www.gunind.com Open in urlscan Pro
89.252.130.99 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.gunind.com/silinecek/shop/image/att/login.html
Submission: On January 16 via automatic, source openphish (January 16th 2021, 1:21:28 am UTC)

Summary HTTP 12 Redirects Links 8 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 12 HTTP transactions. The main IP is 89.252.130.99, located in Turkey and belongs to NETINTERNET Netinternet Bilisim Teknolojileri AS, TR. The main domain is www.gunind.com.
TLS certificate: Issued by R3 on December 23rd 2020. Valid for: 3 months.

This is the only time www.gunind.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: AT&T (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
11	89.252.130.99 89.252.130.99	51559 (NETINTERN...) (NETINTERNET Netinternet Bilisim Teknolojileri AS)
1	144.160.125.207 144.160.125.207	797 (AMERITECH-AS) (AMERITECH-AS)
12	3

11 89.252.130.99 (Turkey)

ASN51559 (NETINTERNET Netinternet Bilisim Teknolojileri AS, TR)
PTR: server.fikirisler.com

www.gunind.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 144.160.125.207 (United States)

ASN797 (AMERITECH-AS, US)
PTR: clcontent-da.att.com

signin.att.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	gunind.com www.gunind.com	207 KB
1	att.com signin.att.com	9 KB
12	2

	Domain	Requested by
11	www.gunind.com	www.gunind.com
1	signin.att.com	www.gunind.com
12	2

This site contains links to these domains. Also see Links.

Domain
www.att.com
about.att.com

Subject Issuer	Validity	Valid
gunind.com R3	`2020-12-23` - `2021-03-23`	3 months	crt.sh
*.att.com DigiCert SHA2 Secure Server CA	`2020-12-16` - `2021-12-20`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.gunind.com/silinecek/shop/image/att/login.html
Frame ID: B0B3E7DA078C67220DDEC924B08B4D66
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Angular (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<[^>]+ ng-version="([\d.]+)"/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

12
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

215 kB
Transfer

843 kB
Size

3
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: https://www.att.com/acctmgmt/fid/lander?origination_point=tguard&Return_URL=https%3A%2F%2Foidc.idp.clogin.att.com%2Fmga%2Fsps%2Foauth%2Foauth20%2Fauthorize%3Fnonce%3DTifUvuLe2x%26redirect_uri%3Dhttps%3A%2F%2Fwww.att.com%2Fisam%2Fsps%2Foidc%2Frp%2Fconsumerfed%2Fredirect%2FolamOP%26alt_dest%3Dhttps%25253A%25252F%25252Fwww.att.com%25252Fmyatt%25252Flgn%25252Fresources%25252Fauth%25252Flogin%25252Fhaloc%25252Fgoto-login%25253Ffrom%25253Dsignin%26scope%3Dopenid%2520authenticationTypes%26response_type%3Did_token%26response_mode%3Dform_post%26state%3DKuSuXN4ZZD%26client_id%3Dm10707&Cancel_URL=https%3A%2F%2Foidc.idp.clogin.att.com%2Fmga%2Fsps%2Foauth%2Foauth20%2Fauthorize%3Fnonce%3DTifUvuLe2x%26redirect_uri%3Dhttps%3A%2F%2Fwww.att.com%2Fisam%2Fsps%2Foidc%2Frp%2Fconsumerfed%2Fredirect%2FolamOP%26alt_dest%3Dhttps%25253A%25252F%25252Fwww.att.com%25252Fmyatt%25252Flgn%25252Fresources%25252Fauth%25252Flogin%25252Fhaloc%25252Fgoto-login%25253Ffrom%25253Dsignin%26scope%3Dopenid%2520authenticationTypes%26response_type%3Did_token%26response_mode%3Dform_post%26state%3DKuSuXN4ZZD%26client_id%3Dm10707
Title: Forgot user ID?

