www.avon-office.com.ua
Open in
urlscan Pro
138.201.19.9
Malicious Activity!
Public Scan
URL:
https://www.avon-office.com.ua/components/mf/Indexxatt.htm
Submission: On June 20 via automatic, source openphish
Submission: On June 20 via automatic, source openphish
Summary
This website contacted 4 IPs
in 3 countries
across 3 domains to perform 17 HTTP transactions.
The main IP is 138.201.19.9, located in
Germany and
belongs to HETZNER-AS, DE.
The main domain is www.avon-office.com.ua.
TLS certificate: Issued by COMODO RSA Domain Validation Secure S... on August 30th 2017. Valid for: a year.
This is the only time www.avon-office.com.ua was scanned on urlscan.io!
TLS certificate: Issued by COMODO RSA Domain Validation Secure S... on August 30th 2017. Valid for: a year.
This is the only time www.avon-office.com.ua was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: AT&T (Telecommunication)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 1 | 138.201.19.9 138.201.19.9 | 24940 (HETZNER-AS) (HETZNER-AS) | |
| 13 | 144.160.149.126 144.160.149.126 | 797 (AMERITECH-AS) (AMERITECH-AS - AT&T Services) | |
| 2 | 2a00:1288:80:... 2a00:1288:80:800::7001 | 203220 (YAHOO-DEB) (YAHOO-DEB) | |
| 17 | 4 |
13
144.160.149.126
(United States)
ASN797 (AMERITECH-AS - AT&T Services, Inc., US)
ASN797 (AMERITECH-AS - AT&T Services, Inc., US)
| home.secureapp.att.net |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 13 |
att.net
home.secureapp.att.net |
198 KB |
| 2 |
yimg.com
s.yimg.com |
|
| 1 |
avon-office.com.ua
www.avon-office.com.ua |
2 KB |
| 17 | 3 |
| Domain | Requested by | |
|---|---|---|
| 13 | home.secureapp.att.net |
www.avon-office.com.ua
home.secureapp.att.net |
| 2 | s.yimg.com |
www.avon-office.com.ua
|
| 1 | www.avon-office.com.ua | |
| 17 | 3 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| www.att.net |
| www.att.com |
| uverseonline.att.net |
| elportal.att.net |
| home.secureapp.att.net |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| avon-office.com.ua COMODO RSA Domain Validation Secure Server CA |
2017-08-30 - 2018-12-04 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://www.avon-office.com.ua/components/mf/Indexxatt.htm
Frame ID: 77E20AE9DA7D24122D16B1D5BAB9513E
Requests: 17 HTTP requests in this frame
Screenshot
Detected technologies
Apache
(Web Servers)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
- script /jquery.*\.js/i
- env /^jQuery$/i
Page Statistics
15 Outgoing links
These are links going to different origins than the main page.
URL: http://www.att.net/
Title: att.net
Title: att.net
Search URL Search Domain Scan URL
URL: http://www.att.com/
Title: att.com
Title: att.com
Search URL Search Domain Scan URL
URL: http://uverseonline.att.net/
Title: uverse.com
Title: uverse.com
Search URL Search Domain Scan URL
URL: http://elportal.att.net/
Title: En Español
Title: En Español
Search URL Search Domain Scan URL
URL: https://www.att.com/esupport/index.jsp?App_ID=PBY
Title: AT&T Support
Title: AT&T Support
Search URL Search Domain Scan URL
URL: https://www.att.com/esupport/article.html#!/wireless/KM1187387
Title: Learn about shared passwords for AT&T email and your AT&T Access ID
Title: Learn about shared passwords for AT&T email and your AT&T Access ID
Search URL Search Domain Scan URL
URL: https://home.secureapp.att.net/attportal/s/context.dll?id=9002001&type=clickthru&name=cgate.Register.Pageviews.www-att-net&redirecturl=https://attreg.att.net/PortalRegWeb/PortalRegController?callingAppId=OP&returnUrl=
Search URL Search Domain Scan URL
URL: http://www.att.net/s/context.dll?id=1400&type=clickthru&name=global.footer.att.support&redirecturl=https://www.att.com/esupport/index.jsp?App_ID=PBY
Title: AT&T Support
Title: AT&T Support
Search URL Search Domain Scan URL
URL: http://www.att.net/s/context.dll?id=1400&type=clickthru&name=global.footer.att.adinfo&redirecturl=http://www.att.net/legal/advertising
Title: Advertise with Us
Title: Advertise with Us
Search URL Search Domain Scan URL
URL: http://www.att.net/s/context.dll?id=1400&type=clickthru&name=global.footer.att.TOS&redirecturl=http://www.att.com/shop/internet/att-internet-terms-of-service.jsp
Title: Terms of Service
Title: Terms of Service
Search URL Search Domain Scan URL
URL: http://www.att.net/s/context.dll?id=1400&type=clickthru&name=global.footer.att.copyright&redirecturl=http://info.yahoo.com/copyright/details.html
Title: Copyright
Title: Copyright
Search URL Search Domain Scan URL
URL: http://www.att.net/s/context.dll?id=1400&type=clickthru&name=global.footer.att.privacy&redirecturl=http://att.yahoo.com/privacy
Title: Privacy Policy
Title: Privacy Policy
Search URL Search Domain Scan URL
URL: http://www.att.net/s/context.dll?id=1400&type=clickthru&name=global.footer.att.aboutourads&redirecturl=http://info.yahoo.com/privacy/us/yahoo/attandyahoo/adchoices.html
Title: About Our Ads
Title: About Our Ads
