urlscan.io logo urlscan.io
SecurityTrails logo

ticketsatt.com Open in urlscan Pro
2606:4700:3031::6815:2189  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://ticketsatt.com/
Submission Tags: phishing
Submission: On October 17 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 18 HTTP transactions. The main IP is 2606:4700:3031::6815:2189, located in United States and belongs to CLOUDFLARENET, US. The main domain is ticketsatt.com.
TLS certificate: Issued by GTS CA 1P5 on October 14th 2022. Valid for: 3 months.
This is the only time ticketsatt.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: AT&T (Telecommunication)

Domain & IP information

IP Address AS Autonomous System
18 2606:4700:303... 13335 (CLOUDFLAR...)
18 1
Apex Domain
Subdomains		 Transfer
18 ticketsatt.com
ticketsatt.com
58 KB
18 1
Domain Requested by
18 ticketsatt.com ticketsatt.com
18 1

This site contains links to these domains. Also see Links.

Domain
oidc.idp.elogin.att.com
Subject Issuer Validity Valid
*.ticketsatt.com
GTS CA 1P5		 2022-10-14 -
2023-01-12		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://ticketsatt.com/
Frame ID: 84A60D60D62D617858159DF1A1CD2642
Requests: 15 HTTP requests in this frame

Frame: https://ticketsatt.com/cdn-cgi/challenge-platform/h/b/scripts/alpha/invisible.js?ts=1665993600
Frame ID: 06DE9332EDBAAB5189E3B8A9DB7EFC78
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

AT&T Security Server: Login

Page Statistics

18
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

58 kB
Transfer

188 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
ticketsatt.com/ 		90 KB
14 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::6815:2189 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ec8f91889097fa4542283c79f45684dbacff390d61c5cea52ff7198f6d51ec60

