pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev Open in urlscan Pro
2606:4700::6812:223  Malicious Activity! Public Scan

8 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request home.html Show response pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev/att.com/	86 KB 8 KB	762ms 721ms	Document text/html	2606:4700::6812:223 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev/att.com/home.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2d508afadc988ec21541854a08e3e7580ed6d8208af7da2a83611d0b6be4958b Request headers Upgrade-Insecure-Requests 1 User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) accept-language de-DE,de;q=0.9 Response headers CF-RAY 7e51f61a78a39279-FRA Connection keep-alive Content-Encoding gzip Content-Type text/html Date Tue, 11 Jul 2023 15:08:22 GMT ETag W/"c429404bc695b1766beff94a9532f9aa" Last-Modified Mon, 19 Jun 2023 20:37:35 GMT Server cloudflare Transfer-Encoding chunked Vary Accept-Encoding
GET H2	200	att_common.js Show response signin-static-js.att.com/scripts/	427 KB 249 KB	2964ms 2038ms	Script application/javascript	144.160.125.207 AMERITECH-AS
General Check archive.org Show headers Download Go to Full URL https://signin-static-js.att.com/scripts/att_common.js?apg Requested by Host: pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev URL: https://pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev/att.com/home.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 144.160.125.207 , United States, ASN797 (AMERITECH-AS, US), Reverse DNS clcontent-da.att.com Software / Resource Hash c2eb39ee130a5b2f8fc823f8bfa06f527bc9708f024ed5b9904e23039fd1f086 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev/ User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers date Tue, 11 Jul 2023 15:08:23 GMT content-encoding gzip via 1.1 google strict-transport-security max-age=31536000; includeSubDomains; preload age 3237 iam_on D509 p3p CP="NON CUR OTPi OUR NOR UNI" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 pragma no-cache last-modified Thu, 01 Sep 2022 03:51:39 GMT vary Accept-Encoding, Origin x-frame-options SAMEORIGIN content-type application/javascript; charset=UTF-8 access-control-allow-origin https://signin.att.com cache-control no-cache, no-store, must-revalidate accept-ranges bytes expires 0
GET H2	403	detm-container-hdr.js www.att.com/scripts/adobe/prod/	0 0	324ms 245ms	Script text/html	2a02:26f0:480:986::2db1 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://www.att.com/scripts/adobe/prod/detm-container-hdr.js Requested by Host: pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev URL: https://pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev/att.com/home.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:480:986::2db1 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash Request headers Referer https://pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev/ accept-language de-DE,de;q=0.9 User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers
GET H2	200	att_common.js Show response signin-static-js.att.com/scripts/	233 KB 135 KB	1186ms 262ms	Script application/javascript	144.160.125.207 AMERITECH-AS
General Check archive.org Show headers Download Go to Full URL https://signin-static-js.att.com/scripts/att_common.js Requested by Host: pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev URL: https://pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev/att.com/home.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 144.160.125.207 , United States, ASN797 (AMERITECH-AS, US), Reverse DNS clcontent-da.att.com Software / Resource Hash 3c965177e2477b3d06d65dbdcdaf65d266dc4c59e156042b3d5a03c180b14bb3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Frame-Options SAMEORIGIN Request headers Referer https://pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev/ accept-language de-DE,de;q=0.9 User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers pragma no-cache date Tue, 11 Jul 2023 15:08:23 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains; preload x-frame-options SAMEORIGIN iam_on D509 content-type application/javascript; charset=UTF-8 p3p CP="NON CUR OTPi OUR NOR UNI" cache-control no-cache, no-store, must-revalidate expires 0
