secapptrussl1.cdfsco.com Open in urlscan Pro
45.133.200.3  Malicious Activity! Public Scan

8 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://cpjcc-461fc.firebaseapp.com/ Page URL
2. https://secapptrussl1.cdfsco.com/ Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response cpjcc-461fc.firebaseapp.com/	324 B 564 B	134ms 19ms	Document text/html	151.101.1.195 FASTLY
General Check archive.org Show headers Download Go to Full URL https://cpjcc-461fc.firebaseapp.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.1.195 , United States, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash 8b94c149319f02df9126ccaa5401a426d911fb1bf4c2c2a08c283989b63b4963 Security Headers Name Value Strict-Transport-Security max-age=31556926; includeSubDomains; preload Request headers :method GET :authority cpjcc-461fc.firebaseapp.com :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 cache-control max-age=3600 content-encoding gzip content-type text/html; charset=utf-8 etag "b5cddd90467196b4ba63029dba6eadc7a3815977eaf3197ae205d37f5232861f" last-modified Tue, 28 Jul 2020 14:45:21 GMT strict-transport-security max-age=31556926; includeSubDomains; preload accept-ranges bytes date Thu, 30 Jul 2020 18:27:44 GMT x-served-by cache-cph20622-CPH x-cache HIT x-cache-hits 1 x-timer S1596133664.282290,VS0,VE0 vary x-fh-requested-host, accept-encoding content-length 260
GET H2	200	Primary Request / Show response secapptrussl1.cdfsco.com/	15 KB 4 KB	220ms 117ms	Document text/html	45.133.200.3 INTERNET-IT
General Check archive.org Show headers Download Go to Full URL https://secapptrussl1.cdfsco.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 45.133.200.3 , Netherlands, ASN200313 (INTERNET-IT, NL), Reverse DNS cpanel-host.prohoster.info Software nginx / PHP/5.6.40 Resource Hash 3dbb306c7d4d571bc357dea1745220e87b411f9d5749c81c5793c9c3f5a82d75 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers :method GET :authority secapptrussl1.cdfsco.com :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest document referer https://cpjcc-461fc.firebaseapp.com/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://cpjcc-461fc.firebaseapp.com/ Response headers status 200 server nginx date Thu, 30 Jul 2020 18:27:45 GMT content-type text/html; charset=UTF-8 vary Accept-Encoding x-powered-by PHP/5.6.40 expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate, post-check=0, pre-check=0 pragma no-cache set-cookie PHPSESSID=0m4pbd46pp6chopho8956v5627; path=/ x-xss-protection 1; mode=block x-content-type-options nosniff x-nginx-cache-status EXPIRED x-server-powered-by Engintron content-encoding gzip
GET H2	404	detm-container-hdr.js secapptrussl1.cdfsco.com/Login%20Screen_files/	0 0	43ms 43ms	Script text/html	45.133.200.3 INTERNET-IT
General Check archive.org Show headers Download Go to Full URL https://secapptrussl1.cdfsco.com/Login%20Screen_files/detm-container-hdr.js Requested by Host: secapptrussl1.cdfsco.com URL: https://secapptrussl1.cdfsco.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 45.133.200.3 , Netherlands, ASN200313 (INTERNET-IT, NL), Reverse DNS cpanel-host.prohoster.info Software nginx / Resource Hash Request headers Referer https://secapptrussl1.cdfsco.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 404 date Thu, 30 Jul 2020 18:27:45 GMT content-encoding gzip server nginx vary Accept-Encoding content-type text/html; charset=iso-8859-1
GET H2	404	quantum-att.js secapptrussl1.cdfsco.com/Login%20Screen_files/	0 0	43ms 42ms	Script text/html	45.133.200.3 INTERNET-IT
