urlscan.io logo urlscan.io
SecurityTrails logo

xffiinnytty-95c9.rugms33.workers.dev Open in urlscan Pro
188.114.97.3  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://xffiinnytty-95c9.rugms33.workers.dev/
Submission: On May 16 via api from FR — Scanned from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 10 IPs in 5 countries across 9 domains to perform 15 HTTP transactions. The main IP is 188.114.97.3, located in Amsterdam, Netherlands and belongs to CLOUDFLARENET, US. The main domain is xffiinnytty-95c9.rugms33.workers.dev.
TLS certificate: Issued by GTS CA 1P5 on March 22nd 2024. Valid for: 3 months.
This is the only time xffiinnytty-95c9.rugms33.workers.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Xfinity (Consumer) Generic Email (Online)

Domain & IP information

IP Address AS Autonomous System
2 188.114.97.3 13335 (CLOUDFLAR...)
1 23.212.215.9 16625 (AKAMAI-AS)
1 151.101.194.137 54113 (FASTLY)
1 104.17.25.14 13335 (CLOUDFLAR...)
2 104.18.10.207 13335 (CLOUDFLAR...)
1 216.58.206.74 15169 (GOOGLE)
1 151.101.65.229 54113 (FASTLY)
3 92.122.106.148 16625 (AKAMAI-AS)
1 95.100.146.34 20940 (AKAMAI-ASN1)
15 10
2    188.114.97.3 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)
xffiinnytty-95c9.rugms33.workers.dev
1    23.212.215.9 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-212-215-9.deploy.static.akamaitechnologies.com
cdn.comcast.com
1    151.101.194.137 (San Francisco, United States)

ASN54113 (FASTLY, US)
code.jquery.com
1    104.17.25.14 (None, )

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
2    104.18.10.207 (None, )

ASN13335 (CLOUDFLARENET, US)
maxcdn.bootstrapcdn.com
stackpath.bootstrapcdn.com
1    216.58.206.74 (United States)

ASN15169 (GOOGLE, US)
PTR: lhr35s11-in-f10.1e100.net
ajax.googleapis.com
1    151.101.65.229 (San Francisco, United States)

ASN54113 (FASTLY, US)
cdn.jsdelivr.net
3    92.122.106.148 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a92-122-106-148.deploy.static.akamaitechnologies.com
static.cimcontent.net
1    95.100.146.34 (Prague, Czech Republic)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a95-100-146-34.deploy.static.akamaitechnologies.com
login.xfinity.com
Apex Domain
Subdomains		 Transfer
3 cimcontent.net
static.cimcontent.net — Cisco Umbrella Rank: 30610
144 KB
2 bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1103
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 3044
29 KB
2 workers.dev
xffiinnytty-95c9.rugms33.workers.dev
383 KB
1 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 310
1 KB
1 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 380
30 KB
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 237
7 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 776
24 KB
1 comcast.com
cdn.comcast.com — Cisco Umbrella Rank: 39230
9 KB
1 xfinity.com
login.xfinity.com — Cisco Umbrella Rank: 29866 Failed
1 KB
15 9
Domain Requested by
3 static.cimcontent.net cdn.comcast.com
2 xffiinnytty-95c9.rugms33.workers.dev xffiinnytty-95c9.rugms33.workers.dev
1 cdn.jsdelivr.net xffiinnytty-95c9.rugms33.workers.dev
1 stackpath.bootstrapcdn.com xffiinnytty-95c9.rugms33.workers.dev
1 ajax.googleapis.com xffiinnytty-95c9.rugms33.workers.dev
1 maxcdn.bootstrapcdn.com xffiinnytty-95c9.rugms33.workers.dev
1 cdnjs.cloudflare.com xffiinnytty-95c9.rugms33.workers.dev
1 code.jquery.com xffiinnytty-95c9.rugms33.workers.dev
1 cdn.comcast.com xffiinnytty-95c9.rugms33.workers.dev
1 login.xfinity.com xffiinnytty-95c9.rugms33.workers.dev
15 10

This site contains no links.