GET H2	403	ssaf-uc.js www.att.com/scripts/ssaf_universal_client/prod/	0 0	57ms 19ms	Script text/html	2a02:26f0:480:986::2db1 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://www.att.com/scripts/ssaf_universal_client/prod/ssaf-uc.js Requested by Host: pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev URL: https://pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev/att.com/home.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:480:986::2db1 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev/ User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers
GET H2	200	styles.css signin.att.com/static/siam/en/halo_c/halo-c-login/	125 KB 30 KB	1059ms 145ms	Stylesheet text/css	144.160.125.207 AMERITECH-AS
General Check archive.org Show headers Download Go to Full URL https://signin.att.com/static/siam/en/halo_c/halo-c-login/styles.css?v=16.4.3 Requested by Host: pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev URL: https://pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev/att.com/home.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 144.160.125.207 , United States, ASN797 (AMERITECH-AS, US), Reverse DNS clcontent-da.att.com Software / Resource Hash b293d306f4e563ea2bdde7767d238833d8097b4a63af67035efce9b1bf112be8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev/ User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers date Tue, 11 Jul 2023 15:08:23 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains; preload last-modified Wed, 28 Jun 2023 04:13:00 GMT etag "1f529-5ff28cc9a6b00" x-frame-options SAMEORIGIN iam_on D509 p3p CP="NON CUR OTPi OUR NOR UNI" access-control-allow-origin * content-type text/css accept-ranges bytes apser p192
GET H2	200	att-logo.svg signin.att.com/static/siam/en/halo_c/images/logos/	8 KB 8 KB	164ms 95ms	Image image/svg+xml	144.160.125.207 AMERITECH-AS
General Check archive.org Show headers Download Go to Show image Full URL https://signin.att.com/static/siam/en/halo_c/images/logos/att-logo.svg Requested by Host: pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev URL: https://pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev/att.com/home.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 144.160.125.207 , United States, ASN797 (AMERITECH-AS, US), Reverse DNS clcontent-da.att.com Software / Resource Hash 6982fbe858e30068de9301b49438c83838bc7beb058146703b22b701e6709c7e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev/ User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers date Tue, 11 Jul 2023 15:08:25 GMT strict-transport-security max-age=31536000; includeSubDomains; preload last-modified Wed, 28 Jun 2023 04:13:00 GMT etag "20b1-5ff28cc9a6b00" x-frame-options SAMEORIGIN iam_on D509 p3p CP="NON CUR OTPi OUR NOR UNI" access-control-allow-origin * content-type image/svg+xml accept-ranges bytes apser p514 content-length 8369
GET H2	200	checkmark.svg signin.att.com/static/siam/en/halo_c/cms/login/default/images/	350 B 435 B	162ms 95ms	Image image/svg+xml	144.160.125.207 AMERITECH-AS
General Check archive.org Show headers Download Go to Show image Full URL https://signin.att.com/static/siam/en/halo_c/cms/login/default/images/checkmark.svg Requested by Host: pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev URL: https://pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev/att.com/home.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 144.160.125.207 , United States, ASN797 (AMERITECH-AS, US), Reverse DNS clcontent-da.att.com Software / Resource Hash b589ac98cac6d578082d9d2e8bb354abcab6f41f25a081a613227a37def44c9a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev/ User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers date Tue, 11 Jul 2023 15:08:25 GMT strict-transport-security max-age=31536000; includeSubDomains; preload last-modified Wed, 28 Jun 2023 04:13:00 GMT etag "15e-5ff28cc9a6b00" x-frame-options SAMEORIGIN iam_on D509 p3p CP="NON CUR OTPi OUR NOR UNI" access-control-allow-origin * content-type image/svg+xml accept-ranges bytes apser p192 content-length 350
