englishstudio.ir
Open in
urlscan Pro
212.33.195.90
Malicious Activity!
Public Scan
Submission: On May 17 via manual from TH
Summary
This is the only time englishstudio.ir was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: AT&T (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 3 | 212.33.195.90 212.33.195.90 | 43754 (ASIATECH) (ASIATECH) | |
17 | 144.160.36.70 144.160.36.70 | 797 (AMERITECH-AS) (AMERITECH-AS) | |
1 | 69.168.106.86 69.168.106.86 | 36271 (SYNACOR-C...) (SYNACOR-CLUSTER) | |
2 | 2a02:26f0:6c0... 2a02:26f0:6c00:2b5::2db1 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 3 | 142.250.181.226 142.250.181.226 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:812::2002 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2a00:1450:400... 2a00:1450:4001:80e::2002 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:82f::2001 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:802::2001 | 15169 (GOOGLE) (GOOGLE) | |
30 | 10 |
ASN43754 (ASIATECH, IR)
PTR: cloud247.mizbanfadns.net
englishstudio.ir |
ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f2.1e100.net
securepubads.g.doubleclick.net |
ASN15169 (GOOGLE, US)
pagead2.googlesyndication.com |
ASN15169 (GOOGLE, US)
adservice.google.de | |
adservice.google.com |
ASN15169 (GOOGLE, US)
a0be2bf9f31ea913bfad16eebb722b76.safeframe.googlesyndication.com |
ASN15169 (GOOGLE, US)
tpc.googlesyndication.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
17 |
att.net
home.secureapp.att.net |
220 KB |
3 |
googlesyndication.com
pagead2.googlesyndication.com a0be2bf9f31ea913bfad16eebb722b76.safeframe.googlesyndication.com tpc.googlesyndication.com |
6 KB |
3 |
doubleclick.net
1 redirects
securepubads.g.doubleclick.net |
129 KB |
3 |
englishstudio.ir
1 redirects
englishstudio.ir |
3 KB |
2 |
att.com
www.att.com |
|
1 |
google.com
adservice.google.com |
553 B |
1 |
google.de
adservice.google.de |
799 B |
1 |
synacor.com
sadlib.static-app.synacor.com |
114 KB |
30 | 8 |
Domain | Requested by | |
---|---|---|
17 | home.secureapp.att.net |
englishstudio.ir
home.secureapp.att.net |
3 | securepubads.g.doubleclick.net |
1 redirects
englishstudio.ir
securepubads.g.doubleclick.net |
3 | englishstudio.ir |
1 redirects
englishstudio.ir
|
2 | www.att.com |
englishstudio.ir
|
1 | tpc.googlesyndication.com |
securepubads.g.doubleclick.net
|
1 | a0be2bf9f31ea913bfad16eebb722b76.safeframe.googlesyndication.com |
securepubads.g.doubleclick.net
|
1 | adservice.google.com |
securepubads.g.doubleclick.net
|
1 | adservice.google.de |
securepubads.g.doubleclick.net
|
1 | pagead2.googlesyndication.com |
securepubads.g.doubleclick.net
|
1 | sadlib.static-app.synacor.com |
englishstudio.ir
|
30 | 10 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.att.net |
www.att.com |
watch.att.com |
envivo.att.yahoo.com |
attreg.att.net |
about.att.com |
www.xandr.com |
survey.foreseeresults.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
home.secureapp.att.net DigiCert SHA2 Secure Server CA |
2020-07-10 - 2022-09-17 |
2 years | crt.sh |
*.g.doubleclick.net GTS CA 1C3 |
2021-04-13 - 2021-07-06 |
3 months | crt.sh |
*.google.com GTS CA 1O1 |
2021-04-13 - 2021-07-06 |
3 months | crt.sh |
tpc.googlesyndication.com GTS CA 1C3 |
2021-04-13 - 2021-07-06 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://englishstudio.ir/layout/
Frame ID: 98F0AEDF97ED39C3952A4A5E4F289FB5
Requests: 30 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://englishstudio.ir/layout
HTTP 301
http://englishstudio.ir/layout/ Page URL
Detected technologies
Google AdSense (Advertising Networks) ExpandDetected patterns
- script /googlesyndication\.com\//i
Webtrends (Analytics) Expand
Detected patterns
- html /<img[^>]+id="DCSIMG"[^>]+webtrends/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery[.-]([\d.]*\d)[^/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
15 Outgoing links
These are links going to different origins than the main page.
