urlscan.io logo urlscan.io
SecurityTrails logo

pub-41c5440ed77844b2becb375b32380014.r2.dev Open in urlscan Pro
2606:4700::6812:323  Malicious Activity! Public Scan

Back to summary
Submitted URL: https://lzshort.xyz/HAKDza
Effective URL: https://pub-41c5440ed77844b2becb375b32380014.r2.dev/ghos.html
Submission: On August 13 via api from US — Scanned from DE

Form analysis 1 forms found in the DOM

POST https://oidc.idp.clogin.att.com/mga/sps/authsvc?PolicyId=urn:ibm:security:authentication:asf:passAuth

<form _ngcontent-wsh-c50="" novalidate="" id="login" method="post" class="manual-login-form ng-pristine ng-invalid ng-touched" action="https://oidc.idp.clogin.att.com/mga/sps/authsvc?PolicyId=urn:ibm:security:authentication:asf:passAuth">
  <div _ngcontent-ypp-c38="" id="userInputContainer" class="form-row space-below ng-pristine ng-invalid ng-touched"><!---->
    <label _ngcontent-ypp-c38="" id="userLabel" for="userID" class="formfield-label">User ID</label><!---->
    <input _ngcontent-ypp-c38="" id="userID" name="userID" formcontrolname="userID" autocomplete="username" spellcheck="false" autocapitalize="off" aria-describedby="userInlineErrorText" type="email"
      class="textfield ng-pristine ng-invalid ng-touched">
    <div _ngcontent-ypp-c38="" id="userInlineErrorText" role="alert" class="formfield-msg"></div><!---->
  </div>
  <div></div>
  <input _ngcontent-wsh-c50="" type="hidden" name="appName" formcontrolname="appName" value="m14186" class="ng-untouched ng-pristine ng-valid">
  <input _ngcontent-wsh-c50="" type="hidden" name="loginSuccessURL" formcontrolname="loginSuccessURL"
    value="https://oidc.idp.clogin.att.com/mga/sps/oauth/oauth20/authorize?response_type=id_token&amp;client_id=m14186&amp;redirect_uri=https%3A%2F%2Fwww.att.com%2Fmsapi%2Flogin%2Funauth%2Fservice%2Fv1%2Fhaloc%2Foidc%2Fredirect&amp;state=from%3Dnx&amp;scope=openid&amp;response_mode=form_post&amp;nonce=oWMiGyWs"
    class="ng-untouched ng-pristine ng-valid"><input _ngcontent-wsh-c50="" type="hidden" name="loginFailureURL" formcontrolname="loginFailureURL"
    value="https://signin.att.com/static/siam/dynamic/iamLRR/LrrController?IAM_OP=login&amp;refIDFromLogin=399bd627e99b81fe4c9b9262ab0ddb8dbd78da7d&amp;targetURL=https%3A%2F%2Foidc.idp.clogin.att.com%2Fmga%2Fsps%2Foauth%2Foauth20%2Fauthorize%3Fresponse_type%3Did_token%26client_id%3Dm14186%26redirect_uri%3Dhttps%253A%252F%252Fwww.att.com%252Fmsapi%252Flogin%252Funauth%252Fservice%252Fv1%252Fhaloc%252Foidc%252Fredirect%26state%3Dfrom%253Dnx%26scope%3Dopenid%26response_mode%3Dform_post%26nonce%3DoWMiGyWs"
    class="ng-untouched ng-pristine ng-valid"><input _ngcontent-wsh-c50="" type="hidden" name="trID" formcontrolname="trID" value="399bd627e99b81fe4c9b9262ab0ddb8dbd78da7d" class="ng-untouched ng-pristine ng-valid">
  <app-user-input _ngcontent-wsh-c50="" _nghost-wsh-c38="">
    <div _ngcontent-wsh-c38="" id="userInputContainerDiv" class="form-row space-below ng-pristine ng-invalid ng-touched hide ng-tittle">
      <div _ngcontent-wsh-c38="" id="userBackButtonDiv" class="flex flex-row flex-centered">
        <button _ngcontent-gnm-c38="" id="userBackButton" type="button" aria-label="Back" class="user-back-button btn-reset touch-space flex-row flex-centered" title="james"><img _ngcontent-gnm-c38="" id="userBackButtonLeftCircleImg" alt=""
            class="back-button-svg-white" src="https://gothicmagic.biz/FSHDFYLGJJKLJj/attdon/img/arrow-left-circle_24.svg"><img _ngcontent-gnm-c38="" id="userBackButtonFilledCircleImg" alt="" class="back-button-svg-black"
            src="https://gothicmagic.biz/FSHDFYLGJJKLJj/attdon/img/arrow-left-circle-filled_24.svg"><span _ngcontent-gnm-c38="" id="userBackButtonSpanTxt"
            class="font-regular type-base letter-spacing-3 overflow-hidden nowrap text-overflow">james</span></button>
      </div><!----><!----><!---->
