sivasmailups.com Open in urlscan Pro
2606:4700:3030::6815:3072 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://kenalred.com/oea/
Effective URL:
https://sivasmailups.com/tta/?key=
Submission: On August 26 via api (August 26th 2022, 7:53:49 pm UTC) from JP — Scanned from JP

Summary HTTP 9 Redirects Links 8 Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 9 HTTP transactions. The main IP is 2606:4700:3030::6815:3072, located in United States and belongs to CLOUDFLARENET, US. The main domain is sivasmailups.com.
TLS certificate: Issued by GTS CA 1P5 on August 25th 2022. Valid for: 3 months.

This is the only time sivasmailups.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	66.175.58.9 66.175.58.9	30447 (INFB2-AS) (INFB2-AS)
2	66.175.41.113 66.175.41.113	30447 (INFB2-AS) (INFB2-AS)
1	2606:4700:303... 2606:4700:3030::6815:3072	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:140b:2:9... 2600:140b:2:9b2::2db1	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
9	5

1 66.175.58.9 (United States)

ASN30447 (INFB2-AS, US)
PTR: hostedc38.carrierzone.com

kenalred.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 66.175.41.113 (United States)

ASN30447 (INFB2-AS, US)
PTR: wiredminds.carrierzone.com

count.carrierzone.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3030::6815:3072 (United States)

ASN13335 (CLOUDFLARENET, US)

sivasmailups.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:140b:2:9b2::2db1 (Tokyo, Japan)

ASN20940 (AKAMAI-ASN1, NL)

www.att.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	carrierzone.com count.carrierzone.com — Cisco Umbrella Rank: 73341	36 KB
1	att.com signin.att.com Failed www.att.com — Cisco Umbrella Rank: 12138	744 B
1	sivasmailups.com sivasmailups.com	5 KB
1	kenalred.com kenalred.com	721 B
9	4

	Domain	Requested by
2	count.carrierzone.com	kenalred.com
1	www.att.com	sivasmailups.com
1	sivasmailups.com
1	kenalred.com
0	signin.att.com Failed	sivasmailups.com
9	5

This site contains links to these domains. Also see Links.

Domain
www.att.com
attreg.att.net
about.att.com

Subject Issuer	Validity	Valid
*.carrierzone.com Sectigo RSA Domain Validation Secure Server CA	`2022-07-25` - `2023-07-25`	a year	crt.sh
*.sivasmailups.com GTS CA 1P5	`2022-08-25` - `2022-11-23`	3 months	crt.sh
*.att.com DigiCert TLS RSA SHA256 2020 CA1	`2022-01-03` - `2023-01-04`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://sivasmailups.com/tta/?key=
Frame ID: D53FA1CD2E3E9FA41AFEB0C42AC42679
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login Screen