General Check archive.org Show headers Download Go to Full URL https://secapptrussl1.cdfsco.com/Login%20Screen_files/quantum-att.js Requested by Host: secapptrussl1.cdfsco.com URL: https://secapptrussl1.cdfsco.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 45.133.200.3 , Netherlands, ASN200313 (INTERNET-IT, NL), Reverse DNS cpanel-host.prohoster.info Software nginx / Resource Hash Request headers Referer https://secapptrussl1.cdfsco.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 404 date Thu, 30 Jul 2020 18:27:45 GMT content-encoding gzip server nginx vary Accept-Encoding content-type text/html; charset=iso-8859-1
GET H/1.1	200 OK	styles.css signin.att.com/static/siam/en/halo_c/halo-c-login/	155 KB 34 KB	814ms 137ms	Stylesheet text/css	144.161.106.163 AMERITECH-AS
General Check archive.org Show headers Download Go to Full URL https://signin.att.com/static/siam/en/halo_c/halo-c-login/styles.css Requested by Host: secapptrussl1.cdfsco.com URL: https://secapptrussl1.cdfsco.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 144.161.106.163 , United States, ASN797 (AMERITECH-AS, US), Reverse DNS clcontent-al.att.com Software / Resource Hash d50e435ab3b331f214706b96f91e491ddfe94c593bdc484c8a3fb538eb614881 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Frame-Options SAMEORIGIN Request headers Referer https://secapptrussl1.cdfsco.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 30 Jul 2020 18:27:46 GMT content-encoding gzip last-modified Fri, 17 Jul 2020 03:21:41 GMT etag "26b0b-5aa9aa7d51b40" x-frame-options SAMEORIGIN iam_on A190 p3p CP="NON CUR OTPi OUR NOR UNI" access-control-allow-origin * cache-control no-transform transfer-encoding chunked strict-transport-security max-age=31536000; includeSubDomains; preload accept-ranges bytes content-type text/css apser p212
GET H/1.1	200 OK	logo.svg signin.att.com/static/siam/en/halo_c/halo-c-login/assets/images/	8 KB 9 KB	779ms 144ms	Image image/svg+xml	144.161.106.163 AMERITECH-AS
General Check archive.org Show headers Download Go to Show image Full URL https://signin.att.com/static/siam/en/halo_c/halo-c-login/assets/images/logo.svg Requested by Host: secapptrussl1.cdfsco.com URL: https://secapptrussl1.cdfsco.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 144.161.106.163 , United States, ASN797 (AMERITECH-AS, US), Reverse DNS clcontent-al.att.com Software / Resource Hash 6982fbe858e30068de9301b49438c83838bc7beb058146703b22b701e6709c7e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Frame-Options SAMEORIGIN Request headers Referer https://secapptrussl1.cdfsco.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 30 Jul 2020 18:27:46 GMT last-modified Fri, 17 Jul 2020 03:21:41 GMT etag "20b1-5aa9aa7d51b40" x-frame-options SAMEORIGIN iam_on A190 p3p CP="NON CUR OTPi OUR NOR UNI" access-control-allow-origin * cache-control no-transform strict-transport-security max-age=31536000; includeSubDomains; preload accept-ranges bytes content-type image/svg+xml apser p206 content-length 8369
GET H/1.1	200 OK	errornew.svg signin.att.com/static/siam/en/halo_c/halo-c-login/assets/images/	566 B 993 B	783ms 144ms	Image image/svg+xml	144.161.106.163 AMERITECH-AS
General Check archive.org Show headers Download Go to Show image Full URL https://signin.att.com/static/siam/en/halo_c/halo-c-login/assets/images/errornew.svg Requested by Host: secapptrussl1.cdfsco.com URL: https://secapptrussl1.cdfsco.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 144.161.106.163 , United States, ASN797 (AMERITECH-AS, US), Reverse DNS clcontent-al.att.com Software / Resource Hash 9b8659596c575886c9202ec3a8506949e69140b50818ca4fc1e58494f3d4e8c9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Frame-Options SAMEORIGIN Request headers Referer https://secapptrussl1.cdfsco.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 30 Jul 2020 18:27:46 GMT last-modified Fri, 17 Jul 2020 03:21:41 GMT etag "236-5aa9aa7d51b40" x-frame-options SAMEORIGIN iam_on A190 p3p CP="NON CUR OTPi OUR NOR UNI" access-control-allow-origin * cache-control no-transform strict-transport-security max-age=31536000; includeSubDomains; preload accept-ranges bytes content-type image/svg+xml apser p205 content-length 566
