urlscan.io logo urlscan.io
SecurityTrails logo

www.healthyu.org Open in urlscan Pro
192.185.103.45  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://www.healthyu.org/smll/attbestfastcheck!.php
Submission: On December 13 via automatic, source openphish
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 3 domains to perform 16 HTTP transactions. The main IP is 192.185.103.45, located in Houston, United States and belongs to CYRUSONE - CyrusOne LLC, US. The main domain is www.healthyu.org.
This is the only time www.healthyu.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: AT&T (Telecommunication)

Domain & IP information

IP Address AS Autonomous System
1 192.185.103.45 20013 (CYRUSONE)
1 15 2001:1890:1c0... 7018 (ATT-INTER...)
1 2a00:1288:80:... 203220 (YAHOO-DEB)
16 3
Apex Domain
Subdomains		 Transfer
15 att.net
home.secureapp.att.net
196 KB
1 yimg.com
s.yimg.com
1 healthyu.org
www.healthyu.org
16 3
Domain Requested by
15 home.secureapp.att.net 1 redirects www.healthyu.org
home.secureapp.att.net
1 s.yimg.com www.healthyu.org
1 www.healthyu.org
16 3

This site contains links to these domains. Also see Links.

Domain
www.att.net
www.att.com
uverseonline.att.net
elportal.att.net
home.secureapp.att.net
Subject Issuer Validity Valid
home.secureapp.att.net
Symantec Class 3 Secure Server CA - G4		 2017-08-17 -
2018-10-13		 a year crt.sh
*.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2017-11-27 -
2018-01-12		 2 months crt.sh

This page contains 1 frames:

Primary Page: http://www.healthyu.org/smll/attbestfastcheck!.php
Frame ID: (2B9A84E40F8F831D7A89997C51001A55)
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • url /\.php(?:$|\?)/i
Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
  • script /jquery.*\.js/i

Page Statistics

16
Requests

94 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

2
Countries

195 kB
Transfer

199 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 14
  • https://home.secureapp.att.net/attportal/s/context.dll?id=9002001&type=clickthru&name=cgate.signIn.Pageviews.www-att-net&redirecturl=/i/s.gif?nocache=3394 HTTP 302
  • https://home.secureapp.att.net/i/s.gif?nocache=3394

16 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request attbestfastcheck!.php
www.healthyu.org/smll/ 		4 KB
0 		Document
General
Check archive.org
Download Go to
Full URL
http://www.healthyu.org/smll/attbestfastcheck!.php
Protocol
HTTP/1.1
Server
192.185.103.45 Houston, United States, ASN20013 (CYRUSONE - CyrusOne LLC, US),
Reverse DNS
192-185-103-45.unifiedlayer.com
Software
nginx/1.12.2 /
Resource Hash
b91a7eb2681d41598967d967e404730ad045c48933b54a86d9a74335962017a8

Request headers

Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Connection
keep-alive
Accept-Encoding
gzip, deflate
Host
www.healthyu.org
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Wed, 13 Dec 2017 13:46:02 GMT
Content-Encoding
gzip
Server
nginx/1.12.2
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
text/html
main.css
home.secureapp.att.net/css/sso/slid/1201/ 		28 KB
28 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://home.secureapp.att.net/css/sso/slid/1201/main.css
Requested by
Host: www.healthyu.org
URL: http://www.healthyu.org/smll/attbestfastcheck!.php
Protocol
HTTP/1.0
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:1890:1c01:2::42 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US),
Reverse DNS
Software
"" /
Resource Hash
dfa2be020e3374a4b1c871c88ada990120fb198d4e8ff685ad35cfae88ad3466