Subject Issuer Validity Valid
rugms33.workers.dev
GTS CA 1P5		 2024-03-22 -
2024-06-20		 3 months crt.sh
xapi.xfinity.com
COMODO RSA Organization Validation Secure Server CA		 2024-02-27 -
2025-02-26		 a year crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2023-07-11 -
2024-07-14		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-07-03 -
2024-07-02		 a year crt.sh
bootstrapcdn.com
GTS CA 1P5		 2024-03-27 -
2024-06-25		 3 months crt.sh
upload.video.google.com
WR2		 2024-05-06 -
2024-07-29		 3 months crt.sh
jsdelivr.net
GlobalSign Atlas R3 DV TLS CA 2023 Q3		 2023-09-27 -
2024-10-28		 a year crt.sh
static.cimcontent.net
COMODO RSA Organization Validation Secure Server CA		 2024-03-19 -
2025-03-19		 a year crt.sh
login.xfinity.com
COMODO RSA Organization Validation Secure Server CA		 2023-10-18 -
2024-10-17		 a year crt.sh

This page contains 1 frames:

Primary Page: https://xffiinnytty-95c9.rugms33.workers.dev/
Frame ID: 43057580C042B29DF922D88BB6D82669
Requests: 18 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Sign in to Xfinity

Detected technologies

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • /popper\.js/([0-9.]+)
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • //cdn\.jsdelivr\.net/

Page Statistics

15
Requests

87 %
HTTPS

0 %
IPv6

9
Domains

10
Subdomains

10
IPs

5
Countries

628 kB
Transfer

2510 kB
Size

4
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
xffiinnytty-95c9.rugms33.workers.dev/ 		2 MB
351 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://xffiinnytty-95c9.rugms33.workers.dev/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1322444ba3137e2eabfc357d74c404b29b0784996ca5e226678fb579c6dba150

Request headers

Accept-Language
nl-NL,nl;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

alt-svc
h3=":443"; ma=86400
cf-ray
884ccf116aabb945-AMS
content-encoding
br
content-type
text/html;charset=UTF-8
date
Thu, 16 May 2024 16:40:19 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wAC046boCkoxg2GywN0UpjykRvc6Pe%2Bq5CnnSuygBPTL90jn8hPqzYKkkWfvpY0JuS2SUpwu1JqCl8%2Fo0dI3HqhIgMcMTuGOuB7jhzyT1wwBsMjIrF0ZCOBj7vlVemPpcmqrzLIKtOiDbMtpiycEYJBUA9Gpux0%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
prism-ui-cebc627.css
login.xfinity.com/static/resi/dist/prism-ui/ 		0
0
bundle-cebc627.css
login.xfinity.com/static/resi/dist/ 		0
0
cookie-consent.css
cdn.comcast.com/cmp/css/ 		58 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.comcast.com/cmp/css/cookie-consent.css
Requested by
Host: xffiinnytty-95c9.rugms33.workers.dev
URL: https://xffiinnytty-95c9.rugms33.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.212.215.9 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-212-215-9.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
44e0fc67298d6784f10f9cebec5a0656af66c9567f6ad000a64ecd60466aed79

