at-t.info Open in urlscan Pro
2606:4700:3037::6815:1013 Public Scan

Go To Rescan
Add Verdict Report

URL:
http://at-t.info/
Submission Tags: phishing
Submission: On May 16 via api (May 16th 2022, 6:55:03 pm UTC) from US — Scanned from DE

Summary HTTP 8 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 8 HTTP transactions. The main IP is 2606:4700:3037::6815:1013, located in United States and belongs to CLOUDFLARENET, US. The main domain is at-t.info.

This is the only time at-t.info was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
5	2606:4700:303... 2606:4700:3037::6815:1013	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:831::200a	15169 (GOOGLE) (GOOGLE)
1	2620:0:862:ed... 2620:0:862:ed1a::2:b	14907 (WIKIMEDIA) (WIKIMEDIA)
1	45.61.48.155 45.61.48.155	47869 (NETROUTIN...) (NETROUTING-AS)
8	4

5 2606:4700:3037::6815:1013 (United States)

ASN13335 (CLOUDFLARENET, US)

at-t.info	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:0:862:ed1a::2:b (United States)

ASN14907 (WIKIMEDIA, US)

upload.wikimedia.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 45.61.48.155 (United States)

ASN47869 (NETROUTING-AS, NL)
PTR: server.cplicense.net

www.tweakservers.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	at-t.info at-t.info	11 KB
1	tweakservers.com www.tweakservers.com	1 KB
1	wikimedia.org upload.wikimedia.org — Cisco Umbrella Rank: 2213	20 KB
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 295	94 KB
8	4

	Domain	Requested by
5	at-t.info	at-t.info
1	www.tweakservers.com	at-t.info
1	upload.wikimedia.org	at-t.info
1	ajax.googleapis.com	at-t.info
8	4

This site contains no links.

Subject Issuer	Validity	Valid
*.wikipedia.org DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2021-10-19` - `2022-11-17`	a year	crt.sh
tweakservers.com R3	`2022-03-23` - `2022-06-21`	3 months	crt.sh

This page contains 1 frames:

Primary Page: http://at-t.info/
Frame ID: EE9DEAAD38E75D86853C17B6208B5A93
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

AT&T Secure Form

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

8
Requests

25 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

126 kB
Transfer

140 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

8 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
at-t.info/ 7 KB
2 KB 114ms
73ms Document
text/html 2606:4700:3037::6815:1013
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://at-t.info/
Protocol: HTTP/1.1
Server: 2606:4700:3037::6815:1013 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.3.31
Resource Hash: f1e5d50763bd1a1a26124a650fd2d5100a5cd6e6535f8d40365c648f2bda34ab

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
accept-language: de-DE,de;q=0.9

Response headers

CF-Cache-Status: DYNAMIC
CF-RAY: 70c653351a5f901e-FRA
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Mon, 16 May 2022 18:54:59 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9%2BSVmbYJNuuQYVBqtUF9PsxN3YHh2JMeByRlZSz8XEmF0rhUuqykb0UQxrTYutT2cfaYpry152GCdDRVTKCUZGc6sqzxF1MZ6DMPqyYdb7qmltQidqs6TSE7KwKBoGnMXoxIFFDhFyM%3D"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
vary: Accept-Encoding
x-powered-by: PHP/7.3.31
x-turbo-charged-by: LiteSpeed

GET
H/1.1 200
OK jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.11.1/ 94 KB
94 KB 80ms
41ms Script
text/javascript 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

http://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js

Requested by

Host: at-t.info
URL: http://at-t.info/

Protocol

HTTP/1.1

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://at-t.info/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

Date: Mon, 16 May 2022 14:35:02 GMT
X-Content-Type-Options: nosniff
Age: 15597
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
Cross-Origin-Resource-Policy: cross-origin
Content-Length: 95786
X-XSS-Protection: 0
Last-Modified: Tue, 03 Mar 2020 19:15:00 GMT
Server: sffe
Cross-Origin-Opener-Policy: same-origin; report-to="hosted-libraries-pushers"
Vary: Accept-Encoding
Report-To: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
Content-Type: text/javascript; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31536000, stale-while-revalidate=2592000
Accept-Ranges: bytes
Timing-Allow-Origin: *
Expires: Tue, 16 May 2023 14:35:02 GMT

GET
H/1.1 200
OK form.js Show response
at-t.info/cfgen-form-1/js/ 11 KB
4 KB 21ms
21ms Script
application/javascript 2606:4700:3037::6815:1013
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://at-t.info/cfgen-form-1/js/form.js
Requested by: Host: at-t.info
URL: http://at-t.info/
Protocol: HTTP/1.1
Server: 2606:4700:3037::6815:1013 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 81e95903efc8f11f23d8fde3d3f44ceccec4d6b7a8a2a3b4ea949db200ad552f

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://at-t.info/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

