urlscan.io logo urlscan.io
SecurityTrails logo

setatt.redirectme.net Open in urlscan Pro
159.89.103.134  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://setatt.redirectme.net/
Submission: On December 23 via automatic, source phishtank — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 2 countries across 3 domains to perform 12 HTTP transactions. The main IP is 159.89.103.134, located in Frankfurt am Main, Germany and belongs to DIGITALOCEAN-ASN, US. The main domain is setatt.redirectme.net.
TLS certificate: Issued by R11 on December 23rd 2024. Valid for: 3 months.
This is the only time setatt.redirectme.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: AT&T (Telecommunication)

Domain & IP information

IP Address AS Autonomous System
2 159.89.103.134 14061 (DIGITALOC...)
4 2a00:1450:400... 15169 (GOOGLE)
1 2a04:4e42:400... 54113 (FASTLY)
1 172.217.18.97 15169 (GOOGLE)
12 5
Apex Domain
Subdomains		 Transfer
5 translate.goog
signin-att-com.translate.goog
30 KB
2 redirectme.net
setatt.redirectme.net
28 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 847
31 KB
12 3
Domain Requested by
5 signin-att-com.translate.goog setatt.redirectme.net
signin-att-com.translate.goog
2 setatt.redirectme.net setatt.redirectme.net
1 code.jquery.com setatt.redirectme.net
12 3

This site contains no links.

Subject Issuer Validity Valid
setatt.redirectme.net
R11		 2024-12-23 -
2025-03-23		 3 months crt.sh
*.googleusercontent.com
WR2		 2024-12-02 -
2025-02-24		 3 months crt.sh
*.jquery.com
Sectigo ECC Domain Validation Secure Server CA		 2024-06-25 -
2025-06-25		 a year crt.sh

This page contains 1 frames:

Primary Page: https://setatt.redirectme.net/
Frame ID: 8EAA8DFA609F959B8DF85E084F290C98
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Login Screen

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

67 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

5
IPs

2
Countries

88 kB
Transfer

253 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
setatt.redirectme.net/ 		14 KB
14 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://setatt.redirectme.net/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
159.89.103.134 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache /
Resource Hash
7ced4e1d6df0c7d589fc1a04389496dbd882a540b697640523230d514def8a4f

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

Accept-Ranges
bytes
Connection
Keep-Alive
Content-Length
14077
Content-Type
text/html
Date
Mon, 23 Dec 2024 20:43:57 GMT
Keep-Alive
timeout=5, max=100
Last-Modified
Mon, 23 Dec 2024 16:48:05 GMT
Server
Apache
styles.css
signin-att-com.translate.goog/static/siam/en/halo_c/halo-c-login/ 		128 KB
25 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://signin-att-com.translate.goog/static/siam/en/halo_c/halo-c-login/styles.css?v=17.1.1&_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp
Requested by
Host: setatt.redirectme.net
URL: https://setatt.redirectme.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
e9d64ddc98959fb478cc1e10b665c237608386ce7820cbfa5b4c502567642d22
Security Headers
Name Value
Content-Security-Policy frame-ancestors *.translate.goog
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://setatt.redirectme.net/

Response headers

x-robots-tag
none
content-security-policy
frame-ancestors *.translate.goog
cross-origin-opener-policy
unsafe-none
content-encoding
gzip
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 23 Dec 2024 20:43:58 GMT
x-xss-protection
0
last-modified
Thu, 18 Jul 2024 18:30:17 GMT
content-type
text/css
server
ESF
jquery-3.6.3.min.js
code.jquery.com/ 		88 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.6.3.min.js
Requested by
Host: setatt.redirectme.net
URL: https://setatt.redirectme.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:400::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
a6f3f0faea4b3d48e03176341bef0ed3151ffbf226d4c6635f1c6039c0500575

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://setatt.redirectme.net
Referer
https://setatt.redirectme.net/

