zafkielweapon116.biz.id Open in urlscan Pro
172.93.121.7 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://api.ukauthority.com/image/getclick?src=http://localhost/media/12839/ccs-paidmedia-lcah-ukauthority-1170-x-120-230801...
Effective URL:
https://zafkielweapon116.biz.id/xfin/secure/
Submission: On February 01 via manual (February 1st 2024, 9:52:19 pm UTC) from US — Scanned from DE

Summary HTTP 10 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 10 HTTP transactions. The main IP is 172.93.121.7, located in Los Angeles, United States and belongs to HOST4GEEKS-LLC, US. The main domain is zafkielweapon116.biz.id.
TLS certificate: Issued by R3 on January 9th 2024. Valid for: 3 months.

This is the only time zafkielweapon116.biz.id was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Xfinity (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:20:... 2606:4700:20::ac43:4880	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 12	172.93.121.7 172.93.121.7	393960 (HOST4GEEK...) (HOST4GEEKS-LLC)
10	2

1 2606:4700:20::ac43:4880 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

api.ukauthority.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 172.93.121.7 (Los Angeles, United States) 2 redirects

ASN393960 (HOST4GEEKS-LLC, US)
PTR: jbart.funiven.com

zafkielweapon116.biz.id	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	zafkielweapon116.biz.id 2 redirects zafkielweapon116.biz.id	256 KB
1	ukauthority.com 1 redirects api.ukauthority.com	466 B
10	2

	Domain	Requested by
12	zafkielweapon116.biz.id	2 redirects zafkielweapon116.biz.id
1	api.ukauthority.com	1 redirects
10	2

This site contains no links.

Subject Issuer	Validity	Valid
zafkielweapon116.biz.id R3	`2024-01-09` - `2024-04-08`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://zafkielweapon116.biz.id/xfin/secure/
Frame ID: 83F83634E90BF50AF171FE2760D0A58F
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in to Xfinity

Page URL History Show full URLs

https://api.ukauthority.com/image/getclick?src=http://localhost/media/12839/ccs-paidmedia-lcah-ukauthori... HTTP 302
https://zafkielweapon116.biz.id/xfin HTTP 301
https://zafkielweapon116.biz.id/xfin/ HTTP 302
https://zafkielweapon116.biz.id/xfin/secure/ Page URL