Search URL Search Domain Scan URL

URL: https://www.att.com/acctmgmt/fpwd/lander?origination_point=tguard&Return_URL=https%3A%2F%2Foidc.idp.clogin.att.com%2Fmga%2Fsps%2Foauth%2Foauth20%2Fauthorize%3Fnonce%3DTifUvuLe2x%26redirect_uri%3Dhttps%3A%2F%2Fwww.att.com%2Fisam%2Fsps%2Foidc%2Frp%2Fconsumerfed%2Fredirect%2FolamOP%26alt_dest%3Dhttps%25253A%25252F%25252Fwww.att.com%25252Fmyatt%25252Flgn%25252Fresources%25252Fauth%25252Flogin%25252Fhaloc%25252Fgoto-login%25253Ffrom%25253Dsignin%26scope%3Dopenid%2520authenticationTypes%26response_type%3Did_token%26response_mode%3Dform_post%26state%3DKuSuXN4ZZD%26client_id%3Dm10707&Cancel_URL=https%3A%2F%2Foidc.idp.clogin.att.com%2Fmga%2Fsps%2Foauth%2Foauth20%2Fauthorize%3Fnonce%3DTifUvuLe2x%26redirect_uri%3Dhttps%3A%2F%2Fwww.att.com%2Fisam%2Fsps%2Foidc%2Frp%2Fconsumerfed%2Fredirect%2FolamOP%26alt_dest%3Dhttps%25253A%25252F%25252Fwww.att.com%25252Fmyatt%25252Flgn%25252Fresources%25252Fauth%25252Flogin%25252Fhaloc%25252Fgoto-login%25253Ffrom%25253Dsignin%26scope%3Dopenid%2520authenticationTypes%26response_type%3Did_token%26response_mode%3Dform_post%26state%3DKuSuXN4ZZD%26client_id%3Dm10707
Title: Forgot password?

Search URL Search Domain Scan URL

URL: https://www.att.com/my/#/welcome?origination_point=tguard&Return_URL=https%3A%2F%2Foidc.idp.clogin.att.com%2Fmga%2Fsps%2Foauth%2Foauth20%2Fauthorize%3Fnonce%3DTifUvuLe2x%26redirect_uri%3Dhttps%3A%2F%2Fwww.att.com%2Fisam%2Fsps%2Foidc%2Frp%2Fconsumerfed%2Fredirect%2FolamOP%26alt_dest%3Dhttps%25253A%25252F%25252Fwww.att.com%25252Fmyatt%25252Flgn%25252Fresources%25252Fauth%25252Flogin%25252Fhaloc%25252Fgoto-login%25253Ffrom%25253Dsignin%26scope%3Dopenid%2520authenticationTypes%26response_type%3Did_token%26response_mode%3Dform_post%26state%3DKuSuXN4ZZD%26client_id%3Dm10707&Cancel_URL=https%3A%2F%2Foidc.idp.clogin.att.com%2Fmga%2Fsps%2Foauth%2Foauth20%2Fauthorize%3Fnonce%3DTifUvuLe2x%26redirect_uri%3Dhttps%3A%2F%2Fwww.att.com%2Fisam%2Fsps%2Foidc%2Frp%2Fconsumerfed%2Fredirect%2FolamOP%26alt_dest%3Dhttps%25253A%25252F%25252Fwww.att.com%25252Fmyatt%25252Flgn%25252Fresources%25252Fauth%25252Flogin%25252Fhaloc%25252Fgoto-login%25253Ffrom%25253Dsignin%26scope%3Dopenid%2520authenticationTypes%26response_type%3Did_token%26response_mode%3Dform_post%26state%3DKuSuXN4ZZD%26client_id%3Dm10707
Title: Create one now

Search URL Search Domain Scan URL

URL: https://www.att.com/legal/legal-policy-center.html
Title: Legal policy center

Search URL Search Domain Scan URL

URL: https://about.att.com/sites/privacy_policy
Title: Privacy policy

Search URL Search Domain Scan URL

URL: https://www.att.com/legal/terms.attWebsiteTermsOfUse.html
Title: Terms of use

