urlscan.io logo urlscan.io
SecurityTrails logo

www.walkingproject.org Open in urlscan Pro
43.240.66.40  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://www.walkingproject.org/sasa/Indexxatt.htm
Submission: On November 28 via automatic, source openphish
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 17 HTTP transactions. The main IP is 43.240.66.40, located in India and belongs to WEBWERKS-AS-IN Web Werks India Pvt. Ltd., IN. The main domain is www.walkingproject.org.
TLS certificate: Issued by cPanel, Inc. Certification Authority on October 10th 2017. Valid for: 3 months.
This is the only time www.walkingproject.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: AT&T (Telecommunication)

Domain & IP information

IP Address AS Autonomous System
1 43.240.66.40 133296 (WEBWERKS-...)
1 15 2001:1890:1c0... 7018 (ATT-INTER...)
2 2a00:1288:80:... 203220 (YAHOO-DEB)
17 3
Apex Domain
Subdomains		 Transfer
15 att.net
home.secureapp.att.net
196 KB
2 yimg.com
s.yimg.com
1 walkingproject.org
www.walkingproject.org
4 KB
17 3
Domain Requested by
15 home.secureapp.att.net 1 redirects www.walkingproject.org
home.secureapp.att.net
2 s.yimg.com www.walkingproject.org
1 www.walkingproject.org
17 3

This site contains links to these domains. Also see Links.

Domain
www.att.net
www.att.com
uverseonline.att.net
elportal.att.net
home.secureapp.att.net
Subject Issuer Validity Valid
walkingproject.org
cPanel, Inc. Certification Authority		 2017-10-10 -
2018-01-08		 3 months crt.sh
home.secureapp.att.net
Symantec Class 3 Secure Server CA - G4		 2017-08-17 -
2018-10-15		 a year crt.sh
*.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2017-10-20 -
2017-12-06		 2 months crt.sh

This page contains 1 frames:

Primary Page: https://www.walkingproject.org/sasa/Indexxatt.htm
Frame ID: 32437.1
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
  • script /jquery.*\.js/i

Page Statistics

17
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

3
Subdomains

3
IPs

3
Countries

199 kB
Transfer

199 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 15
  • https://home.secureapp.att.net/attportal/s/context.dll?id=9002001&type=clickthru&name=cgate.signIn.Pageviews.www-att-net&redirecturl=/i/s.gif?nocache=9518 HTTP 302
  • https://home.secureapp.att.net/i/s.gif?nocache=9518

17 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Indexxatt.htm
www.walkingproject.org/sasa/ 		4 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.walkingproject.org/sasa/Indexxatt.htm
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
43.240.66.40 , India, ASN133296 (WEBWERKS-AS-IN Web Werks India Pvt. Ltd., IN),
Reverse DNS
rb5326.rapidns.com
Software
Apache /
Resource Hash
baa5c6df09ce08373d859fce826d5fa6cdf53b53519d7f6f5074741603eb6b63

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
www.walkingproject.org
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Cache-Control
no-cache
Connection
keep-alive
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Tue, 28 Nov 2017 14:05:53 GMT
Last-Modified
Mon, 27 Nov 2017 21:30:27 GMT
Server
Apache
Content-Type
text/html
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
4145
main.css
home.secureapp.att.net/css/sso/slid/1201/ 		28 KB
28 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://home.secureapp.att.net/css/sso/slid/1201/main.css
Requested by
Host: www.walkingproject.org
URL: https://www.walkingproject.org/sasa/Indexxatt.htm
Protocol
HTTP/1.0
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:1890:1c01:2::42 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US),
Reverse DNS
Software
"" /
Resource Hash
dfa2be020e3374a4b1c871c88ada990120fb198d4e8ff685ad35cfae88ad3466