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
home.secureapp.att.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://www.healthyu.org/smll/attbestfastcheck!.php
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.healthyu.org/smll/attbestfastcheck!.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Wed, 13 Dec 2017 13:43:58 GMT
Last-modified
Tue, 24 Oct 2017 04:39:16 GMT
Server
""
Etag
"6fd5-59eec3f4"
Content-type
text/css
Connection
keep-alive
Accept-ranges
bytes
Content-length
28629
jquery-1.5.1.min.js
home.secureapp.att.net/js/jquery/ 		83 KB
83 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://home.secureapp.att.net/js/jquery/jquery-1.5.1.min.js
Requested by
Host: www.healthyu.org
URL: http://www.healthyu.org/smll/attbestfastcheck!.php
Protocol
HTTP/1.0
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:1890:1c01:2::42 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US),
Reverse DNS
Software
"" /
Resource Hash
764b9e9f3ad386aaa5cdeae9368353994de61c0bede087c8f7e3579cb443de3b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
home.secureapp.att.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
*/*
Referer
http://www.healthyu.org/smll/attbestfastcheck!.php
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.healthyu.org/smll/attbestfastcheck!.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Wed, 13 Dec 2017 13:43:58 GMT
Last-modified
Fri, 11 Mar 2011 22:40:27 GMT
Server
""
Etag
"14d0c-4d7aa4db"
Content-type
application/x-javascript
Connection
keep-alive
Accept-ranges
bytes
Content-length
85260
jquery.simplemodal.js
home.secureapp.att.net/js/jquery/simplemodal/ 		9 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://home.secureapp.att.net/js/jquery/simplemodal/jquery.simplemodal.js
Requested by
Host: www.healthyu.org
URL: http://www.healthyu.org/smll/attbestfastcheck!.php
Protocol
HTTP/1.0
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:1890:1c01:2::42 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US),
Reverse DNS
Software
"" /
Resource Hash
70b5a6613f03d3c015d826185e39839e6dbc2d03871f151bafbed5cc58503f69

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
home.secureapp.att.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
*/*
Referer
http://www.healthyu.org/smll/attbestfastcheck!.php
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.healthyu.org/smll/attbestfastcheck!.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Wed, 13 Dec 2017 13:43:58 GMT
Last-modified
Fri, 05 Nov 2010 18:18:06 GMT
Server
""
Etag
"24fd-4cd44a5e"
Content-type
application/x-javascript
Connection
keep-alive
Accept-ranges
bytes
Content-length
9469
script.js
home.secureapp.att.net/js/sso/slid/1201/ 		47 KB
47 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://home.secureapp.att.net/js/sso/slid/1201/script.js
Requested by
Host: www.healthyu.org
URL: http://www.healthyu.org/smll/attbestfastcheck!.php
Protocol
HTTP/1.0
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:1890:1c01:2::42 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US),
Reverse DNS
Software
"" /
Resource Hash
b71323f713074ada8dae257aabaee2e8cc776e7219385ad1a756bef2f1336d63

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
home.secureapp.att.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
*/*
Referer
http://www.healthyu.org/smll/attbestfastcheck!.php
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.healthyu.org/smll/attbestfastcheck!.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Wed, 13 Dec 2017 13:43:58 GMT
Last-modified
Tue, 24 Oct 2017 04:29:43 GMT
Server
""
Etag
"bdff-59eec1b7"
Content-type
application/x-javascript
Connection
keep-alive
Accept-ranges
bytes
Content-length
48639
script.js
s.yimg.com/ik/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://s.yimg.com/ik/script.js
Requested by
Host: www.healthyu.org
URL: http://www.healthyu.org/smll/attbestfastcheck!.php
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1288:80:800::7001 , United Kingdom, ASN203220 (YAHOO-DEB, DE),
Reverse DNS
Software
ATS /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=604800