Page Statistics

10
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

255 kB
Transfer

254 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://api.ukauthority.com/image/getclick?src=http://localhost/media/12839/ccs-paidmedia-lcah-ukauthority-1170-x-120-230801-v2.gif&destination=//zafkielweapon116.biz.id/xfin HTTP 302
https://zafkielweapon116.biz.id/xfin HTTP 301
https://zafkielweapon116.biz.id/xfin/ HTTP 302
https://zafkielweapon116.biz.id/xfin/secure/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response zafkielweapon116.biz.id/xfin/secure/ Redirect Chain https://api.ukauthority.com/image/getclick?src=http://localhost/media/12839/ccs-paidmedia-lcah-ukauthority-1170-x-120-230801-v2.gif&destination=//zafkielweapon116.biz.id/xfin https://zafkielweapon116.biz.id/xfin https://zafkielweapon116.biz.id/xfin/ https://zafkielweapon116.biz.id/xfin/secure/	4 KB 5 KB	155ms 154ms	Document text/html	172.93.121.7 HOST4GEEKS-LLC
General Check archive.org Show headers Download Go to Full URL https://zafkielweapon116.biz.id/xfin/secure/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.93.121.7 Los Angeles, United States, ASN393960 (HOST4GEEKS-LLC, US), Reverse DNS jbart.funiven.com Software Apache / Resource Hash `e18a80cd28c4dbbb87a9c5821b4c3ecac3a83811e2dad9df162bc84f7351e117` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Thu, 01 Feb 2024 21:52:10 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=98 Pragma no-cache Server Apache Transfer-Encoding chunked Redirect headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Length 0 Content-Type text/html; charset=UTF-8 Date Thu, 01 Feb 2024 21:52:10 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=99 Location ./secure/ Pragma no-cache Server Apache
GET H/1.1	200 OK	reset.css zafkielweapon116.biz.id/xfin/secure/assets/css/	3 KB 3 KB	153ms 152ms	Stylesheet text/css	172.93.121.7 HOST4GEEKS-LLC
General Check archive.org Show headers Download Go to Full URL https://zafkielweapon116.biz.id/xfin/secure/assets/css/reset.css Requested by Host: zafkielweapon116.biz.id URL: https://zafkielweapon116.biz.id/xfin/secure/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.93.121.7 Los Angeles, United States, ASN393960 (HOST4GEEKS-LLC, US), Reverse DNS jbart.funiven.com Software Apache / Resource Hash `ac7749d812900f0402c12fb249eb4e243e3eac82fe5f7e125a28ad8f46406766` Request headers accept-language de-DE,de;q=0.9 Referer https://zafkielweapon116.biz.id/xfin/secure/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers Date Thu, 01 Feb 2024 21:52:10 GMT Last-Modified Sat, 13 May 2023 21:13:48 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 2976
GET H/1.1	200 OK	style.css zafkielweapon116.biz.id/xfin/secure/assets/css/	8 KB 9 KB	320ms 166ms	Stylesheet text/css	172.93.121.7 HOST4GEEKS-LLC
General Check archive.org Show headers Download Go to Full URL https://zafkielweapon116.biz.id/xfin/secure/assets/css/style.css Requested by Host: zafkielweapon116.biz.id URL: https://zafkielweapon116.biz.id/xfin/secure/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.93.121.7 Los Angeles, United States, ASN393960 (HOST4GEEKS-LLC, US), Reverse DNS jbart.funiven.com Software Apache / Resource Hash `3580b0ebdb9c352a228cba7d7e789b60350c357a642110107ece2931e243add6` Request headers accept-language de-DE,de;q=0.9 Referer https://zafkielweapon116.biz.id/xfin/secure/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers Date Thu, 01 Feb 2024 21:52:10 GMT Last-Modified Sun, 21 May 2023 08:58:54 GMT Server Apache Content-Type text/css Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=96 Content-Length 8474
GET H/1.1	200 OK	logo-grey.svg zafkielweapon116.biz.id/xfin/secure/assets/img/	939 B 1 KB	446ms 148ms	Image image/svg+xml	172.93.121.7 HOST4GEEKS-LLC
General Check archive.org Show headers Download Go to Show image Full URL https://zafkielweapon116.biz.id/xfin/secure/assets/img/logo-grey.svg Requested by Host: zafkielweapon116.biz.id URL: https://zafkielweapon116.biz.id/xfin/secure/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.93.121.7 Los Angeles, United States, ASN393960 (HOST4GEEKS-LLC, US), Reverse DNS jbart.funiven.com Software Apache / Resource Hash `15334e1a1a24d9f0f0a3daaedc6f438e3bdd6ef11d7fefb7d37e3208094c7089` Request headers accept-language de-DE,de;q=0.9 Referer https://zafkielweapon116.biz.id/xfin/secure/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers Date Thu, 01 Feb 2024 21:52:10 GMT Last-Modified Sat, 13 May 2023 18:50:04 GMT Server Apache Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 939
GET H/1.1	200 OK	footer.png zafkielweapon116.biz.id/xfin/secure/assets/img/	14 KB 14 KB	460ms 158ms	Image image/png	172.93.121.7 HOST4GEEKS-LLC
General Check archive.org Show headers Download Go to Show image Full URL https://zafkielweapon116.biz.id/xfin/secure/assets/img/footer.png Requested by Host: zafkielweapon116.biz.id URL: https://zafkielweapon116.biz.id/xfin/secure/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.93.121.7 Los Angeles, United States, ASN393960 (HOST4GEEKS-LLC, US), Reverse DNS jbart.funiven.com Software Apache / Resource Hash `989b31c1a18e860650ea2e156095a7707df5f26826069ed976bdc21a641de331` Request headers accept-language de-DE,de;q=0.9 Referer https://zafkielweapon116.biz.id/xfin/secure/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers Date Thu, 01 Feb 2024 21:52:10 GMT Last-Modified Sat, 13 May 2023 19:54:18 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 14349
