ia601501.us.archive.org

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 4 HTTP transactions. The main IP is 207.241.227.111, located in San Francisco, United States and belongs to INTERNET-ARCHIVE, US. The main domain is ia601501.us.archive.org.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on December 23rd 2019. Valid for: 2 years.

This is the only time ia601501.us.archive.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: AT&T (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
1	207.241.227.111 207.241.227.111	7941 (INTERNET-...) (INTERNET-ARCHIVE)
3	144.161.77.234 144.161.77.234	797 (AMERITECH-AS) (AMERITECH-AS)
4	2

1 207.241.227.111 (San Francisco, United States)

ASN7941 (INTERNET-ARCHIVE, US)
PTR: ia601501.us.archive.org

ia601501.us.archive.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 144.161.77.234 (United States)

ASN797 (AMERITECH-AS, US)
PTR: clcontent-ff.att.com

signin.att.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	att.com signin.att.com	60 KB
1	archive.org ia601501.us.archive.org	3 KB
4	2

	Domain	Requested by
3	signin.att.com	ia601501.us.archive.org signin.att.com
1	ia601501.us.archive.org
4	2

This site contains links to these domains. Also see Links.

Domain
www.att.com
attreg.att.net
about.att.com

Subject Issuer	Validity	Valid
*.us.archive.org Go Daddy Secure Certificate Authority - G2	`2019-12-23` - `2022-02-21`	2 years	crt.sh
*.att.com DigiCert TLS RSA SHA256 2020 CA1	`2021-09-22` - `2022-09-22`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://ia601501.us.archive.org/view_archive.php?archive=/1/items/attio2/attio2.zip&file=attio%2Fat.html
Frame ID: A38D8BD45345B16E16B097193B4CF9E4
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Login Screen

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

63 kB
Transfer

191 kB
Size

0
Cookies

8 Outgoing links

These are links going to different origins than the main page.

URL: https://www.att.com/acctmgmt/fid/lander?origination_point=tguard&Return_URL=https%3A%2F%2Foidc.idp.clogin.att.com%2Fmga%2Fsps%2Foauth%2Foauth20%2Fauthorize%3Fnonce%3DTxddoXWss7%26redirect_uri%3Dhttps%253A%252F%252Fatt-yahoo.att.net%252Fisam%252Fsps%252Foidc%252Frp%252FATT-HBO-RP%252Fredirect%252FYahoo%26response_mode%3Dform_post%26alt_dest%3Dhttps%25253A%25252F%25252Fatt-yahoo.att.net%25252FFIM%25252Fsps%25252Fauth%25253FPartnerId%25253Dhttps%2525253A%2525252F%2525252Flogin.yahoo.com%2525252Fsaml2%26scope%3Dopenid%26response_type%3Did_token%26state%3DmYgpiodgRR%26client_id%3Dm40842&Cancel_URL=https%3A%2F%2Foidc.idp.clogin.att.com%2Fmga%2Fsps%2Foauth%2Foauth20%2Fauthorize%3Fnonce%3DTxddoXWss7%26redirect_uri%3Dhttps%253A%252F%252Fatt-yahoo.att.net%252Fisam%252Fsps%252Foidc%252Frp%252FATT-HBO-RP%252Fredirect%252FYahoo%26response_mode%3Dform_post%26alt_dest%3Dhttps%25253A%25252F%25252Fatt-yahoo.att.net%25252FFIM%25252Fsps%25252Fauth%25253FPartnerId%25253Dhttps%2525253A%2525252F%2525252Flogin.yahoo.com%2525252Fsaml2%26scope%3Dopenid%26response_type%3Did_token%26state%3DmYgpiodgRR%26client_id%3Dm40842
Title: Forgot user ID?

