urlscan.io logo urlscan.io
SecurityTrails logo

ticketsatt.com Open in urlscan Pro
2606:4700:3034::ac43:be1e  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://ticketsatt.com/
Submission Tags: phishing
Submission: On October 17 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 18 HTTP transactions. The main IP is 2606:4700:3034::ac43:be1e, located in United States and belongs to CLOUDFLARENET, US. The main domain is ticketsatt.com.
TLS certificate: Issued by GTS CA 1P5 on October 14th 2022. Valid for: 3 months.
This is the only time ticketsatt.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: AT&T (Telecommunication)

Domain & IP information

IP Address AS Autonomous System
18 2606:4700:303... 13335 (CLOUDFLAR...)
18 1
Apex Domain
Subdomains		 Transfer
18 ticketsatt.com
ticketsatt.com
60 KB
18 1
Domain Requested by
18 ticketsatt.com ticketsatt.com
18 1

This site contains links to these domains. Also see Links.

Domain
oidc.idp.elogin.att.com
Subject Issuer Validity Valid
*.ticketsatt.com
GTS CA 1P5		 2022-10-14 -
2023-01-12		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://ticketsatt.com/
Frame ID: 69D0E1DD073DEA41FD4B695198B6CDA5
Requests: 15 HTTP requests in this frame

Frame: https://ticketsatt.com/cdn-cgi/challenge-platform/h/b/scripts/alpha/invisible.js?ts=1666008000
Frame ID: 3BF7BBF6E397CA829636C3719030473C
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

AT&T Security Server: Login

Page Statistics

18
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

60 kB
Transfer

190 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
ticketsatt.com/ 		90 KB
14 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b93c923e22bb062e9b0a0bbb4e2dc77446b64ae994fbe17ec61b587a721ed3be

Request headers

Upgrade-Insecure-Requests
1
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
75b95317fed691d7-FRA
content-encoding
br
content-type
text/html
date
Mon, 17 Oct 2022 13:19:12 GMT
last-modified
Thu, 13 Oct 2022 13:23:12 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UO0T%2Fb89naoQsH%2Bv9gpGylZUnOI9xPEYiBq2PgXLvBbsHicN93j3sU7N9H1R4Awhl0bG%2FBw9O23X92TgtviriPaIu5YcCM2INgshVtixuSqcKPxYIHkANhlTf6j48w6xzaJJZ8fRft8ut1A0Dg%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
main.css
ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/ 		21 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/main.css
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c41481de4849386293a1c4d39814b5760e27248e080bd33f24e95089c0a0c3c4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ticketsatt.com/
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date
Mon, 17 Oct 2022 13:19:12 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 13 Oct 2022 13:19:45 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
5964
etag
W/"5449-5eaea5ce69505-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=s0fTmz%2FRMF1SfBnLJHJSbBlBTVaCJ2Ju9vLcj7COQ5g5WuaUSp9CbpGoiOyUmx9UkuKvo0M5%2BHT5In3p2qE6U%2Bve8supsrD8PFgEWu0AuETIFCJGFRKGvGZ%2FFHWxqVPRC7FQGapb0KgOI8GPMg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
75b953199a0291d7-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
fonts.css
ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/ 		823 B
525 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
58a0b4bfbb00810bfa147c8e32d7646cef1570d2d487b8b14d1af06e638e58a1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ticketsatt.com/
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date
Mon, 17 Oct 2022 13:19:12 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 13 Oct 2022 13:19:44 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
5964
etag
W/"337-5eaea5cdc82dd-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OFEzWPcSQlRxUg2skyVTlfki53RF2fGSiEPMDZMi%2B2t85NZS0x0CilVxxvV6Y9d9yuh94j5KQct4VxrKbo9UTm9Ln9Ajkjp5AUCw3lIC9Z2J9BO6AsVlDX8hCf2e8ASxugjYzvSRkY%2B6dbeKxA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
75b953199a0491d7-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
att_logo_97x40.png
ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/att_logo_97x40.png
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5f43c44a03507663f45f0275597874d6ed132cf38a09775d997ba3669f64edb4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ticketsatt.com/
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date
Mon, 17 Oct 2022 13:19:12 GMT
cf-cache-status
HIT
last-modified
Thu, 13 Oct 2022 13:19:42 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
5579
etag
"cf0-5eaea5cc030c5"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c4inUrrcVKHG3KSTrDLrLHG9kHjrmlzNVaQtgkO%2FG%2B4hB64ETeXtU2%2B8gx49rC7m3iCDmXEv2qUE89Wr%2FHoL3qRzsHLHtg5C2K%2BCz%2BosIhtwOZolgIfry0sXNJVZAA3e7JCVL39i92AYzq0Mag%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
75b9531a1fc468fe-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
3312
GLO_Question_Icon.png
ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/ 		223 B
714 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/GLO_Question_Icon.png
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4a6500fffb1823beca8bd2c203014d05111e97a82dbbb8516a642abb03bf7bf2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ticketsatt.com/
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date
Mon, 17 Oct 2022 13:19:12 GMT
cf-cache-status
HIT
last-modified
Thu, 13 Oct 2022 13:19:45 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
5579
etag
"df-5eaea5ce1a361"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6WHIWHTbRdAN9FjHbCuvCChRl9GmTXcWSFRAI3YH%2B%2BDugbUxXvJnDIebvQnC1GtNhXvTx9ZzPNSuwFqwxoZO%2FsjB22WxRlCoXOowNBfxtatv6F5R7QwrAzGGQ%2BSrWf%2F4gty8Jl52VUuNjgYm9g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
75b9531a2fc968fe-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
223
flat_down_icon_rgb_blu_modified_12x12.png
ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/ 		623 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/flat_down_icon_rgb_blu_modified_12x12.png
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
46ae8c20ff718133d1b34e09314a6636df03de7a39e84a459ee38bb06c05e885