Request headers

Upgrade-Insecure-Requests
1
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
75b8ba5d7b48bbda-FRA
content-encoding
br
content-type
text/html
date
Mon, 17 Oct 2022 11:34:57 GMT
last-modified
Thu, 13 Oct 2022 13:23:12 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=s%2FerUx1aoDDW18BoOwOExSwoNT6cGownHiLl6%2BVUvswyg%2B6FRVzlfHdi1S6X8hpzleb33UF9l%2BtXBVV4wXbiJBuk4ObecwfAxtvdsBe9zE%2BXJ3cQceYdMXdlkQlCnCNLGvL01HFryrLkiYYQ5Q%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
main.css
ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/ 		21 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/main.css
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::6815:2189 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c41481de4849386293a1c4d39814b5760e27248e080bd33f24e95089c0a0c3c4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ticketsatt.com/
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date
Mon, 17 Oct 2022 11:34:57 GMT
content-encoding
br
cf-cache-status
EXPIRED
last-modified
Thu, 13 Oct 2022 13:19:45 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"5449-5eaea5ce69505-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZZnqCOnH0ITJSDXG0tD6WI%2F6VDkuXyaJcl7HvEEx2YBFNv%2Bft1gFMkdGnvwC0l3r5BjnQRFCGpkPg9NQQnUNAV4sPOMR7Q7u2Kv03r4iN51TVVWZYjuRqpcoJ6WJV6f37fbsZp6HzgF7NER0ZA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
75b8ba5fe8fabbda-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
fonts.css
ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/ 		823 B
500 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::6815:2189 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
58a0b4bfbb00810bfa147c8e32d7646cef1570d2d487b8b14d1af06e638e58a1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ticketsatt.com/
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date
Mon, 17 Oct 2022 11:34:57 GMT
content-encoding
br
cf-cache-status
EXPIRED
last-modified
Thu, 13 Oct 2022 13:19:44 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"337-5eaea5cdc82dd-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sPZaHiNttY40IDsl%2B69uJx7lUSfL7LDpaBGj07OFJNwVcMzGRu6ENSULhksD9QJXG3XMnXbLqXzzZPVpdjgga0NRm%2FqHuRW4wmFPmNHTC2PCzBYH%2BorcyeQzIrDQGwuvQ8FeV1bklehzIqwhpA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
75b8ba5fe8fdbbda-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
att_logo_97x40.png
ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/att_logo_97x40.png
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::6815:2189 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5f43c44a03507663f45f0275597874d6ed132cf38a09775d997ba3669f64edb4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ticketsatt.com/
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date
Mon, 17 Oct 2022 11:34:57 GMT
cf-cache-status
REVALIDATED
last-modified
Thu, 13 Oct 2022 13:19:42 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"cf0-5eaea5cc030c5"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fvpR1SeksE6E5GJ1dAtvj57ODG7N%2BptnB8SJfUPnJ6TQX%2F3Z%2BZpDJ72jijsi0jYwPo%2Ffsfe5Y5cw1zpuHJN6f50j9lquTFAssIiKc4nkLQZCCOsdot8EGhTk9ZQARbADoQUKr7N3EVtU8wyesA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
75b8ba5ff94bbbda-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
3312
GLO_Question_Icon.png
ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/ 		223 B
592 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/GLO_Question_Icon.png
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::6815:2189 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4a6500fffb1823beca8bd2c203014d05111e97a82dbbb8516a642abb03bf7bf2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ticketsatt.com/
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date
Mon, 17 Oct 2022 11:34:57 GMT
cf-cache-status
REVALIDATED
last-modified
Thu, 13 Oct 2022 13:19:45 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"df-5eaea5ce1a361"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3o%2F%2B9%2BRE6MNJEGhKNWR%2B%2BW3Bh4DqidcWt%2ByooEjG6IvQOTUjynE4gA0lr%2Bsl%2FddXz8XQx2l1tz5AZaH4KYEhPt4auBTPDcpE1pR9wCX1nn1TMoKunQ6SSHQD%2Bjd7N769Y0BaLxJblYbVWsNbdw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
75b8ba5ff955bbda-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
223
flat_down_icon_rgb_blu_modified_12x12.png
ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/ 		623 B
928 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/flat_down_icon_rgb_blu_modified_12x12.png
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::6815:2189 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
46ae8c20ff718133d1b34e09314a6636df03de7a39e84a459ee38bb06c05e885

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ticketsatt.com/
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date
Mon, 17 Oct 2022 11:34:57 GMT
cf-cache-status
REVALIDATED
last-modified
Thu, 13 Oct 2022 13:19:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"26f-5eaea5cc7260b"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bsx4RB3AN9nfw2%2BgPx6%2FWhcy4rjSpRHNFEFBo1Qwk03xjTw3m4Pl8uQGdwsfhjPQz0vkNssV51IMsBNxmJIZfEtdr3V6Ij5EPRSsolOyHnO%2FtMYTk0ey85CnDzQYGKgPYXBQYNIeQ8SkdrzdMQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
75b8ba5ff95bbbda-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
623
flat_faq-reverse_icon_rgb_blu_modified_18x18.png
ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/ 		1023 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/flat_faq-reverse_icon_rgb_blu_modified_18x18.png
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::6815:2189 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
287e57ae4b394a4912f51899e4537fb4a9c3a9f307ad0e1f539f8aeb46bdb042

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ticketsatt.com/
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date
Mon, 17 Oct 2022 11:34:57 GMT
cf-cache-status
REVALIDATED
last-modified
Thu, 13 Oct 2022 13:19:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"3ff-5eaea5ccbf86f"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=72of4YrsTK%2BQxaLb5v5DwzRuzQSg3H2RJ%2Ba3vcFyIHdcPgtTxOxLW5WSV3d97skVY1WnALE7q3Vc0Nc9plFq3e3s5K0bpWdPrYVUGrSXNF25%2Fcyh8DgdaVBC52576a%2F%2Flkubvhe9Yvlml2t02A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
75b8ba5ff95fbbda-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1023
ATTAleckSans_W_Rg.html
ticketsatt.com/fonts/WOFF/ 		2 KB
1 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/fonts/WOFF/ATTAleckSans_W_Rg.html
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:2189 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
47c8f59964e374539d5f98a05aaf2be47a760fb38169318324d8334f31e993b0

