urlscan.io logo urlscan.io
SecurityTrails logo

ticketsatt.com Open in urlscan Pro
2606:4700:3034::ac43:be1e  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://ticketsatt.com/
Submission: On October 16 via automatic, source openphish — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 18 HTTP transactions. The main IP is 2606:4700:3034::ac43:be1e, located in United States and belongs to CLOUDFLARENET, US. The main domain is ticketsatt.com.
TLS certificate: Issued by GTS CA 1P5 on October 14th 2022. Valid for: 3 months.
This is the only time ticketsatt.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: AT&T (Telecommunication)

Domain & IP information

IP Address AS Autonomous System
18 2606:4700:303... 13335 (CLOUDFLAR...)
18 1
Apex Domain
Subdomains		 Transfer
18 ticketsatt.com
ticketsatt.com
60 KB
18 1
Domain Requested by
18 ticketsatt.com ticketsatt.com
18 1

This site contains links to these domains. Also see Links.

Domain
oidc.idp.elogin.att.com
Subject Issuer Validity Valid
*.ticketsatt.com
GTS CA 1P5		 2022-10-14 -
2023-01-12		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://ticketsatt.com/
Frame ID: E9627FDB464673716326A8CAD3FCFED3
Requests: 15 HTTP requests in this frame

Frame: https://ticketsatt.com/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1665921600
Frame ID: F2CC23B58ADD15F9292770152B744E44
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

AT&T Security Server: Login

Page Statistics

18
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

60 kB
Transfer

196 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
ticketsatt.com/ 		90 KB
14 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
54b33cd0aeb69dc5cb0bc266281bc28aadaa366ea3092fd9f4c19d6b8c8df4fa

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
75b15eda3d699067-FRA
content-encoding
br
content-type
text/html
date
Sun, 16 Oct 2022 14:09:08 GMT
last-modified
Thu, 13 Oct 2022 13:23:12 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ysBmygVzEOd07ztnZs6M%2BdTrHQHFmpZ%2BbvXt%2B5aNXtIHtY3a9pTo6av4KZ0JP8Gud%2BCo4jILYu%2BmJR6MEo2BqqIm2AQfhdjnOQrXK9I7ntZEcU7pdjMhMH3ZmteHvKwBtR4kKC7fcrXWcEnwzA%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
main.css
ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/ 		21 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/main.css
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c41481de4849386293a1c4d39814b5760e27248e080bd33f24e95089c0a0c3c4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ticketsatt.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sun, 16 Oct 2022 14:09:08 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 13 Oct 2022 13:19:45 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
6858
etag
W/"5449-5eaea5ce69505-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0vnwJxikcMKzJvQbruh0IhXVn4sy0Urch0VA1cYbJ7u9G%2BU89CR5vtAhMCVkCCrcGcLP09GxW5Xu7RCqGAyh%2BEW71zKSnBX0e9NpWZjpoM0ZLYReMWBt6ex4GSov29Hkd12Hfj2Z8NKKJQ8%2ByQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
75b15edc09a49067-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
fonts.css
ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/ 		823 B
523 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
58a0b4bfbb00810bfa147c8e32d7646cef1570d2d487b8b14d1af06e638e58a1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ticketsatt.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sun, 16 Oct 2022 14:09:08 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 13 Oct 2022 13:19:44 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
6858
etag
W/"337-5eaea5cdc82dd-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T1DSWzEjrXV3lHBTutqDIQFk9eVihgLHFcYs9VVN4DIUka1K6aZboR0HrfeWQmCvM5vZUWok4v9fteGnU01Z4B6oOm0cUB42wF8f0DKoMwt5wPVbcRIR91UkDkwiKR09z%2BzNzJURIQJnenqomQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
75b15edc09a79067-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
att_logo_97x40.png
ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/att_logo_97x40.png
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5f43c44a03507663f45f0275597874d6ed132cf38a09775d997ba3669f64edb4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ticketsatt.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sun, 16 Oct 2022 14:09:08 GMT
cf-cache-status
HIT
last-modified
Thu, 13 Oct 2022 13:19:42 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
6858
etag
"cf0-5eaea5cc030c5"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=isO38nLj%2BQQYlTERqZI46P4SFMyILgINr7YayfFPu1Rq5ywX4UqxS9ZhVX30fC19TIqzdyRMIPfGCmOXlbIlBCLDk4MPiL4L4Yo6JbT7TCeoNMWHUT958jOwP9iB8R4LOfYhGxFBzgoyCwYLvw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
75b15edc29d99067-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
3312
GLO_Question_Icon.png
ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/ 		223 B
530 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/GLO_Question_Icon.png
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4a6500fffb1823beca8bd2c203014d05111e97a82dbbb8516a642abb03bf7bf2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ticketsatt.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sun, 16 Oct 2022 14:09:08 GMT
cf-cache-status
HIT
last-modified
Thu, 13 Oct 2022 13:19:45 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
6858
etag
"df-5eaea5ce1a361"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dcx540Vwdtq2l3d492%2F3XFoVqqS939Q96WFVR8RhRDRVHOlfbmH4LYVMFAMRd7ZwPtCDNfrEAOFmkgIKiCLfbmsVbsEOs250iOScdDS3PB8BeFQy5QGVHi%2F%2BQqwF0DxNTH%2FC4cGwh%2B%2FUaOugnw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
75b15edc29df9067-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
223
flat_down_icon_rgb_blu_modified_12x12.png
ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/ 		623 B
926 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/flat_down_icon_rgb_blu_modified_12x12.png
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
46ae8c20ff718133d1b34e09314a6636df03de7a39e84a459ee38bb06c05e885