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://xffiinnytty-95c9.rugms33.workers.dev/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 16:40:20 GMT
content-encoding
br
last-modified
Fri, 10 May 2024 07:16:54 GMT
etag
"8dfa7aa09a8bab0686b2d7224754e716:1714568163.244156"
content-type
text/css
cache-control
max-age=2039856
accept-ranges
bytes
x-robots-tag
noindex, nofollow
content-length
8870
expires
Sun, 09 Jun 2024 07:17:56 GMT
jquery-3.2.1.slim.min.js
code.jquery.com/ 		68 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.2.1.slim.min.js
Requested by
Host: xffiinnytty-95c9.rugms33.workers.dev
URL: https://xffiinnytty-95c9.rugms33.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Origin
https://xffiinnytty-95c9.rugms33.workers.dev
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer
https://xffiinnytty-95c9.rugms33.workers.dev/
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 16:40:20 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
age
1160241
x-cache
HIT, HIT
content-length
23856
x-served-by
cache-lga21963-LGA, cache-mad2200093-MAD
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
x-timer
S1715877620.017824,VS0,VE0
etag
W/"28feccc0-10fdd"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=604800
accept-ranges
bytes
x-cache-hits
26, 41993
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ 		19 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Requested by
Host: xffiinnytty-95c9.rugms33.workers.dev
URL: https://xffiinnytty-95c9.rugms33.workers.dev/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Origin
https://xffiinnytty-95c9.rugms33.workers.dev
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer
https://xffiinnytty-95c9.rugms33.workers.dev/
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 16:40:19 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
2760
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
6157
last-modified
Mon, 04 May 2020 16:15:37 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03fa9-4af4"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9Z461RETBwOZzrZNp3ibLyAjVPrCMlBuD7YVCRC6OY3dBQoXoP%2Bs7WlpU3QR65nUCFwccpxHt7Gb%2BQzFxTKh0hO37%2Fp12oxDTRlObsOvp%2B8pyJvv3yuA24JkgHnp3UohgJA2NlKa"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
884ccf12cc171c87-AMS
expires
Tue, 06 May 2025 16:40:19 GMT
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ 		48 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Requested by
Host: xffiinnytty-95c9.rugms33.workers.dev
URL: https://xffiinnytty-95c9.rugms33.workers.dev/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Origin
https://xffiinnytty-95c9.rugms33.workers.dev
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer
https://xffiinnytty-95c9.rugms33.workers.dev/
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 16:40:19 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
1048
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
448390
cdn-cachedat
03/18/2024 12:46:36
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 25 Jan 2021 22:04:04 GMT
cdn-proxyver
1.04
cdn-requestpullcode
200
server
cloudflare
etag
W/"14d449eb8876fa55e1ef3c2cc52b0c17"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cache-control
public, max-age=31919000
cdn-requestid
2093a5d7997f4e580fd0d632497c6345
timing-allow-origin
*
cdn-requestcountrycode
DE
cdn-status
200
cf-ray
884ccf12c8a366db-AMS
cdn-requestpullsuccess
True
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ 		84 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Requested by
Host: xffiinnytty-95c9.rugms33.workers.dev
URL: https://xffiinnytty-95c9.rugms33.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.206.74 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lhr35s11-in-f10.1e100.net
Software
sffe /
Resource Hash
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://xffiinnytty-95c9.rugms33.workers.dev/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 16:17:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1358
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
30028
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 16 May 2025 16:17:41 GMT
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/ 		50 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
Requested by
Host: xffiinnytty-95c9.rugms33.workers.dev
URL: https://xffiinnytty-95c9.rugms33.workers.dev/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.10.207 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://xffiinnytty-95c9.rugms33.workers.dev/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 16:40:19 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
cdn-edgestorageid
723
age
4658406
cdn-cachedat
11/15/2021 23:30:00
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
last-modified
Mon, 25 Jan 2021 22:04:06 GMT
cdn-proxyver
1.0
cdn-requestpullcode
200
server
cloudflare
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cdn-cache
HIT
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cache-control
public, max-age=31919000
cdn-requestid
a35b0179a28ed953258d0fb41376a09c
timing-allow-origin
*
cdn-requestcountrycode
DE
cdn-status
200
cf-ray
884ccf12da40773c-AMS
cdn-requestpullsuccess
True
jquery.session.min.js
cdn.jsdelivr.net/npm/jquery.session@1.0.0/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/jquery.session@1.0.0/jquery.session.min.js
Requested by
Host: xffiinnytty-95c9.rugms33.workers.dev
URL: https://xffiinnytty-95c9.rugms33.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.229 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
35e38c13207686ff7836fb1a81e55beffc957037981ca72e663973ba300616af
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://xffiinnytty-95c9.rugms33.workers.dev/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Thu, 16 May 2024 16:40:20 GMT
x-content-type-options
nosniff
content-encoding
br
age
820271
x-jsd-version
1.0.0
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
974
x-served-by
cache-fra-eddf8230025-FRA, cache-mad22075-MAD
x-jsd-version-type
version
etag
W/"918-S/odanAfLcjzS/u1I3yXinmRccA"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
truncated
/ 		75 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8f76b4202a5a66eaba4bd9a372bb302287dab1f7b897a141a9f0bb9a10b1018d

Request headers

Accept-Language
nl-NL,nl;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ 		132 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
dbdc913afccda63f7888675987f5bd3f341e71ca311f4999e1e557d1ad7d2cda

Request headers

Accept-Language
nl-NL,nl;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

Content-Type
image/jpeg
xfinity-logo-grey.svg
xffiinnytty-95c9.rugms33.workers.dev/static/images/global/ 		32 KB
32 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://xffiinnytty-95c9.rugms33.workers.dev/static/images/global/xfinity-logo-grey.svg
Requested by
Host: xffiinnytty-95c9.rugms33.workers.dev
URL: https://xffiinnytty-95c9.rugms33.workers.dev/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://xffiinnytty-95c9.rugms33.workers.dev/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 16 May 2024 16:40:21 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mU3q1BbgL%2BxfDDYL%2FuASCkXtMp46%2BI%2FzP%2Fj66BCoAKR4UYgrTHTLm7TqjuGzqXHjm7%2F%2FqhAX65UbSA997o88ANzm8oZLTQaBlZaOweXW5dzvzhltxbCJNf95Mr5rzaQc0whltY96aQLKNDiJNYtCMg1w54ycMX4%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html;charset=UTF-8
cf-ray
884ccf1c5fb2b945-AMS
alt-svc
h3=":443"; ma=86400
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ebec0a242eb62dac37ad10740e7797b748ff93103796ed6509414a751ce86820

