![](/screenshots/cac75c9f-8bf2-4c63-9498-91947c44fe11.png)
curly-mode-8272.on.fleek.co
Open in
urlscan Pro
2606:4700::6812:691
Malicious Activity!
Public Scan
Effective URL: https://curly-mode-8272.on.fleek.co/attmailverificationprocess.html
Submission Tags: phishing
Submission: On January 25 via api from US — Scanned from DE
Summary
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on April 8th 2023. Valid for: a year.
This is the only time curly-mode-8272.on.fleek.co was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic Email (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 2 | 2606:4700:440... 2606:4700:4400::ac40:9162 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
18 | 2606:4700::68... 2606:4700::6812:691 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:829::200e | 15169 (GOOGLE) (GOOGLE) | |
3 | 18.165.201.17 18.165.201.17 | 16509 (AMAZON-02) (AMAZON-02) | |
3 | 216.55.149.49 216.55.149.49 | 30447 (INFB2-AS) (INFB2-AS) | |
1 | 2a04:4e42:200... 2a04:4e42:200::649 | 54113 (FASTLY) (FASTLY) | |
1 | 2606:4700::68... 2606:4700::6811:180e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6812:acf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:813::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2606:4700::68... 2606:4700::6812:bcf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
34 | 10 |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
ASN16509 (AMAZON-02, US)
PTR: server-18-165-201-17.lhr50.r.cloudfront.net
cdn.appdynamics.com |
ASN30447 (INFB2-AS, CA)
PTR: websitesmailc45.carrierzone.com
websitesmail.att.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
18 |
fleek.co
curly-mode-8272.on.fleek.co |
14 KB |
3 |
att.com
websitesmail.att.com — Cisco Umbrella Rank: 425716 |
134 KB |
3 |
appdynamics.com
cdn.appdynamics.com — Cisco Umbrella Rank: 4434 |
73 KB |
2 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 1019 stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 2998 |
29 KB |
2 |
flowcode.com
2 redirects
flowcode.com — Cisco Umbrella Rank: 52329 |
1 KB |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 369 |
30 KB |
1 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 225 |
7 KB |
1 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 760 |
24 KB |
1 |
google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 27 |
21 KB |
34 | 9 |
Domain | Requested by | |
---|---|---|
18 | curly-mode-8272.on.fleek.co |
curly-mode-8272.on.fleek.co
|
3 | websitesmail.att.com |
curly-mode-8272.on.fleek.co
websitesmail.att.com |
3 | cdn.appdynamics.com |
curly-mode-8272.on.fleek.co
cdn.appdynamics.com |
2 | flowcode.com | 2 redirects |
1 | stackpath.bootstrapcdn.com |
curly-mode-8272.on.fleek.co
|
1 | ajax.googleapis.com |
curly-mode-8272.on.fleek.co
|
1 | maxcdn.bootstrapcdn.com |
curly-mode-8272.on.fleek.co
|
1 | cdnjs.cloudflare.com |
curly-mode-8272.on.fleek.co
|
1 | code.jquery.com |
curly-mode-8272.on.fleek.co
|
1 | www.google-analytics.com |
curly-mode-8272.on.fleek.co
|
34 | 10 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
fleek.co Cloudflare Inc ECC CA-3 |
2023-04-08 - 2024-04-07 |
a year | crt.sh |
*.google-analytics.com GTS CA 1C3 |
2024-01-02 - 2024-03-26 |
3 months | crt.sh |
*.appdynamics.com DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2023-06-21 - 2024-07-21 |
a year | crt.sh |
websitesmail.att.com DigiCert TLS RSA SHA256 2020 CA1 |
2023-02-12 - 2024-03-14 |
a year | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2023-07-11 - 2024-07-14 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-07-03 - 2024-07-02 |
a year | crt.sh |
bootstrapcdn.com GTS CA 1P5 |
2023-11-30 - 2024-02-28 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2024-01-02 - 2024-03-26 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://curly-mode-8272.on.fleek.co/attmailverificationprocess.html
Frame ID: 36F1677A50B4ABD8007E36082BC527B9
Requests: 35 HTTP requests in this frame
Screenshot
![](/screenshots/cac75c9f-8bf2-4c63-9498-91947c44fe11.png)
Page Title
Login - Webmail 7.0Page URL History Show full URLs
-
http://flowcode.com/p/YG4CiDck6?fc=3D0
HTTP 301
https://flowcode.com/p/YG4CiDck6?fc=3D0 HTTP 302
https://curly-mode-8272.on.fleek.co/attmailverificationprocess.html Page URL
Detected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Detected patterns
- \bangular.{0,32}\.js
![](/vendor/wappa/icons/RequireJS.png)
Detected patterns
- require.*\.js
![](/vendor/wappa/icons/AppDynamics.png)
Detected patterns
- adrum
Detected patterns
- google-analytics\.com/(?:ga|urchin|analytics)\.js
![](/vendor/wappa/icons/Google Font API.png)
Detected patterns
- <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
![](/vendor/wappa/icons/Popper.png)
Detected patterns
- /popper\.js/([0-9.]+)
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://flowcode.com/p/YG4CiDck6?fc=3D0
HTTP 301
https://flowcode.com/p/YG4CiDck6?fc=3D0 HTTP 302
https://curly-mode-8272.on.fleek.co/attmailverificationprocess.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
34 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
attmailverificationprocess.html
curly-mode-8272.on.fleek.co/ Redirect Chain
|
52 KB 14 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
52 KB 21 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
adrum-ext.396a4a3598e4fdd54b8073a93c951462.js
cdn.appdynamics.com/ |
50 KB 20 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
adrum-4.5.15.2691.js
cdn.appdynamics.com/adrum/ |
94 KB 34 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
css
curly-mode-8272.on.fleek.co/https;//fonts.googleapis.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
app.css
websitesmail.att.com/9b26c3f/css/ |