Search URL Search Domain Scan URL

URL: https://www.att.com/features/accessibility.html
Title: Accessibility

Search URL Search Domain Scan URL

URL: https://about.att.com/csr/home/privacy/rights_choices.html
Title: Do not sell my personal info

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request login.html Show response
www.gunind.com/silinecek/shop/image/att/ 16 KB
4 KB 299ms
94ms Document
text/html 89.252.130.99
NETINTERNET Netin...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.gunind.com/silinecek/shop/image/att/login.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 89.252.130.99 , Turkey, ASN51559 (NETINTERNET Netinternet Bilisim Teknolojileri AS, TR),
Reverse DNS: server.fikirisler.com
Software: Apache/2 /
Resource Hash: 9ede611b50c5183b61314fa7fbe4b57b2eca51d5706e11d7d0b8b7c4348b61ec

Request headers

:method: GET
:authority: www.gunind.com
:scheme: https
:path: /silinecek/shop/image/att/login.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 16 Jan 2021 01:21:02 GMT
server: Apache/2
last-modified: Tue, 13 Oct 2020 22:22:26 GMT
etag: "3fa4-5b194d981ec80-gzip"
accept-ranges: bytes
vary: Accept-Encoding,User-Agent
content-encoding: gzip
content-length: 3878
content-type: text/html

GET
H2 200 styles.css
www.gunind.com/silinecek/shop/image/att/login_files/ 155 KB
26 KB 105ms
103ms Stylesheet
text/css 89.252.130.99
NETINTERNET Netin...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.gunind.com/silinecek/shop/image/att/login_files/styles.css
Requested by: Host: www.gunind.com
URL: https://www.gunind.com/silinecek/shop/image/att/login.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 89.252.130.99 , Turkey, ASN51559 (NETINTERNET Netinternet Bilisim Teknolojileri AS, TR),
Reverse DNS: server.fikirisler.com
Software: Apache/2 /
Resource Hash: 3be2a08977aea5fdbca0183f5cd267a31d4c35c3ee80da37baabf6f494f11d8e

Request headers

Referer: https://www.gunind.com/silinecek/shop/image/att/login.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 16 Jan 2021 01:21:02 GMT
content-encoding: gzip
last-modified: Sun, 13 Sep 2020 16:36:02 GMT
server: Apache/2
etag: "26c1d-5af3483720080-gzip"
vary: Accept-Encoding,User-Agent
content-type: text/css
accept-ranges: bytes
content-length: 26259

GET
H2 200 logo.svg
www.gunind.com/silinecek/shop/image/att/login_files/ 8 KB
3 KB 94ms
93ms Image
image/svg+xml 89.252.130.99
NETINTERNET Netin...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.gunind.com/silinecek/shop/image/att/login_files/logo.svg
Requested by: Host: www.gunind.com
URL: https://www.gunind.com/silinecek/shop/image/att/login.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 89.252.130.99 , Turkey, ASN51559 (NETINTERNET Netinternet Bilisim Teknolojileri AS, TR),
Reverse DNS: server.fikirisler.com
Software: Apache/2 /
Resource Hash: 6982fbe858e30068de9301b49438c83838bc7beb058146703b22b701e6709c7e

Request headers

Referer: https://www.gunind.com/silinecek/shop/image/att/login.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 16 Jan 2021 01:21:02 GMT
content-encoding: gzip
last-modified: Sun, 13 Sep 2020 16:11:38 GMT
server: Apache/2
etag: "20b1-5af342c2f2280-gzip"
vary: Accept-Encoding,User-Agent
content-type: image/svg+xml
accept-ranges: bytes
content-length: 3428

GET
H2 200 bt.png
www.gunind.com/silinecek/shop/image/att/login_files/ 1 KB
1 KB 182ms
176ms Image
image/png 89.252.130.99
NETINTERNET Netin...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.gunind.com/silinecek/shop/image/att/login_files/bt.png
Requested by: Host: www.gunind.com
URL: https://www.gunind.com/silinecek/shop/image/att/login.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 89.252.130.99 , Turkey, ASN51559 (NETINTERNET Netinternet Bilisim Teknolojileri AS, TR),
Reverse DNS: server.fikirisler.com
Software: Apache/2 /
Resource Hash: 1280edea47544bff4ed520b046b08d3458fc81ae5fb2f8fcc13cc9c4262b2fe3