Request headers

Referer
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Origin
https://ticketsatt.com
accept-language
de-DE,de;q=0.9
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date
Mon, 17 Oct 2022 11:34:57 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Thu, 13 Oct 2022 13:19:54 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uoFkZ9jjBgSUn21We8ZYq2KN1YJlkGbsVRcK1HpbBerv8H83NRJ1fvDP%2BgZbCSWi13S9vobNKYyuT8Pdf7BZ0RpFvDsgFaBbEK6xoYCyIC5c2uiCipA8Kh6JYG8Ap%2FRV3CTebiRmSyYrBs6mgg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cf-ray
75b8ba61aa48929c-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
ATTAleckSans_W_Md.html
ticketsatt.com/fonts/WOFF/ 		2 KB
1 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/fonts/WOFF/ATTAleckSans_W_Md.html
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:2189 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
486e34cc47beef5fbdc721ca5a142eda3ca5b18a4ba6be9356ce446cd599c25b

Request headers

Referer
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Origin
https://ticketsatt.com
accept-language
de-DE,de;q=0.9
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date
Mon, 17 Oct 2022 11:34:57 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Thu, 13 Oct 2022 13:19:54 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EzDSlYttTIPpBDXB%2B0kYlktrXHYJlKrN6QiYGwoI1yEwUJL001FzCvoQjvb4ejiw9OQMQ4OOff%2Bg3%2BnoxBMwrhjNy8u52JMNt1LAa2eu7PeXe9LlbtsJpbhRlk7bckQlXox%2B4oSMS1jqepoD7g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cf-ray
75b8ba61aa4c929c-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
invisible.js
ticketsatt.com/cdn-cgi/challenge-platform/h/b/scripts/alpha/ Frame 06DE 		36 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/cdn-cgi/challenge-platform/h/b/scripts/alpha/invisible.js?ts=1665993600
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:2189 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8bd1ab5d5e35af51dcd82f5b2a7b9d6c01433c8670e09896ce391c3f661c746e

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date
Mon, 17 Oct 2022 11:34:57 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=retJZ8qQZH%2BCBntyovZzwSroqDgiohk3eQmfDyMt2h2rgzzra0Q7t2Aqng5CAaAtdGBj1GKbNL9IXwAxBTMU3DQJjYPbYCcdYl8K%2BQ9BaUA0ORL9w%2BhdddOnMHz%2BtUd2K1JTba8vTqHA6cOLAg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400, public
x-control-type-options
nosniff
cf-ray
75b8ba61ba5b929c-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
pica.js
ticketsatt.com/cdn-cgi/challenge-platform/h/b/scripts/ Frame 06DE 		23 KB
8 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/cdn-cgi/challenge-platform/h/b/scripts/pica.js
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:2189 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8087531e8656b02b11f9a2894e878df6750f2ad059e450635f15676f1d6ca9ce

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date
Mon, 17 Oct 2022 11:34:57 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nQSUFenwf5oiHaPASKWtwYpO%2FBqJi8K%2BD1RPGcWKx1KUPehsQsQDm%2BvK3ymwDCIc8MB50CdQfOIMP1ydaLYTq0bmkJSjiJNWTGvQjf%2Bp5jbwQjpurzEtdIMPZa5XooAPhAggB5qgkcz9vPjn9w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400, public
x-control-type-options
nosniff
cf-ray
75b8ba620b0a929c-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
ATTAleckSans_W_Md.html
ticketsatt.com/fonts/WOFF2/ 		2 KB
2 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/fonts/WOFF2/ATTAleckSans_W_Md.html
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:2189 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5ae3ef56302c178cd6d4e9f26da3af8baa47d596632f982b8196520bfba1657a

