atacadaodostoldos.com.br Open in urlscan Pro
162.214.102.75 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://atacadaodostoldos.com.br/wp1
Effective URL:
https://atacadaodostoldos.com.br/wp1/c89768d34e1d6924651787270/
Submission: On August 30 via manual (August 30th 2021, 1:33:25 pm UTC) from US

Summary HTTP 8 Redirects Links 9 Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 8 HTTP transactions. The main IP is 162.214.102.75, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is atacadaodostoldos.com.br.
TLS certificate: Issued by R3 on July 21st 2021. Valid for: 3 months.

This is the only time atacadaodostoldos.com.br was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: AT&T (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
3 4	162.214.102.75 162.214.102.75	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
5	144.160.19.173 144.160.19.173	797 (AMERITECH-AS) (AMERITECH-AS)
2	144.161.77.194 144.161.77.194	797 (AMERITECH-AS) (AMERITECH-AS)
8	3

4 162.214.102.75 (United States) 3 redirects

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: dedi-4885351.saudehoje.app

atacadaodostoldos.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 144.160.19.173 (United States)

ASN797 (AMERITECH-AS, US)

signin.att.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 144.161.77.194 (United States)

ASN797 (AMERITECH-AS, US)

managed.att.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	att.com signin.att.com managed.att.com	83 KB
4	atacadaodostoldos.com.br 3 redirects atacadaodostoldos.com.br	229 KB
8	2

	Domain	Requested by
5	signin.att.com	atacadaodostoldos.com.br signin.att.com
4	atacadaodostoldos.com.br	3 redirects
2	managed.att.com	atacadaodostoldos.com.br
8	3

This site contains links to these domains. Also see Links.

Domain
identity.att.com
m.att.com
www.att.com
about.att.com

Subject Issuer	Validity	Valid
atacadaodostoldos.com.br R3	`2021-07-21` - `2021-10-19`	3 months	crt.sh
*.att.com DigiCert SHA2 Secure Server CA	`2020-12-16` - `2021-12-20`	a year	crt.sh
managed.att.com DigiCert SHA2 Secure Server CA	`2021-03-17` - `2022-04-17`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://atacadaodostoldos.com.br/wp1/c89768d34e1d6924651787270/
Frame ID: A73CBC4B586CD9EA4A9FAFEE02E6958C
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login Screen

Page URL History Show full URLs

https://atacadaodostoldos.com.br/wp1 HTTP 301
https://atacadaodostoldos.com.br/wp1/ HTTP 302
https://atacadaodostoldos.com.br/wp1/c89768d34e1d6924651787270 HTTP 301
https://atacadaodostoldos.com.br/wp1/c89768d34e1d6924651787270/ Page URL

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

3
IPs

1
Countries

311 kB
Transfer

430 kB
Size

2
Cookies

9 Outgoing links

These are links going to different origins than the main page.

URL: https://identity.att.com/identity-ui/fid/lander?origination_point=tguard&trid=a1d3343af7c2e602d940e2c4afb97e273196e374&appName=aaid_client&Return_URL=https%3A%2F%2Foidc.idp.clogin.att.com%2Fmga%2Fsps%2Foauth%2Foauth20%2Fauthorize%3Fnonce%3DmDfI0vJz2a%26redirect_uri%3Dhttps%253A%252F%252Fcaaid.att.com%252Fisam%252Fsps%252Foidc%252Frp%252Fconsumerfed%252Fredirect%252Faaidpartner%26response_mode%3Dform_post%26alt_dest%3Dhttps%25253A%25252F%25252Fcaaid.att.com%25252FiamLRR%25252Fheaderdump.jsp%26scope%3Dopenid%26response_type%3Did_token%26state%3DSSXelNO1ap%26client_id%3Daaid_client&Cancel_URL=https%3A%2F%2Foidc.idp.clogin.att.com%2Fmga%2Fsps%2Foauth%2Foauth20%2Fauthorize%3Fnonce%3DmDfI0vJz2a%26redirect_uri%3Dhttps%253A%252F%252Fcaaid.att.com%252Fisam%252Fsps%252Foidc%252Frp%252Fconsumerfed%252Fredirect%252Faaidpartner%26response_mode%3Dform_post%26alt_dest%3Dhttps%25253A%25252F%25252Fcaaid.att.com%25252FiamLRR%25252Fheaderdump.jsp%26scope%3Dopenid%26response_type%3Did_token%26state%3DSSXelNO1ap%26client_id%3Daaid_client&lang=en-us
Title: Forgot user ID?

