assets.qnrxfintykdcomcast.tech Open in urlscan Pro
2606:4700:20::681a:ae7  Malicious Activity! Public Scan

Submitted URL: http://assets.qnrxfintykdcomcast.tech/undefined
Effective URL: https://assets.qnrxfintykdcomcast.tech/undefined
Submission: On August 07 via manual from IN — Scanned from CH

Summary

This website contacted 4 IPs in 2 countries across 2 domains to perform 8 HTTP transactions. The main IP is 2606:4700:20::681a:ae7, located in United States and belongs to CLOUDFLARENET, US. The main domain is assets.qnrxfintykdcomcast.tech.
TLS certificate: Issued by WE1 on July 5th 2024. Valid for: 3 months.
This is the only time assets.qnrxfintykdcomcast.tech was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Xfinity (Consumer)

Domain & IP information

IP Address AS Autonomous System
4 2606:4700:20:... 13335 (CLOUDFLAR...)
1 104.18.95.41 13335 (CLOUDFLAR...)
1 104.18.94.41 13335 (CLOUDFLAR...)
8 4
Apex Domain
Subdomains
Transfer
4 qnrxfintykdcomcast.tech
assets.qnrxfintykdcomcast.tech
159 KB
2 cloudflare.com
challenges.cloudflare.com — Cisco Umbrella Rank: 3877
15 KB
8 2
Domain Requested by
4 assets.qnrxfintykdcomcast.tech assets.qnrxfintykdcomcast.tech
2 challenges.cloudflare.com assets.qnrxfintykdcomcast.tech
challenges.cloudflare.com
8 2

This site contains links to these domains. Also see Links.

Domain
www.cloudflare.com
Subject Issuer Validity Valid
qnrxfintykdcomcast.tech
WE1
2024-07-05 -
2024-10-03
3 months crt.sh
challenges.cloudflare.com
E5
2024-07-17 -
2024-10-15
3 months crt.sh

This page contains 2 frames:

Primary Page: https://assets.qnrxfintykdcomcast.tech/undefined
Frame ID: C38A1E738323BA8CBB732E44A2F491FE
Requests: 8 HTTP requests in this frame

Frame: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/xoozi/0x4AAAAAAAAjq6WYeRDKmebM/light/fbE/normal/auto/
Frame ID: 982DF6400A9450DF3281A2C518EF55F6
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

Just a moment...

Page URL History Show full URLs

  1. http://assets.qnrxfintykdcomcast.tech/undefined HTTP 307
    https://assets.qnrxfintykdcomcast.tech/undefined Page URL

Page Statistics

8
Requests

75 %
HTTPS

33 %
IPv6

2
Domains

2
Subdomains

4
IPs

2
Countries

174 kB
Transfer

451 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://assets.qnrxfintykdcomcast.tech/undefined HTTP 307
    https://assets.qnrxfintykdcomcast.tech/undefined Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request undefined
assets.qnrxfintykdcomcast.tech/
Redirect Chain
  • http://assets.qnrxfintykdcomcast.tech/undefined
  • https://assets.qnrxfintykdcomcast.tech/undefined
149 KB
56 KB
Document
General
Full URL
https://assets.qnrxfintykdcomcast.tech/undefined
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ae7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a8b535827b5664ff8713074703b86868f5aad616503663512e677d6ff0bfd03e
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

accept-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-chl-out
nvvS23dobM5NoK+2XO36o3yuUawb5yTDfcE5ay/W3P691bIDM3qFCF7kTjfTCUN/yLqu9d1NhgmsKYZ+87zXNJm6Tdk1SgOcotxxDa4fPjRvzKepqtB5p6RIWAtp1TPQFkBaAAvXN4xvO78L27kwGw==$Zj9W0367WAzZlqfEwZT4JA==
cf-mitigated
challenge
cf-ray
8af6654249c066fe-AMS
content-encoding
br
content-type
text/html; charset=UTF-8
critical-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy
same-origin
cross-origin-resource-policy
same-origin
date
Wed, 07 Aug 2024 09:56:13 GMT
expires
Thu, 01 Jan 1970 00:00:01 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
origin-agent-cluster
?1
permissions-policy
accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy
same-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ogxcJkIp1oYID%2BylURyZFw%2BmzFkl23kKUQU6UtnpKeE8L1Y8TyagANUXb%2BXXUgsEKWvvSUfx7mnOUte5OHU5oPJT4D1I7T3AuopZqVdZpsXHidhv3Dz8A4pMCAWMnnT5D93U1PZcxI0bTwXHEwVlTXqe6Z7pKjHvX4lS9A%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-content-options
nosniff
x-frame-options
SAMEORIGIN