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ticketsatt.com/
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date
Mon, 17 Oct 2022 13:19:13 GMT
cf-cache-status
HIT
last-modified
Thu, 13 Oct 2022 13:19:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
5580
etag
"26f-5eaea5cc7260b"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0ewlU3lklkqSV86uVdCqzsWFPiqCOs6Ohviec1mHrZKNxkQJ1NyHonwrxSwUKGeFcPTZU9kcP38%2BEs5mh7gGZa9e3fDE8z8cZ9EyMhito8dISOkal2aQ4NEudzlXwiUqb4N8Co7eGDpAkapJSg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
75b9531a2fcd68fe-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
623
flat_faq-reverse_icon_rgb_blu_modified_18x18.png
ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/ 		1023 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/flat_faq-reverse_icon_rgb_blu_modified_18x18.png
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
287e57ae4b394a4912f51899e4537fb4a9c3a9f307ad0e1f539f8aeb46bdb042

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ticketsatt.com/
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date
Mon, 17 Oct 2022 13:19:12 GMT
cf-cache-status
HIT
last-modified
Thu, 13 Oct 2022 13:19:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
age
5579
etag
"3ff-5eaea5ccbf86f"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RHtaS125OviVNQRqJ%2FQlJaWUH0AZHZhRBQkZpzJuGgahi0LOrw%2F9fb%2F2SNppKIEuV7zua3erJiuiIv85Su546BymiQy5njTVP4FD%2BnQL1E76VMHV3HDuAPxGAK3g%2BWR%2BQvqH73Vzprf6p8n1rA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
75b9531a2fd168fe-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1023
ATTAleckSans_W_Rg.html
ticketsatt.com/fonts/WOFF/ 		2 KB
1 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/fonts/WOFF/ATTAleckSans_W_Rg.html
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3f1ef3e4ed04378b5bfddf0fc9dba195dc20bc0cc6eeb107abeb8a821d6ba204

Request headers

Referer
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Origin
https://ticketsatt.com
accept-language
de-DE,de;q=0.9
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date
Mon, 17 Oct 2022 13:19:13 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Thu, 13 Oct 2022 13:19:54 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IiXwl9gyryVPvKC2zMz%2BetKduxsQGFi9yNDCd0CV8L5F3TW4V0dfF7I4JCXnV9btxj2TCBkY7vGqXry%2BzaD8Oryzfc%2BmsooRF6886cL4dODHHMVnxPqJ%2FiHAkXgZX4e3VYZLuQPV8GHQ4eAl1A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cf-ray
75b9531a2fde68fe-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
ATTAleckSans_W_Md.html
ticketsatt.com/fonts/WOFF/ 		2 KB
1 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/fonts/WOFF/ATTAleckSans_W_Md.html
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
34b1f503e5071c03574b37b52e80679950e7f0c0b64b941e9058ccff6a7b2c89