Search URL Search Domain Scan URL

URL: https://identity.att.com/identity-ui/fpwd/lander?origination_point=tguard&trid=a1d3343af7c2e602d940e2c4afb97e273196e374&appName=aaid_client&Return_URL=https%3A%2F%2Foidc.idp.clogin.att.com%2Fmga%2Fsps%2Foauth%2Foauth20%2Fauthorize%3Fnonce%3DmDfI0vJz2a%26redirect_uri%3Dhttps%253A%252F%252Fcaaid.att.com%252Fisam%252Fsps%252Foidc%252Frp%252Fconsumerfed%252Fredirect%252Faaidpartner%26response_mode%3Dform_post%26alt_dest%3Dhttps%25253A%25252F%25252Fcaaid.att.com%25252FiamLRR%25252Fheaderdump.jsp%26scope%3Dopenid%26response_type%3Did_token%26state%3DSSXelNO1ap%26client_id%3Daaid_client&Cancel_URL=https%3A%2F%2Foidc.idp.clogin.att.com%2Fmga%2Fsps%2Foauth%2Foauth20%2Fauthorize%3Fnonce%3DmDfI0vJz2a%26redirect_uri%3Dhttps%253A%252F%252Fcaaid.att.com%252Fisam%252Fsps%252Foidc%252Frp%252Fconsumerfed%252Fredirect%252Faaidpartner%26response_mode%3Dform_post%26alt_dest%3Dhttps%25253A%25252F%25252Fcaaid.att.com%25252FiamLRR%25252Fheaderdump.jsp%26scope%3Dopenid%26response_type%3Did_token%26state%3DSSXelNO1ap%26client_id%3Daaid_client&lang=en-us
Title: Forgot password?

Search URL Search Domain Scan URL

URL: https://m.att.com/my/#/welcome?origination_point=tguard&Return_URL=https%3A%2F%2Foidc.idp.clogin.att.com%2Fmga%2Fsps%2Foauth%2Foauth20%2Fauthorize%3Fnonce%3DmDfI0vJz2a%26redirect_uri%3Dhttps%253A%252F%252Fcaaid.att.com%252Fisam%252Fsps%252Foidc%252Frp%252Fconsumerfed%252Fredirect%252Faaidpartner%26response_mode%3Dform_post%26alt_dest%3Dhttps%25253A%25252F%25252Fcaaid.att.com%25252FiamLRR%25252Fheaderdump.jsp%26scope%3Dopenid%26response_type%3Did_token%26state%3DSSXelNO1ap%26client_id%3Daaid_client&Cancel_URL=https%3A%2F%2Foidc.idp.clogin.att.com%2Fmga%2Fsps%2Foauth%2Foauth20%2Fauthorize%3Fnonce%3DmDfI0vJz2a%26redirect_uri%3Dhttps%253A%252F%252Fcaaid.att.com%252Fisam%252Fsps%252Foidc%252Frp%252Fconsumerfed%252Fredirect%252Faaidpartner%26response_mode%3Dform_post%26alt_dest%3Dhttps%25253A%25252F%25252Fcaaid.att.com%25252FiamLRR%25252Fheaderdump.jsp%26scope%3Dopenid%26response_type%3Did_token%26state%3DSSXelNO1ap%26client_id%3Daaid_client
Title: Create one now

Search URL Search Domain Scan URL

URL: https://www.att.com/support/article/wireless/KM1375558/
Title: Learn about ZenKey

Search URL Search Domain Scan URL

URL: https://www.att.com/legal/legal-policy-center.html
Title: Legal policy center

Search URL Search Domain Scan URL

URL: https://about.att.com/sites/privacy_policy
Title: Privacy policy

Search URL Search Domain Scan URL

URL: https://www.att.com/legal/terms.attWebsiteTermsOfUse.html
Title: Terms of use

Search URL Search Domain Scan URL

URL: https://www.att.com/features/accessibility.html
Title: Accessibility

Search URL Search Domain Scan URL

URL: https://about.att.com/csr/home/privacy/rights_choices.html
Title: Do not sell my personal information