GET H2	200	runtime.js Show response signin.att.com/static/siam/en/halo_c/halo-c-login/	1 KB 820 B	552ms 486ms	Script application/javascript	144.160.125.207 AMERITECH-AS
General Check archive.org Show headers Download Go to Full URL https://signin.att.com/static/siam/en/halo_c/halo-c-login/runtime.js?v=16.4.3 Requested by Host: pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev URL: https://pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev/att.com/home.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 144.160.125.207 , United States, ASN797 (AMERITECH-AS, US), Reverse DNS clcontent-da.att.com Software / Resource Hash 6c5acbb82a46a4971660f65131241dffcc28828f4dbd76b8ec7bab0b468250f8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev/ User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers date Tue, 11 Jul 2023 15:08:25 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains; preload last-modified Wed, 28 Jun 2023 04:13:00 GMT etag "5cd-5ff28cc9a6b00" x-frame-options SAMEORIGIN iam_on D509 p3p CP="NON CUR OTPi OUR NOR UNI" access-control-allow-origin * content-type application/javascript accept-ranges bytes apser p893
GET H2	200	polyfills.js Show response signin.att.com/static/siam/en/halo_c/halo-c-login/	45 KB 17 KB	162ms 95ms	Script application/javascript	144.160.125.207 AMERITECH-AS
General Check archive.org Show headers Download Go to Full URL https://signin.att.com/static/siam/en/halo_c/halo-c-login/polyfills.js?v=16.4.3 Requested by Host: pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev URL: https://pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev/att.com/home.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 144.160.125.207 , United States, ASN797 (AMERITECH-AS, US), Reverse DNS clcontent-da.att.com Software / Resource Hash caa22a11a7d51983bd572bcf5c6ac58daeb82e5cd5ac15191870f18ee3d9546d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev/ User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers date Tue, 11 Jul 2023 15:08:25 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains; preload last-modified Wed, 28 Jun 2023 04:13:00 GMT etag "b346-5ff28cc9a6b00" x-frame-options SAMEORIGIN iam_on D509 p3p CP="NON CUR OTPi OUR NOR UNI" access-control-allow-origin * content-type application/javascript accept-ranges bytes apser p514
GET H2	200	vendor.js Show response signin.att.com/static/siam/en/halo_c/halo-c-login/	474 KB 154 KB	162ms 96ms	Script application/javascript	144.160.125.207 AMERITECH-AS
General Check archive.org Show headers Download Go to Full URL https://signin.att.com/static/siam/en/halo_c/halo-c-login/vendor.js?v=16.4.3 Requested by Host: pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev URL: https://pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev/att.com/home.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 144.160.125.207 , United States, ASN797 (AMERITECH-AS, US), Reverse DNS clcontent-da.att.com Software / Resource Hash 284bdefd04b7928f8c2b7640d2742b060154e58d649c31fa6f6ba5fce695e1cb Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev/ User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers date Tue, 11 Jul 2023 15:08:25 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains; preload last-modified Wed, 28 Jun 2023 04:13:00 GMT etag "76725-5ff28cc9a6b00" x-frame-options SAMEORIGIN iam_on D509 p3p CP="NON CUR OTPi OUR NOR UNI" access-control-allow-origin * content-type application/javascript accept-ranges bytes apser p001
GET H2	200	main.js Show response signin.att.com/static/siam/en/halo_c/halo-c-login/	185 KB 49 KB	162ms 96ms	Script application/javascript	144.160.125.207 AMERITECH-AS