Search URL Search Domain Scan URL
URL: http://www.att.net/s/context.dll?id=1400&type=clickthru&name=global.footer.att.AUP&redirecturl=https://www.att.com/legal/terms.aup.html
Title: Acceptable Use Policy
Title: Acceptable Use Policy
Search URL Search Domain Scan URL
URL: http://www.att.net/s/context.dll?id=1400&type=clickthru&name=global.footer.att.IP&redirecturl=http://www.att.com/gen/privacy-policy?pid=2587
Title: © 2018 AT&T Intellectual Property
Title: © 2018 AT&T Intellectual Property
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 15- https://home.secureapp.att.net/attportal/s/context.dll?id=9002001&type=clickthru&name=cgate.signIn.Pageviews.www-att-net&redirecturl=/i/s.gif?nocache=8856 HTTP 302
- http://home.secureapp.att.net/i/s.gif?nocache=8856
17 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
Indexxatt.htm
www.avon-office.com.ua/components/mf/ |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.0 |
main.css
home.secureapp.att.net/css/sso/slid/1201/ |
28 KB 28 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.0 |
jquery-1.5.1.min.js
home.secureapp.att.net/js/jquery/ |
83 KB 84 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.0 |
jquery.simplemodal.js
home.secureapp.att.net/js/jquery/simplemodal/ |
9 KB 10 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.0 |
script.js
home.secureapp.att.net/js/sso/slid/1201/ |
47 KB 48 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
script.js
s.yimg.com/ik/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.0 |
mobile.css
home.secureapp.att.net/css/sso/slid/1201/ |
4 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.0 |
footerBg.png
home.secureapp.att.net/design/CDLS10/img/ui/ |
560 B 788 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.0 |
pageBg.png
home.secureapp.att.net/design/cdls10/img/ui/ |
169 B 396 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.0 |
btnSumbit.png
home.secureapp.att.net/img/sso/slid/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET S |
script.js
s.yimg.com/ik/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.0 |
txt-clear.png
home.secureapp.att.net/img/sso/slid/ |
3 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.0 |
support-icon.jpg
home.secureapp.att.net/img/sso/slid/ |
2 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.0 |
att_globe_blue_80x80.png
home.secureapp.att.net/design/CDLS10/img/logos/ |
16 KB 16 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.0 |
attGlobalNavHeader-bg.gif
home.secureapp.att.net/design/cdls20/img/ui/ |
149 B 376 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.0 |
ques.png
home.secureapp.att.net/img/sso/slid/ |
363 B 591 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET |
s.gif
home.secureapp.att.net/i/ Redirect Chain
|
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- home.secureapp.att.net
- URL
- http://home.secureapp.att.net/i/s.gif?nocache=8856
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: AT&T (Telecommunication)31 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| $ function| jQuery string| agent string| ORIGINATION_POINT_URL string| RETURN_URL string| CANCEL_URL function| getWindowWidth function| getWindowHeight function| setRegURL function| logPgvw function| refer function| submitForm function| trimAll function| chkTick function| unchkTick function| getElementsByClassName function| btnChange function| acctSelBtnEnable function| ie6Img function| getYadContents function| init undefined| countdownElement function| overlay function| cancelLoad function| Redirecturl string| focusableElementsString function| trapTabKey function| supportRedirect object| yld_mgr string| q1Zidx string| q2Zidx1 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| www.avon-office.com.ua/ | Name: IV_JCT Value: %2FcommonLogin |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
home.secureapp.att.net
s.yimg.com
www.avon-office.com.ua
home.secureapp.att.net
138.201.19.9
144.160.149.126
2a00:1288:80:800::7001
01a7e22fd83c617ff55898233518c54a9ecce7e0de3e8a63c4fa59315b029c6b
27da51ec2023f96407f92161ddda0e290b0661a765822ff03e5d61f3aecf8aa0
30a949cc26cd4f709fa897313f8d448b2cb724a40a170c4b8e8ce6b3aa890fd1
5fd69c4fa9f1a2a6fbdab11ff45053dbd08237e6190dfc9c071fadd08fe9b7d5
61e91515aaf72cba3014a136331a138eca6b27831c8f2e6b0c128825243f5263
764b9e9f3ad386aaa5cdeae9368353994de61c0bede087c8f7e3579cb443de3b
9880eb5b6a6b1dec8f568c14a1a5be755c460d2ea2df66fa7b5e6b99227f7128
baa5c6df09ce08373d859fce826d5fa6cdf53b53519d7f6f5074741603eb6b63
c537cf7e2770d1b4953255dfccff8e0bdbfd4adb4e88d868e353208ae7ff13c1
da0f28b0d18d448b29cb3ee6e742952e7247c627d3800d045ba1573ca1fc07f4
db2a3260d580716fb8dae973b1b994f799f545d520b7a1636d473ecbdbdd2223
dfa2be020e3374a4b1c871c88ada990120fb198d4e8ff685ad35cfae88ad3466
dfa35aa4643a991e1d2ec6e3562e1a0465174c7200a7572c92619904bb08530f
fdee766a03e4032897a2cd75326c135d8e938592bfb00f12ed5b4eb223f54c3f