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
home.secureapp.att.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
https://www.walkingproject.org/sasa/Indexxatt.htm
Connection
keep-alive
Cache-Control
no-cache
Referer
https://www.walkingproject.org/sasa/Indexxatt.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Tue, 28 Nov 2017 14:03:35 GMT
Last-modified
Tue, 24 Oct 2017 04:39:16 GMT
Server
""
Etag
"6fd5-59eec3f4"
Content-type
text/css
Connection
keep-alive
Accept-ranges
bytes
Content-length
28629
jquery-1.5.1.min.js
home.secureapp.att.net/js/jquery/ 		83 KB
83 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://home.secureapp.att.net/js/jquery/jquery-1.5.1.min.js
Requested by
Host: www.walkingproject.org
URL: https://www.walkingproject.org/sasa/Indexxatt.htm
Protocol
HTTP/1.0
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:1890:1c01:2::42 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US),
Reverse DNS
Software
"" /
Resource Hash
764b9e9f3ad386aaa5cdeae9368353994de61c0bede087c8f7e3579cb443de3b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
home.secureapp.att.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
*/*
Referer
https://www.walkingproject.org/sasa/Indexxatt.htm
Connection
keep-alive
Cache-Control
no-cache
Referer
https://www.walkingproject.org/sasa/Indexxatt.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Tue, 28 Nov 2017 14:03:35 GMT
Last-modified
Fri, 11 Mar 2011 22:40:27 GMT
Server
""
Etag
"14d0c-4d7aa4db"
Content-type
application/x-javascript
Connection
keep-alive
Accept-ranges
bytes
Content-length
85260
jquery.simplemodal.js
home.secureapp.att.net/js/jquery/simplemodal/ 		9 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://home.secureapp.att.net/js/jquery/simplemodal/jquery.simplemodal.js
Requested by
Host: www.walkingproject.org
URL: https://www.walkingproject.org/sasa/Indexxatt.htm
Protocol
HTTP/1.0
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:1890:1c01:2::42 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US),
Reverse DNS
Software
"" /
Resource Hash
70b5a6613f03d3c015d826185e39839e6dbc2d03871f151bafbed5cc58503f69

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
home.secureapp.att.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
*/*
Referer
https://www.walkingproject.org/sasa/Indexxatt.htm
Connection
keep-alive
Cache-Control
no-cache
Referer
https://www.walkingproject.org/sasa/Indexxatt.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Tue, 28 Nov 2017 14:03:35 GMT
Last-modified
Fri, 05 Nov 2010 18:18:06 GMT
Server
""
Etag
"24fd-4cd44a5e"
Content-type
application/x-javascript
Connection
keep-alive
Accept-ranges
bytes
Content-length
9469
script.js
home.secureapp.att.net/js/sso/slid/1201/ 		47 KB
47 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://home.secureapp.att.net/js/sso/slid/1201/script.js
Requested by
Host: www.walkingproject.org
URL: https://www.walkingproject.org/sasa/Indexxatt.htm
Protocol
HTTP/1.0
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:1890:1c01:2::42 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US),
Reverse DNS
Software
"" /
Resource Hash
b71323f713074ada8dae257aabaee2e8cc776e7219385ad1a756bef2f1336d63

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
home.secureapp.att.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
*/*
Referer
https://www.walkingproject.org/sasa/Indexxatt.htm
Connection
keep-alive
Cache-Control
no-cache
Referer
https://www.walkingproject.org/sasa/Indexxatt.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Tue, 28 Nov 2017 14:03:35 GMT
Last-modified
Tue, 24 Oct 2017 04:29:43 GMT
Server
""
Etag
"bdff-59eec1b7"
Content-type
application/x-javascript
Connection
keep-alive
Accept-ranges
bytes
Content-length
48639
script.js
s.yimg.com/ik/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://s.yimg.com/ik/script.js
Requested by
Host: www.walkingproject.org
URL: https://www.walkingproject.org/sasa/Indexxatt.htm
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1288:80:800::7001 , United Kingdom, ASN203220 (YAHOO-DEB, DE),
Reverse DNS
Software
ATS /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