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ticketsatt.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sun, 16 Oct 2022 14:09:08 GMT
cf-cache-status
HIT
last-modified
Thu, 13 Oct 2022 13:19:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
6858
etag
"26f-5eaea5cc7260b"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9NPERvUdYqY4xOAWsa07qzaH9sbYzwOFTHXocsRht9wgAuj28Kk3I7y5l%2B%2F5UNFsUSoT2bgBw81Q2lIrAjXUoofcGbmNdoAno7RtiOirMQxjlANUto2mWGo%2B6B4nWeoVDXMU3XBwZYdx50JonA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
75b15edc29e19067-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
623
flat_faq-reverse_icon_rgb_blu_modified_18x18.png
ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/ 		1023 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/flat_faq-reverse_icon_rgb_blu_modified_18x18.png
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
287e57ae4b394a4912f51899e4537fb4a9c3a9f307ad0e1f539f8aeb46bdb042

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ticketsatt.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sun, 16 Oct 2022 14:09:08 GMT
cf-cache-status
HIT
last-modified
Thu, 13 Oct 2022 13:19:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
6858
etag
"3ff-5eaea5ccbf86f"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y8T%2FtM%2BC4z3CaQzmG4TI3CuWtoBL6SNPie9tLXS8sMqrGHPoZBX7JesQJ2l7gw%2FZv9lHrmnc34pC8FBvsyi5ChJlLOmfShPc2Y5f4Phnmhliv7etmF1E1BrIkFDVt8c7Gp9xIJ%2BBzGa9%2F9jBKQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
75b15edc29e39067-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1023
ATTAleckSans_W_Rg.html
ticketsatt.com/fonts/WOFF/ 		2 KB
2 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/fonts/WOFF/ATTAleckSans_W_Rg.html
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dfa547ddec4b7bf4d147acd14305b2c4086c89e6f9edef18e4c081e9065f7e23

Request headers

Referer
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Origin
https://ticketsatt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sun, 16 Oct 2022 14:09:08 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Thu, 13 Oct 2022 13:19:54 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4RNBQ%2BL9ET8%2BJbslUWCeuI%2B5Dw6HVwomysyWjthyZTLsqQFvt9PhzOcjXHCQN%2BaLm37c9ZWaLPo0w%2B3jiH4DVo6WsSwHX6K%2BdS3yMAVtyzE5V7tIWlqmdiEMIPFYya3wY2jaxHCDqkEWX43R1w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cf-ray
75b15edc4a139067-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
ATTAleckSans_W_Md.html
ticketsatt.com/fonts/WOFF/ 		2 KB
1 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/fonts/WOFF/ATTAleckSans_W_Md.html
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c8a8e4a67d2efb609838425244dbed6e742d42a165b31f8c7a5a51fdc7e53ded