Request headers

Referer
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Origin
https://ticketsatt.com
accept-language
de-DE,de;q=0.9
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date
Mon, 17 Oct 2022 11:34:57 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Thu, 13 Oct 2022 13:19:55 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=I9iUBUaHt5v9l563bl8ibwwL5rcprtf5ZzaGKdQ5f%2BkHjl1jxc0RKJa8e74aUFC%2B6egiT9owL5svGDqmjyKPoxT7OYzDdBzGl%2F0itKfRc8jv5Xi2Y5FyTgfNP%2BFcGvhF4CCxhc%2BpCmPFiN%2FuDg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cf-ray
75b8ba634d26929c-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
75b8ba5d7b48bbda
ticketsatt.com/cdn-cgi/challenge-platform/h/b/cv/result/ Frame 06DE 		2 B
662 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/cdn-cgi/challenge-platform/h/b/cv/result/75b8ba5d7b48bbda
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/cdn-cgi/challenge-platform/h/b/scripts/alpha/invisible.js?ts=1665993600
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:2189 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer
accept-language
de-DE,de;q=0.9
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)
Content-Type
application/json

Response headers

date
Mon, 17 Oct 2022 11:34:58 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gX4bLvcuCeWCzyzh0bE7tBJ36UWUjP7dZipdBOAyalbUTmtZ905pK1qJVL%2B1G3GKugdlLOT%2FxeFvBLs3eV%2BWES1ABG%2B8gQC3yMkF4toUmvkj95IOSKG%2F8d2%2FU6avMyvSJRQTsTd9uqm1rbMPNQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/plain; charset=UTF-8
cf-ray
75b8ba64afb2929c-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
ATTAleckSans_W_Rg.html
ticketsatt.com/fonts/WOFF2/ 		2 KB
1 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/fonts/WOFF2/ATTAleckSans_W_Rg.html
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:2189 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
867b2b394048ac0f45309d9c7dc817fd353097a2fcba58cdf047af230de5d0ef

Request headers

Referer
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Origin
https://ticketsatt.com
accept-language
de-DE,de;q=0.9
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date
Mon, 17 Oct 2022 11:34:58 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Thu, 13 Oct 2022 13:19:55 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eD0h9KF4JiFdZQdbvPSP82e6nHKPVpndCMpwP1b9v9frJoDNWx8k7hjdGa9kBcXHkvZfnTE075%2FfNQ5eu1sXABk9ot1cxLxlIBKa52Sk2kr0MJcjJH4pDd5Sm3CHgYePgxvA8yIvy5xyQ0qs5Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cf-ray
75b8ba64afb4929c-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
ATTAleckSans_W_Md.html
ticketsatt.com/fonts/TTF/ 		2 KB
1 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/fonts/TTF/ATTAleckSans_W_Md.html
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:2189 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc6c179cb0a2d2418718588fb1e2ce9cc1299315f2633c60e7abc1d4dcd743c1

Request headers

Referer
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Origin
https://ticketsatt.com
accept-language
de-DE,de;q=0.9
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date
Mon, 17 Oct 2022 11:34:58 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Thu, 13 Oct 2022 13:19:53 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lIeDQUUuyc7t8t9%2FkRJYKzYVwZ0QdnWn%2FVoFpy5QPiHqX5vsvzgZ3lG6sgnBHGBLHbQu3uFqtio1Jylj1x%2FsFeAoOLCRXN0sbE%2F5RHs5cUSHfljUBwSTyhPAj7gN3B92x197dy9RHQR1nfg8fg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cf-ray
75b8ba64afb5929c-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
ATTAleckSans_W_Rg.html
ticketsatt.com/fonts/TTF/ 		603 B
798 B 		Font
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/fonts/TTF/ATTAleckSans_W_Rg.html
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:2189 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1f1a1686bcc1f037cff5cf62ec09ab8cb7e9c5daeab5f0b5cc4278eef98c167c