General Check archive.org Show headers Download Go to Full URL https://signin.att.com/static/siam/en/halo_c/halo-c-login/main.js?v=16.4.3 Requested by Host: pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev URL: https://pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev/att.com/home.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 144.160.125.207 , United States, ASN797 (AMERITECH-AS, US), Reverse DNS clcontent-da.att.com Software / Resource Hash 4159656bcbb7b77c763c468d9d8b78215bc251f25f1d58b5148ce140466f04d4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev/ User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers date Tue, 11 Jul 2023 15:08:25 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains; preload last-modified Wed, 28 Jun 2023 04:13:00 GMT etag "2e395-5ff28cc9a6b00" x-frame-options SAMEORIGIN iam_on D509 p3p CP="NON CUR OTPi OUR NOR UNI" access-control-allow-origin * content-type application/javascript accept-ranges bytes apser p211
GET H2	200	ATTAleckSans_W_Rg.woff2 signin.att.com/static/siam/en/halo_c/halo-c-login/assets/fonts/att/ATTAleckSans/woff2/	18 KB 18 KB	552ms 137ms	Font application/octet-stream	144.160.125.207 AMERITECH-AS
General Check archive.org Show headers Download Go to Full URL https://signin.att.com/static/siam/en/halo_c/halo-c-login/assets/fonts/att/ATTAleckSans/woff2/ATTAleckSans_W_Rg.woff2 Requested by Host: signin.att.com URL: https://signin.att.com/static/siam/en/halo_c/halo-c-login/styles.css?v=16.4.3 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 144.160.125.207 , United States, ASN797 (AMERITECH-AS, US), Reverse DNS clcontent-da.att.com Software / Resource Hash e2740c7b209e33aca7176250d80f94b4924e5e5d18076ee3b95f32a0e20d1f58 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Frame-Options SAMEORIGIN Request headers Referer https://signin.att.com/static/siam/en/halo_c/halo-c-login/styles.css?v=16.4.3 Origin https://pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev accept-language de-DE,de;q=0.9 User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers date Tue, 11 Jul 2023 15:08:25 GMT strict-transport-security max-age=31536000; includeSubDomains; preload last-modified Wed, 28 Jun 2023 04:13:00 GMT etag "4830-5ff28cc9a6b00" x-frame-options SAMEORIGIN iam_on D509 p3p CP="NON CUR OTPi OUR NOR UNI" access-control-allow-origin * accept-ranges bytes apser p192 content-length 18480
GET H2	200	ATTAleckSans_W_Bd.woff2 signin.att.com/static/siam/en/halo_c/halo-c-login/assets/fonts/att/ATTAleckSans/woff2/	18 KB 18 KB	548ms 137ms	Font application/octet-stream	144.160.125.207 AMERITECH-AS
General Check archive.org Show headers Download Go to Full URL https://signin.att.com/static/siam/en/halo_c/halo-c-login/assets/fonts/att/ATTAleckSans/woff2/ATTAleckSans_W_Bd.woff2 Requested by Host: signin.att.com URL: https://signin.att.com/static/siam/en/halo_c/halo-c-login/styles.css?v=16.4.3 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 144.160.125.207 , United States, ASN797 (AMERITECH-AS, US), Reverse DNS clcontent-da.att.com Software / Resource Hash 37a1212cc1ab5c935d9a3fee05c98c940eaa895a23510e5f83d550dfbb0d763f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Frame-Options SAMEORIGIN Request headers Referer https://signin.att.com/static/siam/en/halo_c/halo-c-login/styles.css?v=16.4.3 Origin https://pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev accept-language de-DE,de;q=0.9 User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers date Tue, 11 Jul 2023 15:08:25 GMT strict-transport-security max-age=31536000; includeSubDomains; preload last-modified Wed, 28 Jun 2023 04:13:00 GMT etag "48d8-5ff28cc9a6b00" x-frame-options SAMEORIGIN iam_on D509 p3p CP="NON CUR OTPi OUR NOR UNI" access-control-allow-origin * accept-ranges bytes apser p893 content-length 18648
GET H2	200	en.json Show response signin.att.com/static/siam/en/halo_c/cms/login/default/i18n/	4 KB 5 KB	188ms 188ms	XHR application/json	144.160.125.207 AMERITECH-AS