GET H/1.1	200 OK	footer-md.png zafkielweapon116.biz.id/xfin/secure/assets/img/	11 KB 12 KB	471ms 162ms	Image image/png	172.93.121.7 HOST4GEEKS-LLC
General Check archive.org Show headers Download Go to Show image Full URL https://zafkielweapon116.biz.id/xfin/secure/assets/img/footer-md.png Requested by Host: zafkielweapon116.biz.id URL: https://zafkielweapon116.biz.id/xfin/secure/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.93.121.7 Los Angeles, United States, ASN393960 (HOST4GEEKS-LLC, US), Reverse DNS jbart.funiven.com Software Apache / Resource Hash `92bcfaa48a13ca088ff92deaf584ff2cf2e73fe140af38c46e23c79e541bac21` Request headers accept-language de-DE,de;q=0.9 Referer https://zafkielweapon116.biz.id/xfin/secure/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers Date Thu, 01 Feb 2024 21:52:10 GMT Last-Modified Sun, 21 May 2023 08:01:22 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 11775
GET H/1.1	200 OK	footer-lg.png zafkielweapon116.biz.id/xfin/secure/assets/img/	10 KB 10 KB	487ms 168ms	Image image/png	172.93.121.7 HOST4GEEKS-LLC
General Check archive.org Show headers Download Go to Show image Full URL https://zafkielweapon116.biz.id/xfin/secure/assets/img/footer-lg.png Requested by Host: zafkielweapon116.biz.id URL: https://zafkielweapon116.biz.id/xfin/secure/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.93.121.7 Los Angeles, United States, ASN393960 (HOST4GEEKS-LLC, US), Reverse DNS jbart.funiven.com Software Apache / Resource Hash `89d4f9610212b5e4337fc512c2dee0a5c016e88a9f679825f97559a7adaeb776` Request headers accept-language de-DE,de;q=0.9 Referer https://zafkielweapon116.biz.id/xfin/secure/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers Date Thu, 01 Feb 2024 21:52:10 GMT Last-Modified Sun, 21 May 2023 08:01:52 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 10309
GET DATA	200 OK	truncated /	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `ebec0a242eb62dac37ad10740e7797b748ff93103796ed6509414a751ce86820` Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers Content-Type image/svg+xml
GET H/1.1	200 OK	dmsans-regular.woff2 zafkielweapon116.biz.id/xfin/secure/assets/fonts/	29 KB 29 KB	172ms 172ms	Font font/woff2	172.93.121.7 HOST4GEEKS-LLC
General Check archive.org Show headers Download Go to Full URL https://zafkielweapon116.biz.id/xfin/secure/assets/fonts/dmsans-regular.woff2 Requested by Host: zafkielweapon116.biz.id URL: https://zafkielweapon116.biz.id/xfin/secure/assets/css/reset.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.93.121.7 Los Angeles, United States, ASN393960 (HOST4GEEKS-LLC, US), Reverse DNS jbart.funiven.com Software Apache / Resource Hash `40aefc09f33205666c2c42f20d54285147ae9434ef5f8018481950fd67ddcb68` Request headers Referer https://zafkielweapon116.biz.id/xfin/secure/assets/css/reset.css Origin https://zafkielweapon116.biz.id accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers Date Thu, 01 Feb 2024 21:52:10 GMT Last-Modified Sat, 13 May 2023 18:59:04 GMT Server Apache Content-Type font/woff2 Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=95 Content-Length 29920
GET H/1.1	200 OK	xfinitybrown-bold.woff2 zafkielweapon116.biz.id/xfin/secure/assets/fonts/	87 KB 87 KB	178ms 178ms	Font font/woff2	172.93.121.7 HOST4GEEKS-LLC
General Check archive.org Show headers Download Go to Full URL https://zafkielweapon116.biz.id/xfin/secure/assets/fonts/xfinitybrown-bold.woff2 Requested by Host: zafkielweapon116.biz.id URL: https://zafkielweapon116.biz.id/xfin/secure/assets/css/reset.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.93.121.7 Los Angeles, United States, ASN393960 (HOST4GEEKS-LLC, US), Reverse DNS jbart.funiven.com Software Apache / Resource Hash `69420c9db91c689c4ea04655f57a0bcea09b71003f21cd5e56afa71b80f049f0` Request headers Referer https://zafkielweapon116.biz.id/xfin/secure/assets/css/reset.css Origin https://zafkielweapon116.biz.id accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers Date Thu, 01 Feb 2024 21:52:10 GMT Last-Modified Sat, 13 May 2023 18:59:08 GMT Server Apache Content-Type font/woff2 Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 88920
GET H/1.1	200 OK	xfinitybrown-regular.woff2 zafkielweapon116.biz.id/xfin/secure/assets/fonts/	84 KB 85 KB	280ms 156ms	Font font/woff2	172.93.121.7 HOST4GEEKS-LLC
General Check archive.org Show headers Download Go to Full URL https://zafkielweapon116.biz.id/xfin/secure/assets/fonts/xfinitybrown-regular.woff2 Requested by Host: zafkielweapon116.biz.id URL: https://zafkielweapon116.biz.id/xfin/secure/assets/css/reset.css Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.93.121.7 Los Angeles, United States, ASN393960 (HOST4GEEKS-LLC, US), Reverse DNS jbart.funiven.com Software Apache / Resource Hash `ac7ab1854db99c8278486132a7cef4a5d4f2992fd59488d02b4a5c5a071407d0` Request headers Referer https://zafkielweapon116.biz.id/xfin/secure/assets/css/reset.css Origin https://zafkielweapon116.biz.id accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36 Response headers Date Thu, 01 Feb 2024 21:52:11 GMT Last-Modified Sat, 13 May 2023 18:59:06 GMT Server Apache Content-Type font/woff2 Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 86524