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://atacadaodostoldos.com.br/wp1 HTTP 301
https://atacadaodostoldos.com.br/wp1/ HTTP 302
https://atacadaodostoldos.com.br/wp1/c89768d34e1d6924651787270 HTTP 301
https://atacadaodostoldos.com.br/wp1/c89768d34e1d6924651787270/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
atacadaodostoldos.com.br/wp1/c89768d34e1d6924651787270/
Redirect Chain

https://atacadaodostoldos.com.br/wp1
https://atacadaodostoldos.com.br/wp1/
https://atacadaodostoldos.com.br/wp1/c89768d34e1d6924651787270
https://atacadaodostoldos.com.br/wp1/c89768d34e1d6924651787270/

228 KB
229 KB

204ms
203ms

Document
text/html

162.214.102.75
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: https://atacadaodostoldos.com.br/wp1/c89768d34e1d6924651787270/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 162.214.102.75 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: dedi-4885351.saudehoje.app
Software: Apache /
Resource Hash: efc5060bdfa9560b936d0c9bfc128f578abb66c77ebc9e3da3c0a4206b3b1b52

Request headers

Host: atacadaodostoldos.com.br
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Mon, 30 Aug 2021 13:33:06 GMT
Server: Apache
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Mon, 30 Aug 2021 13:33:06 GMT
Server: Apache
Location: https://atacadaodostoldos.com.br/wp1/c89768d34e1d6924651787270/
Content-Length: 271
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK timeout.js Show response
signin.att.com/static/siam/en/halo_c/timeout_redirect/ 1 KB
851 B 738ms
150ms Script
application/javascript 144.160.19.173
AMERITECH-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://signin.att.com/static/siam/en/halo_c/timeout_redirect/timeout.js?v=11.5.3

Requested by

Host: atacadaodostoldos.com.br
URL: https://atacadaodostoldos.com.br/wp1/c89768d34e1d6924651787270/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

144.160.19.173 , United States, ASN797 (AMERITECH-AS, US),

Reverse DNS

Software

Resource Hash

83f5ed17f46cd4448a02c705214a95e869ecb411c8ea95e1256593c75e178e56

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://atacadaodostoldos.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 30 Aug 2021 13:33:08 GMT
content-encoding: gzip
last-modified: Wed, 25 Aug 2021 19:29:39 GMT
etag: "430-5ca6745708ec0"
x-frame-options: SAMEORIGIN
iam_on: 95
p3p: CP="NON CUR OTPi OUR NOR UNI"
access-control-allow-origin: *
transfer-encoding: chunked
strict-transport-security: max-age=31536000; includeSubDomains; preload
accept-ranges: bytes
content-type: application/javascript
apser: p770

GET
H/1.1 200
OK styles.css
signin.att.com/static/siam/en/halo_c/halo-c-login/ 154 KB
33 KB 741ms
158ms Stylesheet
text/css 144.160.19.173
AMERITECH-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://signin.att.com/static/siam/en/halo_c/halo-c-login/styles.css?v=11.5.3

Requested by

Host: atacadaodostoldos.com.br
URL: https://atacadaodostoldos.com.br/wp1/c89768d34e1d6924651787270/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

144.160.19.173 , United States, ASN797 (AMERITECH-AS, US),

Reverse DNS

Software

Resource Hash

949412be812344238cfda8c907b5cb0e34594811efaa65432e2e2e1401687ecf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://atacadaodostoldos.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 30 Aug 2021 13:33:08 GMT
content-encoding: gzip
last-modified: Wed, 25 Aug 2021 19:29:39 GMT
etag: "2674d-5ca6745708ec0"
x-frame-options: SAMEORIGIN
iam_on: 95
p3p: CP="NON CUR OTPi OUR NOR UNI"
access-control-allow-origin: *
transfer-encoding: chunked
strict-transport-security: max-age=31536000; includeSubDomains; preload
accept-ranges: bytes
content-type: text/css
apser: p771

GET
H/1.1 200
OK att-logo.svg
signin.att.com/static/siam/en/halo_c/images/logos/ 8 KB
9 KB 151ms
150ms Image
image/svg+xml 144.160.19.173
AMERITECH-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://signin.att.com/static/siam/en/halo_c/images/logos/att-logo.svg