Title: att.net
Search URL Search Domain Scan URL
Title: att.com
Search URL Search Domain Scan URL
Title: uverse.com
Search URL Search Domain Scan URL
Title: En Español
Search URL Search Domain Scan URL
Title: AT&T Support
Search URL Search Domain Scan URL
Title: Learn about shared passwords for AT&T email.
Search URL Search Domain Scan URL
Title: Forgot User ID?
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: Terms
Search URL Search Domain Scan URL
Title: Privacy
Search URL Search Domain Scan URL
Title: Advertise
Search URL Search Domain Scan URL
Title: Advertising Choices
Search URL Search Domain Scan URL
Title: Acceptable Use Policy
Search URL Search Domain Scan URL
Title: Feedback
Search URL Search Domain Scan URL
Title: © 2020 AT&T Intellectual Property
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://englishstudio.ir/layout
HTTP 301
http://englishstudio.ir/layout/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 20- http://securepubads.g.doubleclick.net/tag/js/gpt.js HTTP 301
- https://securepubads.g.doubleclick.net/tag/js/gpt.js
30 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
englishstudio.ir/layout/ Redirect Chain
|
8 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
_fontface.css
home.secureapp.att.net/css/sso/slid/1201/ |
0 960 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
main.css
home.secureapp.att.net/css/sso/slid/1201/ |
28 KB 29 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-1.5.1.min.js
home.secureapp.att.net/js/jquery/ |
83 KB 84 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery.simplemodal.js
home.secureapp.att.net/js/jquery/simplemodal/ |
9 KB 10 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
script.js
home.secureapp.att.net/js/sso/slid/1201/ |
53 KB 54 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
att.js
sadlib.static-app.synacor.com/client/att/ |
378 KB 114 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
satelliteLib-bee1ce9b89e943a46b1dfd167adc564fe75eef37.js
www.att.com/scripts/satellite/prod/8bb7555f31d461fe2aef4e2d53a11a03e7f9a04c/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Button.png
home.secureapp.att.net/design/CDLS10/img/logos/ |
2 KB 3 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
AT&T_logo.png
home.secureapp.att.net/design/CDLS10/img/logos/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
mobile.css
home.secureapp.att.net/css/sso/slid/1201/ |
4 KB 5 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
satelliteLib-bee1ce9b89e943a46b1dfd167adc564fe75eef37.js
www.att.com/scripts/satellite/prod/8bb7555f31d461fe2aef4e2d53a11a03e7f9a04c/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
webtrends.min.js
englishstudio.ir/commonLogin/igate_edam/staticContent/images/SLID/js/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
pageBg.png
home.secureapp.att.net/design/cdls10/img/ui/ |
169 B 1001 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
btnSumbit.png
home.secureapp.att.net/img/sso/slid/ |
1 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
footerBg.png
home.secureapp.att.net/design/CDLS10/img/ui/ |
560 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
attGlobalNavHeader-bg.gif
home.secureapp.att.net/design/cdls20/img/ui/ |
149 B 981 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
att_globe_blue_80x80.png
home.secureapp.att.net/design/CDLS10/img/logos/ |
16 KB 17 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
support-icon.jpg
home.secureapp.att.net/img/sso/slid/ |
2 KB 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
txt-clear.png
home.secureapp.att.net/img/sso/slid/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ques.png
home.secureapp.att.net/img/sso/slid/ |
363 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gpt.js
securepubads.g.doubleclick.net/tag/js/ Redirect Chain
|
63 KB 21 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
pubads_impl_2021051301.js
securepubads.g.doubleclick.net/gpt/ |
306 KB 108 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
context.dll
home.secureapp.att.net/attportal/s/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
show_companion_ad.js
pagead2.googlesyndication.com/pagead/ |
14 KB 6 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
integrator.js
adservice.google.de/adsid/ |
107 B 799 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
integrator.js
adservice.google.com/adsid/ |
107 B 553 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
ads
securepubads.g.doubleclick.net/gampad/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