:path
/ik/script.js
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
s.yimg.com
referer
https://www.walkingproject.org/sasa/Indexxatt.htm
:scheme
https
:method
GET
Referer
https://www.walkingproject.org/sasa/Indexxatt.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date
Tue, 28 Nov 2017 14:05:55 GMT
via
HTTP/1.1 web4.usw18.mobstor.gq1.yahoo.com UserFiberFramework/1.0, HTTPS/1.1 web1.use18.mobstor.bf1.yahoo.com UserFiberFramework/1.0, https/1.1 e16.ycpi.deb.yahoo.com (ApacheTrafficServer [cSsSfU])
x-ysws-request-id
b3c23709-0282-411a-af82-d88d1ba64e6d,082d5d51-9863-4ee6-b1db-926dc3066762
server
ATS
age
0
x-ysws-error-detail
not_in_objectstore
strict-transport-security
max-age=300
content-type
text/html; charset=iso-8859-1
status
404
content-length
25
x-ysws-visited-replicas
gops.use18.mobstor.vip.bf1.yahoo.com,gops.usw18.mobstor.vip.gq1.yahoo.com
mobile.css
home.secureapp.att.net/css/sso/slid/1201/ 		4 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://home.secureapp.att.net/css/sso/slid/1201/mobile.css
Requested by
Host: www.walkingproject.org
URL: https://www.walkingproject.org/sasa/Indexxatt.htm
Protocol
HTTP/1.0
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:1890:1c01:2::42 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US),
Reverse DNS
Software
"" /
Resource Hash
30a949cc26cd4f709fa897313f8d448b2cb724a40a170c4b8e8ce6b3aa890fd1

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
home.secureapp.att.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
https://www.walkingproject.org/sasa/Indexxatt.htm
Connection
keep-alive
Cache-Control
no-cache
Referer
https://www.walkingproject.org/sasa/Indexxatt.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Tue, 28 Nov 2017 14:03:36 GMT
Last-modified
Wed, 21 Dec 2016 10:14:45 GMT
Server
""
Etag
"fa3-585a5615"
Content-type
text/css
Connection
keep-alive
Accept-ranges
bytes
Content-length
4003
pageBg.png
home.secureapp.att.net/design/cdls10/img/ui/ 		169 B
169 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://home.secureapp.att.net/design/cdls10/img/ui/pageBg.png
Requested by
Host: www.walkingproject.org
URL: https://www.walkingproject.org/sasa/Indexxatt.htm
Protocol
HTTP/1.0
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:1890:1c01:2::42 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US),
Reverse DNS
Software
"" /
Resource Hash
c537cf7e2770d1b4953255dfccff8e0bdbfd4adb4e88d868e353208ae7ff13c1

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
home.secureapp.att.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
Connection
keep-alive
Cache-Control
no-cache
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Tue, 28 Nov 2017 14:03:36 GMT
Last-modified
Tue, 11 Aug 2009 21:10:32 GMT
Server
""
Etag
"a9-4a81de48"
Content-type
image/png
Connection
keep-alive
Accept-ranges
bytes
Content-length
169
btnSumbit.png
home.secureapp.att.net/img/sso/slid/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://home.secureapp.att.net/img/sso/slid/btnSumbit.png
Requested by
Host: www.walkingproject.org
URL: https://www.walkingproject.org/sasa/Indexxatt.htm
Protocol
HTTP/1.0
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:1890:1c01:2::42 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US),
Reverse DNS
Software
"" /
Resource Hash
27da51ec2023f96407f92161ddda0e290b0661a765822ff03e5d61f3aecf8aa0

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
home.secureapp.att.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
Connection
keep-alive
Cache-Control
no-cache
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Tue, 28 Nov 2017 14:03:36 GMT
Last-modified
Tue, 21 Sep 2010 15:06:50 GMT
Server
""
Etag
"573-4c98ca0a"
Content-type
image/png
Connection
keep-alive
Accept-ranges
bytes
Content-length
1395
footerBg.png
home.secureapp.att.net/design/CDLS10/img/ui/ 		560 B
560 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://home.secureapp.att.net/design/CDLS10/img/ui/footerBg.png
Requested by
Host: www.walkingproject.org
URL: https://www.walkingproject.org/sasa/Indexxatt.htm
Protocol
HTTP/1.0
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:1890:1c01:2::42 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US),
Reverse DNS
Software
"" /
Resource Hash
61e91515aaf72cba3014a136331a138eca6b27831c8f2e6b0c128825243f5263

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
home.secureapp.att.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
Connection
keep-alive
Cache-Control
no-cache
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Tue, 28 Nov 2017 14:03:36 GMT
Last-modified
Fri, 17 Jul 2009 17:05:33 GMT
Server
""
Etag
"230-4a60af5d"
Content-type
image/png
Connection
keep-alive
Accept-ranges
bytes
Content-length
560
script.js
s.yimg.com/ik/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://s.yimg.com/ik/script.js
Requested by
Host: www.walkingproject.org
URL: https://www.walkingproject.org/sasa/Indexxatt.htm
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1288:80:800::7001 , United Kingdom, ASN203220 (YAHOO-DEB, DE),
Reverse DNS
Software
ATS /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