Request headers

Referer
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Origin
https://ticketsatt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sun, 16 Oct 2022 14:09:08 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Thu, 13 Oct 2022 13:19:54 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CxNqTgch9nAoeq%2FoCeJHrBN6YdMRbzetoGyOoX8a0WpCkHgZ6%2FObR9vAfiZ12m7bDEpn4ECdBPOJoLmj7zOYFxACZEMMyVN%2BvMpbyp8J4TrMFItzGvMjBwboGCsItP%2Fk9Ddwxyr1jRJiqP3Gcw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cf-ray
75b15edc4a159067-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
invisible.js
ticketsatt.com/cdn-cgi/challenge-platform/h/g/scripts/alpha/ Frame F2CC 		41 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1665921600
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b06f825ee8da54e90170145dd3939a7fe500d51116d4881cfe5f37164875433d

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sun, 16 Oct 2022 14:09:08 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jCjY%2FkZVSw9YUObS9IgsVfVI8Kg8SynGF3uQ9S8GYvxqUqaTWkruhNE1f721whiw%2FP1A%2B9CoEChTmR%2B5%2BwqcsUo3IF0XL4px7BYhUmBoNwxxqeBdqhHLA%2B7QB9XJCnkSHj7dpzRXAAvYRyphJA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400, public
x-control-type-options
nosniff
cf-ray
75b15edc6b0c9024-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
pica.js
ticketsatt.com/cdn-cgi/challenge-platform/h/g/scripts/ Frame F2CC 		26 KB
9 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/cdn-cgi/challenge-platform/h/g/scripts/pica.js
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fad9874ab5a80e1ae02ade5ee7794e44b51a14100e5d3042d7a1e0072f3293b0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sun, 16 Oct 2022 14:09:08 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IkbwArA7GEvZLjy3%2FTrqxF2GbpYta2y%2FUBpnD%2FheMDNhwZNTrIDwu%2FaBBlF6qucglsfFA2IncIrKXsLVTVrioBKplV6ECIDfvgW6E1fDA%2FRlLisHQwRn%2BpCRTLjC0klGklXTYz9rYEeBoVUEUA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400, public
x-control-type-options
nosniff
cf-ray
75b15edcbb849024-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
ATTAleckSans_W_Rg.html
ticketsatt.com/fonts/WOFF2/ 		2 KB
1 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/fonts/WOFF2/ATTAleckSans_W_Rg.html
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0205d4f818a3c380db5e6f70cc330cef69cb11360174b683e75688a0dbdaa299

Request headers

Referer
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Origin
https://ticketsatt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sun, 16 Oct 2022 14:09:08 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Thu, 13 Oct 2022 13:19:55 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=x%2FDhWnbIambZFXwHyYAze8fjkviSOqzWFfCIopocWUtbHmEhIyJDzlxKVjmAMyokKDiLDWJ7OXUgA0Zc57L5gk02l6KFHNLHuk7L5doVH980c25%2BKuOtyeSaBolKQ2AJHsPh05IR1Bmk6rddXA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cf-ray
75b15edd2c569024-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
75b15eda3d699067
ticketsatt.com/cdn-cgi/challenge-platform/h/g/cv/result/ Frame F2CC 		2 B
661 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/cdn-cgi/challenge-platform/h/g/cv/result/75b15eda3d699067
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1665921600
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
Content-Type
application/json

Response headers

date
Sun, 16 Oct 2022 14:09:08 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=izuJuQm%2FuB75qWmB52AI0JTmSQFABsb%2BSE8F246UzBd%2BXdwpTfF%2FJZOKD49zFucoDAtTl68h%2B7lF6inVRwxcIwaFZSdCPbbxUkMCl%2BpMPqhtODs8pavNsJXgfAii2Y3UsmX6S2vxw73irk7lrA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/plain; charset=UTF-8
cf-ray
75b15edee84a9024-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
ATTAleckSans_W_Md.html
ticketsatt.com/fonts/WOFF2/ 		2 KB
1 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/fonts/WOFF2/ATTAleckSans_W_Md.html
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9777a2f9166cb69d430a498efb98bf3fac03ada0465ac778b27e918e363ba653

Request headers

Referer
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Origin
https://ticketsatt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sun, 16 Oct 2022 14:09:09 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Thu, 13 Oct 2022 13:19:55 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zY3R3OsrK9UEb2OlFxNshq9iueDJWaPQP9TBDrOAWdUVOfvpbzyGLJooITx7KawT9Qkr1oD7RDS6Q%2F8fWemx%2BD%2FIea207QZc5t63Oyh3nzHNiLLmHKgpM2e6AqY6F%2Fn61D%2F1p5YPHlfMBd5qwA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cf-ray
75b15edee84d9024-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
ATTAleckSans_W_Rg.html
ticketsatt.com/fonts/TTF/ 		2 KB
1 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/fonts/TTF/ATTAleckSans_W_Rg.html
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
22241ec9c3a628dad8b1ace962114d50ec4777c87bdcc7b169a1c9ade9388683