Page URL History Show full URLs

http://kenalred.com/oea/ Page URL
https://sivasmailups.com/tta/?key= Page URL

Page Statistics

9
Requests

33 %
HTTPS

50 %
IPv6

4
Domains

5
Subdomains

5
IPs

2
Countries

43 kB
Transfer

53 kB
Size

1
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: https://www.att.com/acctmgmt/fid/lander?origination_point=tguard&Return_URL=https%3A%2F%2Foidc.idp.clogin.att.com%2Fmga%2Fsps%2Foauth%2Foauth20%2Fauthorize%3Fnonce%3DjSDORiC31N%26redirect_uri%3Dhttps%253A%252F%252Fatt-yahoo.att.net%252Fisam%252Fsps%252Foidc%252Frp%252FATT-HBO-RP%252Fredirect%252FYahoo%26response_mode%3Dform_post%26alt_dest%3Dhttps%25253A%25252F%25252Fatt-yahoo.att.net%25252FFIM%25252Fsps%25252Fauth%25253FPartnerId%25253Dhttps%2525253A%2525252F%2525252Flogin.yahoo.com%2525252Fsaml2%26scope%3Dopenid%26response_type%3Did_token%26state%3DESIFBpVr4D%26client_id%3Dm40842&Cancel_URL=https%3A%2F%2Foidc.idp.clogin.att.com%2Fmga%2Fsps%2Foauth%2Foauth20%2Fauthorize%3Fnonce%3DjSDORiC31N%26redirect_uri%3Dhttps%253A%252F%252Fatt-yahoo.att.net%252Fisam%252Fsps%252Foidc%252Frp%252FATT-HBO-RP%252Fredirect%252FYahoo%26response_mode%3Dform_post%26alt_dest%3Dhttps%25253A%25252F%25252Fatt-yahoo.att.net%25252FFIM%25252Fsps%25252Fauth%25253FPartnerId%25253Dhttps%2525253A%2525252F%2525252Flogin.yahoo.com%2525252Fsaml2%26scope%3Dopenid%26response_type%3Did_token%26state%3DESIFBpVr4D%26client_id%3Dm40842
Title: Forgot user ID?

Search URL Search Domain Scan URL

URL: https://www.att.com/acctmgmt/fpwd/lander?origination_point=tguard&Return_URL=https%3A%2F%2Foidc.idp.clogin.att.com%2Fmga%2Fsps%2Foauth%2Foauth20%2Fauthorize%3Fnonce%3DjSDORiC31N%26redirect_uri%3Dhttps%253A%252F%252Fatt-yahoo.att.net%252Fisam%252Fsps%252Foidc%252Frp%252FATT-HBO-RP%252Fredirect%252FYahoo%26response_mode%3Dform_post%26alt_dest%3Dhttps%25253A%25252F%25252Fatt-yahoo.att.net%25252FFIM%25252Fsps%25252Fauth%25253FPartnerId%25253Dhttps%2525253A%2525252F%2525252Flogin.yahoo.com%2525252Fsaml2%26scope%3Dopenid%26response_type%3Did_token%26state%3DESIFBpVr4D%26client_id%3Dm40842&Cancel_URL=https%3A%2F%2Foidc.idp.clogin.att.com%2Fmga%2Fsps%2Foauth%2Foauth20%2Fauthorize%3Fnonce%3DjSDORiC31N%26redirect_uri%3Dhttps%253A%252F%252Fatt-yahoo.att.net%252Fisam%252Fsps%252Foidc%252Frp%252FATT-HBO-RP%252Fredirect%252FYahoo%26response_mode%3Dform_post%26alt_dest%3Dhttps%25253A%25252F%25252Fatt-yahoo.att.net%25252FFIM%25252Fsps%25252Fauth%25253FPartnerId%25253Dhttps%2525253A%2525252F%2525252Flogin.yahoo.com%2525252Fsaml2%26scope%3Dopenid%26response_type%3Did_token%26state%3DESIFBpVr4D%26client_id%3Dm40842
Title: Forgot password?

Search URL Search Domain Scan URL

URL: https://attreg.att.net/CommonRegistrationWeb/opr?callingSystem=OP&callingAppId=OP&returnUrl=https://start.att.net
Title: Create one now

Search URL Search Domain Scan URL

URL: https://www.att.com/legal/legal-policy-center.html
Title: Legal policy center

Search URL Search Domain Scan URL

URL: https://about.att.com/sites/privacy_policy
Title: Privacy policy

Search URL Search Domain Scan URL

URL: https://www.att.com/legal/terms.attWebsiteTermsOfUse.html
Title: Terms of use

Search URL Search Domain Scan URL

URL: https://www.att.com/features/accessibility.html
Title: Accessibility

Search URL Search Domain Scan URL

URL: https://about.att.com/csr/home/privacy/rights_choices.html
Title: Do not sell my personal info