Response headers

content-encoding
gzip
etag
W/"28feccc0-15f5b"
age
4351905
x-cache
HIT, HIT
date
Mon, 23 Dec 2024 20:43:57 GMT
content-type
application/javascript; charset=utf-8
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
x-cache-hits
36409, 45176
x-served-by
cache-lga21985-LGA, cache-mad22066-MAD
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=604800
x-timer
S1734986638.528548,VS0,VE0
cross-origin-resource-policy
cross-origin
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
31046
server
nginx
loader.svg
signin-att-com.translate.goog/static/siam/en/halo_c/cms/login/default/images/ 		363 B
347 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://signin-att-com.translate.goog/static/siam/en/halo_c/cms/login/default/images/loader.svg?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp
Requested by
Host: setatt.redirectme.net
URL: https://setatt.redirectme.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
9c89b05cd97e3fccb4339020efd91af04f98d8c3ca7b0238d088380b8866ff61
Security Headers
Name Value
Content-Security-Policy frame-ancestors *.translate.goog
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://setatt.redirectme.net/

Response headers

x-robots-tag
none
content-security-policy
frame-ancestors *.translate.goog
cross-origin-opener-policy
unsafe-none
content-encoding
gzip
age
119
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 23 Dec 2024 20:43:58 GMT
x-xss-protection
0
last-modified
Thu, 18 Jul 2024 18:30:17 GMT
content-type
image/svg+xml
server
ESF
att-logo.svg
signin-att-com.translate.goog/static/siam/en/halo_c/images/logos/ 		8 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://signin-att-com.translate.goog/static/siam/en/halo_c/images/logos/att-logo.svg?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp
Requested by
Host: setatt.redirectme.net
URL: https://setatt.redirectme.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
6982fbe858e30068de9301b49438c83838bc7beb058146703b22b701e6709c7e
Security Headers
Name Value
Content-Security-Policy frame-ancestors *.translate.goog
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://setatt.redirectme.net/

Response headers

x-robots-tag
none
content-security-policy
frame-ancestors *.translate.goog
cross-origin-opener-policy
unsafe-none
content-encoding
gzip
age
54398
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 23 Dec 2024 20:43:58 GMT
x-xss-protection
0
last-modified
Thu, 18 Jul 2024 18:30:17 GMT
content-type
image/svg+xml
server
ESF
red-error-icon.svg
signin-att-com.translate.goog/static/siam/en/halo_c/cms/login/default/images/ 		374 B
354 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://signin-att-com.translate.goog/static/siam/en/halo_c/cms/login/default/images/red-error-icon.svg?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp
Requested by
Host: setatt.redirectme.net
URL: https://setatt.redirectme.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
c764ce95343aad98ce57c9f35d78f25b0f07555c0f64c05ee1d589521973fb1d
Security Headers
Name Value
Content-Security-Policy frame-ancestors *.translate.goog
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://setatt.redirectme.net/

Response headers

x-robots-tag
none
content-security-policy
frame-ancestors *.translate.goog
cross-origin-opener-policy
unsafe-none
content-encoding
gzip
age
13273
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 23 Dec 2024 20:43:58 GMT
x-xss-protection
0
last-modified
Tue, 27 Jun 2023 19:40:42 GMT
content-type
image/svg+xml
server
ESF
/
setatt.redirectme.net/ 		14 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://setatt.redirectme.net/
Requested by
Host: setatt.redirectme.net
URL: https://setatt.redirectme.net/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
159.89.103.134 Frankfurt am Main, Germany, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://setatt.redirectme.net/

Response headers

Accept-Ranges
bytes
Content-Length
14077
Date
Mon, 23 Dec 2024 20:43:57 GMT
Last-Modified
Mon, 23 Dec 2024 16:48:05 GMT
Content-Type
text/html
Server
Apache
ATTAleckSans_W_Rg.woff2
signin-att-com.translate.goog/static/siam/en/halo_c/halo-c-login/assets/fonts/att/ATTAleckSans/woff2/ 		0
0
ATTAleckSans_W_Bd.woff2
signin-att-com.translate.goog/static/siam/en/halo_c/halo-c-login/assets/fonts/att/ATTAleckSans/woff2/ 		0
0
ATTAleckSans_W_Bd.woff
signin-att-com.translate.goog/static/siam/en/halo_c/halo-c-login/assets/fonts/att/ATTAleckSans/woff/ 		0
0
ATTAleckSans_W_Rg.woff
signin-att-com.translate.goog/static/siam/en/halo_c/halo-c-login/assets/fonts/att/ATTAleckSans/woff/ 		0
0
favicon.ico
signin-att-com.translate.goog/ 		1 KB
687 B 		Other
General
Check archive.org
Download Go to
Full URL
https://signin-att-com.translate.goog/favicon.ico?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.18.97 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
zrh04s05-in-f97.1e100.net
Software
ESF /
Resource Hash
42938b72e2ec54515eb9c49145f42b8728cfc0b70170f80aef58ce93032b1c1d
Security Headers
Name Value
Content-Security-Policy frame-ancestors *.translate.goog
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://setatt.redirectme.net/