Request headers

:path
/ik/script.js
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
s.yimg.com
referer
http://www.healthyu.org/smll/attbestfastcheck!.php
:scheme
https
:method
GET
Referer
http://www.healthyu.org/smll/attbestfastcheck!.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date
Wed, 13 Dec 2017 13:46:03 GMT
via
HTTP/1.1 web5.usw18.mobstor.gq1.yahoo.com UserFiberFramework/1.0, HTTPS/1.1 web14.use18.mobstor.bf1.yahoo.com UserFiberFramework/1.0, https/1.1 e15.ycpi.deb.yahoo.com (ApacheTrafficServer [cSsSfU])
x-ysws-request-id
4fa1d148-efe8-4f03-b405-e90514c152b3,55e56340-1333-4150-8ab6-5fd9aae67858
server
ATS
age
0
x-ysws-error-detail
not_in_objectstore
strict-transport-security
max-age=604800
content-type
text/html; charset=iso-8859-1
status
404
content-length
25
x-ysws-visited-replicas
gops.use18.mobstor.vip.bf1.yahoo.com,gops.usw18.mobstor.vip.gq1.yahoo.com
mobile.css
home.secureapp.att.net/css/sso/slid/1201/ 		4 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://home.secureapp.att.net/css/sso/slid/1201/mobile.css
Requested by
Host: www.healthyu.org
URL: http://www.healthyu.org/smll/attbestfastcheck!.php
Protocol
HTTP/1.0
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:1890:1c01:2::42 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US),
Reverse DNS
Software
"" /
Resource Hash
30a949cc26cd4f709fa897313f8d448b2cb724a40a170c4b8e8ce6b3aa890fd1

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
home.secureapp.att.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
http://www.healthyu.org/smll/attbestfastcheck!.php
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.healthyu.org/smll/attbestfastcheck!.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Wed, 13 Dec 2017 13:43:58 GMT
Last-modified
Wed, 21 Dec 2016 10:14:45 GMT
Server
""
Etag
"fa3-585a5615"
Content-type
text/css
Connection
keep-alive
Accept-ranges
bytes
Content-length
4003
pageBg.png
home.secureapp.att.net/design/cdls10/img/ui/ 		169 B
169 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://home.secureapp.att.net/design/cdls10/img/ui/pageBg.png
Requested by
Host: www.healthyu.org
URL: http://www.healthyu.org/smll/attbestfastcheck!.php
Protocol
HTTP/1.0
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:1890:1c01:2::42 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US),
Reverse DNS
Software
"" /
Resource Hash
c537cf7e2770d1b4953255dfccff8e0bdbfd4adb4e88d868e353208ae7ff13c1

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
home.secureapp.att.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
Connection
keep-alive
Cache-Control
no-cache
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Wed, 13 Dec 2017 13:43:58 GMT
Last-modified
Tue, 11 Aug 2009 21:10:32 GMT
Server
""
Etag
"a9-4a81de48"
Content-type
image/png
Connection
keep-alive
Accept-ranges
bytes
Content-length
169
btnSumbit.png
home.secureapp.att.net/img/sso/slid/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://home.secureapp.att.net/img/sso/slid/btnSumbit.png
Requested by
Host: www.healthyu.org
URL: http://www.healthyu.org/smll/attbestfastcheck!.php
Protocol
HTTP/1.0
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:1890:1c01:2::42 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US),
Reverse DNS
Software
"" /
Resource Hash
27da51ec2023f96407f92161ddda0e290b0661a765822ff03e5d61f3aecf8aa0

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
home.secureapp.att.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
Connection
keep-alive
Cache-Control
no-cache
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Wed, 13 Dec 2017 13:43:58 GMT
Last-modified
Tue, 21 Sep 2010 15:06:50 GMT
Server
""
Etag
"573-4c98ca0a"
Content-type
image/png
Connection
keep-alive
Accept-ranges
bytes
Content-length
1395
footerBg.png
home.secureapp.att.net/design/CDLS10/img/ui/ 		560 B
560 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://home.secureapp.att.net/design/CDLS10/img/ui/footerBg.png
Requested by
Host: www.healthyu.org
URL: http://www.healthyu.org/smll/attbestfastcheck!.php
Protocol
HTTP/1.0
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:1890:1c01:2::42 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US),
Reverse DNS
Software
"" /
Resource Hash
61e91515aaf72cba3014a136331a138eca6b27831c8f2e6b0c128825243f5263

