![](/screenshots/93972782-2e2e-4c90-8d5c-82d2a13ea785.png)
mail.twc.com
Open in
urlscan Pro
107.14.73.68
Malicious Activity!
Public Scan
Effective URL: https://mail.twc.com/
Submission: On May 09 via manual from US
Summary
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on October 29th 2018. Valid for: a year.
This is the only time mail.twc.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Spectrum (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
16 | 107.14.73.68 107.14.73.68 | 7843 (TWC-7843-BB) (TWC-7843-BB - Charter Communications Inc) | |
1 3 | 104.109.56.111 104.109.56.111 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 4 | 34.247.143.160 34.247.143.160 | 16509 (AMAZON-02) (AMAZON-02 - Amazon.com) | |
1 2 | 66.235.149.58 66.235.149.58 | 15224 (OMNITURE) (OMNITURE - Adobe Systems Inc.) | |
22 | 4 |
ASN7843 (TWC-7843-BB - Charter Communications Inc, US)
PTR: dnvrco-twc-vip.email.rr.com
mail.twc.com |
ASN20940 (AKAMAI-ASN1, US)
PTR: a104-109-56-111.deploy.static.akamaitechnologies.com
sb.scorecardresearch.com |
ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-34-247-143-160.eu-west-1.compute.amazonaws.com
twc.demdex.net |
ASN15224 (OMNITURE - Adobe Systems Inc., US)
PTR: twcc.com.ssl.d2.sc.omtrdc.net
tr-ssl.twcc.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
twc.com
mail.twc.com |
317 KB |
4 |
demdex.net
1 redirects
twc.demdex.net |
4 KB |
3 |
scorecardresearch.com
1 redirects
sb.scorecardresearch.com |
2 KB |
2 |
twcc.com
1 redirects
tr-ssl.twcc.com |
2 KB |
22 | 4 |
Domain | Requested by | |
---|---|---|
16 | mail.twc.com |
mail.twc.com
|
4 | twc.demdex.net |
1 redirects
mail.twc.com
|
3 | sb.scorecardresearch.com |
1 redirects
mail.twc.com
|
2 | tr-ssl.twcc.com | 1 redirects |
22 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.spectrum.com |
business.spectrum.com |
myservices.timewarnercable.com |
www.timewarnercable.com |
tv.twcc.com |
watch.spectrum.net |
urt.rr.com |
pt.rr.com |
www.twcmedia.com |
help.twcable.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
mail.twc.com DigiCert SHA2 Secure Server CA |
2018-10-29 - 2019-10-30 |
a year | crt.sh |
*.scorecardresearch.com COMODO RSA Organization Validation Secure Server CA |
2018-11-28 - 2019-12-26 |
a year | crt.sh |
*.demdex.net DigiCert SHA2 High Assurance Server CA |
2018-01-09 - 2021-02-12 |
3 years | crt.sh |
tr-ssl.twcc.com DigiCert SHA2 High Assurance Server CA |
2019-02-12 - 2020-05-15 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://mail.twc.com/
Frame ID: B24F48880293ABC1C1B18BD8A8BD27C3
Requests: 21 HTTP requests in this frame
Frame:
https://twc.demdex.net/dest4.html?d_nsid=1
Frame ID: B59127BF0EE53DF602CE2AF1B05568EE
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/93972782-2e2e-4c90-8d5c-82d2a13ea785.png)
Page URL History Show full URLs
- http://mail.twc.com/ Page URL
- https://mail.twc.com/ Page URL
Detected technologies
![](/vendor/wappa/icons/Java.png)
Detected patterns
- headers server /^Resin(?:\/(\S*))?/i
![](/vendor/wappa/icons/Resin.png)
Detected patterns
- headers server /^Resin(?:\/(\S*))?/i
![](/vendor/wappa/icons/SiteCatalyst.png)
Detected patterns
- script /\/s[_-]code.*\.js/i
- env /^s_(?:account|objectID|code|INST)$/i
![](/vendor/wappa/icons/comScore.png)
Detected patterns
- html /<iframe[^>]* (?:id="comscore"|scr=[^>]+comscore)|\.scorecardresearch\.com\/beacon\.js|COMSCORE\.beacon/i
- script /\.scorecardresearch\.com\/beacon\.js|COMSCORE\.beacon/i
- env /^_?COMSCORE$/i
Page Statistics
15 Outgoing links
These are links going to different origins than the main page.