Request headers

Accept-Language
nl-NL,nl;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml
dmsans-bold.woff2
static.cimcontent.net/common-web-assets/fonts/dm-sans/ 		29 KB
29 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://static.cimcontent.net/common-web-assets/fonts/dm-sans/dmsans-bold.woff2
Requested by
Host: cdn.comcast.com
URL: https://cdn.comcast.com/cmp/css/cookie-consent.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.122.106.148 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a92-122-106-148.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
f4fc8ea1d0db62d19b2320e0299afe1c60abc0aacb7ba34d4169d56bcc828fe2

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://cdn.comcast.com/
Origin
https://xffiinnytty-95c9.rugms33.workers.dev
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-amz-version-id
DHIOgH6n5UjcwLAziLrYut7N.Mn_3M7Y
date
Thu, 16 May 2024 16:40:21 GMT
last-modified
Thu, 11 May 2023 15:25:59 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P7
etag
"5f8fa708197e8666b28fecf16ab5c7f9"
x-amz-server-side-encryption
AES256
content-type
binary/octet-stream
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
content-length
29872
x-amz-cf-id
Dihr1lC5rCFI5kbFGr2jqzYTO8otMeIYOcbI7V0thtx5tiZ2YCNzhw==
dmsans-regular.woff2
static.cimcontent.net/common-web-assets/fonts/dm-sans/ 		29 KB
30 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://static.cimcontent.net/common-web-assets/fonts/dm-sans/dmsans-regular.woff2
Requested by
Host: cdn.comcast.com
URL: https://cdn.comcast.com/cmp/css/cookie-consent.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.122.106.148 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a92-122-106-148.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
40aefc09f33205666c2c42f20d54285147ae9434ef5f8018481950fd67ddcb68

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://cdn.comcast.com/
Origin
https://xffiinnytty-95c9.rugms33.workers.dev
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-amz-version-id
ZQxPeo_vUOCj9xk4ZmwMw9n7PdUHhNWZ
date
Thu, 16 May 2024 16:40:21 GMT
last-modified
Thu, 11 May 2023 15:25:59 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P7
etag
"b9d5e5cad821648da76e2fedb6c6a680"
x-amz-server-side-encryption
AES256
content-type
binary/octet-stream
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
content-length
29920
x-amz-cf-id
HQvkZaor87yIJUHEV6K1XCdmpIIhkpAbQB_6lUzMzEPsiwbcmYtbnA==
xfinitybrown-regular.woff2
static.cimcontent.net/common-web-assets/fonts/xfinity-brown-optimized/ 		84 KB
85 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://static.cimcontent.net/common-web-assets/fonts/xfinity-brown-optimized/xfinitybrown-regular.woff2
Requested by
Host: cdn.comcast.com
URL: https://cdn.comcast.com/cmp/css/cookie-consent.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
92.122.106.148 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a92-122-106-148.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ac7ab1854db99c8278486132a7cef4a5d4f2992fd59488d02b4a5c5a071407d0

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://cdn.comcast.com/
Origin
https://xffiinnytty-95c9.rugms33.workers.dev
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-amz-version-id
JV_1KoYVZhkjCPcZGZrb.Jzm5gmhB2.R
date
Thu, 16 May 2024 16:40:21 GMT
last-modified
Tue, 19 Jul 2022 15:07:37 GMT
server
AmazonS3
x-amz-cf-pop
FRA2-C1
etag
"7852867d778f90102ccdec973b475759"
content-type
binary/octet-stream
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
content-length
86524
x-amz-cf-id
BGWeVDizcQa8rkQKvW0i0hAiAuP8osJJxX2s-t8whOsC5CJu9EaX4g==
favicon.ico
login.xfinity.com/static/images/favicon/ 		11 KB
1 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://login.xfinity.com/static/images/favicon/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
95.100.146.34 Prague, Czech Republic, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a95-100-146-34.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
aa050de8862f7eaa8ea290eb9612bf949d6a2c8a6ea60ce60df5af3697c89a7d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://xffiinnytty-95c9.rugms33.workers.dev/
Accept-Language
nl-NL,nl;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
gzip
date
Thu, 16 May 2024 16:40:21 GMT
last-modified
Mon, 13 May 2024 17:15:34 GMT
vary
Accept-Encoding
content-type
image/x-icon
accept-ranges
bytes
content-length
998