General Check archive.org Show headers Download Go to Full URL https://signin.att.com/static/siam/en/halo_c/cms/login/default/i18n/en.json Requested by Host: signin-static-js.att.com URL: https://signin-static-js.att.com/scripts/att_common.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 144.160.125.207 , United States, ASN797 (AMERITECH-AS, US), Reverse DNS clcontent-da.att.com Software / Resource Hash c890d090b2a50decf2950425dfa8ba817f59435a63938d6d329f49b008429c8a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Frame-Options SAMEORIGIN Request headers Accept application/json, text/plain, */* Referer https://pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev/ accept-language de-DE,de;q=0.9 User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers date Tue, 11 Jul 2023 15:08:26 GMT strict-transport-security max-age=31536000; includeSubDomains; preload last-modified Wed, 28 Jun 2023 04:13:00 GMT etag "11f0-5ff28cc9a6b00" x-frame-options SAMEORIGIN iam_on D509 p3p CP="NON CUR OTPi OUR NOR UNI" access-control-allow-origin * content-type application/json accept-ranges bytes apser p514 content-length 4592
GET DATA	200 OK	truncated /	89 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 50e6072d26098d48004a30addeecabd5b22b91e5ccdf9dd86f96459783e3ac23 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers Content-Type image/png
POST H2	200	dip Show response signin-static-js.att.com/__imp_apg__/api/dip/v1/	206 B 581 B	207ms 186ms	XHR text/html	144.160.125.207 AMERITECH-AS
General Check archive.org Show headers Download Go to Full URL https://signin-static-js.att.com/__imp_apg__/api/dip/v1/dip Requested by Host: signin-static-js.att.com URL: https://signin-static-js.att.com/scripts/att_common.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 144.160.125.207 , United States, ASN797 (AMERITECH-AS, US), Reverse DNS clcontent-da.att.com Software / Resource Hash 99893aeb9995a93ebe2a3d01f15a87c968972983a5984a79245fc32bede6773d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Frame-Options SAMEORIGIN Request headers Referer https://pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev/ accept-language de-DE,de;q=0.9 User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Content-type application/x-www-form-urlencoded Response headers pragma no-cache date Tue, 11 Jul 2023 15:08:27 GMT via 1.1 google strict-transport-security max-age=31536000; includeSubDomains; preload vary Origin x-frame-options SAMEORIGIN content-type text/html; charset=UTF-8 access-control-allow-origin https://pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev iam_on D509 p3p CP="NON CUR OTPi OUR NOR UNI" cache-control no-cache, no-store, must-revalidate alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 206 expires 0
POST H2	200	/ Show response signin-static-js.att.com/__imp_apg__/api/imp/v1.0/report/	265 B 654 B	309ms 309ms	Fetch text/plain	144.160.125.207 AMERITECH-AS
General Check archive.org Show headers Download Go to Full URL https://signin-static-js.att.com/__imp_apg__/api/imp/v1.0/report/?m&fq=load Requested by Host: signin-static-js.att.com URL: https://signin-static-js.att.com/scripts/att_common.js?apg Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 144.160.125.207 , United States, ASN797 (AMERITECH-AS, US), Reverse DNS clcontent-da.att.com Software / Resource Hash d5b82ad4def0f1dbb8b4e0c8f4cab9bed6dc0893be7d6d544953b7640d3f2455 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Frame-Options SAMEORIGIN Request headers accept text/plain,*/*;q=0.9 Referer https://pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev/ accept-language de-DE,de;q=0.9 User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) content-type text/plain;charset=UTF-8 Response headers date Tue, 11 Jul 2023 15:08:27 GMT content-encoding gzip via 1.1 google strict-transport-security max-age=31536000; includeSubDomains; preload iam_on D509 p3p CP="NON CUR OTPi OUR NOR UNI" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 pragma no-cache x-frame-options SAMEORIGIN access-control-allow-methods OPTIONS, GET, POST content-type text/plain; charset=UTF-8 access-control-allow-origin https://pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true access-control-allow-headers Accept,DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range expires 0
POST H2	200	/ Show response signin-static-js.att.com/__imp_apg__/api/imp/v1.0/report/	0 237 B	172ms 171ms	Fetch text/plain	144.160.125.207 AMERITECH-AS