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
home.secureapp.att.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
Connection
keep-alive
Cache-Control
no-cache
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Wed, 13 Dec 2017 13:43:58 GMT
Last-modified
Fri, 17 Jul 2009 17:05:33 GMT
Server
""
Etag
"230-4a60af5d"
Content-type
image/png
Connection
keep-alive
Accept-ranges
bytes
Content-length
560
attGlobalNavHeader-bg.gif
home.secureapp.att.net/design/cdls20/img/ui/ 		149 B
149 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://home.secureapp.att.net/design/cdls20/img/ui/attGlobalNavHeader-bg.gif
Requested by
Host: home.secureapp.att.net
URL: https://home.secureapp.att.net/js/jquery/jquery-1.5.1.min.js
Protocol
HTTP/1.0
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:1890:1c01:2::42 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US),
Reverse DNS
Software
"" /
Resource Hash
9880eb5b6a6b1dec8f568c14a1a5be755c460d2ea2df66fa7b5e6b99227f7128

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
home.secureapp.att.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
Connection
keep-alive
Cache-Control
no-cache
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Wed, 13 Dec 2017 13:43:59 GMT
Last-modified
Thu, 26 Apr 2012 21:04:53 GMT
Server
""
Etag
"95-4f99b875"
Content-type
image/gif
Connection
keep-alive
Accept-ranges
bytes
Content-length
149
txt-clear.png
home.secureapp.att.net/img/sso/slid/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://home.secureapp.att.net/img/sso/slid/txt-clear.png
Requested by
Host: home.secureapp.att.net
URL: https://home.secureapp.att.net/js/jquery/jquery-1.5.1.min.js
Protocol
HTTP/1.0
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:1890:1c01:2::42 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US),
Reverse DNS
Software
"" /
Resource Hash
fdee766a03e4032897a2cd75326c135d8e938592bfb00f12ed5b4eb223f54c3f

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
home.secureapp.att.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
Connection
keep-alive
Cache-Control
no-cache
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Wed, 13 Dec 2017 13:43:59 GMT
Last-modified
Tue, 29 Jul 2014 15:04:17 GMT
Server
""
Etag
"cda-53d7b7f1"
Content-type
image/png
Connection
keep-alive
Accept-ranges
bytes
Content-length
3290
att_globe_blue_80x80.png
home.secureapp.att.net/design/CDLS10/img/logos/ 		16 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://home.secureapp.att.net/design/CDLS10/img/logos/att_globe_blue_80x80.png
Requested by
Host: home.secureapp.att.net
URL: https://home.secureapp.att.net/js/jquery/jquery-1.5.1.min.js
Protocol
HTTP/1.0
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:1890:1c01:2::42 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US),
Reverse DNS
Software
"" /
Resource Hash
dfa35aa4643a991e1d2ec6e3562e1a0465174c7200a7572c92619904bb08530f

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
home.secureapp.att.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
Connection
keep-alive
Cache-Control
no-cache
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Wed, 13 Dec 2017 13:43:59 GMT
Last-modified
Fri, 20 May 2016 12:43:47 GMT
Server
""
Etag
"40c4-573f0683"
Content-type
image/png
Connection
keep-alive
Accept-ranges
bytes
Content-length
16580
support-icon.jpg
home.secureapp.att.net/img/sso/slid/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://home.secureapp.att.net/img/sso/slid/support-icon.jpg
Requested by
Host: home.secureapp.att.net
URL: https://home.secureapp.att.net/js/jquery/jquery-1.5.1.min.js
Protocol
HTTP/1.0
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:1890:1c01:2::42 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US),
Reverse DNS
Software
"" /
Resource Hash
01a7e22fd83c617ff55898233518c54a9ecce7e0de3e8a63c4fa59315b029c6b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
home.secureapp.att.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
Connection
keep-alive
Cache-Control
no-cache
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Wed, 13 Dec 2017 13:43:59 GMT
Last-modified
Mon, 26 Jul 2010 21:26:50 GMT
Server
""
Etag
"615-4c4dfd9a"
Content-type
image/jpeg
Connection
keep-alive
Accept-ranges
bytes
Content-length
1557
ques.png
home.secureapp.att.net/img/sso/slid/ 		363 B
363 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://home.secureapp.att.net/img/sso/slid/ques.png
Requested by
Host: home.secureapp.att.net
URL: https://home.secureapp.att.net/js/sso/slid/1201/script.js
Protocol
HTTP/1.0
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:1890:1c01:2::42 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US),
Reverse DNS
Software
"" /
Resource Hash
5fd69c4fa9f1a2a6fbdab11ff45053dbd08237e6190dfc9c071fadd08fe9b7d5