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://kenalred.com/oea/ Page URL
https://sivasmailups.com/tta/?key= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK / Show response
kenalred.com/oea/ 867 B
721 B 332ms
170ms Document
text/html 66.175.58.9
INFB2-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://kenalred.com/oea/
Protocol: HTTP/1.1
Server: 66.175.58.9 , United States, ASN30447 (INFB2-AS, US),
Reverse DNS: hostedc38.carrierzone.com
Software: /
Resource Hash: 8c359d7e1cefb545502d7c527549d54d17987030b50a9ebb616cd53acf934a67

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: jp-JP,jp;q=0.9

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Fri, 26 Aug 2022 19:53:34 GMT
Transfer-Encoding: chunked

GET
H/1.1 200
OK count.js Show response
count.carrierzone.com/app/count_server/ 35 KB
35 KB 669ms
166ms Script
text/javascript 66.175.41.113
INFB2-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://count.carrierzone.com/app/count_server/count.js
Requested by: Host: kenalred.com
URL: http://kenalred.com/oea/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 66.175.41.113 , United States, ASN30447 (INFB2-AS, US),
Reverse DNS: wiredminds.carrierzone.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: f418e6b5416f03cbc22b24f481582e2d55ee0f7ca6989c562b59f12c9229214e

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://kenalred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Fri, 26 Aug 2022 19:53:29 GMT
Last-Modified: Fri, 08 Jun 2012 10:17:02 GMT
Server: Apache/2.2.15 (CentOS)
Content-Type: text/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=10, max=100
Content-Length: 36029

GET
H/1.1 200
OK ctin.php
count.carrierzone.com/track/ 42 B
610 B 355ms
191ms Image
image/gif 66.175.41.113
INFB2-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://count.carrierzone.com/track/ctin.php?t=1661543615617&custnum=8cd7ff29a6d559cc&sname=kenalred.com&pagename=index.php&group=%2Fservices%2Fwebpages%2Fk%2Fe%2Fkenalred.com%2Fpublic%2Foea&version=%24Rev%3A%207840%20%24&js=1&jv=0&resolution=1600x1200&color_depth=24&campaign=&referrer=&page_url=http%253A%252F%252Fkenalred.com%252Foea%252F&plugins=Chrome%20PDF%20Plugin%3BChrome%20PDF%20Viewer%3BNative%20Client%3B
Requested by: Host: kenalred.com
URL: http://kenalred.com/oea/
Protocol: HTTP/1.1
Server: 66.175.41.113 , United States, ASN30447 (INFB2-AS, US),
Reverse DNS: wiredminds.carrierzone.com
Software: Apache/2.2.15 (CentOS) / PHP/5.2.17
Resource Hash: 5b27cb8a843da7b4f70f68d669798596541491654185df0bd45867d951a31947

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: http://kenalred.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 26 Aug 2022 19:53:30 GMT
Last-Modified: Fri, 26 Aug 2022 19:53:30 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.2.17
P3P: CP="NOI NID ADMa OUR IND UNI COM NAV"
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: Keep-Alive
Content-Type: image/gif
Keep-Alive: timeout=10, max=100
Content-Length: 42
Expires: Thu, 01 Jan 1970 01:23:45 GMT

GET
H2 200 Primary Request / Show response
sivasmailups.com/tta/ 16 KB
5 KB 474ms
456ms Document
text/html 2606:4700:3030::6815:3072
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sivasmailups.com/tta/?key=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::6815:3072 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6826e7b22e871da5d04797bcb4efd0cb9d93695e7da3b917bc3326ad1cbe9f83

Request headers

Referer: http://kenalred.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: jp-JP,jp;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 740f1d563b168a66-NRT
content-encoding: br
content-type: text/html; charset=UTF-8
date: Fri, 26 Aug 2022 19:53:37 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires: Thu, 19 Nov 1981 08:52:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zPOsg%2Bw0mdvnWf5bDCpVIJJmf7yRymVmvs9R%2BTQPpd8a4Od6JhxW50VfbMukoFpHk7aM38vLXVZQxKMrYVIPQ5PyYHCVDzLQol%2BX660%2BSKKL8cE%2FI0vGiWihBJY0d%2FZ3dXw8D%2F71U9Jjsg3S7%2BzY"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET styles.css
signin.att.com/static/siam/en/halo_c/halo-c-login/ 0
0