General Check archive.org Show headers Download Go to Full URL https://signin-static-js.att.com/__imp_apg__/api/imp/v1.0/report/?m Requested by Host: signin-static-js.att.com URL: https://signin-static-js.att.com/scripts/att_common.js?apg Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 144.160.125.207 , United States, ASN797 (AMERITECH-AS, US), Reverse DNS clcontent-da.att.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Frame-Options SAMEORIGIN Request headers accept text/plain,*/*;q=0.9 Referer https://pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev/ accept-language de-DE,de;q=0.9 User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) content-type text/plain;charset=UTF-8 Response headers date Tue, 11 Jul 2023 15:08:30 GMT content-encoding gzip via 1.1 google strict-transport-security max-age=31536000; includeSubDomains; preload iam_on D509 p3p CP="NON CUR OTPi OUR NOR UNI" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 pragma no-cache x-frame-options SAMEORIGIN access-control-allow-methods OPTIONS, GET, POST content-type text/plain; charset=UTF-8 access-control-allow-origin https://pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true access-control-allow-headers Accept,DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range expires 0

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: AT&T (Telecommunication)

182 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 boolean| credentialless object| onbeforetoggle object| onscrollend string| dataParameter function| _0x319076 string| result function| _0x3d25 function| _0x3fb7 string| detmScriptLoadType object| loginJspEnvVars string| loginLanguage object| timeoutJspVars object| webpackJsonp function| Zone function| __zone_symbol__Promise function| __zone_symbol__fetch function| __zone_symbol__legacyPatch function| __zone_symbol__queueMicrotask function| __zone_symbol__setTimeout function| __zone_symbol__clearTimeout function| __zone_symbol__setInterval function| __zone_symbol__clearInterval function| __zone_symbol__requestAnimationFrame function| __zone_symbol__cancelAnimationFrame function| __zone_symbol__webkitRequestAnimationFrame function| __zone_symbol__webkitCancelAnimationFrame function| __zone_symbol__alert function| __zone_symbol__prompt function| __zone_symbol__confirm function| __zone_symbol__MutationObserver function| __zone_symbol__WebKitMutationObserver function| __zone_symbol__IntersectionObserver function| __zone_symbol__FileReader boolean| __zone_symbol__ononsearchpatched boolean| __zone_symbol__ononappinstalledpatched boolean| __zone_symbol__ononbeforeinstallpromptpatched boolean| __zone_symbol__ononbeforexrselectpatched boolean| __zone_symbol__ononabortpatched boolean| __zone_symbol__ononbeforeinputpatched boolean| __zone_symbol__ononblurpatched boolean| __zone_symbol__ononcancelpatched boolean| __zone_symbol__ononcanplaypatched boolean| __zone_symbol__ononcanplaythroughpatched boolean| __zone_symbol__ononchangepatched boolean| __zone_symbol__ononclickpatched boolean| __zone_symbol__ononclosepatched boolean| __zone_symbol__ononcontextlostpatched boolean| __zone_symbol__ononcontextmenupatched boolean| __zone_symbol__ononcontextrestoredpatched boolean| __zone_symbol__ononcuechangepatched boolean| __zone_symbol__onondblclickpatched boolean| __zone_symbol__onondragpatched boolean| __zone_symbol__onondragendpatched boolean| __zone_symbol__onondragenterpatched boolean| __zone_symbol__onondragleavepatched boolean| __zone_symbol__onondragoverpatched boolean| __zone_symbol__onondragstartpatched boolean| __zone_symbol__onondroppatched boolean| __zone_symbol__onondurationchangepatched boolean| __zone_symbol__ononemptiedpatched boolean| __zone_symbol__ononendedpatched boolean| __zone_symbol__ononerrorpatched boolean| __zone_symbol__ononfocuspatched boolean| __zone_symbol__ononformdatapatched boolean| __zone_symbol__ononinputpatched boolean| __zone_symbol__ononinvalidpatched boolean| __zone_symbol__ononkeydownpatched boolean| __zone_symbol__ononkeypresspatched boolean| __zone_symbol__ononkeyuppatched boolean| __zone_symbol__ononloadpatched boolean| __zone_symbol__ononloadeddatapatched boolean| __zone_symbol__ononloadedmetadatapatched