easy-pear-duck-tutu.cyclic.app Open in urlscan Pro
52.33.196.106  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response easy-pear-duck-tutu.cyclic.app/	24 KB 24 KB	1958ms 1419ms	Document text/html	52.33.196.106 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://easy-pear-duck-tutu.cyclic.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.33.196.106 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-33-196-106.us-west-2.compute.amazonaws.com Software / Express Resource Hash ff118d7ef60180182a4ef72d90fc80b20a407fc030fa35da3e60110310c6e633 Request headers Upgrade-Insecure-Requests 1 User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) accept-language de-DE,de;q=0.9 Response headers accept-ranges bytes apigw-requestid SxbskivnvHcEJug= cache-control public, max-age=0 content-length 24722 content-type text/html; charset=UTF-8 date Wed, 07 Feb 2024 15:48:33 GMT etag W/"6092-18d66470960" last-modified Thu, 01 Feb 2024 20:05:48 GMT x-powered-by Express
GET H2	200	styles.css signin.att.com/static/siam/en/halo_c/halo-c-login/	126 KB 31 KB	767ms 149ms	Stylesheet text/css	144.161.106.163 AMERITECH-AS
General Check archive.org Show headers Download Go to Full URL https://signin.att.com/static/siam/en/halo_c/halo-c-login/styles.css Requested by Host: easy-pear-duck-tutu.cyclic.app URL: https://easy-pear-duck-tutu.cyclic.app/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 144.161.106.163 , United States, ASN797 (AMERITECH-AS, US), Reverse DNS Software / Resource Hash 2f47247427bbbc19d6a08ab626cc43994d0e3e2069a5a5a4a80ba5e513c42fdb Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://easy-pear-duck-tutu.cyclic.app/ User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers date Wed, 07 Feb 2024 15:48:34 GMT content-encoding gzip strict-transport-security max-age=31536000; includeSubDomains; preload last-modified Wed, 15 Nov 2023 23:05:05 GMT etag "1f912-60a38ef082a40" x-frame-options SAMEORIGIN iam_on A189 p3p CP="NON CUR OTPi OUR NOR UNI" access-control-allow-origin * content-type text/css accept-ranges bytes apser p205
GET H2	200	att_hz_lg_lkp_rgb_pos.svg signin.att.com/static/siam/en/halo_c/images/logos/	5 KB 5 KB	561ms 149ms	Image image/svg+xml	144.161.106.163 AMERITECH-AS
General Check archive.org Show headers Download Go to Show image Full URL https://signin.att.com/static/siam/en/halo_c/images/logos/att_hz_lg_lkp_rgb_pos.svg Requested by Host: easy-pear-duck-tutu.cyclic.app URL: https://easy-pear-duck-tutu.cyclic.app/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 144.161.106.163 , United States, ASN797 (AMERITECH-AS, US), Reverse DNS Software / Resource Hash ecc6e5c037a4e54c1ed4052c9880d55c27187bf709fb82fae2709c92d3a3a563 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://easy-pear-duck-tutu.cyclic.app/ User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers date Wed, 07 Feb 2024 15:48:34 GMT strict-transport-security max-age=31536000; includeSubDomains; preload last-modified Wed, 15 Nov 2023 23:05:05 GMT etag "1240-60a38ef082a40" x-frame-options SAMEORIGIN iam_on A189 p3p CP="NON CUR OTPi OUR NOR UNI" access-control-allow-origin * content-type image/svg+xml accept-ranges bytes apser p213 content-length 4672
GET H2	200	jquery.min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/	87 KB 28 KB	132ms 48ms	Script application/javascript	2606:4700::6811:180e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js Requested by Host: easy-pear-duck-tutu.cyclic.app URL: https://easy-pear-duck-tutu.cyclic.app/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://easy-pear-duck-tutu.cyclic.app/ User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers date Wed, 07 Feb 2024 15:48:33 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 6098658 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 27938 last-modified Tue, 02 Mar 2021 18:58:36 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "603e8adc-15d9d" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=C2S7Bzz9VIFwsgEoNKOsgEfTe4523HY8jGTzO1jfG3gNCaOgLq9r5YNZlif89rXBj4hoxknNecmrwP2M10tJnsITknlxIhMD3ShEJ6Uf2K2dzzt1244blA%2BMob4GJd0PhIRdLgMDTys%2B9qLEJqBa6%2Btf"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 851cc71f085c6adf-FRA expires Mon, 27 Jan 2025 15:48:33 GMT