Response headers

x-robots-tag
none
content-security-policy
frame-ancestors *.translate.goog
cross-origin-opener-policy
unsafe-none
content-encoding
gzip
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 23 Dec 2024 20:43:59 GMT
x-xss-protection
0
last-modified
Wed, 29 May 2019 15:07:07 GMT
content-type
image/x-icon
server
ESF

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
signin-att-com.translate.goog
URL
https://signin-att-com.translate.goog/static/siam/en/halo_c/halo-c-login/assets/fonts/att/ATTAleckSans/woff2/ATTAleckSans_W_Rg.woff2
Domain
signin-att-com.translate.goog
URL
https://signin-att-com.translate.goog/static/siam/en/halo_c/halo-c-login/assets/fonts/att/ATTAleckSans/woff2/ATTAleckSans_W_Bd.woff2
Domain
signin-att-com.translate.goog
URL
https://signin-att-com.translate.goog/static/siam/en/halo_c/halo-c-login/assets/fonts/att/ATTAleckSans/woff/ATTAleckSans_W_Bd.woff
Domain
signin-att-com.translate.goog
URL
https://signin-att-com.translate.goog/static/siam/en/halo_c/halo-c-login/assets/fonts/att/ATTAleckSans/woff/ATTAleckSans_W_Rg.woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: AT&T (Telecommunication)

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery

0 Cookies

9 Console Messages

Source Level URL
Text
recommendation verbose URL: https://setatt.redirectme.net/
Message:
[DOM] Password forms should have (optionally hidden) username fields for accessibility: (More info: https://goo.gl/9p2vKq) %o
javascript error URL: https://setatt.redirectme.net/
Message:
Access to font at 'https://signin-att-com.translate.goog/static/siam/en/halo_c/halo-c-login/assets/fonts/att/ATTAleckSans/woff2/ATTAleckSans_W_Bd.woff2' from origin 'https://setatt.redirectme.net' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://signin-att-com.translate.goog/static/siam/en/halo_c/halo-c-login/assets/fonts/att/ATTAleckSans/woff2/ATTAleckSans_W_Bd.woff2
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://setatt.redirectme.net/
Message:
Access to font at 'https://signin-att-com.translate.goog/static/siam/en/halo_c/halo-c-login/assets/fonts/att/ATTAleckSans/woff2/ATTAleckSans_W_Rg.woff2' from origin 'https://setatt.redirectme.net' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://signin-att-com.translate.goog/static/siam/en/halo_c/halo-c-login/assets/fonts/att/ATTAleckSans/woff2/ATTAleckSans_W_Rg.woff2
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://setatt.redirectme.net/
Message:
Access to font at 'https://signin-att-com.translate.goog/static/siam/en/halo_c/halo-c-login/assets/fonts/att/ATTAleckSans/woff/ATTAleckSans_W_Rg.woff' from origin 'https://setatt.redirectme.net' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://signin-att-com.translate.goog/static/siam/en/halo_c/halo-c-login/assets/fonts/att/ATTAleckSans/woff/ATTAleckSans_W_Rg.woff
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://setatt.redirectme.net/
Message:
Access to font at 'https://signin-att-com.translate.goog/static/siam/en/halo_c/halo-c-login/assets/fonts/att/ATTAleckSans/woff/ATTAleckSans_W_Bd.woff' from origin 'https://setatt.redirectme.net' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://signin-att-com.translate.goog/static/siam/en/halo_c/halo-c-login/assets/fonts/att/ATTAleckSans/woff/ATTAleckSans_W_Bd.woff
Message:
Failed to load resource: net::ERR_FAILED