Request headers

Referer
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Origin
https://ticketsatt.com
accept-language
de-DE,de;q=0.9
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date
Mon, 17 Oct 2022 13:19:13 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Thu, 13 Oct 2022 13:19:54 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XsLfXZykqPYFh4yivtFmvliUREMTLcdyratVLfQy4Bns8T2ofARcxpwRbJrWJ5SiCGsXdKIMB%2FxsWXfV9OKIYboruEZXD9OtUYYEwxzg50xJ%2FvlvZdZXJejZFGng0nuDaT3bjeXQiiIjXCjl6g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cf-ray
75b9531a2fe068fe-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
invisible.js
ticketsatt.com/cdn-cgi/challenge-platform/h/b/scripts/alpha/ Frame 3BF7 		37 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/cdn-cgi/challenge-platform/h/b/scripts/alpha/invisible.js?ts=1666008000
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
14e72cb0bed84d9886a336258df0d9f8c02ebcba60579c927f83b281c245faa3

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date
Mon, 17 Oct 2022 13:19:13 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5oedz1iGPVsA2XwlUAwdhNqN5jCIfIPBcikkEHMifSXXc6VXkEsiGPvpQ9Z7jL7gCnR%2BamQpk16gnAf7X3ZtTkk9vwTATCmKWtzxEfQMXbtdqc%2FLi86jm7b%2Bmt1opdhdFyqsRysrn1zzv6%2BhmQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400, public
x-control-type-options
nosniff
cf-ray
75b9531a78af68fe-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
pica.js
ticketsatt.com/cdn-cgi/challenge-platform/h/b/scripts/ Frame 3BF7 		22 KB
8 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/cdn-cgi/challenge-platform/h/b/scripts/pica.js
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cff3ff99178048b06fc2ed99ab290d549dfa2b0f980527001cc7b026881f6ef3

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date
Mon, 17 Oct 2022 13:19:13 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t3G6p1wRphFhk2ZVjxdYRlwt2Qz%2BPrc15Uw0dwUSAZ0xNtYzSP8ijKXzeFb0BzdLMIXfoWR3vqCgec%2BAgJWuwcWo8Mcmg2PCXCFqg5Y9tHzVxU8lKssQACyDelX7Q%2F68InRp0zC36lHv3T8Ulw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400, public
x-control-type-options
nosniff
cf-ray
75b9531ab93f68fe-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
ATTAleckSans_W_Rg.html
ticketsatt.com/fonts/WOFF2/ 		2 KB
1 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/fonts/WOFF2/ATTAleckSans_W_Rg.html
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
58326f7ea5a67110cca1cc151b4a927e83f5190d6a230c235b87aba6e80a3939

Request headers

Referer
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Origin
https://ticketsatt.com
accept-language
de-DE,de;q=0.9
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date
Mon, 17 Oct 2022 13:19:13 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Thu, 13 Oct 2022 13:19:55 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JRbcDXpzDnoRJHQ50Izq42tze4OjX72ONL3fWjjyCz566v%2BuVAdi39VoW9wE9qq5lauHSsLy2ztsS%2FNqg2mjhftJa47P7jH8G9vcqKZTIwx1SRukVXSAW0Ku4gpoTEzG1HlzsEMYmIbHUauuhw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cf-ray
75b9531b5a6d68fe-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
ATTAleckSans_W_Md.html
ticketsatt.com/fonts/WOFF2/ 		2 KB
1 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/fonts/WOFF2/ATTAleckSans_W_Md.html
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d6ad1c6c2f7605fda6fb05fa2b3d59be93890b674e17a8062b677a016af50d82

Request headers

Referer
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Origin
https://ticketsatt.com
accept-language
de-DE,de;q=0.9
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date
Mon, 17 Oct 2022 13:19:13 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Thu, 13 Oct 2022 13:19:55 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dVcQpIztnzniqOtImrNIUfyFm8nHV0egeP7PU05ECa7XRrbrLrzoH6PrNUPmI78PXZyZBFt0qcvnp4j0CX%2FaTbj60%2FJmV0%2FBRbqaqz00f4pIjYn8qDNGbngG1%2ByUhLX0dkZFe5j9Dc8gISqR1A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cf-ray
75b9531b8aac68fe-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
ATTAleckSans_W_Rg.html
ticketsatt.com/fonts/TTF/ 		2 KB
1 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/fonts/TTF/ATTAleckSans_W_Rg.html
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3929a4945ddfd79cc090461d9d235579aa0146d135ed9f0100faab9a89d407c8

