![](/screenshots/78ae5ab3-9482-45f5-a83d-7784053d8b83.png)
groupuser.dnsalias.net
Open in
urlscan Pro
138.68.101.19
Malicious Activity!
Public Scan
Submission: On May 09 via automatic, source certstream-suspicious — Scanned from DE
Summary
TLS certificate: Issued by cPanel, Inc. Certification Authority on May 9th 2023. Valid for: 3 months.
This is the only time groupuser.dnsalias.net was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Xfinity (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
9 | 138.68.101.19 138.68.101.19 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
1 | 2606:4700::68... 2606:4700::6811:190e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:80b::2001 | 15169 (GOOGLE) (GOOGLE) | |
3 | 2a02:26f0:480... 2a02:26f0:480:6a1::30d4 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
14 | 5 |
ASN20940 (AKAMAI-ASN1, NL)
static.cimcontent.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
dnsalias.net
groupuser.dnsalias.net |
587 KB |
3 |
cimcontent.net
static.cimcontent.net — Cisco Umbrella Rank: 24631 |
80 KB |
1 |
blogspot.com
98570.blogspot.com |
|
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 231 |
5 KB |
14 | 4 |
Domain | Requested by | |
---|---|---|
9 | groupuser.dnsalias.net |
groupuser.dnsalias.net
|
3 | static.cimcontent.net |
groupuser.dnsalias.net
|
1 | 98570.blogspot.com |
groupuser.dnsalias.net
|
1 | cdnjs.cloudflare.com |
groupuser.dnsalias.net
|
14 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
groupuser.dnsalias.net cPanel, Inc. Certification Authority |
2023-05-09 - 2023-08-07 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2022-08-03 - 2023-08-02 |
a year | crt.sh |
misc-sni.blogspot.com GTS CA 1C3 |
2023-04-17 - 2023-07-10 |
3 months | crt.sh |
static.cimcontent.net COMODO RSA Organization Validation Secure Server CA |
2023-03-30 - 2024-03-29 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://groupuser.dnsalias.net/
Frame ID: 0F3ADC388764D43828FEE090805DD1BC
Requests: 16 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
groupuser.dnsalias.net/ |
60 KB 60 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fonts.css
groupuser.dnsalias.net/css/ |
4 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
style.css
groupuser.dnsalias.net/css/ |
55 KB 56 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.min.js
groupuser.dnsalias.net/js/ |
156 KB 156 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.validate.min.js
groupuser.dnsalias.net/js/ |
49 KB 49 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.mask.js
cdnjs.cloudflare.com/ajax/libs/jquery.mask/1.14.10/ |
20 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
loading_spinner.gif
groupuser.dnsalias.net/img/ |
164 KB 164 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
cap.gif
groupuser.dnsalias.net/img/ |
67 KB 67 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
congra.png
groupuser.dnsalias.net/img/ |
25 KB 25 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.CardValidator.js
groupuser.dnsalias.net/js/ |
6 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
98570.blogspot.com/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
933 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
3 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
XfinityStandard-Regular.woff2
static.cimcontent.net/fonts/latest/Xfinity_Standard/ |
26 KB 26 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
XfinityStandard-Light.woff2
static.cimcontent.net/fonts/latest/Xfinity_Standard/ |
27 KB 27 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
XfinityStandard-Medium.woff2
static.cimcontent.net/fonts/latest/Xfinity_Standard/ |
27 KB 27 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Xfinity (Consumer)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless function| $ function| jQuery1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
groupuser.dnsalias.net/ | Name: PHPSESSID Value: 151c7937043384f12f9423109f244628 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
98570.blogspot.com
cdnjs.cloudflare.com
groupuser.dnsalias.net
static.cimcontent.net
138.68.101.19
2606:4700::6811:190e
2a00:1450:4001:80b::2001
2a02:26f0:480:6a1::30d4
138c0ead0fbcd09dd455df9870920e8725b367fbf02ac0cef0c62874000ab176
2a031939885bb7efba89d423c9ee7c0fe2bab465f18db63f40a9ae2bd7bc0228
2e31f31633d04598c60731878851d821eaa4403af63b930d58bb10bc9c0428a2
3aff7c9a7e7770ba800ae672e3059379a22787edc69ae322b4e1209bd81e106e
4bd9c8ed57b1dd8fddcc2910170e9b81b40f7b628e272924e88a98f45ebb9aea
5227bd146de79d636b955a0e26ed4f7c2bd28831edb1759aee1d947021cb2755
5723eb5c9b31fdff6a79f7b74042ff29f5765f14bda2f93bd4813da47d8d248d
58fd862aaa51daaa186ee3fecfd805c0f8eea09146e9c7deb44a3f30a1ad01b5
7b82ac5b246304551b1d4417410d4355d8450fd30e2c5cf02df4656aacd5e885
89db88fadaf63fd4e91d869fed81834918debd6eacbe6e47b5ad54e061996aed
af38256eedc05a627c84dae00ff5f37f69240f434462592e2b07c2f93811c9ff
be483938eb34538b970684f72e312f62652e84b42b7ad86953962d1ce2217c44
dc88fa2a7aecef682d6a179ca216064be5017862c45a369b4d981ee7fe477a67
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eb4c5c948a9fe478145ad1f4246de731beb49a23fd8d707fd8fadea38009326f
fc6cd95261064c28600405c9c8dd51813abf8367e85b6e00f0f3031a8338988a