Rank: 30063 |
170 KB |
1 |
comcast.net
1 redirects
edge.static-assets.top.comcast.net — Cisco Umbrella Rank: 50442 |
452 B |
9 | 6 |
Domain | Requested by | |
---|---|---|
3 | sdx.xfinity.com |
gastrophoria.com
|
2 | privacy-policy.truste.com |
gastrophoria.com
|
2 | gastrophoria.com |
gastrophoria.com
|
1 | cdnjs.cloudflare.com |
gastrophoria.com
|
1 | static.cimcontent.net |
gastrophoria.com
|
1 | edge.static-assets.top.comcast.net | 1 redirects |
9 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
privacy.truste.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
gastrophoria.com cPanel, Inc. Certification Authority |
2023-07-30 - 2023-10-28 |
3 months | crt.sh |
*.truste.com Amazon RSA 2048 M02 |
2023-11-18 - 2024-12-15 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-07-03 - 2024-07-02 |
a year | crt.sh |
www.xfinity.comcast.net COMODO RSA Organization Validation Secure Server CA |
2023-08-30 - 2024-08-29 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://gastrophoria.com/awp-content/themes/twentyseventeen/template-parts/navigation/ACCOUNTIDDDDSSSSxxxxxxxxxxxbe9f5ecd4cbf96b1040480f14954b189/login?country.x=US&safeAuth-KeY=%20191502i74co17Xs$t948iXiCYYCX$9nn161805s$tYX$$t00n6$m4F5tXs1XFs2mX0iTCT$sc8i5n779
Frame ID: 96F1E1C21FD8096CEF2F154D9C395FB4
Requests: 11 HTTP requests in this frame
1 Outgoing links
These are links going to different origins than the main page.
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 1- https://edge.static-assets.top.comcast.net/cms/data/assets/bin-201705/b1372fb33a8af099efbde90184076f9b.png HTTP 301
- https://static.cimcontent.net/cms/data/assets/bin-201705/b1372fb33a8af099efbde90184076f9b.png
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
login
gastrophoria.com/awp-content/themes/twentyseventeen/template-parts/navigation/ACCOUNTIDDDDSSSSxxxxxxxxxxxbe9f5ecd4cbf96b1040480f14954b189/ |
10 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles-light.css
gastrophoria.com/awp-content/themes/twentyseventeen/template-parts/navigation/ACCOUNTIDDDDSSSSxxxxxxxxxxxbe9f5ecd4cbf96b1040480f14954b189/css/ |
45 KB 45 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
b1372fb33a8af099efbde90184076f9b.png
static.cimcontent.net/cms/data/assets/bin-201705/ Redirect Chain
|
169 KB 170 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
asc
privacy-policy.truste.com/privacy-seal/Comcast-Cable-Communications-Management,-LLC/ |
17 B 2 KB |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
seal
privacy-policy.truste.com/privacy-seal/Comcast-Cable-Communications-Management,-LLC/ |
161 B 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.1.0/ |
258 KB 64 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
XfinityStandard-Medium.woff2
sdx.xfinity.com/fonts/latest/Xfinity_Standard/ |
27 KB 27 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
XfinityStandard-Regular.woff2
sdx.xfinity.com/fonts/latest/Xfinity_Standard/ |
26 KB 26 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
XfinityStandard-Light.woff2
sdx.xfinity.com/fonts/latest/Xfinity_Standard/ |
27 KB 27 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Xfinity (Consumer)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
gastrophoria.com/ | Name: PHPSESSID Value: 89423e128b8c81a072187d576f3fbceb |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
cdnjs.cloudflare.com
edge.static-assets.top.comcast.net
gastrophoria.com
privacy-policy.truste.com
sdx.xfinity.com
static.cimcontent.net
13.225.214.68
2001:558:fe36:100::1a
2600:141b:1c00:2296::1b62
2600:141b:1c00:38f::30d4
2606:4700::6811:180e
64.6.254.96
138c0ead0fbcd09dd455df9870920e8725b367fbf02ac0cef0c62874000ab176
2a031939885bb7efba89d423c9ee7c0fe2bab465f18db63f40a9ae2bd7bc0228
38118fa99879ff7473b4b7a8d1d004f62cb43d0a27b9b768bbf3c198bdde827d
58fd862aaa51daaa186ee3fecfd805c0f8eea09146e9c7deb44a3f30a1ad01b5
815d1100b641ac0b65a7db0faff7eebeb050511a12768df2372dba60cc1156ff
adf6758f9c4e5d981137b208cc62e652f26b61d9fbf38b6a47f1d01f36c70897
af2d3351d5bb6b63e81eb19140f27324fd7b0ba94dc7c39b6154461243e4986e
b25a2092f0752b754e933008f10213c55dd5ce93a791e355b0abed9182cc8df9
bc55362b581fffb0af8a0e226a26dae3b7f4d2b8930a81ed15f1492e404e19a2
de29ba0f5c0f48f9e1470e94dbf1db5c9f9d0ac12b752f8d750f29fea7e1d6aa
fc6cd95261064c28600405c9c8dd51813abf8367e85b6e00f0f3031a8338988a