Request headers

Referer: https://www.gunind.com/silinecek/shop/image/att/login.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 16 Jan 2021 01:21:02 GMT
last-modified: Sun, 13 Sep 2020 16:32:56 GMT
server: Apache/2
accept-ranges: bytes
etag: "444-5af34785bde00"
content-length: 1092
content-type: image/png

GET
H2 200 runtime.js Show response
www.gunind.com/silinecek/shop/image/att/login_files/ 1 KB
772 B 223ms
219ms Script
application/javascript 89.252.130.99
NETINTERNET Netin...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.gunind.com/silinecek/shop/image/att/login_files/runtime.js
Requested by: Host: www.gunind.com
URL: https://www.gunind.com/silinecek/shop/image/att/login.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 89.252.130.99 , Turkey, ASN51559 (NETINTERNET Netinternet Bilisim Teknolojileri AS, TR),
Reverse DNS: server.fikirisler.com
Software: Apache/2 /
Resource Hash: 6c5acbb82a46a4971660f65131241dffcc28828f4dbd76b8ec7bab0b468250f8

Request headers

Referer: https://www.gunind.com/silinecek/shop/image/att/login.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 16 Jan 2021 01:21:02 GMT
content-encoding: gzip
last-modified: Sun, 13 Sep 2020 16:11:38 GMT
server: Apache/2
etag: "5cd-5af342c2f2280-gzip"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
accept-ranges: bytes
content-length: 719

GET
H2 200 polyfills.js Show response
www.gunind.com/silinecek/shop/image/att/login_files/ 45 KB
15 KB 183ms
179ms Script
application/javascript 89.252.130.99
NETINTERNET Netin...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.gunind.com/silinecek/shop/image/att/login_files/polyfills.js
Requested by: Host: www.gunind.com
URL: https://www.gunind.com/silinecek/shop/image/att/login.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 89.252.130.99 , Turkey, ASN51559 (NETINTERNET Netinternet Bilisim Teknolojileri AS, TR),
Reverse DNS: server.fikirisler.com
Software: Apache/2 /
Resource Hash: 404242f2c176ef500776c795d03817ee93ec04b15fa756a4a19d8e288a53377f

Request headers

Referer: https://www.gunind.com/silinecek/shop/image/att/login.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 16 Jan 2021 01:21:02 GMT
content-encoding: gzip
last-modified: Sun, 13 Sep 2020 16:11:38 GMT
server: Apache/2
etag: "b3d2-5af342c2f2280-gzip"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
accept-ranges: bytes
content-length: 14995

GET
H2 200 vendor.js Show response
www.gunind.com/silinecek/shop/image/att/login_files/ 445 KB
125 KB 234ms
231ms Script
application/javascript 89.252.130.99
NETINTERNET Netin...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.gunind.com/silinecek/shop/image/att/login_files/vendor.js
Requested by: Host: www.gunind.com
URL: https://www.gunind.com/silinecek/shop/image/att/login.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 89.252.130.99 , Turkey, ASN51559 (NETINTERNET Netinternet Bilisim Teknolojileri AS, TR),
Reverse DNS: server.fikirisler.com
Software: Apache/2 /
Resource Hash: ce340e00045f01005937b209564c39e45e45ec1bc60aa13a22f37c2884dde5d9

Request headers

Referer: https://www.gunind.com/silinecek/shop/image/att/login.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 16 Jan 2021 01:21:02 GMT
content-encoding: gzip
last-modified: Sun, 13 Sep 2020 16:11:38 GMT
server: Apache/2
etag: "6f384-5af342c2f2280-gzip"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
accept-ranges: bytes