Requested by

Host: atacadaodostoldos.com.br
URL: https://atacadaodostoldos.com.br/wp1/c89768d34e1d6924651787270/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

144.160.19.173 , United States, ASN797 (AMERITECH-AS, US),

Reverse DNS

Software

Resource Hash

6982fbe858e30068de9301b49438c83838bc7beb058146703b22b701e6709c7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://atacadaodostoldos.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 30 Aug 2021 13:33:08 GMT
last-modified: Wed, 25 Aug 2021 19:29:39 GMT
etag: "20b1-5ca6745708ec0"
x-frame-options: SAMEORIGIN
iam_on: 95
p3p: CP="NON CUR OTPi OUR NOR UNI"
access-control-allow-origin: *
strict-transport-security: max-age=31536000; includeSubDomains; preload
accept-ranges: bytes
content-type: image/svg+xml
apser: p766
content-length: 8369

GET
H/1.1 200
OK ATTAleckSans_W_Rg.woff2
signin.att.com/static/siam/en/halo_c/halo-c-login/assets/fonts/att/ATTAleckSans/woff2/ 18 KB
18 KB 608ms
150ms Font
application/octet-stream 144.160.19.173
AMERITECH-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://signin.att.com/static/siam/en/halo_c/halo-c-login/assets/fonts/att/ATTAleckSans/woff2/ATTAleckSans_W_Rg.woff2

Requested by

Host: signin.att.com
URL: https://signin.att.com/static/siam/en/halo_c/halo-c-login/styles.css?v=11.5.3

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

144.160.19.173 , United States, ASN797 (AMERITECH-AS, US),

Reverse DNS

Software

Resource Hash

e2740c7b209e33aca7176250d80f94b4924e5e5d18076ee3b95f32a0e20d1f58

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Request headers

Origin: https://atacadaodostoldos.com.br
Referer: https://signin.att.com/static/siam/en/halo_c/halo-c-login/styles.css?v=11.5.3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 30 Aug 2021 13:33:09 GMT
last-modified: Wed, 25 Aug 2021 19:29:39 GMT
etag: "4830-5ca6745708ec0"
x-frame-options: SAMEORIGIN
iam_on: 95
p3p: CP="NON CUR OTPi OUR NOR UNI"
access-control-allow-origin: *
strict-transport-security: max-age=31536000; includeSubDomains; preload
accept-ranges: bytes
apser: p770
content-length: 18480

GET
H/1.1 200
OK ATTAleckSans_W_Md.woff2
signin.att.com/static/siam/en/halo_c/halo-c-login/assets/fonts/att/ATTAleckSans/woff2/ 19 KB
19 KB 612ms
148ms Font
application/octet-stream 144.160.19.173
AMERITECH-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://signin.att.com/static/siam/en/halo_c/halo-c-login/assets/fonts/att/ATTAleckSans/woff2/ATTAleckSans_W_Md.woff2

Requested by

Host: signin.att.com
URL: https://signin.att.com/static/siam/en/halo_c/halo-c-login/styles.css?v=11.5.3

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

144.160.19.173 , United States, ASN797 (AMERITECH-AS, US),

Reverse DNS

Software

Resource Hash

59ea63b5ffe0f060e37c24a44b6406943df9e4fca39e2ef43023c2ae9783f220

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Request headers

Origin: https://atacadaodostoldos.com.br
Referer: https://signin.att.com/static/siam/en/halo_c/halo-c-login/styles.css?v=11.5.3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 30 Aug 2021 13:33:09 GMT
last-modified: Wed, 25 Aug 2021 19:29:39 GMT
etag: "4c8c-5ca6745708ec0"
x-frame-options: SAMEORIGIN
iam_on: 95
p3p: CP="NON CUR OTPi OUR NOR UNI"
access-control-allow-origin: *
strict-transport-security: max-age=31536000; includeSubDomains; preload
accept-ranges: bytes
apser: p766
content-length: 19596