GET H/1.1	200 OK	main.js Show response signin.att.com/static/siam/en/halo_c/halo-c-login/	89 KB 25 KB	768ms 135ms	Script application/javascript	144.161.106.163 AMERITECH-AS
General Check archive.org Show headers Download Go to Full URL https://signin.att.com/static/siam/en/halo_c/halo-c-login/main.js Requested by Host: secapptrussl1.cdfsco.com URL: https://secapptrussl1.cdfsco.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 144.161.106.163 , United States, ASN797 (AMERITECH-AS, US), Reverse DNS clcontent-al.att.com Software / Resource Hash cc636ba71b320c1343ba5ee7bd667f497ac63fc0c4dbe6cc0d1773122e62d74a Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Frame-Options SAMEORIGIN Request headers Referer https://secapptrussl1.cdfsco.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 30 Jul 2020 18:27:46 GMT content-encoding gzip last-modified Fri, 17 Jul 2020 03:21:41 GMT etag "16271-5aa9aa7d51b40" x-frame-options SAMEORIGIN iam_on A190 p3p CP="NON CUR OTPi OUR NOR UNI" access-control-allow-origin * cache-control no-transform transfer-encoding chunked strict-transport-security max-age=31536000; includeSubDomains; preload accept-ranges bytes content-type application/javascript apser p213
GET H2	200	detm-container-ftr.js Show response www.att.com/scripts/adobe/prod/	486 B 567 B	221ms 205ms	Script application/x-javascript	2a02:26f0:6c00:195::2db1 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://www.att.com/scripts/adobe/prod/detm-container-ftr.js Requested by Host: secapptrussl1.cdfsco.com URL: https://secapptrussl1.cdfsco.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:6c00:195::2db1 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software Akamai Resource Optimizer / Resource Hash 178fab8f721f7639665ec6ef300452e94387aee858d14300d1ef5c3d98442a01 Security Headers Name Value Strict-Transport-Security max-age=15768000 ; preload Request headers Referer https://secapptrussl1.cdfsco.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Thu, 30 Jul 2020 18:27:45 GMT content-encoding br last-modified Thu, 30 Jul 2020 01:21:43 GMT server Akamai Resource Optimizer etag "8c1b899d417b2a0283afe21b836da604:1596071878.433794" strict-transport-security max-age=15768000 ; preload content-type application/x-javascript status 200 cache-control max-age=900 server-timing cdn-cache; desc=HIT, edge; dur=1 accept-ranges bytes content-length 245
GET H2	404	quantum-att.js secapptrussl1.cdfsco.com/Login%20Screen_files/	0 0	42ms 41ms	Script text/html	45.133.200.3 INTERNET-IT
General Check archive.org Show headers Download Go to Full URL https://secapptrussl1.cdfsco.com/Login%20Screen_files/quantum-att.js Requested by Host: secapptrussl1.cdfsco.com URL: https://secapptrussl1.cdfsco.com/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 45.133.200.3 , Netherlands, ASN200313 (INTERNET-IT, NL), Reverse DNS cpanel-host.prohoster.info Software nginx / Resource Hash Request headers Referer https://secapptrussl1.cdfsco.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 404 date Thu, 30 Jul 2020 18:27:45 GMT content-encoding gzip server nginx vary Accept-Encoding content-type text/html; charset=iso-8859-1
GET H/1.1	200 OK	ATTAleckSans_W_Rg.woff signin.att.com/static/siam/en/halo_c/halo-c-login/	22 KB 23 KB	519ms 129ms	Font application/x-font-woff	144.161.106.163 AMERITECH-AS