GET DATA	200 OK	truncated /	467 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash df4cff0ac010bc2ae490916002c85a17a8cda07b85610c7cd1eb30ed30f2561a Request headers accept-language de-DE,de;q=0.9 Referer User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers Content-Type image/png
GET H2	200	ATTAleckSans_W_Rg.woff2 signin.att.com/static/siam/en/halo_c/halo-c-login/assets/fonts/att/ATTAleckSans/woff2/	18 KB 18 KB	428ms 145ms	Font application/octet-stream	144.161.106.163 AMERITECH-AS
General Check archive.org Show headers Download Go to Full URL https://signin.att.com/static/siam/en/halo_c/halo-c-login/assets/fonts/att/ATTAleckSans/woff2/ATTAleckSans_W_Rg.woff2 Requested by Host: signin.att.com URL: https://signin.att.com/static/siam/en/halo_c/halo-c-login/styles.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 144.161.106.163 , United States, ASN797 (AMERITECH-AS, US), Reverse DNS Software / Resource Hash e2740c7b209e33aca7176250d80f94b4924e5e5d18076ee3b95f32a0e20d1f58 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Frame-Options SAMEORIGIN Request headers Referer https://signin.att.com/static/siam/en/halo_c/halo-c-login/styles.css Origin https://easy-pear-duck-tutu.cyclic.app accept-language de-DE,de;q=0.9 User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers date Wed, 07 Feb 2024 15:48:34 GMT strict-transport-security max-age=31536000; includeSubDomains; preload last-modified Wed, 15 Nov 2023 23:05:05 GMT etag "4830-60a38ef082a40" x-frame-options SAMEORIGIN iam_on A189 p3p CP="NON CUR OTPi OUR NOR UNI" access-control-allow-origin * accept-ranges bytes apser p206 content-length 18480
GET H2	200	ATTAleckSans_W_Bd.woff2 signin.att.com/static/siam/en/halo_c/halo-c-login/assets/fonts/att/ATTAleckSans/woff2/	18 KB 18 KB	427ms 144ms	Font application/octet-stream	144.161.106.163 AMERITECH-AS
General Check archive.org Show headers Download Go to Full URL https://signin.att.com/static/siam/en/halo_c/halo-c-login/assets/fonts/att/ATTAleckSans/woff2/ATTAleckSans_W_Bd.woff2 Requested by Host: signin.att.com URL: https://signin.att.com/static/siam/en/halo_c/halo-c-login/styles.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 144.161.106.163 , United States, ASN797 (AMERITECH-AS, US), Reverse DNS Software / Resource Hash 37a1212cc1ab5c935d9a3fee05c98c940eaa895a23510e5f83d550dfbb0d763f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Frame-Options SAMEORIGIN Request headers Referer https://signin.att.com/static/siam/en/halo_c/halo-c-login/styles.css Origin https://easy-pear-duck-tutu.cyclic.app accept-language de-DE,de;q=0.9 User-Agent ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com) Response headers date Wed, 07 Feb 2024 15:48:34 GMT strict-transport-security max-age=31536000; includeSubDomains; preload last-modified Wed, 15 Nov 2023 23:05:05 GMT etag "48d8-60a38ef082a40" x-frame-options SAMEORIGIN iam_on A189 p3p CP="NON CUR OTPi OUR NOR UNI" access-control-allow-origin * accept-ranges bytes apser p212 content-length 18648

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: AT&T (Telecommunication)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| generateRandomString function| $ function| jQuery function| smb string| email object| dispemElement object| dispemdiv object| Signin object| userfield object| passfield object| Next

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
easy-pear-duck-tutu.cyclic.app
signin.att.com
144.161.106.163
2606:4700::6811:180e
52.33.196.106
2f47247427bbbc19d6a08ab626cc43994d0e3e2069a5a5a4a80ba5e513c42fdb
37a1212cc1ab5c935d9a3fee05c98c940eaa895a23510e5f83d550dfbb0d763f
df4cff0ac010bc2ae490916002c85a17a8cda07b85610c7cd1eb30ed30f2561a
e2740c7b209e33aca7176250d80f94b4924e5e5d18076ee3b95f32a0e20d1f58
ecc6e5c037a4e54c1ed4052c9880d55c27187bf709fb82fae2709c92d3a3a563
ff118d7ef60180182a4ef72d90fc80b20a407fc030fa35da3e60110310c6e633
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e