Date: Mon, 16 May 2022 18:54:59 GMT
content-encoding: gzip
CF-Cache-Status: HIT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Age: 7584
Connection: keep-alive
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 3139
last-modified: Wed, 20 Apr 2022 16:38:18 GMT
Server: cloudflare
vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xyt5rk1%2FtJRyJWet9M3VbM0baTDd5Mw35%2BKDYGFoqFGrsnbT%2FuHnSl1HQEKguKe1wIskdchaEr9p3zZocAK4gLRZFR1TUtWAzxMhuVWvFqCS5CFUAA7SHZHsyEiTxHI6Gb6XUKIxcz0%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: application/javascript
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
Accept-Ranges: bytes
CF-RAY: 70c653365d45901e-FRA
expires: Mon, 23 May 2022 16:48:34 GMT

GET
H/1.1 200
OK form.css
at-t.info/cfgen-form-1/css/ 7 KB
2 KB 43ms
30ms Stylesheet
text/css 2606:4700:3037::6815:1013
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: http://at-t.info/cfgen-form-1/css/form.css
Requested by: Host: at-t.info
URL: http://at-t.info/
Protocol: HTTP/1.1
Server: 2606:4700:3037::6815:1013 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f4b120ca0d0095f8eba1e7fc9c049550dff5f7d6d6ea57e77e867c255d140f19

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://at-t.info/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

Date: Mon, 16 May 2022 18:54:59 GMT
content-encoding: gzip
CF-Cache-Status: HIT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Age: 7584
Connection: keep-alive
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 1377
last-modified: Wed, 20 Apr 2022 16:38:18 GMT
Server: cloudflare
vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PY1TRT0WAMYRqSoQqglYrn371fXEANLWMwrHptMZPr834ZEUSuLBc4w%2F%2BQr98GEi9qw1pxkXfihx9kSlvpJtpV6BDZmRZ%2FcJ7hqmm9f5VPYb7QiY5Viq05OxfiUzIvA5R9aphuBDD3I%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: text/css
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
Accept-Ranges: bytes
CF-RAY: 70c653366bb99be6-FRA
expires: Mon, 23 May 2022 16:48:34 GMT

GET
H2 200 200px-Logo_for_at%26t.svg.png
upload.wikimedia.org/wikipedia/commons/thumb/0/04/Logo_for_at%26t.svg/ 18 KB
20 KB 74ms
28ms Image
image/png 2620:0:862:ed1a::2:b
WIKIMEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://upload.wikimedia.org/wikipedia/commons/thumb/0/04/Logo_for_at%26t.svg/200px-Logo_for_at%26t.svg.png

Requested by

Host: at-t.info
URL: http://at-t.info/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2620:0:862:ed1a::2:b , United States, ASN14907 (WIKIMEDIA, US),

Reverse DNS

Software

ATS/8.0.8 /

Resource Hash

c69f50bafdb46de97e8f962de10b4272ef3e194846ac5b4eb8c453349c4792c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=106384710; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://at-t.info/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date: Sun, 15 May 2022 23:13:05 GMT
nel: { "report_to": "wm_nel", "max_age": 86400, "failure_fraction": 0.05, "success_fraction": 0.0}
age: 70915
x-cache-status: hit-front
x-cache: cp3063 hit, cp3065 hit/2
content-disposition: inline;filename*=UTF-8''Logo_for_at%26t.svg.png
server-timing: cache;desc="hit-front", host;desc="cp3065"
content-length: 18786
x-client-ip: 2a03:1b20:6:f011::9e
accept-ranges: bytes
last-modified: Sat, 23 Apr 2022 02:39:33 GMT
server: ATS/8.0.8
etag: 55267aa3ab54b251044b4a1335b153ee
strict-transport-security: max-age=106384710; includeSubDomains; preload
report-to: { "group": "wm_nel", "max_age": 86400, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] }
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache
permissions-policy: interest-cohort=(),ch-ua-arch=(self "intake-analytics.wikimedia.org"),ch-ua-bitness=(self "intake-analytics.wikimedia.org"),ch-ua-full-version-list=(self "intake-analytics.wikimedia.org"),ch-ua-model=(self "intake-analytics.wikimedia.org"),ch-ua-platform-version=(self "intake-analytics.wikimedia.org")
accept-ch: Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
timing-allow-origin: *

GET
H/1.1 200
OK captcha.php
at-t.info/cfgen-form-1/inc/ 367 B
1 KB 60ms
60ms Image
image/png 2606:4700:3037::6815:1013
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://at-t.info/cfgen-form-1/inc/captcha.php
Requested by: Host: at-t.info
URL: http://at-t.info/
Protocol: HTTP/1.1
Server: 2606:4700:3037::6815:1013 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.3.31
Resource Hash: ad2fbfb1065122e255ca036032bfd09ddfe868aff65c8b962ac6e5abf414b047