Request headers

Referer
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Origin
https://ticketsatt.com
accept-language
de-DE,de;q=0.9
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date
Mon, 17 Oct 2022 13:19:13 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Thu, 13 Oct 2022 13:19:53 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hgpRXYicFTGymxxWEnbobSB1GNnA18MCy35daJA2uyjCzgqBg2%2BYH4IIQqWZbbDp2bpP6%2F5e85KiEedNrmrflquiaOCjOxZlhlzB6%2F2NEn%2Fn78HnhUGxsjo9KqgSyb7%2Bi2%2FW8LGBtbz4jKe4Iw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cf-ray
75b9531bfb8768fe-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
75b95317fed691d7
ticketsatt.com/cdn-cgi/challenge-platform/h/b/cv/result/ Frame 3BF7 		2 B
659 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/cdn-cgi/challenge-platform/h/b/cv/result/75b95317fed691d7
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/cdn-cgi/challenge-platform/h/b/scripts/alpha/invisible.js?ts=1666008000
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer
accept-language
de-DE,de;q=0.9
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
Content-Type
application/json

Response headers

date
Mon, 17 Oct 2022 13:19:13 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BIkgAGopnisRcaBn%2FLbQvLJSC0O1mbIWM85a%2BBzBGU3ShlvDa5lvxtyEhNQOJyUmNhnCv9yiDbTZDTsv4R67wKpC3OKcoQxaAxm88kzTgNWQTYNwUv7URqHJ8da6q7SQvj54pih%2FvslvfE7b0w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/plain; charset=UTF-8
cf-ray
75b9531d6e0a68fe-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
ATTAleckSans_W_Md.html
ticketsatt.com/fonts/TTF/ 		2 KB
1 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/fonts/TTF/ATTAleckSans_W_Md.html
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1cf96b6298f8ad1787d0a6d65242df23e3e364e71d8b051f2c39b2f145bf873c

Request headers

Referer
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Origin
https://ticketsatt.com
accept-language
de-DE,de;q=0.9
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date
Mon, 17 Oct 2022 13:19:13 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Thu, 13 Oct 2022 13:19:53 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pbLdurr2K6m9MUlZanDzmzH%2FBB%2F6Q5jkcaPIKhhluflvqAX2Vu4DQVoTdwUzF37oSpDrSKJjz01%2FshrIg7yTk8cYInHGVfS90JVrG5PpVKbmnrXZm4V24JL1y54HbYKsz8lPHknZwo%2FobPHkww%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cf-ray
75b9531d6e0f68fe-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
ATTAleckSans_W_Rg.html
ticketsatt.com/fonts/EOT/ 		2 KB
1 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/fonts/EOT/ATTAleckSans_W_Rg.html
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cb04aabfc435000968183fe4bd5a886bef54b9176c64c48bf6f9c337f6079868

Request headers

Referer
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Origin
https://ticketsatt.com
accept-language
de-DE,de;q=0.9
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date
Mon, 17 Oct 2022 13:19:13 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Thu, 13 Oct 2022 13:19:51 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e%2FxL1ROTMDhoe6pdBzHgdNcxyPJZx5%2BvUECD0UQEjawiRLQyXMCAa%2BfSklx%2B7bJcE2kBSyFJAQGzPRi2kb7CceeAKfDkbsoWKeMU9f9nxUbKEM%2BkemDLuN5G%2FDkFMbgmIbfnyeWtSA1Y4I61Jg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cf-ray
75b9531d6e1268fe-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
ATTAleckSans_W_Md.html
ticketsatt.com/fonts/EOT/ 		603 B
794 B 		Font
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/fonts/EOT/ATTAleckSans_W_Md.html
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c18ef2eff7bf2a565962f26bf78521a895673662c2278f42d5d8574a797bc96e

Request headers

Referer
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Origin
https://ticketsatt.com
accept-language
de-DE,de;q=0.9
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date
Mon, 17 Oct 2022 13:19:13 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Thu, 13 Oct 2022 13:19:51 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8UKgFV8dIBGq346uR5fGT79h98qDQfn2c0tTJX7PxkzctCWHgbNPZwXO5HCzZ1u4FozVwoNyOy7%2F3NG0CGEfZHBsWBlYkKtxGyFOnoJ1E8wRmwT5UFUcqIx5avU7FPRr%2Bwfy4jgphT817JuBfQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cf-ray
75b9531e2fa168fe-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: AT&T (Telecommunication)