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
login.xfinity.com
URL
https://login.xfinity.com/static/resi/dist/prism-ui/prism-ui-cebc627.css
Domain
login.xfinity.com
URL
https://login.xfinity.com/static/resi/dist/bundle-cebc627.css

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Xfinity (Consumer) Generic Email (Online)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| $ function| jQuery function| Popper object| bootstrap function| _0x29d8 function| _0x26f955 function| _0x566c

4 Cookies

Domain/Path Name / Value
login.xfinity.com/static/resi/dist/prism-ui Name: bid
Value: lHtzW5sSQ9eIIdaY9dlNo3KRq7c
login.xfinity.com/static/resi/dist Name: bid
Value: PiY5W343QGiv-ieakw4JOnzlV5M
login.xfinity.com/ Name: AWSALBCORS
Value: nz4nkepr78MmypdJUvqvVf/U6RR8lLqyeKTr3ZRxpM5P2rLRv3sm7rBQ6IrwUomVh/gZPW64lXm0pt2SQhMRFpwIH8A8J9lxG6HrqzUnuj57pA6sGJex3iGjCO3R
xffiinnytty-95c9.rugms33.workers.dev/ Name: __session:0.8106245204372662:
Value: https:

13 Console Messages

Source Level URL
Text
security warning URL: https://xffiinnytty-95c9.rugms33.workers.dev/(Line 1)
Message:
An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can escape its sandboxing.
javascript warning URL: https://xffiinnytty-95c9.rugms33.workers.dev/(Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.2.1.slim.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://xffiinnytty-95c9.rugms33.workers.dev/(Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.2.1.slim.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://xffiinnytty-95c9.rugms33.workers.dev/(Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://xffiinnytty-95c9.rugms33.workers.dev/(Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://xffiinnytty-95c9.rugms33.workers.dev/(Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://xffiinnytty-95c9.rugms33.workers.dev/(Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://xffiinnytty-95c9.rugms33.workers.dev/(Line 1)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn.jsdelivr.net/npm/jquery.session@1.0.0/jquery.session.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
other warning URL: https://xffiinnytty-95c9.rugms33.workers.dev/
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://xffiinnytty-95c9.rugms33.workers.dev/
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://xffiinnytty-95c9.rugms33.workers.dev/
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://xffiinnytty-95c9.rugms33.workers.dev/
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.
other warning URL: https://xffiinnytty-95c9.rugms33.workers.dev/
Message:
Third-party cookie will be blocked. Learn more in the Issues tab.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdn.comcast.com
cdn.jsdelivr.net
cdnjs.cloudflare.com
code.jquery.com
login.xfinity.com
maxcdn.bootstrapcdn.com
stackpath.bootstrapcdn.com
static.cimcontent.net
xffiinnytty-95c9.rugms33.workers.dev
login.xfinity.com
104.17.25.14
104.18.10.207
151.101.194.137
151.101.65.229
188.114.97.3
216.58.206.74
23.212.215.9
92.122.106.148
95.100.146.34
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
1322444ba3137e2eabfc357d74c404b29b0784996ca5e226678fb579c6dba150
35e38c13207686ff7836fb1a81e55beffc957037981ca72e663973ba300616af
40aefc09f33205666c2c42f20d54285147ae9434ef5f8018481950fd67ddcb68
44e0fc67298d6784f10f9cebec5a0656af66c9567f6ad000a64ecd60466aed79
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
8f76b4202a5a66eaba4bd9a372bb302287dab1f7b897a141a9f0bb9a10b1018d
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
aa050de8862f7eaa8ea290eb9612bf949d6a2c8a6ea60ce60df5af3697c89a7d
ac7ab1854db99c8278486132a7cef4a5d4f2992fd59488d02b4a5c5a071407d0
dbdc913afccda63f7888675987f5bd3f341e71ca311f4999e1e557d1ad7d2cda
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
ebec0a242eb62dac37ad10740e7797b748ff93103796ed6509414a751ce86820
f4fc8ea1d0db62d19b2320e0299afe1c60abc0aacb7ba34d4169d56bcc828fe2