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Xfinity (Consumer)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			zafkielweapon116.biz.id/	1969-12-31 23:59:59	Name: PHPSESSID Value: 81b1007cdb0b256b4ee50e6cfb61d11d

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.ukauthority.com
zafkielweapon116.biz.id
172.93.121.7
2606:4700:20::ac43:4880
15334e1a1a24d9f0f0a3daaedc6f438e3bdd6ef11d7fefb7d37e3208094c7089
3580b0ebdb9c352a228cba7d7e789b60350c357a642110107ece2931e243add6
40aefc09f33205666c2c42f20d54285147ae9434ef5f8018481950fd67ddcb68
69420c9db91c689c4ea04655f57a0bcea09b71003f21cd5e56afa71b80f049f0
89d4f9610212b5e4337fc512c2dee0a5c016e88a9f679825f97559a7adaeb776
92bcfaa48a13ca088ff92deaf584ff2cf2e73fe140af38c46e23c79e541bac21
989b31c1a18e860650ea2e156095a7707df5f26826069ed976bdc21a641de331
ac7749d812900f0402c12fb249eb4e243e3eac82fe5f7e125a28ad8f46406766
ac7ab1854db99c8278486132a7cef4a5d4f2992fd59488d02b4a5c5a071407d0
e18a80cd28c4dbbb87a9c5821b4c3ecac3a83811e2dad9df162bc84f7351e117
ebec0a242eb62dac37ad10740e7797b748ff93103796ed6509414a751ce86820

zafkielweapon116.biz.id Open in urlscan Pro 172.93.121.7 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

10 Requests

100 %HTTPS

50 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

255 kBTransfer

254 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

1 Cookies

Indicators

zafkielweapon116.biz.id Open in urlscan Pro
172.93.121.7 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

255 kB
Transfer

254 kB
Size

1
Cookies

10 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!