![](/screenshots/f978d6b7-cc1e-428d-9121-649f5809f1c7.png)
elpollomasrico.com
Open in
urlscan Pro
63.247.72.202
Malicious Activity!
Public Scan
Effective URL: http://elpollomasrico.com/includes/auth/acct/login/verification/home/
Submission: On March 05 via manual from US
Summary
This is the only time elpollomasrico.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Xfinity (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 54.83.52.76 54.83.52.76 | 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com) | |
1 2 | 63.247.72.202 63.247.72.202 | 3595 (GNAXNET-AS) (GNAXNET-AS - Global Net Access) | |
7 | 76.96.69.84 76.96.69.84 | 7922 (COMCAST-7922) (COMCAST-7922 - Comcast Cable Communications) | |
1 | 2.16.186.112 2.16.186.112 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
4 | 104.111.237.93 104.111.237.93 | 16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies) | |
13 | 4 |
ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-83-52-76.compute-1.amazonaws.com
bit.do |
ASN3595 (GNAXNET-AS - Global Net Access, LLC, US)
PTR: muchick.wperu.com
elpollomasrico.com |
ASN7922 (COMCAST-7922 - Comcast Cable Communications, LLC, US)
login.comcast.net |
ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-186-112.deploy.akamaitechnologies.com
por-img.cimcontent.net |
ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-237-93.deploy.static.akamaitechnologies.com
sdx.xfinity.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
comcast.net
login.comcast.net |
47 KB |
4 |
xfinity.com
sdx.xfinity.com |
113 KB |
2 |
elpollomasrico.com
1 redirects
elpollomasrico.com |
17 KB |
1 |
cimcontent.net
por-img.cimcontent.net |
43 KB |
1 |
bit.do
1 redirects
bit.do |
268 B |
13 | 5 |
Domain | Requested by | |
---|---|---|
7 | login.comcast.net |
elpollomasrico.com
|
4 | sdx.xfinity.com |
elpollomasrico.com
|
2 | elpollomasrico.com | 1 redirects |
1 | por-img.cimcontent.net |
elpollomasrico.com
|
1 | bit.do | 1 redirects |
13 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
businessclass.comcast.net |
login.comcast.net |
login.comcast.nethttp |
login.comcast.nethttps |
Subject Issuer | Validity | Valid |
---|
This page contains 1 frames:
Primary Page:
http://elpollomasrico.com/includes/auth/acct/login/verification/home/
Frame ID: (C975D667268D499A4F0C92235D48EB0)
Requests: 13 HTTP requests in this frame
Screenshot
![](/screenshots/f978d6b7-cc1e-428d-9121-649f5809f1c7.png)
Page URL History Show full URLs
-
http://bit.do/d8Huw
HTTP 301
http://elpollomasrico.com/includes/auth/acct/login/verification/home HTTP 301
http://elpollomasrico.com/includes/auth/acct/login/verification/home/ Page URL
Detected technologies
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Detected patterns
- env /^jQuery$/i
Page Statistics
7 Outgoing links
These are links going to different origins than the main page.
Title: Sign in now
Search URL Search Domain Scan URL
Title: Learn more
Search URL Search Domain Scan URL
Title: Site Map
Search URL Search Domain Scan URL
Title: Privacy Policy
Search URL Search Domain Scan URL
Title: Terms of Service
Search URL Search Domain Scan URL
Title: Contact Us
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://bit.do/d8Huw
HTTP 301
http://elpollomasrico.com/includes/auth/acct/login/verification/home HTTP 301
http://elpollomasrico.com/includes/auth/acct/login/verification/home/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
13 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
elpollomasrico.com/includes/auth/acct/login/verification/home/ Redirect Chain
|
17 KB 17 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles-dark.min.css
login.comcast.net/static/css/junket/ |
44 KB 11 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Mbox.js
login.comcast.net//cdn.comcast.com/~/Media/Javascripts/Omniture/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
598b4917a434005b0ffc357c4320926e.png
por-img.cimcontent.net/cms/data/assets/bin-201511/ |
42 KB 43 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
asc
login.comcast.net//privacy-policy.truste.com/privacy-seal/Comcast-Cable-Communications-Management,-LLC/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
seal
login.comcast.net//privacy-policy.truste.com/privacy-seal/Comcast-Cable-Communications-Management,-LLC/ |
1 KB 1 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-1.7.min.js
login.comcast.net/static/js/libs/ |
92 KB 33 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
scripts-responsive.min.js
login.comcast.net/static/js/ |
5 KB 2 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
omniture.js
login.comcast.net/static/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
XfinityStandard-Thin.woff2
sdx.xfinity.com/fonts/latest/Xfinity_Standard/ |
32 KB 33 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
XfinityStandard-Light.woff2
sdx.xfinity.com/fonts/latest/Xfinity_Standard/ |
27 KB 27 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
XfinityStandard-Regular.woff2
sdx.xfinity.com/fonts/latest/Xfinity_Standard/ |
26 KB 26 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
GET S |
XfinityStandard-Medium.woff2
sdx.xfinity.com/fonts/latest/Xfinity_Standard/ |
27 KB 27 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Xfinity (Consumer)4 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery object| login object| shared0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
bit.do
elpollomasrico.com
login.comcast.net
por-img.cimcontent.net
sdx.xfinity.com
104.111.237.93
2.16.186.112
54.83.52.76
63.247.72.202
76.96.69.84
138c0ead0fbcd09dd455df9870920e8725b367fbf02ac0cef0c62874000ab176
2a031939885bb7efba89d423c9ee7c0fe2bab465f18db63f40a9ae2bd7bc0228
44f222333b4c6396b38f2e06dc73d385d243e2b36a30914fd10b6ddb4e831017
4e3473e771edb8208e38ed3422c9700e9edaf4da1c96dc7d23d1e24f1a61414f
b5439f2201a5409ff05248df13222508874e0f8dbbeff94ed4045dd991368bd9
c42c9dc00c9f5da47295156a5a6065939d1aafd3fedb43bd1138ea4353e6da04
d9004ad03ec2d9d946b925a57f4291f70c02e7dbd9e5ddfa4e006352f95e70f3
f76d476752259cdab42d5d549fa2b1d32f068242e22eff3a57f0d58ec5cdd0cc
fc6cd95261064c28600405c9c8dd51813abf8367e85b6e00f0f3031a8338988a
ff4e4975ef403004f8fe8e59008db7ad47f54b10d84c72eb90e728d1ec9157ce