boolean| __zone_symbol__ononloadstartpatched boolean| __zone_symbol__ononmousedownpatched boolean| __zone_symbol__ononmouseenterpatched boolean| __zone_symbol__ononmouseleavepatched boolean| __zone_symbol__ononmousemovepatched boolean| __zone_symbol__ononmouseoutpatched boolean| __zone_symbol__ononmouseoverpatched boolean| __zone_symbol__ononmouseuppatched boolean| __zone_symbol__ononmousewheelpatched boolean| __zone_symbol__ononpausepatched boolean| __zone_symbol__ononplaypatched boolean| __zone_symbol__ononplayingpatched boolean| __zone_symbol__ononprogresspatched boolean| __zone_symbol__ononratechangepatched boolean| __zone_symbol__ononresetpatched boolean| __zone_symbol__ononresizepatched boolean| __zone_symbol__ononscrollpatched boolean| __zone_symbol__ononsecuritypolicyviolationpatched boolean| __zone_symbol__ononseekedpatched boolean| __zone_symbol__ononseekingpatched boolean| __zone_symbol__ononselectpatched boolean| __zone_symbol__ononslotchangepatched boolean| __zone_symbol__ononstalledpatched boolean| __zone_symbol__ononsubmitpatched boolean| __zone_symbol__ononsuspendpatched boolean| __zone_symbol__onontimeupdatepatched boolean| __zone_symbol__onontogglepatched boolean| __zone_symbol__ononvolumechangepatched boolean| __zone_symbol__ononwaitingpatched boolean| __zone_symbol__ononwebkitanimationendpatched boolean| __zone_symbol__ononwebkitanimationiterationpatched boolean| __zone_symbol__ononwebkitanimationstartpatched boolean| __zone_symbol__ononwebkittransitionendpatched boolean| __zone_symbol__ononwheelpatched boolean| __zone_symbol__ononauxclickpatched boolean| __zone_symbol__onongotpointercapturepatched boolean| __zone_symbol__ononlostpointercapturepatched boolean| __zone_symbol__ononpointerdownpatched boolean| __zone_symbol__ononpointermovepatched boolean| __zone_symbol__ononpointerrawupdatepatched boolean| __zone_symbol__ononpointeruppatched boolean| __zone_symbol__ononpointercancelpatched boolean| __zone_symbol__ononpointeroverpatched boolean| __zone_symbol__ononpointeroutpatched boolean| __zone_symbol__ononpointerenterpatched boolean| __zone_symbol__ononpointerleavepatched boolean| __zone_symbol__ononselectstartpatched boolean| __zone_symbol__ononselectionchangepatched boolean| __zone_symbol__ononanimationendpatched boolean| __zone_symbol__ononanimationiterationpatched boolean| __zone_symbol__ononanimationstartpatched boolean| __zone_symbol__onontransitionrunpatched boolean| __zone_symbol__onontransitionstartpatched boolean| __zone_symbol__onontransitionendpatched boolean| __zone_symbol__onontransitioncancelpatched boolean| __zone_symbol__ononafterprintpatched boolean| __zone_symbol__ononbeforeprintpatched boolean| __zone_symbol__ononbeforeunloadpatched boolean| __zone_symbol__ononhashchangepatched boolean| __zone_symbol__ononlanguagechangepatched boolean| __zone_symbol__ononmessagepatched boolean| __zone_symbol__ononmessageerrorpatched boolean| __zone_symbol__ononofflinepatched boolean| __zone_symbol__onononlinepatched boolean| __zone_symbol__ononpagehidepatched boolean| __zone_symbol__ononpageshowpatched boolean| __zone_symbol__ononpopstatepatched boolean| __zone_symbol__ononrejectionhandledpatched boolean| __zone_symbol__ononstoragepatched boolean| __zone_symbol__ononunhandledrejectionpatched boolean| __zone_symbol__ononunloadpatched boolean| __zone_symbol__onondevicemotionpatched boolean| __zone_symbol__onondeviceorientationpatched boolean| __zone_symbol__onondeviceorientationabsolutepatched boolean| __zone_symbol__ononbeforematchpatched boolean| __zone_symbol__ononbeforetogglepatched boolean| __zone_symbol__ononcontentvisibilityautostatechangepatched boolean| __zone_symbol__ononscrollendpatched object| __zone_symbol__DM_DOC_READYfalse object| __zone_symbol__popstatefalse function| getAngularTestability function| getAllAngularTestabilities function| getAllAngularRootElements object| frameworkStabilizers object| __zone_symbol__beforeunloadfalse boolean| ‮saFelNds‭ object| __zone_symbol__keydownfalse object| __zone_symbol__keyupfalse object| __zone_symbol__keypressfalse object| __zone_symbol__clickfalse