Title: Home
Search URL Search Domain Scan URL
Title: Business
Search URL Search Domain Scan URL
Title: My Account
Search URL Search Domain Scan URL
Title: Support
Search URL Search Domain Scan URL
Title: TV Listings
Search URL Search Domain Scan URL
Title: Watch TV
Search URL Search Domain Scan URL
Title: Security
Search URL Search Domain Scan URL
Title: About Us
Search URL Search Domain Scan URL
Title: Email Address
Search URL Search Domain Scan URL
Title: Password?
Search URL Search Domain Scan URL
Title: Advertise with Us
Search URL Search Domain Scan URL
Title: Terms of Use
Search URL Search Domain Scan URL
Title: Web Privacy Policy
Search URL Search Domain Scan URL
Title: Your California Privacy Rights
Search URL Search Domain Scan URL
Title: TWC Subscriber Policies
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://mail.twc.com/ Page URL
- https://mail.twc.com/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 16- https://sb.scorecardresearch.com/b?c1=2&c2=6036183&ns__t=1557424214010&ns_c=UTF-8&cv=3.1&c8=Log%20In&c7=https%3A%2F%2Fmail.twc.com%2F&c9=http%3A%2F%2Fmail.twc.com%2F HTTP 302
- https://sb.scorecardresearch.com/b2?c1=2&c2=6036183&ns__t=1557424214010&ns_c=UTF-8&cv=3.1&c8=Log%20In&c7=https%3A%2F%2Fmail.twc.com%2F&c9=http%3A%2F%2Fmail.twc.com%2F
- https://twc.demdex.net/event?d_nsid=1&d_ld=_ts%3D1557424214166&d_rtbd=json&d_jsonv=1&d_dst=1&d_cts=1&d_cb=demdexRequestCallback_twc_1_1557424214166 HTTP 302
- https://twc.demdex.net/firstevent?d_nsid=1&d_ld=_ts%3D1557424214166&d_rtbd=json&d_jsonv=1&d_dst=1&d_cts=1&d_cb=demdexRequestCallback_twc_1_1557424214166
- https://tr-ssl.twcc.com/b/ss/rrglobal/1/H.26.2/s57740969738812?AQB=1&ndh=1&t=9%2F4%2F2019%2017%3A50%3A14%204%200&fid=28D365B84683C68B-2D02075F0280DA9A&ce=UTF-8&ns=roadrunner&pageName=webmail%3Elogin%3Emain&g=https%3A%2F%2Fmail.twc.com%2F&r=http%3A%2F%2Fmail.twc.com%2F&cc=USD&ch=webmail&events=event13&c1=twc.com&c9=login&v13=D%3DpageName&c27=first%20visit&v27=D%3Dc27&c28=new&v28=D%3Dc28&c30=1%3A1%3A1%3A1&v30=D%3Dc30&c51=webmail&v51=D%3Dc51&c56=webmail%3Awebmail&v56=D%3Dc56&c69=12%3A50%20pm%7Cthursday&v71=D%3Dc71&c72=twcc&v72=D%3Dc72&c73=https%3A%2F%2Fmail.twc.com%2F&v73=D%3Dc73&c74=3.8%7Ch.27.2%7C20150120&v74=D%3Dc69&v75=D%3Dc75&h1=webmail%7Clogin%7Cmain&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1 HTTP 302
- https://tr-ssl.twcc.com/b/ss/rrglobal/1/H.26.2/s57740969738812?AQB=1&pccr=true&vidn=2E6A342B053166DA-4000010BA00078A0&&ndh=1&t=9%2F4%2F2019%2017%3A50%3A14%204%200&fid=28D365B84683C68B-2D02075F0280DA9A&ce=UTF-8&ns=roadrunner&pageName=webmail%3Elogin%3Emain&g=https%3A%2F%2Fmail.twc.com%2F&r=http%3A%2F%2Fmail.twc.com%2F&cc=USD&ch=webmail&events=event13&c1=twc.com&c9=login&v13=D%3DpageName&c27=first%20visit&v27=D%3Dc27&c28=new&v28=D%3Dc28&c30=1%3A1%3A1%3A1&v30=D%3Dc30&c51=webmail&v51=D%3Dc51&c56=webmail%3Awebmail&v56=D%3Dc56&c69=12%3A50%20pm%7Cthursday&v71=D%3Dc71&c72=twcc&v72=D%3Dc72&c73=https%3A%2F%2Fmail.twc.com%2F&v73=D%3Dc73&c74=3.8%7Ch.27.2%7C20150120&v74=D%3Dc69&v75=D%3Dc75&h1=webmail%7Clogin%7Cmain&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1
22 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
![]() mail.twc.com/ |
13 KB 13 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
common_js.jsp;jsessionid=aaaBHF6WjwaYq7vC4TDQw
mail.twc.com/includes/ |
17 KB 18 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
reset-min.447a.css;jsessionid=aaaBHF6WjwaYq7vC4TDQw
mail.twc.com/includes/ |
1 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