Search URL Search Domain Scan URL

URL: https://www.att.com/acctmgmt/fpwd/lander?origination_point=tguard&Return_URL=https%3A%2F%2Foidc.idp.clogin.att.com%2Fmga%2Fsps%2Foauth%2Foauth20%2Fauthorize%3Fnonce%3DTxddoXWss7%26redirect_uri%3Dhttps%253A%252F%252Fatt-yahoo.att.net%252Fisam%252Fsps%252Foidc%252Frp%252FATT-HBO-RP%252Fredirect%252FYahoo%26response_mode%3Dform_post%26alt_dest%3Dhttps%25253A%25252F%25252Fatt-yahoo.att.net%25252FFIM%25252Fsps%25252Fauth%25253FPartnerId%25253Dhttps%2525253A%2525252F%2525252Flogin.yahoo.com%2525252Fsaml2%26scope%3Dopenid%26response_type%3Did_token%26state%3DmYgpiodgRR%26client_id%3Dm40842&Cancel_URL=https%3A%2F%2Foidc.idp.clogin.att.com%2Fmga%2Fsps%2Foauth%2Foauth20%2Fauthorize%3Fnonce%3DTxddoXWss7%26redirect_uri%3Dhttps%253A%252F%252Fatt-yahoo.att.net%252Fisam%252Fsps%252Foidc%252Frp%252FATT-HBO-RP%252Fredirect%252FYahoo%26response_mode%3Dform_post%26alt_dest%3Dhttps%25253A%25252F%25252Fatt-yahoo.att.net%25252FFIM%25252Fsps%25252Fauth%25253FPartnerId%25253Dhttps%2525253A%2525252F%2525252Flogin.yahoo.com%2525252Fsaml2%26scope%3Dopenid%26response_type%3Did_token%26state%3DmYgpiodgRR%26client_id%3Dm40842
Title: Forgot password?

Search URL Search Domain Scan URL

URL: https://attreg.att.net/PortalRegWeb/PortalRegController?callingAppId=OP
Title: Create one now

Search URL Search Domain Scan URL

URL: https://www.att.com/legal/legal-policy-center.html
Title: Legal policy center

Search URL Search Domain Scan URL

URL: https://about.att.com/sites/privacy_policy
Title: Privacy policy

Search URL Search Domain Scan URL

URL: https://www.att.com/legal/terms.attWebsiteTermsOfUse.html
Title: Terms of use

Search URL Search Domain Scan URL

URL: https://www.att.com/features/accessibility.html
Title: Accessibility

Search URL Search Domain Scan URL

URL: https://about.att.com/csr/home/privacy/rights_choices.html
Title: Do not sell my personal info

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request view_archive.php Show response
ia601501.us.archive.org/ 10 KB
3 KB 352ms
88ms Document
text/html 207.241.227.111
INTERNET-ARCHIVE

General

Check archive.org

Show headers Download Go to

Full URL

https://ia601501.us.archive.org/view_archive.php?archive=/1/items/attio2/attio2.zip&file=attio%2Fat.html

Protocol

H2

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

207.241.227.111 San Francisco, United States, ASN7941 (INTERNET-ARCHIVE, US),

Reverse DNS

ia601501.us.archive.org

Software

nginx/1.18.0 (Ubuntu) /

Resource Hash

cb396af94898d8fe6ba6b85056eb7bc56c6645a9e9a0cdad7dd2a8602c0458c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: en-US,en;q=0.9

Response headers

server: nginx/1.18.0 (Ubuntu)
date: Wed, 01 Dec 2021 14:25:31 GMT
content-type: text/html;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=10800
content-disposition: inline; filename="at.html"
strict-transport-security: max-age=15724800
referrer-policy: no-referrer-when-downgrade
content-encoding: gzip

GET
H/1.1 200
OK styles.css
signin.att.com/static/siam/en/halo_c/halo-c-login/ 154 KB
33 KB 1311ms
94ms Stylesheet
text/css 144.161.77.234
AMERITECH-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://signin.att.com/static/siam/en/halo_c/halo-c-login/styles.css

Requested by

Host: ia601501.us.archive.org
URL: https://ia601501.us.archive.org/view_archive.php?archive=/1/items/attio2/attio2.zip&file=attio%2Fat.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

144.161.77.234 , United States, ASN797 (AMERITECH-AS, US),

Reverse DNS

clcontent-ff.att.com

Software

/

Resource Hash

f6965e98f020c4a13929d6a3629f6f58e46a515a03fa132d669ebc2ed2d08344

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-US,en;q=0.9
Referer: https://ia601501.us.archive.org/view_archive.php?archive=/1/items/attio2/attio2.zip&file=attio%2Fat.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 14:25:32 GMT
content-encoding: gzip
last-modified: Fri, 19 Nov 2021 07:41:56 GMT
etag: "2680b-5d11f68ccd900"
x-frame-options: SAMEORIGIN
iam_on: 605
p3p: CP="NON CUR OTPi OUR NOR UNI"
access-control-allow-origin: *
transfer-encoding: chunked
strict-transport-security: max-age=31536000; includeSubDomains; preload
accept-ranges: bytes
content-type: text/css
apser: p578