object| __zone_symbol__mousedownfalse object| __zone_symbol__mouseupfalse object| __zone_symbol__mousemovefalse object| __zone_symbol__touchstartfalse object| __zone_symbol__touchendfalse object| __zone_symbol__touchmovefalse object| __zone_symbol__loadfalse object| __zone_symbol__orientationchangefalse object| __zone_symbol__visibilitychangefalse object| __zone_symbol__touchstarttrue object| __zone_symbol__focustrue object| __zone_symbol__blurtrue number| ‮chXsmTds‭ function| __zone_symbol__addEventListener function| __zone_symbol__removeEventListener undefined| __zone_symbol__eventListeners undefined| __zone_symbol__removeAllListeners function| eventListeners function| removeAllListeners

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev/	1970-01-20 21:57:04	Name: _imp_di_pc_ Value: AWtwrWQAAAAAwBJ1wzfbJu%2BxDWYZGg0A
			.pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev/	1970-01-20 21:57:25	Name: __ts_xfdF3__ Value: 209414824
			.pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev/	1970-01-20 13:54:40	Name: _imp_apg_r_ Value: %7B%22_fr%22%3A20000%2C%22diA%22%3A%22AWtwrWQAAAAAwBJ1wzfbJu%2BxDWYZGg0A%22%2C%22diB%22%3A%22AR9vQKi%2F0yll8lRnl6ugx4RtVg3VceSv%22%2C%22fr%22%3A%22coOphUryXwXMYAcmPVToRw%3D%3D_1-7ehgH505gisJrQMOlMlTvH6mnfPYKRn3QnzaYqfa9Pcfb-hWJoCRu2Fs7RjVopBerUQYpEeA5Q4dZIXFLByJf3wU70GR1J6u_3b05oEkFF-mpUKBOQMVDKLOnEGcmwzuclHJMTv4jl_9RSUk652sFcKSaFZrMez331nxHFOKXB_osdleP7e5i%22%2C%22ct%22%3A%22N0xqfP9dvTHN%2FDf8tmCks8VeDv2Q7BWl038L%2BUo%3D%22%7D

7 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	(Line 2) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.att.com/scripts/adobe/prod/detm-container-hdr.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	(Line 2) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://www.att.com/scripts/adobe/prod/detm-container-hdr.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	(Line 2) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://signin-static-js.att.com/scripts/att_common.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network	error	URL: https://www.att.com/scripts/adobe/prod/detm-container-hdr.js Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://www.att.com/scripts/ssaf_universal_client/prod/ssaf-uc.js Message: Failed to load resource: the server responded with a status of 403 ()
rendering	warning	URL: https://signin-static-js.att.com/scripts/att_common.js Message: Canvas2D: Multiple readback operations using getImageData are faster with the willReadFrequently attribute set to true. See: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently
rendering	warning	URL: https://signin-static-js.att.com/scripts/att_common.js Message: Canvas2D: Multiple readback operations using getImageData are faster with the willReadFrequently attribute set to true. See: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

pub-493ed05ca0194ff0a7dc9f81dfddba1c.r2.dev
signin-static-js.att.com
signin.att.com
www.att.com
144.160.125.207
2606:4700::6812:223
2a02:26f0:480:986::2db1
284bdefd04b7928f8c2b7640d2742b060154e58d649c31fa6f6ba5fce695e1cb
2d508afadc988ec21541854a08e3e7580ed6d8208af7da2a83611d0b6be4958b
37a1212cc1ab5c935d9a3fee05c98c940eaa895a23510e5f83d550dfbb0d763f
3c965177e2477b3d06d65dbdcdaf65d266dc4c59e156042b3d5a03c180b14bb3
4159656bcbb7b77c763c468d9d8b78215bc251f25f1d58b5148ce140466f04d4
50e6072d26098d48004a30addeecabd5b22b91e5ccdf9dd86f96459783e3ac23
6982fbe858e30068de9301b49438c83838bc7beb058146703b22b701e6709c7e
6c5acbb82a46a4971660f65131241dffcc28828f4dbd76b8ec7bab0b468250f8
99893aeb9995a93ebe2a3d01f15a87c968972983a5984a79245fc32bede6773d
b293d306f4e563ea2bdde7767d238833d8097b4a63af67035efce9b1bf112be8
b589ac98cac6d578082d9d2e8bb354abcab6f41f25a081a613227a37def44c9a
c2eb39ee130a5b2f8fc823f8bfa06f527bc9708f024ed5b9904e23039fd1f086
c890d090b2a50decf2950425dfa8ba817f59435a63938d6d329f49b008429c8a
caa22a11a7d51983bd572bcf5c6ac58daeb82e5cd5ac15191870f18ee3d9546d
d5b82ad4def0f1dbb8b4e0c8f4cab9bed6dc0893be7d6d544953b7640d3f2455
e2740c7b209e33aca7176250d80f94b4924e5e5d18076ee3b95f32a0e20d1f58
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855