:path
/ik/script.js
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
s.yimg.com
referer
https://www.walkingproject.org/sasa/Indexxatt.htm
:scheme
https
:method
GET
Referer
https://www.walkingproject.org/sasa/Indexxatt.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

date
Tue, 28 Nov 2017 14:05:56 GMT
via
HTTP/1.1 web12.usw18.mobstor.gq1.yahoo.com UserFiberFramework/1.0, HTTPS/1.1 web7.use18.mobstor.bf1.yahoo.com UserFiberFramework/1.0, https/1.1 e16.ycpi.deb.yahoo.com (ApacheTrafficServer [cSsSfU])
x-ysws-request-id
2ff1ce33-fe42-4c25-96d0-4997b6eefbdc,0ed54f62-254d-43c3-badf-211f4f6f11ef
server
ATS
age
2
x-ysws-error-detail
not_in_objectstore
strict-transport-security
max-age=300
content-type
text/html; charset=iso-8859-1
status
404
content-length
25
x-ysws-visited-replicas
gops.use18.mobstor.vip.bf1.yahoo.com,gops.usw18.mobstor.vip.gq1.yahoo.com
attGlobalNavHeader-bg.gif
home.secureapp.att.net/design/cdls20/img/ui/ 		149 B
149 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://home.secureapp.att.net/design/cdls20/img/ui/attGlobalNavHeader-bg.gif
Requested by
Host: home.secureapp.att.net
URL: https://home.secureapp.att.net/js/jquery/jquery-1.5.1.min.js
Protocol
HTTP/1.0
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:1890:1c01:2::42 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US),
Reverse DNS
Software
"" /
Resource Hash
9880eb5b6a6b1dec8f568c14a1a5be755c460d2ea2df66fa7b5e6b99227f7128

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
home.secureapp.att.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
Connection
keep-alive
Cache-Control
no-cache
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Tue, 28 Nov 2017 14:03:37 GMT
Last-modified
Thu, 26 Apr 2012 21:04:53 GMT
Server
""
Etag
"95-4f99b875"
Content-type
image/gif
Connection
keep-alive
Accept-ranges
bytes
Content-length
149
txt-clear.png
home.secureapp.att.net/img/sso/slid/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://home.secureapp.att.net/img/sso/slid/txt-clear.png
Requested by
Host: home.secureapp.att.net
URL: https://home.secureapp.att.net/js/jquery/jquery-1.5.1.min.js
Protocol
HTTP/1.0
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:1890:1c01:2::42 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US),
Reverse DNS
Software
"" /
Resource Hash
fdee766a03e4032897a2cd75326c135d8e938592bfb00f12ed5b4eb223f54c3f

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
home.secureapp.att.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
Connection
keep-alive
Cache-Control
no-cache
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Tue, 28 Nov 2017 14:03:37 GMT
Last-modified
Tue, 29 Jul 2014 15:04:17 GMT
Server
""
Etag
"cda-53d7b7f1"
Content-type
image/png
Connection
keep-alive
Accept-ranges
bytes
Content-length
3290
att_globe_blue_80x80.png
home.secureapp.att.net/design/CDLS10/img/logos/ 		16 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://home.secureapp.att.net/design/CDLS10/img/logos/att_globe_blue_80x80.png
Requested by
Host: home.secureapp.att.net
URL: https://home.secureapp.att.net/js/jquery/jquery-1.5.1.min.js
Protocol
HTTP/1.0
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:1890:1c01:2::42 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US),
Reverse DNS
Software
"" /
Resource Hash
dfa35aa4643a991e1d2ec6e3562e1a0465174c7200a7572c92619904bb08530f