Request headers

Referer
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Origin
https://ticketsatt.com
accept-language
de-DE,de;q=0.9
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date
Mon, 17 Oct 2022 11:34:58 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Thu, 13 Oct 2022 13:19:53 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zWav%2FCqJ5TC7r6Lcpi7qzdCmGGXKnxWV1BzamSZic0OuOL8Ovrq99sp8SH8AxpOqXrWcrwryjI%2F9RWPrRGp6dqHQ2Fn6xnJJ6DTy2Bm%2FuTPJVqH%2FIPBGAZBBKALtaduqmoM%2BdAs1ZxjmE%2FyQ0A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cf-ray
75b8ba656905929c-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
ATTAleckSans_W_Md.html
ticketsatt.com/fonts/EOT/ 		603 B
793 B 		Font
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/fonts/EOT/ATTAleckSans_W_Md.html
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:2189 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c18ef2eff7bf2a565962f26bf78521a895673662c2278f42d5d8574a797bc96e

Request headers

Referer
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Origin
https://ticketsatt.com
accept-language
de-DE,de;q=0.9
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date
Mon, 17 Oct 2022 11:34:58 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Thu, 13 Oct 2022 13:19:51 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FtRPC8CuEv%2BPibFX2pXA1pj%2FCclUmo2hx4hUAuUC0qQJ9%2FpFgeyUXirvxt6HjO4bxpujTmjyzTGGqrlEN6X71Ud5Krs6UbDoy2q8f5dMY5a7b110Klh1ycREn2o9kMpHmDfD7i3RK5lSvbe2ow%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cf-ray
75b8ba65994d929c-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
ATTAleckSans_W_Rg.html
ticketsatt.com/fonts/EOT/ 		603 B
800 B 		Font
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/fonts/EOT/ATTAleckSans_W_Rg.html
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::6815:2189 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a87e4c497298cf0734b2f42280983882834dfea528a025d763092af3fc87e31b

Request headers

Referer
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Origin
https://ticketsatt.com
accept-language
de-DE,de;q=0.9
User-Agent
ia_archiver (+http://www.alexa.com/site/help/webmasters; crawler@alexa.com)

Response headers

date
Mon, 17 Oct 2022 11:34:58 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Thu, 13 Oct 2022 13:19:51 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mo%2FN96uhFY%2FumEsw%2B1rLduovv4adC8YsgXPudAMqw%2F0WZhOO6tKI8P7oEnE2zXdxfygz1RcPudhHeFd4bLvBmrEUqi%2F%2FyWsOwQXHhKm9mZM6WpI3xZB1tMP4pNJWR%2FZsbDYIway0z3fGh26pkQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cf-ray
75b8ba662a4a929c-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: AT&T (Telecommunication)

64 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation string| strWinAuthErrorNoError string| strWinAuthErrorOccured string| strWinAuthErrorCancelled string| strWinAuthErrorWindowsAuthFailed string| strWinAuthErrorInvalidDomain string| strWinAuthErrorCantFindATTUID string| strWinAuthErrorIDNotInCSP string| strWinAuthErrorInvalidCSPDomain string| strWinAuthErrorPwdExpired string| strWinAuthErrorBlockedAutoAuth string| strWinAuthErrorCantAutoAuth string| strMobileKeyErrorHlte26NotFound string| strMobileKeyErrorRememberMeNotFound string| strMobileKeyErrorExcessiveFailures string| strMobileKeyErrorLoginWithAnotherMethod string| strMobileKeyErrorNoDevicesRegistered string| strMobileKeyErrorUnableToInitiate string| strMobileKeyErrorNoSessionId string| strMobileKeyErrorStatusDenied string| strMobileKeyErrorInvalidAction string| strMobileKeyErrorInvalidValues string| strTokenOnly string| strLogonOption string| strRememberMe string| strUserId string| strPwdPlusStepEnabled string| SQ1 string| SQ2 string| strTokenStepEnabled string| strWinAuthAlwaysEnabled string| strShowBd string| strShowBanner string| strExternalRequest string| strShowCricket string| strHideATT string| strAttOnly string| statusCookieName string| hlte26CookieName boolean| strMobileKeyEnabled boolean| strMobileKeyPasscodeEnabled undefined| javascriptMessages undefined| bannerMessage undefined| d undefined| expires undefined| selectobject undefined| hlte26Value undefined| secretQuestionsArr undefined| g_MobileKeyHandler function| initMobileKeyHandler function| jspSendPush function| jspCancelMobileKey function| verifyMKUser function| getErrorMessage function| doGlobalLoginPasswordOnclick