General Check archive.org Show headers Download Go to Full URL https://signin.att.com/static/siam/en/halo_c/halo-c-login/ATTAleckSans_W_Rg.woff Requested by Host: secapptrussl1.cdfsco.com URL: https://secapptrussl1.cdfsco.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 144.161.106.163 , United States, ASN797 (AMERITECH-AS, US), Reverse DNS clcontent-al.att.com Software / Resource Hash 07b3a3d0f02092988f8b70fa51992fa109b23bbc82638fc857dee5ee0e3ad5dc Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://signin.att.com/static/siam/en/halo_c/halo-c-login/styles.css Origin https://secapptrussl1.cdfsco.com Response headers date Thu, 30 Jul 2020 18:27:47 GMT last-modified Fri, 17 Jul 2020 03:21:41 GMT etag "5948-5aa9aa7d51b40" x-frame-options SAMEORIGIN iam_on A190 p3p CP="NON CUR OTPi OUR NOR UNI" access-control-allow-origin * cache-control no-transform strict-transport-security max-age=31536000; includeSubDomains; preload accept-ranges bytes content-type application/x-font-woff apser p212 content-length 22856
GET H/1.1	200 OK	ATTAleckSans_W_Md.woff signin.att.com/static/siam/en/halo_c/halo-c-login/	23 KB 24 KB	522ms 129ms	Font application/x-font-woff	144.161.106.163 AMERITECH-AS
General Check archive.org Show headers Download Go to Full URL https://signin.att.com/static/siam/en/halo_c/halo-c-login/ATTAleckSans_W_Md.woff Requested by Host: secapptrussl1.cdfsco.com URL: https://secapptrussl1.cdfsco.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 144.161.106.163 , United States, ASN797 (AMERITECH-AS, US), Reverse DNS clcontent-al.att.com Software / Resource Hash d0c4812c9f1b672a7ea3420b10ea389cabb4b50694418965003250c876a2b13b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Frame-Options SAMEORIGIN Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://signin.att.com/static/siam/en/halo_c/halo-c-login/styles.css Origin https://secapptrussl1.cdfsco.com Response headers date Thu, 30 Jul 2020 18:27:47 GMT last-modified Fri, 17 Jul 2020 03:21:41 GMT etag "5d6c-5aa9aa7d51b40" x-frame-options SAMEORIGIN iam_on A190 p3p CP="NON CUR OTPi OUR NOR UNI" access-control-allow-origin * cache-control no-transform strict-transport-security max-age=31536000; includeSubDomains; preload accept-ranges bytes content-type application/x-font-woff apser p213 content-length 23916

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: AT&T (Telecommunication)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

string| detmScriptLoadType object| loginJspEnvVars string| loginLanguage object| webpackJsonp function| detmExecuteFooter

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			secapptrussl1.cdfsco.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 0m4pbd46pp6chopho8956v5627

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31556926; includeSubDomains; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cpjcc-461fc.firebaseapp.com
secapptrussl1.cdfsco.com
signin.att.com
www.att.com
144.161.106.163
151.101.1.195
2a02:26f0:6c00:195::2db1
45.133.200.3
07b3a3d0f02092988f8b70fa51992fa109b23bbc82638fc857dee5ee0e3ad5dc
178fab8f721f7639665ec6ef300452e94387aee858d14300d1ef5c3d98442a01
3dbb306c7d4d571bc357dea1745220e87b411f9d5749c81c5793c9c3f5a82d75
6982fbe858e30068de9301b49438c83838bc7beb058146703b22b701e6709c7e
8b94c149319f02df9126ccaa5401a426d911fb1bf4c2c2a08c283989b63b4963
9b8659596c575886c9202ec3a8506949e69140b50818ca4fc1e58494f3d4e8c9
cc636ba71b320c1343ba5ee7bd667f497ac63fc0c4dbe6cc0d1773122e62d74a
d0c4812c9f1b672a7ea3420b10ea389cabb4b50694418965003250c876a2b13b
d50e435ab3b331f214706b96f91e491ddfe94c593bdc484c8a3fb538eb614881