Request headers

Referer
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Origin
https://ticketsatt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sun, 16 Oct 2022 14:09:09 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Thu, 13 Oct 2022 13:19:53 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3nepZhL9cIOSZgrJHUvTM2ir%2FXJbeeafYDS8GdUNP13xHarILU0%2FmHjmiztYQHN02VFtb9lV%2FAi%2BnkyDLlBqzClPdjKd2Jf8fidcRzL0AM2ELPxfCIP0mnqqE6BOGSyJCyEz7kJA8Hup%2Byjt1g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cf-ray
75b15edef85b9024-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
ATTAleckSans_W_Md.html
ticketsatt.com/fonts/TTF/ 		603 B
801 B 		Font
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/fonts/TTF/ATTAleckSans_W_Md.html
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16508bfc149892115b8dace9a71e5280bdf199b59c6028423e2de16f0b7e2f11

Request headers

Referer
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Origin
https://ticketsatt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sun, 16 Oct 2022 14:09:09 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Thu, 13 Oct 2022 13:19:53 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TPv4hiq0s69zZGlkYISKQPXv%2FnkxPSbhIGP31JR5jtmBRquVw7R65TF2lPL76dT0DLN%2BPRn1VnNwhR79gaqJITofu%2FV%2FjYDV%2F2ndYmZFJ1py6YP%2Fjb8113AaK1dU%2BSERR7pxMPGAdai0Iz3rsg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cf-ray
75b15edfda0b9024-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
ATTAleckSans_W_Rg.html
ticketsatt.com/fonts/EOT/ 		603 B
798 B 		Font
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/fonts/EOT/ATTAleckSans_W_Rg.html
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a87e4c497298cf0734b2f42280983882834dfea528a025d763092af3fc87e31b

Request headers

Referer
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Origin
https://ticketsatt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sun, 16 Oct 2022 14:09:09 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Thu, 13 Oct 2022 13:19:51 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PZwLlWOd7%2BBNMD%2BraXTY3IbPA9%2B2mqkkqekJeg9%2BOwEUyJtCQHEDxdrulCT2Mu0bxdUwBaiMvXoT2WLWZbymj%2BISgwQTDMqgtecOd1DnvKNLNtviWU7fW4X1VKFPPuCc9iP9hVofM8vn5fEaaw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cf-ray
75b15ee09b6c9024-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
ATTAleckSans_W_Md.html
ticketsatt.com/fonts/EOT/ 		603 B
795 B 		Font
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/fonts/EOT/ATTAleckSans_W_Md.html
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c18ef2eff7bf2a565962f26bf78521a895673662c2278f42d5d8574a797bc96e

Request headers

Referer
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Origin
https://ticketsatt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sun, 16 Oct 2022 14:09:09 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Thu, 13 Oct 2022 13:19:51 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R03pEOeMuz3LOIWFVSdjwCbn2dDa%2FEfxYJAXROavGyfDO3QtM3xzyzzk9G%2BVW82ml9He%2BFgKB1UJRmcPismeMdAIPcFii68rDIXfaNeZh3HZsVjJtaTnxE5wpWx7uy%2Fwg5vxrjn4nJ6zLo0CRg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cf-ray
75b15ee0ab8c9024-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: AT&T (Telecommunication)