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
home.secureapp.att.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
Connection
keep-alive
Cache-Control
no-cache
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Wed, 13 Dec 2017 13:43:59 GMT
Last-modified
Mon, 19 Jul 2010 03:35:58 GMT
Server
""
Etag
"16b-4c43c81e"
Content-type
image/png
Connection
keep-alive
Accept-ranges
bytes
Content-length
363
s.gif
home.secureapp.att.net/i/
Redirect Chain
  • https://home.secureapp.att.net/attportal/s/context.dll?id=9002001&type=clickthru&name=cgate.signIn.Pageviews.www-att-net&redirecturl=/i/s.gif?nocache=3394
  • https://home.secureapp.att.net/i/s.gif?nocache=3394
43 B
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://home.secureapp.att.net/i/s.gif?nocache=3394
Protocol
HTTP/1.0
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:1890:1c01:2::42 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US),
Reverse DNS
Software
"" /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
home.secureapp.att.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
http://www.healthyu.org/smll/attbestfastcheck!.php
Cookie
ZIP2COOKIESTR=uniqueid=121317134359347008853&ppvdr=&userid=1&userpw=.&gloc=0&uh=1_0_; ATTINTCOOKSTR=uniqueid=121317134359347008853
Connection
keep-alive
Cache-Control
no-cache
Referer
http://www.healthyu.org/smll/attbestfastcheck!.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Wed, 13 Dec 2017 13:43:59 GMT
Last-modified
Thu, 25 Sep 2003 20:17:53 GMT
Server
""
Etag
"2b-3f734d71"
Content-type
image/gif
Connection
keep-alive
Accept-ranges
bytes
Content-length
43

Redirect headers

Location
https://home.secureapp.att.net/i/s.gif?nocache=3394
Date
Wed, 13 Dec 2017 13:43:59 GMT
Connection
keep-alive
Server
""
Set-cookie
ZIP2COOKIESTR=uniqueid=121317134359347008853&ppvdr=&userid=1&userpw=.&gloc=0&uh=1_0_; path=/; domain=.att.net ATTINTCOOKSTR=uniqueid=121317134359347008853; expires=Wednesday, 09-Dec-2019 23:12:40 GMT; path=/; domain=.att.net
Content-length
0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: AT&T (Telecommunication)

33 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onafterprint object| onbeforeprint function| $ function| jQuery string| agent string| ORIGINATION_POINT_URL string| RETURN_URL string| CANCEL_URL function| getWindowWidth function| getWindowHeight function| setRegURL function| logPgvw function| refer function| submitForm function| trimAll function| chkTick function| unchkTick function| getElementsByClassName function| btnChange function| acctSelBtnEnable function| ie6Img function| getYadContents function| init undefined| countdownElement function| overlay function| cancelLoad function| Redirecturl string| focusableElementsString function| trapTabKey function| supportRedirect object| yld_mgr string| q1Zidx string| q2Zidx

1 Cookies

Domain/Path Name / Value
www.healthyu.org/ Name: IV_JCT
Value: %2FcommonLogin