webmail.447a.css;jsessionid=aaaBHF6WjwaYq7vC4TDQw
mail.twc.com/includes/ |
59 KB 59 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
s_code.447a.js
mail.twc.com/includes/scripts/ |
71 KB 0 |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
javascript_js.jsp;jsessionid=aaaBHF6WjwaYq7vC4TDQw
mail.twc.com/login/ |
6 KB 6 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
![]() mail.twc.com/ |
13 KB 13 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
common_js.jsp
mail.twc.com/includes/ |
17 KB 18 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
reset-min.447a.css
mail.twc.com/includes/ |
1 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
webmail.447a.css
mail.twc.com/includes/ |
59 KB 59 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
s_code.447a.js
mail.twc.com/includes/scripts/ |
102 KB 102 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
javascript_js.jsp
mail.twc.com/login/ |
6 KB 6 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
spectrum-logo-154x40.png
mail.twc.com/images/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
beacon.js
sb.scorecardresearch.com/ |
1 KB 1 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
adlogin_bg.jpg
mail.twc.com/images/ |
14 KB 15 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
loginHeader_bg.png
mail.twc.com/images/ |
1004 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
in_page_btn_blue.png
mail.twc.com/images/webmail_images/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
b2
sb.scorecardresearch.com/ Redirect Chain
|
0 248 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
dest4.html
twc.demdex.net/ Frame B591 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
firstevent
twc.demdex.net/ Redirect Chain
|
732 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
event
twc.demdex.net/ |
1 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
s57740969738812
tr-ssl.twcc.com/b/ss/rrglobal/1/H.26.2/ Redirect Chain
|
43 B 742 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Spectrum (Telecommunication)138 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask string| url function| validateLoginForm function| validateMailSettingsBlockingForm function| validateComposeForm function| validateDestinationForm function| validateMailSettingsListExternalForm function| validateFamilyMboxForm function| validateFilterForm function| validateFilterListForm function| validateAddEditFolderForm function| trim function| validateMailSettingsFilterForm function| validateMailSettingsForwardingForm function| validateMailSettingsJunkMailForm function| validateMailSettingsJunkMailCMForm function| validateMailSettingsJunkMailCTForm function| validateMailSettingsAntivirusCTForm function| validateMailSettingsAntivirusForm function| validateMailSettingsAliasForm function| validateMailSettingsExternalForm function| validateMailSettingsPreferencesForm function| validateMessageSearchForm function| validateMailSettingsSignatureForm function| validateMailSettingsVacationForm function| validateNotificationForm function| validateMailSettingsReturnReceiptForm function| validateGeneralSettingsGreetingsForm function| validateGeneralSettingsPasswordForm function| validateGeneralSettingsPinForm function| validateGeneralSettingsTimeZoneForm function| validateGeneralSettingsUserLocaleForm function| validateMailSettingsSendersControlForm function| validateVoicemailSettingsPreferencesForm function| validateVoicemailSettingsFaxForm function| validateVoicemailSettingsLanguagesForm