GET
H2 200 main.js Show response
www.gunind.com/silinecek/shop/image/att/login_files/ 92 KB
20 KB 223ms
220ms Script
application/javascript 89.252.130.99
NETINTERNET Netin...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.gunind.com/silinecek/shop/image/att/login_files/main.js
Requested by: Host: www.gunind.com
URL: https://www.gunind.com/silinecek/shop/image/att/login.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 89.252.130.99 , Turkey, ASN51559 (NETINTERNET Netinternet Bilisim Teknolojileri AS, TR),
Reverse DNS: server.fikirisler.com
Software: Apache/2 /
Resource Hash: 08cc6b2e30a8a41a3ce8ad92ff3e4a3e11871c8e56dc1faa3271fdc1d27befb2

Request headers

Referer: https://www.gunind.com/silinecek/shop/image/att/login.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 16 Jan 2021 01:21:02 GMT
content-encoding: gzip
last-modified: Sun, 13 Sep 2020 16:11:38 GMT
server: Apache/2
etag: "16e3f-5af342c2f2280-gzip"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
accept-ranges: bytes
content-length: 20043

GET
H2 200 detm-container-ftr.js Show response
www.gunind.com/silinecek/shop/image/att/login_files/ 486 B
367 B 183ms
177ms Script
application/javascript 89.252.130.99
NETINTERNET Netin...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.gunind.com/silinecek/shop/image/att/login_files/detm-container-ftr.js
Requested by: Host: www.gunind.com
URL: https://www.gunind.com/silinecek/shop/image/att/login.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 89.252.130.99 , Turkey, ASN51559 (NETINTERNET Netinternet Bilisim Teknolojileri AS, TR),
Reverse DNS: server.fikirisler.com
Software: Apache/2 /
Resource Hash: 178fab8f721f7639665ec6ef300452e94387aee858d14300d1ef5c3d98442a01

Request headers

Referer: https://www.gunind.com/silinecek/shop/image/att/login.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 16 Jan 2021 01:21:02 GMT
content-encoding: gzip
last-modified: Sun, 13 Sep 2020 16:11:38 GMT
server: Apache/2
etag: "1e6-5af342c2f2280-gzip"
vary: Accept-Encoding,User-Agent
content-type: application/javascript
accept-ranges: bytes
content-length: 297

GET
H2 200 ATTAleckSans_W_Rg.woff
www.gunind.com/silinecek/shop/image/att/login_files/ 35 KB
6 KB 958ms
956ms Font
text/html 89.252.130.99
NETINTERNET Netin...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.gunind.com/silinecek/shop/image/att/login_files/ATTAleckSans_W_Rg.woff
Requested by: Host: www.gunind.com
URL: https://www.gunind.com/silinecek/shop/image/att/login_files/styles.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 89.252.130.99 , Turkey, ASN51559 (NETINTERNET Netinternet Bilisim Teknolojileri AS, TR),
Reverse DNS: server.fikirisler.com
Software: Apache/2 / PHP/5.6.40
Resource Hash: ac63ba2deea708ca3de9a9ae7bf4f36dd0d2511d4acd740cfd18274f1f379f34

Request headers

Origin: https://www.gunind.com
Referer: https://www.gunind.com/silinecek/shop/image/att/login_files/styles.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 16 Jan 2021 01:21:02 GMT
content-encoding: gzip
server: Apache/2
x-powered-by: PHP/5.6.40
content-length: 5783
vary: Accept-Encoding,User-Agent
content-type: text/html; charset=utf-8

GET
DATA 200
OK truncated
/ 343 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0e83d280e36ce078cd1d301e8a02367860d245e752f308eed1201c273fccf3e4

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 ATTAleckSans_W_Md.woff
www.gunind.com/silinecek/shop/image/att/login_files/ 35 KB
6 KB 929ms
928ms Font
text/html 89.252.130.99
NETINTERNET Netin...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.gunind.com/silinecek/shop/image/att/login_files/ATTAleckSans_W_Md.woff
Requested by: Host: www.gunind.com
URL: https://www.gunind.com/silinecek/shop/image/att/login_files/styles.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 89.252.130.99 , Turkey, ASN51559 (NETINTERNET Netinternet Bilisim Teknolojileri AS, TR),
Reverse DNS: server.fikirisler.com
Software: Apache/2 / PHP/5.6.40
Resource Hash: 77288fcc3a2b89dff351be4fe53ede451517daaf681faf16ed1a59d15851dd74