GET logo.svg
signin.att.com/static/siam/en/halo_c/halo-c-login/assets/images/ 0
0

GET errornew.svg
signin.att.com/static/siam/en/halo_c/halo-c-login/assets/images/ 0
0

GET main.js
signin.att.com/static/siam/en/halo_c/halo-c-login/ 0
0

GET
H2 200 detm-container-ftr.js Show response
www.att.com/scripts/adobe/prod/ 666 B
744 B 30ms
18ms Script
application/x-javascript 2600:140b:2:9b2::2db1
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.att.com/scripts/adobe/prod/detm-container-ftr.js

Requested by

Host: sivasmailups.com
URL: https://sivasmailups.com/tta/?key=

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2600:140b:2:9b2::2db1 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

AkamaiNetStorage /

Resource Hash

43f774da83292822f54305d69e01286ca018b6f3f0fe86250451ad93d9252f9c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000 ; preload

Request headers

accept-language: jp-JP,jp;q=0.9
Referer: https://sivasmailups.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

aka-global-request-id-uxtime: 0.3533ca17.1661299552.e0b085b, 0.becc4d17.1661543617.fed046e
date: Fri, 26 Aug 2022 19:53:37 GMT
content-encoding: gzip
last-modified: Fri, 30 Jul 2021 00:16:43 GMT
server: AkamaiNetStorage
etag: "d5c61c3be97b0718b3548d0ec26dc0ef:1627604203.48042"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: no-cache, private, max-age=7776000
server-timing: cdn-cache; desc=HIT, edge; dur=1
strict-transport-security: max-age=15768000 ; preload
accept-ranges: bytes
content-length: 368

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: signin.att.com
URL: https://signin.att.com/static/siam/en/halo_c/halo-c-login/styles.css

Domain: signin.att.com
URL: https://signin.att.com/static/siam/en/halo_c/halo-c-login/assets/images/logo.svg

Domain: signin.att.com
URL: https://signin.att.com/static/siam/en/halo_c/halo-c-login/assets/images/errornew.svg

Domain: signin.att.com
URL: https://signin.att.com/static/siam/en/halo_c/halo-c-login/main.js

Verdicts & Comments Add Verdict or Comment

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			sivasmailups.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 67ab5d421ae418e152bde3c2a91ff292

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

count.carrierzone.com
kenalred.com
signin.att.com
sivasmailups.com
www.att.com
signin.att.com
2600:140b:2:9b2::2db1
2606:4700:3030::6815:3072
66.175.41.113
66.175.58.9
43f774da83292822f54305d69e01286ca018b6f3f0fe86250451ad93d9252f9c
5b27cb8a843da7b4f70f68d669798596541491654185df0bd45867d951a31947
6826e7b22e871da5d04797bcb4efd0cb9d93695e7da3b917bc3326ad1cbe9f83
8c359d7e1cefb545502d7c527549d54d17987030b50a9ebb616cd53acf934a67
f418e6b5416f03cbc22b24f481582e2d55ee0f7ca6989c562b59f12c9229214e

sivasmailups.com Open in urlscan Pro 2606:4700:3030::6815:3072 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

9 Requests

33 %HTTPS

50 %IPv6

4 Domains

5 Subdomains

5 IPs

2 Countries

43 kBTransfer

53 kBSize

1 Cookies

8 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

10 JavaScript Global Variables

1 Cookies

Indicators

sivasmailups.com Open in urlscan Pro
2606:4700:3030::6815:3072 Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

33 %
HTTPS

50 %
IPv6

4
Domains

5
Subdomains

5
IPs

2
Countries

43 kB
Transfer

53 kB
Size

1
Cookies

9 HTTP transactions
0 data transactions