Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us
Logo

Comcast

comcast.com
Group Medusa
Discovered 2025-10-04 10:33 UTC
Est. attack date 2025-09-26
Country US
Sector
Agriculture and Food Production Education Energy & Utilities Financial Services Government & Defense Healthcare Hospitality Manufacturing Other Professional Services Retail & E-Commerce Technology Transportation

Description:

Comcast Corporation operates as a media and technology company worldwide. It operates through Residential Connectivity & Platforms, Business Services Connectivity, Media, Studios, and Theme Parks segments. The Residential Connectivity & Platforms segment provides residential broadband and wireless connectivity services, residential and business video services, sky-branded entertainment television networks, and advertising. The Business Services Connectivity segment offers connectivity services for small business locations, which include broadband, wireline voice, and wireless services, as well as solutions for medium-sized customers and larger enterprises; and small business connectivity services in the United Kingdom. company is headquartered in Comcast Center 1701 John F. Kennedy Boulevard Philadelphia, PA 19103 United States. 182,000 Employees. The total amount of data leakage is 834.4 GB
Infostealer activity detected by HudsonRock

Compromised Employees: 715

Compromised Users: 2984

Third Party Employee Credentials: 1564

External Attack Surface: 173

Infostealer Distribution
FortiBleed Exposure Detected

This domain's FortiOS SSL-VPN credentials were exposed via the "FortiBleed" leak (CVE-2022-40684).

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • No emails found.
MX Records
  • mxa-00143702.gslb.pphosted.com. Proofpoint
  • mxb-00143702.gslb.pphosted.com. Proofpoint
TXT Records
  • paloaltonetworks-site-verification=b6c919476067691db128e9375b002b801db8ab2a1de767bc27acb829530c59bd
  • atlassian-domain-verification=J+tB36tc4CyLsnqZ/MTW5tI3SZ+IOFAGTWEgMbo+FLRl+gvI4cSIQmMmTYOPEbTz
  • airtable-verification=d9386eea22fce5ee0d01209512aa7706
  • docusign=8fb076b3-05e6-41c4-a6ee-6f6227be4b11
  • vertexinc-cloud-208b00fd-6b0a-43ae-8e00-1ee7ab817d66
  • autodesk-domain-verification=9qi_qkHrCGa8onVbz33s
  • airtable-verification=709aa8e31ed274aa8abc0f3a9286141f
  • adobe-idp-site-verification=8c9c59d410322404f7d75a0b3c770ce7b87cf141707b58224143253e1149f489
  • google-site-verification=XdqEZdbhoNgKou31_aOrVN98TKJqxC0Ve3hNPBmSM7M
  • docusign=0ead29a6-1c9c-4b0c-865a-85a5a127e776
  • intersight=3c7c5c60389a6b81830ef696f8761bc121ecf3f10d7cf8eef08f66af90451a8f
  • teamviewer-sso-verification=4a24e296450940f48ac4faba9a172fc0
  • pendo-domain-verification=XM4f85DQvo0VLA8QzSh-M0bjGEs
  • openai-domain-verification=dv-z3jR2RoYFRLipmXTqN9mx5hU
  • atlassian-domain-verification=xhDGO0SgEPXcuSpqqvu7kAzZyKrM2pat53VPEt5XvKGHvOq4ErhUFRioLG98Ndh3
  • 3587620
  • airtable-verification=00fd4b2a11b394abba9d040c40502707
  • airtable-verification=644c0c83b6807a2a10c20d4cf57505d7
  • paloaltonetworks-site-verification=b51e185f274a13eccff6f0e001549d4a2f08fc11c599ffde8f295cc7cf4c3138
  • apple-domain-verification=VNdTgwsxrDHE4eJM
  • facebook-domain-verification=f1zw72g52fjiesmld6xtuj467pl7f5
  • airtable-verification=31e52307c66bf62d16697b7f0439d35e
  • smartsheet-site-validation=x1Hv84--jB9jvo7M0QQviDXPy_81zS_t
  • eYZbzQ91r/pvvnV/FdrbHyREx7EaAwWLeNYk/EMQrJiGpNCsX4tJcWlHJDFzifTDbfnlhI6koqrm0dYgkIfncg==
  • v=spf1 " "ip4:148.163.145.77 ip4:148.163.141.77 ip4:162.150.44.71 ip4:96.114.158.212 ip4:68.87.31.167 ip4:68.87.96.15 ip4:96.114.28.75 ip4:96.114.28.76 ip4:67.231.157.49 ip4:67.231.149.53 ip4:192.28.144.202 " "include:spfext.zapproved.com include:_spf.mdp.comcast.net include:_spf.comcast.com include:spf-00143705.pphosted.com ~all
  • browserstack-domain-verification=e23475d1-ef64-4cf7-bf92-7620239fe86a
  • atlassian-domain-verification=n+yfnu4Su0J6uQkiatjL+lTNjzOZrPUGOpVn+HiHPwwDgMivjJD5Pwg7yzepfmIC
  • mongodb-site-verification=ucqyDX29txaTTi3K4euWVtieT0zCXRrg
  • docker-verification=f79a60d9-69ec-4c26-8d54-0165c0943613
  • pexip-ms-tenant-domain-verification=31cff1f1-d4b6-492b-8d98-5b42f38c3949
  • snowflake-verification=5bf2f458-019f-1000-8b08-000000000420
  • gitkraken-domain-verification=82a0c351cecd44e7da8f5254930e2b9f4508718255d575583f48949e4a887399
  • al0yn+08kj3q/n1E+s02ttnE5Fd9gIjwjjbn4mCggizGLJepyQ7cMxRTgw4RxYVoZ965qJIHfnH0966SxaicMw==
  • atlassian-domain-verification=C34TI2IiJOrziv9uyV2Yva6ZoRRCSZPjqc15wZASQfypHgNMl6esmkpDsYYXhjk7
  • amazonses:RYuDm+T3xJC87y0v4Cj4JlDm9d5enVzIZcr/arCF7J0=
  • apple-domain-verification=XRKeuEf5cWtc2oDC
  • 1password-site-verification=3BCX5ACVKBD73ADOMJ5XWM7JJ4
  • aws-domain-verification=c326827a-0d9a-4061-a35d-1ea2a8afc6f5
Cloud / SaaS Services Detected
1Password Adobe Amazon SES/WorkMail Apple Atlassian Autodesk Docker DocuSign MondoDB OpenIA Proofpoint Smartsheet Teamviewer

Leak Screenshot:

Leak Screenshot

Legal Disclaimer: Ransomware.live does not engage in the acquisition, exfiltration, downloading, possession, hosting, access, consultation, redistribution, or disclosure of unlawfully obtained data. This platform indexes only publicly visible information posted by ransomware operators and open web sources without accessing or obtaining the underlying stolen content. The service is provided to support public awareness, legitimate research, and cyber-resilience. No stolen personal or confidential data is collected or distributed via this site.