POST
H/1.1 200
OK 5058f9a1-d426-4412-9328-8a4d87697dee Show response
managed.att.com/bf/ 1 KB
1 KB 798ms
201ms XHR
text/plain 144.161.77.194
AMERITECH-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://managed.att.com/bf/5058f9a1-d426-4412-9328-8a4d87697dee?dtCookie=null;referer=https%3A%2F%2Fatacadaodostoldos.com.br%2Fwp1%2Fc89768d34e1d6924651787270%2F;visitID=FUQJNTFCQCCEGFBDFHOUGDGHVFOPVURH-0;app=52b8119d19be9235;crc=1473798811;end=1
Requested by: Host: atacadaodostoldos.com.br
URL: https://atacadaodostoldos.com.br/wp1/c89768d34e1d6924651787270/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 144.161.77.194 , United States, ASN797 (AMERITECH-AS, US),
Reverse DNS
Software: /
Resource Hash: e6575d118e9186578cde8479ae7651873daf5e9daee8115a384486a2b3ac3423

Request headers

Referer: https://atacadaodostoldos.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin: https://atacadaodostoldos.com.br
Date: Mon, 30 Aug 2021 13:33:11 GMT
Cache-Control: no-cache
Content-Length: 1060
Content-Type: text/plain;charset=utf-8

POST
H/1.1 200
OK 5058f9a1-d426-4412-9328-8a4d87697dee Show response
managed.att.com/bf/ 1 KB
1 KB 198ms
197ms XHR
text/plain 144.161.77.194
AMERITECH-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://managed.att.com/bf/5058f9a1-d426-4412-9328-8a4d87697dee?dtCookie=null;referer=https%3A%2F%2Fatacadaodostoldos.com.br%2Fwp1%2Fc89768d34e1d6924651787270%2F;visitID=FUQJNTFCQCCEGFBDFHOUGDGHVFOPVURH-0;app=52b8119d19be9235;crc=4272797034;end=1
Requested by: Host: atacadaodostoldos.com.br
URL: https://atacadaodostoldos.com.br/wp1/c89768d34e1d6924651787270/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 144.161.77.194 , United States, ASN797 (AMERITECH-AS, US),
Reverse DNS
Software: /
Resource Hash: f6560d7223b56bdaf817b9ff86d1be084b8603500e34dd15bbadbdbfdd561af3

Request headers

Referer: https://atacadaodostoldos.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin: https://atacadaodostoldos.com.br
Date: Mon, 30 Aug 2021 13:33:12 GMT
Cache-Control: no-cache
Content-Length: 1060
Content-Type: text/plain;charset=utf-8

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: AT&T (Telecommunication)

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.atacadaodostoldos.com.br/	1969-12-31 23:59:59	Name: dtPC Value: -16$130387774_214h1vFUQJNTFCQCCEGFBDFHOUGDGHVFOPVURH-0e1
			.atacadaodostoldos.com.br/	1969-12-31 23:59:59	Name: rxvt Value: 1630332189459\|1630330387789

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

atacadaodostoldos.com.br
managed.att.com
signin.att.com
144.160.19.173
144.161.77.194
162.214.102.75
59ea63b5ffe0f060e37c24a44b6406943df9e4fca39e2ef43023c2ae9783f220
6982fbe858e30068de9301b49438c83838bc7beb058146703b22b701e6709c7e
83f5ed17f46cd4448a02c705214a95e869ecb411c8ea95e1256593c75e178e56
949412be812344238cfda8c907b5cb0e34594811efaa65432e2e2e1401687ecf
e2740c7b209e33aca7176250d80f94b4924e5e5d18076ee3b95f32a0e20d1f58
e6575d118e9186578cde8479ae7651873daf5e9daee8115a384486a2b3ac3423
efc5060bdfa9560b936d0c9bfc128f578abb66c77ebc9e3da3c0a4206b3b1b52
f6560d7223b56bdaf817b9ff86d1be084b8603500e34dd15bbadbdbfdd561af3

atacadaodostoldos.com.br Open in urlscan Pro 162.214.102.75 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

8 Requests

100 %HTTPS

0 %IPv6

2 Domains

3 Subdomains

3 IPs

1 Countries

311 kBTransfer

430 kBSize

2 Cookies

9 Outgoing links

Page URL History

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

17 JavaScript Global Variables

2 Cookies

Indicators

atacadaodostoldos.com.br Open in urlscan Pro
162.214.102.75 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

3
IPs

1
Countries

311 kB
Transfer

430 kB
Size

2
Cookies

8 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!