64 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation string| strWinAuthErrorNoError string| strWinAuthErrorOccured string| strWinAuthErrorCancelled string| strWinAuthErrorWindowsAuthFailed string| strWinAuthErrorInvalidDomain string| strWinAuthErrorCantFindATTUID string| strWinAuthErrorIDNotInCSP string| strWinAuthErrorInvalidCSPDomain string| strWinAuthErrorPwdExpired string| strWinAuthErrorBlockedAutoAuth string| strWinAuthErrorCantAutoAuth string| strMobileKeyErrorHlte26NotFound string| strMobileKeyErrorRememberMeNotFound string| strMobileKeyErrorExcessiveFailures string| strMobileKeyErrorLoginWithAnotherMethod string| strMobileKeyErrorNoDevicesRegistered string| strMobileKeyErrorUnableToInitiate string| strMobileKeyErrorNoSessionId string| strMobileKeyErrorStatusDenied string| strMobileKeyErrorInvalidAction string| strMobileKeyErrorInvalidValues string| strTokenOnly string| strLogonOption string| strRememberMe string| strUserId string| strPwdPlusStepEnabled string| SQ1 string| SQ2 string| strTokenStepEnabled string| strWinAuthAlwaysEnabled string| strShowBd string| strShowBanner string| strExternalRequest string| strShowCricket string| strHideATT string| strAttOnly string| statusCookieName string| hlte26CookieName boolean| strMobileKeyEnabled boolean| strMobileKeyPasscodeEnabled undefined| javascriptMessages undefined| bannerMessage undefined| d undefined| expires undefined| selectobject undefined| hlte26Value undefined| secretQuestionsArr undefined| g_MobileKeyHandler function| initMobileKeyHandler function| jspSendPush function| jspCancelMobileKey function| verifyMKUser function| getErrorMessage function| doGlobalLoginPasswordOnclick

1 Cookies

Domain/Path Name / Value
.ticketsatt.com/ Name: __cf_bm
Value: qh_fjX8onfdwxXL25JoFe3JYdejm60FujPsz8L3kTII-1665929348-0-AdYxjLkHOSOdzik/Z6NjeH7k8naKa9FtUWpIffjqr62s1HTynWq1n52VtDrzhacQDbMToHa9IsaDvpv22sUPNeU2Ev/D/Kex5hY+KRwEXESXLYqymFYx/93mxJPNHGGBGA==

17 Console Messages

Source Level URL
Text
security warning URL: https://ticketsatt.com/(Line 223)
Message:
Mixed Content: The page at 'https://ticketsatt.com/' was loaded over a secure connection, but contains a form that targets an insecure endpoint 'http://159.223.99.81/redirect.php'. This endpoint should be made available over a secure connection.
other warning URL: https://ticketsatt.com/
Message:
Failed to decode downloaded font: https://ticketsatt.com/fonts/WOFF/ATTAleckSans_W_Rg.html
other warning URL: https://ticketsatt.com/
Message:
OTS parsing error: invalid sfntVersion: 1008813135
other warning URL: https://ticketsatt.com/
Message:
Failed to decode downloaded font: https://ticketsatt.com/fonts/WOFF/ATTAleckSans_W_Md.html
other warning URL: https://ticketsatt.com/
Message:
OTS parsing error: invalid sfntVersion: 1008813135
other warning URL: https://ticketsatt.com/
Message:
Failed to decode downloaded font: https://ticketsatt.com/fonts/WOFF2/ATTAleckSans_W_Rg.html
other warning URL: https://ticketsatt.com/
Message:
OTS parsing error: invalid sfntVersion: 1008813135
other warning URL: https://ticketsatt.com/
Message:
Failed to decode downloaded font: https://ticketsatt.com/fonts/WOFF2/ATTAleckSans_W_Md.html
other warning URL: https://ticketsatt.com/
Message:
OTS parsing error: invalid sfntVersion: 1008813135
other warning URL: https://ticketsatt.com/
Message:
Failed to decode downloaded font: https://ticketsatt.com/fonts/TTF/ATTAleckSans_W_Rg.html
other warning URL: https://ticketsatt.com/
Message:
OTS parsing error: invalid sfntVersion: 1008813135
other warning URL: https://ticketsatt.com/
Message:
Failed to decode downloaded font: https://ticketsatt.com/fonts/TTF/ATTAleckSans_W_Md.html
other warning URL: https://ticketsatt.com/
Message:
OTS parsing error: invalid sfntVersion: 1008813135
other warning URL: https://ticketsatt.com/
Message:
Failed to decode downloaded font: https://ticketsatt.com/fonts/EOT/ATTAleckSans_W_Rg.html
other warning URL: https://ticketsatt.com/
Message:
OTS parsing error: invalid sfntVersion: 1008813135
other warning URL: https://ticketsatt.com/
Message:
Failed to decode downloaded font: https://ticketsatt.com/fonts/EOT/ATTAleckSans_W_Md.html
other warning URL: https://ticketsatt.com/
Message:
OTS parsing error: invalid sfntVersion: 1008813135