container.html
a0be2bf9f31ea913bfad16eebb722b76.safeframe.googlesyndication.com/safeframe/1-0-38/html/ |
0 0 |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
container.html
tpc.googlesyndication.com/safeframe/1-0-38/html/ |
0 0 |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- securepubads.g.doubleclick.net
- URL
- https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=665067475212283&correlator=2949593619258581&output=ldjh&impl=fifs&eid=31060841%2C31061163&vrg=2021051301&ptt=17&sc=0&sfv=1-0-38&ecs=20210517&iu_parts=5284%2Csyn.att%2Clogin&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=1440x1024%7C1440x800%7C300x250%7C300x600&prev_scp=ar%3D0&cookie_enabled=1&bc=23&abxe=1&lmt=1621263418&dt=1621263418959&dlt=1621263416169&idt=1727&frm=20&biw=1600&bih=1200&oid=3&adxs=80&adys=112&adks=3592017840&ucis=1&ifi=1&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=http%3A%2F%2Fenglishstudio.ir%2Flayout%2F&vis=1&scr_x=0&scr_y=0&psz=1440x-1&msz=1440x-1&ga_vid=1331976521.1621263419&ga_sid=1621263419&ga_hid=1162922222&ga_fc=false&fws=4&ohw=1440&btvi=0
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: AT&T (Telecommunication)65 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| antiClickjack undefined| noFrameBusting function| $ function| jQuery string| agent string| ORIGINATION_POINT_URL string| RETURN_URL string| CANCEL_URL function| getWindowWidth function| getWindowHeight function| GetURLParameter function| setRegURL function| logPgvw function| refer function| submitForm function| trimAll function| chkTick function| unchkTick function| getElementsByClassName function| btnChange function| acctSelBtnEnable function| ie6Img function| getYadContents function| init undefined| countdownElement function| overlay function| cancelLoad function| Redirecturl string| focusableElementsString function| trapTabKey function| supportRedirect function| webtrendsAsyncInit string| q1Zidx string| q2Zidx object| Sadlib_Config object| TN8 object| SW_Config object| rubicontag object| googletag object| Sadlib object| SynDetectPii object| sadlib object| ggeac object| google_js_reporting_queue function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter undefined| google_measure_js_timing number| google_srt function| googleCompanionsServicePresent function| googleGetCompanionAdSlots function| googleSetCompanionAdContents function| google_companion_error object| googleToken object| googleIMState function| processGoogleToken number| __google_ad_urls_id number| google_unique_id object| gaGlobal0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
a0be2bf9f31ea913bfad16eebb722b76.safeframe.googlesyndication.com
adservice.google.com
adservice.google.de
englishstudio.ir
home.secureapp.att.net
pagead2.googlesyndication.com
sadlib.static-app.synacor.com
securepubads.g.doubleclick.net
tpc.googlesyndication.com
www.att.com
securepubads.g.doubleclick.net
142.250.181.226
144.160.36.70
212.33.195.90
2a00:1450:4001:802::2001
2a00:1450:4001:80e::2002
2a00:1450:4001:812::2002
2a00:1450:4001:82f::2001
2a02:26f0:6c00:2b5::2db1
69.168.106.86
01a7e22fd83c617ff55898233518c54a9ecce7e0de3e8a63c4fa59315b029c6b
1c592a51351836456628c2cb9a7dd86d41257d821f8926b137c8f5c63aaf0ca3
1cc81f7d815f47fc37a1970647c509ff7526cd82ce07a1d1ad5eec4d95989708
27da51ec2023f96407f92161ddda0e290b0661a765822ff03e5d61f3aecf8aa0
4a50fbdd6f9e85373e2b7a39749dc8bd5a324608f1e74a4c203479d4f30e7db3
4bdcba71062ad849da6c41bb9130977f59af71c1b82e4c397b193469ece62ad6
5fd69c4fa9f1a2a6fbdab11ff45053dbd08237e6190dfc9c071fadd08fe9b7d5
601f450bfc37544f6ebbdcbecf66d18121b3a6c99ff9ab31994769f1b08f6e86
61e91515aaf72cba3014a136331a138eca6b27831c8f2e6b0c128825243f5263
70b5a6613f03d3c015d826185e39839e6dbc2d03871f151bafbed5cc58503f69
764b9e9f3ad386aaa5cdeae9368353994de61c0bede087c8f7e3579cb443de3b
8e6ec1efd720fba57823309829b05bb57ebb5716c813c88b3c88cf36ab9aa5e9
9880eb5b6a6b1dec8f568c14a1a5be755c460d2ea2df66fa7b5e6b99227f7128
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5182fbd8bbbbc358b704a5a070ffad58bd079b7800803935d9e3b2b8b9c5d87
a8c89bb3937cdc4a70b3568eae5a390d918433be78f89deba07846932ae7c695
ba137ccbea3ce6b2fa1a0db924782ea2a42597b4d196aa2b8ab7628580330c9c
c537cf7e2770d1b4953255dfccff8e0bdbfd4adb4e88d868e353208ae7ff13c1
c8b5d984e6d2cdaf64b8a50c9b645e347e74ffa712aa0b9422015700c98f9bb9
dfa35aa4643a991e1d2ec6e3562e1a0465174c7200a7572c92619904bb08530f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fdee766a03e4032897a2cd75326c135d8e938592bfb00f12ed5b4eb223f54c3f