function| validateVoicemailSettingsPhoneNumberForm function| validateVoicemailSettingsFmfmForm function| validateVoicemailSettingsNewFmfmForm function| hint function| doMoveTop function| confirmDelete function| doDelete function| confirmForwardAsSpam function| doForwardAsSpam function| confirmForwardAsPhishing function| doForwardAsPhishing function| selectAllCheckboxes function| selectAllEnabledCheckboxes function| capitalize function| validateData function| verifyAndSubmit function| isCheckBoxSelected function| validateSendersForm function| validateAddressesContactsForm function| openWin function| navigating function| preserveSelectedAddresses function| doSwitchFolder string| s_account object| s string| sc_version function| s_getObjectID object| scVars object| webEventMap boolean| isDev string| msoCookie function| getURLInfo function| setProcessingRules function| s_doPlugins function| scDataMap function| setWebEvent function| scTrackPage function| resetValues function| scTrackLink function| setChannelManager function| setPercPageViewed function| setLowerCaseVar function| readCookie function| isBlank function| trimLc function| replaceAll function| scLog boolean| runOnce string| s_code string| s_objectID function| s_gi function| s_giqf string| s_an function| s_sp function| s_jn function| s_rep function| s_d function| s_fe function| s_fa function| s_ft object| s_c_il number| s_c_in function| DIL number| s_giq string| domain string| temp function| onKeyPressBlockNumbers function| getCheckedValue function| createCookie function| eraseCookie function| checkSavedLogin function| loginCompletion string| _host string| _trackingRegion string| _pageName string| _url string| forwarding string| _bhDomainList string| _twcDomainList string| _variant object| _comscore function| udm_ object| ns_p object| COMSCORE function| demdexRequestCallback_twc_1_1557424214166 string| j string| s_tnt string| f0 number| d object| eo number| y string| S object| s_Obj string| s_PPVid function| s_PPVevent number| s_PPVi number| s_PPVt boolean| noneIndex object| s_i_0_roadrunner function| demdexRequestCallback_twc_1_15574242144684 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
mail.twc.com/ | Name: UqZBpD3n Value: v1sZIg4g@@5w0 |
|
.twc.com/ | Name: s_fid Value: 3C82F98B4A7FD7F8-24DBD1D7B257C005 |
|
mail.twc.com/ | Name: JSESSIONID Value: aaakCrzxaQUme5Aa5TDQw |
|
.twc.com/ | Name: s_cc Value: true |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
mail.twc.com
sb.scorecardresearch.com
tr-ssl.twcc.com
twc.demdex.net
104.109.56.111
107.14.73.68
34.247.143.160
66.235.149.58
0e191c235fdf9ca105b96d92e4d147c169a8cee249efa02eed2563b3b5913120
2fdee7fcce101484e22d5c6f6ad3bcb3932a3551a64c43da390ce80b48b45bc1
37a2f9238d1beea9e3333e3cdb945492ea6375f5eae9fbc322c90c73fa09370d
59cd1543e9e02259174f7b83965ac6424359c077e364564893b231a84f5461d2
61399d329ea62625c3920f074955c16a01ad8b7a233c733e2e4e0200957c8606
6cab2eab86908a3ed920c0b3082e406fbb6cd575d560508ac2019452b23dbffa
7846c7b80959e9a2db4099308825654a98386d26902377ab7800d56a81c09714
935032216b0330101eb88a8d2a4e5641e96aa3ef635d44f595eb97c7733b9cf6
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
c65fa0bf6d8803bb210ff2a3d7bc6525369adf80f034b2c01b1c9ccef4d3ad7c
ced9dde9079499a83add3cd3dbc31533f86513c99cfa62f91a3c7c344873261b
d0fd74148f4cbe78bd0e6328dc5ce5955f0a0ecdb1eb2919da4a7e596ac65912
d72bd1a3194e3da579029b5e5fb12804340a776c84b8a57e17bb52376b41aeb3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e8345f5f10f7d32b5acd859e8c7c9aadaffb6d989c479ed1dc67f032b4512dc0