1005 KB 127 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
custom.css
websitesmail.att.com/9b26c3f/branding/hid-1111/css/ |
5 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.js
curly-mode-8272.on.fleek.co/9b26c3f/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
config.js
curly-mode-8272.on.fleek.co/9b26c3f/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
infrastructure.js
curly-mode-8272.on.fleek.co/9b26c3f/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
base-controller.js
curly-mode-8272.on.fleek.co/9b26c3f/components/base/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
list-controller.js
curly-mode-8272.on.fleek.co/9b26c3f/sections/mail/list/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ui-bootstrap-tpls.js
curly-mode-8272.on.fleek.co/9b26c3f/vendor/angular-bootstrap/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
base-controller-abstract.js
curly-mode-8272.on.fleek.co/9b26c3f/components/base/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
list-controller-abstract.js
curly-mode-8272.on.fleek.co/9b26c3f/sections/mail/list/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
en_US.js
curly-mode-8272.on.fleek.co/9b26c3f/i18n/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login.js
curly-mode-8272.on.fleek.co/9b26c3f/sections/login/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login-controller.js
curly-mode-8272.on.fleek.co/9b26c3f/sections/login/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
snapuser.js
curly-mode-8272.on.fleek.co/9b26c3f/components/snapuser/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
focus.js
curly-mode-8272.on.fleek.co/9b26c3f/components/focus/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login-controller-abstract.js
curly-mode-8272.on.fleek.co/9b26c3f/sections/login/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
focus-directive.js
curly-mode-8272.on.fleek.co/9b26c3f/components/focus/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
snapuser-directive.js
curly-mode-8272.on.fleek.co/9b26c3f/components/snapuser/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
navstatus-logo.png
websitesmail.att.com/9b26c3f/branding/hid-1111/images/ |
2 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
require.js
curly-mode-8272.on.fleek.co/9b26c3f/ |
0 0 |
Script
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.2.1.slim.min.js
code.jquery.com/ |
68 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ |
19 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ |
48 KB 14 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ |
84 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/ |
50 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
5 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
fontawesome-webfont.woff2
websitesmail.att.com/9b26c3f/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
fontawesome-webfont.woff
websitesmail.att.com/9b26c3f/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
fontawesome-webfont.ttf
websitesmail.att.com/9b26c3f/fonts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
adrum-ext.396a4a3598e4fdd54b8073a93c951462.js
cdn.appdynamics.com/ |
50 KB 20 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- curly-mode-8272.on.fleek.co
- URL
- https://curly-mode-8272.on.fleek.co/https;//fonts.googleapis.com/css?family=Lato:300,400,700
- Domain
- websitesmail.att.com
- URL
- https://websitesmail.att.com/9b26c3f/fonts/fontawesome-webfont.woff2?v=4.7.0
- Domain
- websitesmail.att.com
- URL
- https://websitesmail.att.com/9b26c3f/fonts/fontawesome-webfont.woff?v=4.7.0
- Domain
- websitesmail.att.com
- URL
- https://websitesmail.att.com/9b26c3f/fonts/fontawesome-webfont.ttf?v=4.7.0
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic Email (Online)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| OptanonWrapper object| google_tag_data function| ga object| gaplugins object| ADRUM number| adrum-start-time function| $ function| jQuery function| Popper object| bootstrap string| tx1 string| tx2 string| ur2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.flowcode.com/ | Name: _cfuvid Value: Sh75wssctfja1UZ4bIN7W5PM82qnE6iKTflK0aYsMW8-1706210460348-0-604800000 |
|
.flowcode.com/ | Name: __cf_bm Value: yhU3drcEugJR0ucUaQv7PFiCao994VSuIrUz2JD0eXI-1706210460-1-AaPYujBaq01nTM99EAbNxPtwQxtjFf/psRAOjSG9a+XBsCOmuM0PZwEIqy/RHkhERXh0o+OytL+dvB1mAf400g0= |
41 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | upgrade-insecure-requests |
Strict-Transport-Security | max-age=31536000; includeSubDomains |
X-Content-Type-Options | nosniff |
X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
cdn.appdynamics.com
cdnjs.cloudflare.com
code.jquery.com
curly-mode-8272.on.fleek.co
flowcode.com
maxcdn.bootstrapcdn.com
stackpath.bootstrapcdn.com
websitesmail.att.com
www.google-analytics.com
curly-mode-8272.on.fleek.co
websitesmail.att.com
18.165.201.17
216.55.149.49
2606:4700:4400::ac40:9162
2606:4700::6811:180e
2606:4700::6812:691
2606:4700::6812:acf
2606:4700::6812:bcf
2a00:1450:4001:813::200a
2a00:1450:4001:829::200e
2a04:4e42:200::649
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
60009ef5f3565c84402dd05e73f5fca89b43a515a305425f000b9fbd4c9f6d31
74a7115b66ed1586f8067b8b238560b97f354e34c027b7ba8842f0756d27e976
7c8699ad588d2407b23b32f43872a1d910dda4d96578423ae37be5e699623eff
83239804a3038eac4046c4290b937684a6e45bc432b6df706dea3a6c67176895
87f70dfbc2ff2c8a2b892bfe369005a005c39b17ec0af6c1b153fdcf7712e67e
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
a698276a123d22649dccc684bbddf0d2cfe5e13b6c11a16d0533d7a7e78587af
b00cd68d7d42e86f29c39170f15cc4dd14822bfd373974c28d09052fff17a747
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b