Redirect headers

Location
https://assets.qnrxfintykdcomcast.tech/undefined
Non-Authoritative-Reason
HttpsUpgrades
truncated
/
939 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
15334e1a1a24d9f0f0a3daaedc6f438e3bdd6ef11d7fefb7d37e3208094c7089

Request headers

Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml
v1
assets.qnrxfintykdcomcast.tech/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/
95 KB
37 KB
Script
General
Full URL
https://assets.qnrxfintykdcomcast.tech/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8af6654249c066fe
Requested by
Host: assets.qnrxfintykdcomcast.tech
URL: https://assets.qnrxfintykdcomcast.tech/undefined
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ae7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fa7baa75a1b0291d3b7ffa1282c9b2da9ccace4269e1d82ed9c43748d17faba4

Request headers

Referer
https://assets.qnrxfintykdcomcast.tech/undefined?__cf_chl_rt_tk=cJVL94Z7O5rBsV.Zr3Wwif0_gkNPjisYu09.EYHyg8I-1723024573-0.0.1.1-6015
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Wed, 07 Aug 2024 09:56:13 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yXrfSlkVy6TV8AeQSbrNJQiPsW%2BrDCdyd5AyIC26Zpd1FoxLdDoFRw5iayyueUJELGUk0y%2BlRmRZtA6w0MHLuPsVWpZL6OmWjE8LrX0ChRvUS1U9B7uv7c9KBTOhNou8hexvCFQw58CxrbRDIagqvIJD4Y0WV%2FRr7Ens1A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
8af665436acb66fe-AMS
api.js
challenges.cloudflare.com/turnstile/v0/b/8c81cb09042c/
43 KB
15 KB
Script
General
Full URL
https://challenges.cloudflare.com/turnstile/v0/b/8c81cb09042c/api.js?onload=UYbeL2&render=explicit
Requested by
Host: assets.qnrxfintykdcomcast.tech
URL: https://assets.qnrxfintykdcomcast.tech/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8af6654249c066fe
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.95.41 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
25b1f543c4682618e2fff0c607d70a896ecfc080ce500c41ce00b7ffad0ec411

Request headers

Referer
Origin
https://assets.qnrxfintykdcomcast.tech
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Wed, 07 Aug 2024 09:56:14 GMT
content-encoding
br
last-modified
Fri, 26 Jul 2024 18:15:35 GMT
server
cloudflare
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public
cross-origin-resource-policy
cross-origin
cf-ray
8af6654448d301e7-ZRH
alt-svc
h3=":443"; ma=86400
62c58988-ad7a-4a37-8cd2-e9521d4054f1
https://assets.qnrxfintykdcomcast.tech/
13 B
0
Other
General
Full URL
blob:https://assets.qnrxfintykdcomcast.tech/62c58988-ad7a-4a37-8cd2-e9521d4054f1
Requested by
Host: assets.qnrxfintykdcomcast.tech
URL: https://assets.qnrxfintykdcomcast.tech/undefined
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8860e7fef89219a219cb11d18bd8e4a322f32072613f86e935e7fe162ab69c04

Request headers

Referer
https://assets.qnrxfintykdcomcast.tech/undefined
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Length
13
Content-Type
text/javascript
144ae8bbb047c34
assets.qnrxfintykdcomcast.tech/cdn-cgi/challenge-platform/h/b/flow/ov1/1745466769:1723023104:qbj0OfiV8axGjZDDer_UtWPhEvE9xNafj1092OdVvFM/8af6654249c066fe/
16 KB
13 KB
XHR
General
Full URL
https://assets.qnrxfintykdcomcast.tech/cdn-cgi/challenge-platform/h/b/flow/ov1/1745466769:1723023104:qbj0OfiV8axGjZDDer_UtWPhEvE9xNafj1092OdVvFM/8af6654249c066fe/144ae8bbb047c34
Requested by
Host: assets.qnrxfintykdcomcast.tech
URL: https://assets.qnrxfintykdcomcast.tech/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8af6654249c066fe
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ae7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
03cdb536e64160f61f561f1b670d5cb3cd368d792f92fe64066314c5db02326c

Request headers

Referer
https://assets.qnrxfintykdcomcast.tech/undefined
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
CF-Challenge
144ae8bbb047c34
Content-type
application/x-www-form-urlencoded