GET
H/1.1 200
OK logo.svg
signin.att.com/static/siam/en/halo_c/halo-c-login/assets/images/ 8 KB
9 KB 1301ms
83ms Image
image/svg+xml 144.161.77.234
AMERITECH-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://signin.att.com/static/siam/en/halo_c/halo-c-login/assets/images/logo.svg

Requested by

Host: ia601501.us.archive.org
URL: https://ia601501.us.archive.org/view_archive.php?archive=/1/items/attio2/attio2.zip&file=attio%2Fat.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

144.161.77.234 , United States, ASN797 (AMERITECH-AS, US),

Reverse DNS

clcontent-ff.att.com

Software

/

Resource Hash

6982fbe858e30068de9301b49438c83838bc7beb058146703b22b701e6709c7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Request headers

Accept-Language: en-US,en;q=0.9
Referer: https://ia601501.us.archive.org/view_archive.php?archive=/1/items/attio2/attio2.zip&file=attio%2Fat.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 14:25:32 GMT
last-modified: Thu, 26 Aug 2021 03:53:35 GMT
etag: "20b1-5ca6e4fa54dc0"
x-frame-options: SAMEORIGIN
iam_on: 605
p3p: CP="NON CUR OTPi OUR NOR UNI"
access-control-allow-origin: *
strict-transport-security: max-age=31536000; includeSubDomains; preload
accept-ranges: bytes
content-type: image/svg+xml
apser: p579
content-length: 8369

GET
H/1.1 200
OK ATTAleckSans_W_Rg.woff2
signin.att.com/static/siam/en/halo_c/halo-c-login/assets/fonts/att/ATTAleckSans/woff2/ 18 KB
18 KB 347ms
81ms Font
application/octet-stream 144.161.77.234
AMERITECH-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://signin.att.com/static/siam/en/halo_c/halo-c-login/assets/fonts/att/ATTAleckSans/woff2/ATTAleckSans_W_Rg.woff2

Requested by

Host: signin.att.com
URL: https://signin.att.com/static/siam/en/halo_c/halo-c-login/styles.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

144.161.77.234 , United States, ASN797 (AMERITECH-AS, US),

Reverse DNS

clcontent-ff.att.com

Software

/

Resource Hash

e2740c7b209e33aca7176250d80f94b4924e5e5d18076ee3b95f32a0e20d1f58

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://signin.att.com/static/siam/en/halo_c/halo-c-login/styles.css
Origin: https://ia601501.us.archive.org
Accept-Language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 01 Dec 2021 14:25:33 GMT
last-modified: Fri, 19 Nov 2021 07:41:56 GMT
etag: "4830-5d11f68ccd900"
x-frame-options: SAMEORIGIN
iam_on: 605
p3p: CP="NON CUR OTPi OUR NOR UNI"
access-control-allow-origin: *
strict-transport-security: max-age=31536000; includeSubDomains; preload
accept-ranges: bytes
apser: p580
content-length: 18480

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: AT&T (Telecommunication)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15724800

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ia601501.us.archive.org
signin.att.com
144.161.77.234
207.241.227.111
6982fbe858e30068de9301b49438c83838bc7beb058146703b22b701e6709c7e
cb396af94898d8fe6ba6b85056eb7bc56c6645a9e9a0cdad7dd2a8602c0458c3
e2740c7b209e33aca7176250d80f94b4924e5e5d18076ee3b95f32a0e20d1f58
f6965e98f020c4a13929d6a3629f6f58e46a515a03fa132d669ebc2ed2d08344

ia601501.us.archive.org Open in urlscan Pro 207.241.227.111 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

4 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

63 kBTransfer

191 kBSize

0 Cookies

8 Outgoing links

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

5 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

ia601501.us.archive.org Open in urlscan Pro
207.241.227.111 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

63 kB
Transfer

191 kB
Size

0
Cookies

4 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!