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
home.secureapp.att.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
Connection
keep-alive
Cache-Control
no-cache
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Tue, 28 Nov 2017 14:03:37 GMT
Last-modified
Fri, 20 May 2016 12:43:47 GMT
Server
""
Etag
"40c4-573f0683"
Content-type
image/png
Connection
keep-alive
Accept-ranges
bytes
Content-length
16580
support-icon.jpg
home.secureapp.att.net/img/sso/slid/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://home.secureapp.att.net/img/sso/slid/support-icon.jpg
Requested by
Host: home.secureapp.att.net
URL: https://home.secureapp.att.net/js/jquery/jquery-1.5.1.min.js
Protocol
HTTP/1.0
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:1890:1c01:2::42 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US),
Reverse DNS
Software
"" /
Resource Hash
01a7e22fd83c617ff55898233518c54a9ecce7e0de3e8a63c4fa59315b029c6b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
home.secureapp.att.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
Connection
keep-alive
Cache-Control
no-cache
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Tue, 28 Nov 2017 14:03:37 GMT
Last-modified
Mon, 26 Jul 2010 21:26:50 GMT
Server
""
Etag
"615-4c4dfd9a"
Content-type
image/jpeg
Connection
keep-alive
Accept-ranges
bytes
Content-length
1557
ques.png
home.secureapp.att.net/img/sso/slid/ 		363 B
363 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://home.secureapp.att.net/img/sso/slid/ques.png
Requested by
Host: home.secureapp.att.net
URL: https://home.secureapp.att.net/js/sso/slid/1201/script.js
Protocol
HTTP/1.0
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:1890:1c01:2::42 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US),
Reverse DNS
Software
"" /
Resource Hash
5fd69c4fa9f1a2a6fbdab11ff45053dbd08237e6190dfc9c071fadd08fe9b7d5

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
home.secureapp.att.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
Connection
keep-alive
Cache-Control
no-cache
Referer
https://home.secureapp.att.net/css/sso/slid/1201/main.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Tue, 28 Nov 2017 14:03:37 GMT
Last-modified
Mon, 19 Jul 2010 03:35:58 GMT
Server
""
Etag
"16b-4c43c81e"
Content-type
image/png
Connection
keep-alive
Accept-ranges
bytes
Content-length
363
s.gif
home.secureapp.att.net/i/
Redirect Chain
  • https://home.secureapp.att.net/attportal/s/context.dll?id=9002001&type=clickthru&name=cgate.signIn.Pageviews.www-att-net&redirecturl=/i/s.gif?nocache=9518
  • https://home.secureapp.att.net/i/s.gif?nocache=9518
43 B
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://home.secureapp.att.net/i/s.gif?nocache=9518
Protocol
HTTP/1.0
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2001:1890:1c01:2::42 , United States, ASN7018 (ATT-INTERNET4 - AT&T Services, Inc., US),
Reverse DNS
Software
"" /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
home.secureapp.att.net
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://www.walkingproject.org/sasa/Indexxatt.htm
Cookie
ZIP2COOKIESTR=uniqueid=112817140338175008775&ppvdr=&userid=1&userpw=.&gloc=0&uh=1_0_; ATTINTCOOKSTR=uniqueid=112817140338175008775
Connection
keep-alive
Cache-Control
no-cache
Referer
https://www.walkingproject.org/sasa/Indexxatt.htm
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

Response headers

Date
Tue, 28 Nov 2017 14:03:38 GMT
Last-modified
Thu, 25 Sep 2003 20:17:53 GMT
Server
""
Etag
"2b-3f734d71"
Content-type
image/gif
Connection
keep-alive
Accept-ranges
bytes
Content-length
43

Redirect headers

Location
https://home.secureapp.att.net/i/s.gif?nocache=9518
Date
Tue, 28 Nov 2017 14:03:38 GMT
Connection
keep-alive
Server
""
Set-cookie
ZIP2COOKIESTR=uniqueid=112817140338175008775&ppvdr=&userid=1&userpw=.&gloc=0&uh=1_0_; path=/; domain=.att.net ATTINTCOOKSTR=uniqueid=112817140338175008775; expires=Wednesday, 09-Dec-2019 23:12:40 GMT; path=/; domain=.att.net
Content-length
0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: AT&T (Telecommunication)

31 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery string| agent string| ORIGINATION_POINT_URL string| RETURN_URL string| CANCEL_URL function| getWindowWidth function| getWindowHeight function| setRegURL function| logPgvw function| refer function| submitForm function| trimAll function| chkTick function| unchkTick function| getElementsByClassName function| btnChange function| acctSelBtnEnable function| ie6Img function| getYadContents function| init undefined| countdownElement function| overlay function| cancelLoad function| Redirecturl string| focusableElementsString function| trapTabKey function| supportRedirect object| yld_mgr string| q1Zidx string| q2Zidx

1 Cookies

Domain/Path Name / Value
www.walkingproject.org/ Name: IV_JCT
Value: %2FcommonLogin