Response headers

date
Wed, 07 Aug 2024 09:56:14 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y%2B7xlRMqthnlRmzbbmbWNewc5hpO3MxVDC5f1MLAsGRKSRutGPPJKw9jj9LxaWhKHfRhf8R%2F1UNk8mh4JKyckEt%2Bfodly7QkYoGlZmpM5m9JPo68Ppg6DT7VlDQwQcl%2FCU0%2Fv5xHv5xPsLUYolJQOCVQ2y0AaM2Z8Ll41A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/plain; charset=UTF-8
cf-ray
8af66544cc3466fe-AMS
cf-chl-gen
n4CpfBlFxKOFrPUoz++LLpg8fK85iBEP75S0P9VY4gS7OkOdCfTAe93d9joDczPZReh33zniSg==$gUhQ3ZrF0EBE2svq
favicon.ico
assets.qnrxfintykdcomcast.tech/
146 KB
53 KB
Other
General
Full URL
https://assets.qnrxfintykdcomcast.tech/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ae7 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4332e858d27e4058663e16ed7cf01febcf8a6436eef9c04309719d37dad1ec26
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://assets.qnrxfintykdcomcast.tech/undefined
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date
Wed, 07 Aug 2024 09:56:14 GMT
content-encoding
br
x-content-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cross-origin-embedder-policy
require-corp
critical-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-resource-policy
same-origin
cf-chl-out
8ls6JqhJON4l8PmJlqTyC1CWoeQcIqcKKZ++noUULUSSXFy03RqgnpdhDuJfwLyvtYjeb6KRP4uHB9AbuP7kGDidk0CgB+cE9PvjqWBdX3Y3Mkga9KCg1/1GdpqD+Yo2uIJvu1d7ly2vEkeavMaCGA==$NV67IbwjIZFRRJFZHYITpg==
referrer-policy
same-origin
accept-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-opener-policy
same-origin
cf-mitigated
challenge
server
cloudflare
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FnRklNEbn7gyxxgPWHjsOAAQwh7uTZ3qq7Oh5%2Fr%2FUPA2khQZVRf5jvJmYVdZCFSA0Xz0cdE3i1nIAn5GzMn%2Bn8Lbg4YF1zHRZF2Pno6HOdFiUZRHd7vDMvCUy5gtR5BSMCdOPElD1l58dT4lJdRxOL6gGa7ScrLhXrVMQg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
origin-agent-cluster
?1
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy
accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
cf-ray
8af66544dc4466fe-AMS
expires
Thu, 01 Jan 1970 00:00:01 GMT
/
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/xoozi/0x4AAAAAAAAjq6WYeRDKmebM/light/fbE/normal/auto/ Frame 982D
0
0
Document
General
Full URL
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/xoozi/0x4AAAAAAAAjq6WYeRDKmebM/light/fbE/normal/auto/
Requested by
Host: challenges.cloudflare.com
URL: https://challenges.cloudflare.com/turnstile/v0/b/8c81cb09042c/api.js?onload=UYbeL2&render=explicit
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.94.41 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy frame-src https://challenges.cloudflare.com/; base-uri 'self'

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

accept-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
alt-svc
h3=":443"; ma=86400
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
8af66545aa95bbf4-ZRH
content-encoding
br
content-security-policy
frame-src https://challenges.cloudflare.com/; base-uri 'self'
content-type
text/html; charset=UTF-8
critical-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy
same-origin
cross-origin-resource-policy
cross-origin
date
Wed, 07 Aug 2024 09:56:14 GMT
document-policy
js-profiling
origin-agent-cluster
?1
permissions-policy
accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy
same-origin
server
cloudflare
2c88e8a5-ab81-4ae1-b239-5c6f1bf8d936
https://assets.qnrxfintykdcomcast.tech/
80 B
0
Other
General
Full URL
blob:https://assets.qnrxfintykdcomcast.tech/2c88e8a5-ab81-4ae1-b239-5c6f1bf8d936
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f3418640c1204265881221580b9d1554424f6ed49549d408da50c690ab29f400

Request headers

Referer
https://assets.qnrxfintykdcomcast.tech/undefined
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Content-Length
80
Content-Type
text/javascript

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Xfinity (Consumer)

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery object| _cf_chl_opt function| CcuM6 function| DPHb1 function| UYbeL2 boolean| LqTgj1 function| qeSZC2 function| LfBy5 function| TclWT0 function| TltI2 object| lZKwZ7 object| UPatB2 object| xnCn5 number| xDKZ3 object| angular object| turnstile boolean| RaMt3 string| OnYIY1 boolean| skCwJ6

0 Cookies

2 Console Messages

Source Level URL
Text
network error URL: https://assets.qnrxfintykdcomcast.tech/undefined
Message:
Failed to load resource: the server responded with a status of 403 ()
network error URL: https://assets.qnrxfintykdcomcast.tech/favicon.ico
Message:
Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Frame-Options SAMEORIGIN