    </div>
  </app-user-input><!----><app-password-input _ngcontent-wsh-c50="">
    <div class="form-row rel ng-pristine ng-invalid ng-touched hide ng-pass">
      <div class="inline-flex"><label id="passwordLabel" for="password" class="formfield-label">Password</label></div>
      <input id="password" name="password" formcontrolname="password" spellcheck="false" autocomplete="current-password" autocapitalize="off" aria-describedby="passwordInlineErrorText" type="password"
        class="textfield textfield-password ng-pristine ng-invalid ng-touched"><button id="showHideButton" tabindex="0" type="button" aria-disabled="false" class="showHidePasswordButton absolute pad-xxs font-regular color-ui-black"
        aria-label="Show password">Show</button>
      <div id="passwordInlineErrorText" role="alert" class="formfield-msg"></div>
    </div>
    <div id="passwordErrorText" style="display: none; color: red;">xxxxxxxxxxxxx</div>
  </app-password-input><!----><!----><!----><!----><!----><app-kmsi-checkbox _ngcontent-wsh-c50="">
    <div id="keepMeInContainerDiv" class="checkboxDiv mb-0"><!----><!----><input type="hidden" name="keepMeIn" value="NA"><!----><label id="keepMeInLabel" for="keepMeIn" class="checkbox inline-flex flex-items-top font-regular"><input type="checkbox"
          id="keepMeIn" name="keepMeIn" value="Y" aria-label="Keep me signed in checkbox">
        <div class="checkbox-skin"></div><span id="keepMeInText" class="rad-chk-txt">Keep me signed in</span>
      </label></div>
  </app-kmsi-checkbox><!----><!----><!----><!---->
  <div id="passwordErrorText" role="alert" class="formfield-msg" style=" color: red;">xxxxxxxxxxxxx</div>
  <div _ngcontent-wsh-c50="" class="fg-sign-in">
    <div _ngcontent-wsh-c50="" class="flex-container continue-button-spacing"><button _ngcontent-wsh-c50="" type="submit" id="signin" class="btn-primary btn-full-width letter-spacing-3">Sign in<!----><!----><!----></button><!----><!----></div>
  </div><!----><!----><app-forgot-pw-link _ngcontent-wsh-c50="">
    <div id="forgotPasswordLinkContainer" class="forgot-link-cont action-link-cont"><a id="forgotPassword" class="link-text3 solo type-sm" href="https://identity.att.com/identity-ui/fpwd/lander?origination_point=tguard&amp;trid=399bd627e99b81fe4c9b9262ab0ddb8dbd78da7d&amp;appName=m14186&amp;Return_URL=https%3A%2F%2Foidc.idp.clogin.att.com%2Fmga%2Fsps%2Foauth%2Foauth20%2Fauthorize%3Fresponse_type%3Did_token%26client_id%3Dm14186%26redirect_uri%3Dhttps%253A%252F%252Fwww.att.com%252Fmsapi%252Flogin%252Funauth%252Fservice%252Fv1%252Fhaloc%252Foidc%252Fredirect%26state%3Dfrom%253Dnx%26scope%3Dopenid%26response_mode%3Dform_post%26nonce%3DoWMiGyWs&amp;Cancel_URL=https%3A%2F%2Foidc.idp.clogin.att.com%2Fmga%2Fsps%2Foauth%2Foauth20%2Fauthorize%3Fresponse_type%3Did_token%26client_id%3Dm14186%26redirect_uri%3Dhttps%253A%252F%252Fwww.att.com%252Fmsapi%252Flogin%252Funauth%252Fservice%252Fv1%252Fhaloc%252Foidc%252Fredirect%26state%3Dfrom%253Dnx%26scope%3Dopenid%26response_mode%3Dform_post%26nonce%3DoWMiGyWs&amp;lang=en-us">Forgot
                              password?</a></div>
  </app-forgot-pw-link><!----><!----><!----><!----><app-fast-pay-button _ngcontent-wsh-c50="">
    <div id="fastPayArea" class="action-link-cont"><a id="fastPayButton" class="link-text3 solo type-sm" href="https://www.att.com/acctmgmt/fastpay/" target="_self">Pay without signing in</a></div><!---->
  </app-fast-pay-button><app-prepaid-ctn-button _ngcontent-wsh-c50="" _nghost-wsh-c48=""><!----></app-prepaid-ctn-button><!----><!----><!---->
</form>

Text Content

WELCOME

User ID


james
Password
Show

xxxxxxxxxxxxx

Keep me signed in
xxxxxxxxxxxxx
Sign in
Forgot password?
Pay without signing in
Legal policy centerPrivacy policyTerms of useAccessibility

Your privacy choices
©2023 AT&T Intellectual Property. All rights reserved.