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://at-t.info/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

pragma: no-cache
Date: Mon, 16 May 2022 18:54:59 GMT
CF-Cache-Status: DYNAMIC
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
x-powered-by: PHP/7.3.31
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8C%2BdvUisaN%2Ff%2BiYIWSuKVgbVgaAgp0mqK%2FzRpW%2FUjTwiEqUkRBgMjcgQze%2BaDiGBnEz5jqaE%2FftBbsEAcFluqgA2kTfvq7AxuQNfV8KGh1M4Tu7GqINE8GG%2BUIMEmIy7BQcd6Bhq%2FqQ%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: image/png
cache-control: no-store, no-cache, must-revalidate
x-turbo-charged-by: LiteSpeed
Connection: keep-alive
CF-RAY: 70c653375db19be6-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 367
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H/1.1 200
OK captcha-refresh.png
at-t.info/cfgen-form-1/img/ 829 B
2 KB 27ms
27ms Image
image/png 2606:4700:3037::6815:1013
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://at-t.info/cfgen-form-1/img/captcha-refresh.png
Requested by: Host: at-t.info
URL: http://at-t.info/
Protocol: HTTP/1.1
Server: 2606:4700:3037::6815:1013 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fcb5c333e313f4b67282881de5b1422b1b7ac55bd0d96c9496e1654098b1d950

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://at-t.info/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

Date: Mon, 16 May 2022 18:54:59 GMT
CF-Cache-Status: HIT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Age: 7584
Connection: keep-alive
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
Content-Length: 829
last-modified: Wed, 20 Apr 2022 16:38:18 GMT
Server: cloudflare
Vary: Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2onqG3TQG8YF%2BuMIzh06ep0pvbKAYARchbffp2%2BQMqwAHyFHNpnWU%2Bo5Ydmrek2t10ExP0bAzDk%2FuXx4Hp2KKKcfuk7ER3xsty4%2FfP4s9lhiAPwCH3hwVkMkxCNxuAQfGUWGZJgCoIQ%3D"}],"group":"cf-nel","max_age":604800}
Content-Type: image/png
cache-control: public, max-age=604800
x-turbo-charged-by: LiteSpeed
Accept-Ranges: bytes
CF-RAY: 70c65337a83e901e-FRA
expires: Mon, 23 May 2022 16:48:35 GMT

GET
H2 200 symantec_norton_sites_seal.jpg
www.tweakservers.com/wp-content/uploads/ 1 KB
1 KB 306ms
88ms Image
image/jpeg 45.61.48.155
NETROUTING-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tweakservers.com/wp-content/uploads/symantec_norton_sites_seal.jpg
Requested by: Host: at-t.info
URL: http://at-t.info/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.61.48.155 , United States, ASN47869 (NETROUTING-AS, NL),
Reverse DNS: server.cplicense.net
Software: imunify360-webshield/1.18 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://at-t.info/
User-Agent: ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

cf-edge-cache: no-cache
date: Mon, 16 May 2022 18:55:00 GMT
cache-control: private, no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
last-modified: Monday, 16-May-2022 18:55:00 GMT
server: imunify360-webshield/1.18
content-type: image/jpeg

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			at-t.info/	1969-12-31 23:59:59	Name: PHPSESSID Value: dcdbdd629b41c3f6aa36847cba9268fa

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
at-t.info
upload.wikimedia.org
www.tweakservers.com
2606:4700:3037::6815:1013
2620:0:862:ed1a::2:b
2a00:1450:4001:831::200a
45.61.48.155
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
81e95903efc8f11f23d8fde3d3f44ceccec4d6b7a8a2a3b4ea949db200ad552f
ad2fbfb1065122e255ca036032bfd09ddfe868aff65c8b962ac6e5abf414b047
c69f50bafdb46de97e8f962de10b4272ef3e194846ac5b4eb8c453349c4792c7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f1e5d50763bd1a1a26124a650fd2d5100a5cd6e6535f8d40365c648f2bda34ab
f4b120ca0d0095f8eba1e7fc9c049550dff5f7d6d6ea57e77e867c255d140f19
fcb5c333e313f4b67282881de5b1422b1b7ac55bd0d96c9496e1654098b1d950

at-t.info Open in urlscan Pro 2606:4700:3037::6815:1013 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

8 Requests

25 %HTTPS

75 %IPv6

4 Domains

4 Subdomains

4 IPs

2 Countries

126 kBTransfer

140 kBSize

1 Cookies

0 Outgoing links

Redirected requests

8 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

1 Cookies

Indicators

at-t.info Open in urlscan Pro
2606:4700:3037::6815:1013 Public Scan

Screenshot
Live screenshot

Full Image

8
Requests

25 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

126 kB
Transfer

140 kB
Size

1
Cookies

8 HTTP transactions
0 data transactions