Request headers

Origin: https://www.gunind.com
Referer: https://www.gunind.com/silinecek/shop/image/att/login_files/styles.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 16 Jan 2021 01:21:02 GMT
content-encoding: gzip
server: Apache/2
x-powered-by: PHP/5.6.40
content-length: 5782
vary: Accept-Encoding,User-Agent
content-type: text/html; charset=utf-8

GET
H/1.1 200
OK logo.svg
signin.att.com/static/siam/en/halo_c/halo-c-login/assets/images/ 8 KB
9 KB 1154ms
153ms Image
image/svg+xml 144.160.125.207
AMERITECH-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://signin.att.com/static/siam/en/halo_c/halo-c-login/assets/images/logo.svg

Requested by

Host: www.gunind.com
URL: https://www.gunind.com/silinecek/shop/image/att/login.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

144.160.125.207 , United States, ASN797 (AMERITECH-AS, US),

Reverse DNS

clcontent-da.att.com

Software

Resource Hash

6982fbe858e30068de9301b49438c83838bc7beb058146703b22b701e6709c7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.gunind.com/silinecek/shop/image/att/login.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 16 Jan 2021 01:21:04 GMT
last-modified: Fri, 08 Jan 2021 13:14:27 GMT
etag: "20b1-5b86355f5d2c0"
x-frame-options: SAMEORIGIN
iam_on: D508
p3p: CP="NON CUR OTPi OUR NOR UNI"
access-control-allow-origin: *
strict-transport-security: max-age=31536000; includeSubDomains; preload
accept-ranges: bytes
content-type: image/svg+xml
apser: p192
content-length: 8369

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: AT&T (Telecommunication)

153 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.gunind.com/	1969-12-31 23:59:59	Name: OCSESSID Value: 551f3a0a13298893e68e4c1491
.www.gunind.com/	1970-01-19 16:09:12	Name: currency Value: TRY
.www.gunind.com/	1970-01-19 16:09:12	Name: language Value: tr-tr

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

signin.att.com
www.gunind.com
144.160.125.207
89.252.130.99
08cc6b2e30a8a41a3ce8ad92ff3e4a3e11871c8e56dc1faa3271fdc1d27befb2
0e83d280e36ce078cd1d301e8a02367860d245e752f308eed1201c273fccf3e4
1280edea47544bff4ed520b046b08d3458fc81ae5fb2f8fcc13cc9c4262b2fe3
178fab8f721f7639665ec6ef300452e94387aee858d14300d1ef5c3d98442a01
3be2a08977aea5fdbca0183f5cd267a31d4c35c3ee80da37baabf6f494f11d8e
404242f2c176ef500776c795d03817ee93ec04b15fa756a4a19d8e288a53377f
6982fbe858e30068de9301b49438c83838bc7beb058146703b22b701e6709c7e
6c5acbb82a46a4971660f65131241dffcc28828f4dbd76b8ec7bab0b468250f8
77288fcc3a2b89dff351be4fe53ede451517daaf681faf16ed1a59d15851dd74
9ede611b50c5183b61314fa7fbe4b57b2eca51d5706e11d7d0b8b7c4348b61ec
ac63ba2deea708ca3de9a9ae7bf4f36dd0d2511d4acd740cfd18274f1f379f34
ce340e00045f01005937b209564c39e45e45ec1bc60aa13a22f37c2884dde5d9

www.gunind.com Open in urlscan Pro 89.252.130.99 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

12 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

3 IPs

2 Countries

215 kBTransfer

843 kBSize

3 Cookies

8 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

153 JavaScript Global Variables

3 Cookies

Indicators

www.gunind.com Open in urlscan Pro
89.252.130.99 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

2
Countries

215 kB
Transfer

843 kB
Size

3
Cookies

12 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!