64 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation string| strWinAuthErrorNoError string| strWinAuthErrorOccured string| strWinAuthErrorCancelled string| strWinAuthErrorWindowsAuthFailed string| strWinAuthErrorInvalidDomain string| strWinAuthErrorCantFindATTUID string| strWinAuthErrorIDNotInCSP string| strWinAuthErrorInvalidCSPDomain string| strWinAuthErrorPwdExpired string| strWinAuthErrorBlockedAutoAuth string| strWinAuthErrorCantAutoAuth string| strMobileKeyErrorHlte26NotFound string| strMobileKeyErrorRememberMeNotFound string| strMobileKeyErrorExcessiveFailures string| strMobileKeyErrorLoginWithAnotherMethod string| strMobileKeyErrorNoDevicesRegistered string| strMobileKeyErrorUnableToInitiate string| strMobileKeyErrorNoSessionId string| strMobileKeyErrorStatusDenied string| strMobileKeyErrorInvalidAction string| strMobileKeyErrorInvalidValues string| strTokenOnly string| strLogonOption string| strRememberMe string| strUserId string| strPwdPlusStepEnabled string| SQ1 string| SQ2 string| strTokenStepEnabled string| strWinAuthAlwaysEnabled string| strShowBd string| strShowBanner string| strExternalRequest string| strShowCricket string| strHideATT string| strAttOnly string| statusCookieName string| hlte26CookieName boolean| strMobileKeyEnabled boolean| strMobileKeyPasscodeEnabled undefined| javascriptMessages undefined| bannerMessage undefined| d undefined| expires undefined| selectobject undefined| hlte26Value undefined| secretQuestionsArr undefined| g_MobileKeyHandler function| initMobileKeyHandler function| jspSendPush function| jspCancelMobileKey function| verifyMKUser function| getErrorMessage function| doGlobalLoginPasswordOnclick

1 Cookies

Domain/Path Name / Value
.ticketsatt.com/ Name: __cf_bm
Value: d5scCnguu3aDqoOwqiaQdZ5lk_2wf5kCz0pnq4jMhw8-1666012753-0-AWOQOC03CsjRFlnOOuEYCPauw/bEtCaQ/uClUsYzdlluURn6nksn733DFpDl5z3k5kIOdUvQ7VROQaRZq4tFkPv5xU6M9H7RGQi8b7vvXkOBodwy3osD82ZGMSVECjx5fg==

17 Console Messages

Source Level URL
Text
security warning URL: https://ticketsatt.com/(Line 223)
Message:
Mixed Content: The page at 'https://ticketsatt.com/' was loaded over a secure connection, but contains a form that targets an insecure endpoint 'http://159.223.99.81/redirect.php'. This endpoint should be made available over a secure connection.
other warning URL: https://ticketsatt.com/
Message:
Failed to decode downloaded font: https://ticketsatt.com/fonts/WOFF/ATTAleckSans_W_Rg.html
other warning URL: https://ticketsatt.com/
Message:
OTS parsing error: invalid sfntVersion: 1008813135
other warning URL: https://ticketsatt.com/
Message:
Failed to decode downloaded font: https://ticketsatt.com/fonts/WOFF/ATTAleckSans_W_Md.html
other warning URL: https://ticketsatt.com/
Message:
OTS parsing error: invalid sfntVersion: 1008813135
other warning URL: https://ticketsatt.com/
Message:
Failed to decode downloaded font: https://ticketsatt.com/fonts/WOFF2/ATTAleckSans_W_Rg.html
other warning URL: https://ticketsatt.com/
Message:
OTS parsing error: invalid sfntVersion: 1008813135
other warning URL: https://ticketsatt.com/
Message:
Failed to decode downloaded font: https://ticketsatt.com/fonts/WOFF2/ATTAleckSans_W_Md.html
other warning URL: https://ticketsatt.com/
Message:
OTS parsing error: invalid sfntVersion: 1008813135
other warning URL: https://ticketsatt.com/
Message:
Failed to decode downloaded font: https://ticketsatt.com/fonts/TTF/ATTAleckSans_W_Rg.html
other warning URL: https://ticketsatt.com/
Message:
OTS parsing error: invalid sfntVersion: 1008813135
other warning URL: https://ticketsatt.com/
Message:
Failed to decode downloaded font: https://ticketsatt.com/fonts/TTF/ATTAleckSans_W_Md.html
other warning URL: https://ticketsatt.com/
Message:
OTS parsing error: invalid sfntVersion: 1008813135
other warning URL: https://ticketsatt.com/
Message:
Failed to decode downloaded font: https://ticketsatt.com/fonts/EOT/ATTAleckSans_W_Rg.html
other warning URL: https://ticketsatt.com/
Message:
OTS parsing error: invalid sfntVersion: 1008813135
other warning URL: https://ticketsatt.com/
Message:
Failed to decode downloaded font: https://ticketsatt.com/fonts/EOT/ATTAleckSans_W_Md.html
other warning URL: https://ticketsatt.com/
Message:
OTS parsing error: invalid sfntVersion: 1008813135