1 Cookies

Domain/Path Name / Value
.ticketsatt.com/ Name: __cf_bm
Value: QDNlMihsDI_jhT.PqhjRNJreAMhqDriUNBtquxsXqmk-1666006498-0-Ac5mg+m6K/5ELatzWjsH/rOENz10I8D3w2EwPgtTKD2jMnMCaSdyzsiSTVN136/EmQoqYkPqDFH8ICPr/7nX02H37WeTYpn6AY9QKVE31PFOhtKBVS6lSsi9GM5AXtrSww==

17 Console Messages

Source Level URL
Text
security warning URL: https://ticketsatt.com/(Line 223)
Message:
Mixed Content: The page at 'https://ticketsatt.com/' was loaded over a secure connection, but contains a form that targets an insecure endpoint 'http://159.223.99.81/redirect.php'. This endpoint should be made available over a secure connection.
other warning URL: https://ticketsatt.com/
Message:
Failed to decode downloaded font: https://ticketsatt.com/fonts/WOFF/ATTAleckSans_W_Md.html
other warning URL: https://ticketsatt.com/
Message:
OTS parsing error: invalid sfntVersion: 1008813135
other warning URL: https://ticketsatt.com/
Message:
Failed to decode downloaded font: https://ticketsatt.com/fonts/WOFF/ATTAleckSans_W_Rg.html
other warning URL: https://ticketsatt.com/
Message:
OTS parsing error: invalid sfntVersion: 1008813135
other warning URL: https://ticketsatt.com/
Message:
Failed to decode downloaded font: https://ticketsatt.com/fonts/WOFF2/ATTAleckSans_W_Md.html
other warning URL: https://ticketsatt.com/
Message:
OTS parsing error: invalid sfntVersion: 1008813135
other warning URL: https://ticketsatt.com/
Message:
Failed to decode downloaded font: https://ticketsatt.com/fonts/WOFF2/ATTAleckSans_W_Rg.html
other warning URL: https://ticketsatt.com/
Message:
OTS parsing error: invalid sfntVersion: 1008813135
other warning URL: https://ticketsatt.com/
Message:
Failed to decode downloaded font: https://ticketsatt.com/fonts/TTF/ATTAleckSans_W_Md.html
other warning URL: https://ticketsatt.com/
Message:
OTS parsing error: invalid sfntVersion: 1008813135
other warning URL: https://ticketsatt.com/
Message:
Failed to decode downloaded font: https://ticketsatt.com/fonts/TTF/ATTAleckSans_W_Rg.html
other warning URL: https://ticketsatt.com/
Message:
OTS parsing error: invalid sfntVersion: 1008813135
other warning URL: https://ticketsatt.com/
Message:
Failed to decode downloaded font: https://ticketsatt.com/fonts/EOT/ATTAleckSans_W_Md.html
other warning URL: https://ticketsatt.com/
Message:
OTS parsing error: invalid sfntVersion: 1008813135
other warning URL: https://ticketsatt.com/
Message:
Failed to decode downloaded font: https://ticketsatt.com/fonts/EOT/ATTAleckSans_W_Rg.html
other warning URL: https://ticketsatt.com/
Message:
OTS parsing error: invalid sfntVersion: 1008813135