urlscan.io logo urlscan.io
SecurityTrails logo

ticketsatt.com Open in urlscan Pro
2606:4700:3034::ac43:be1e  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://ticketsatt.com/
Submission: On October 16 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 18 HTTP transactions. The main IP is 2606:4700:3034::ac43:be1e, located in United States and belongs to CLOUDFLARENET, US. The main domain is ticketsatt.com.
TLS certificate: Issued by GTS CA 1P5 on October 14th 2022. Valid for: 3 months.
This is the only time ticketsatt.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: AT&T (Telecommunication)

Domain & IP information

IP Address AS Autonomous System
18 2606:4700:303... 13335 (CLOUDFLAR...)
18 1
Apex Domain
Subdomains		 Transfer
18 ticketsatt.com
ticketsatt.com
58 KB
18 1
Domain Requested by
18 ticketsatt.com ticketsatt.com
18 1

This site contains links to these domains. Also see Links.

Domain
oidc.idp.elogin.att.com
Subject Issuer Validity Valid
*.ticketsatt.com
GTS CA 1P5		 2022-10-14 -
2023-01-12		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://ticketsatt.com/
Frame ID: 63116D301F27DC171D16FBA533D6E385
Requests: 15 HTTP requests in this frame

Frame: https://ticketsatt.com/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1665921600
Frame ID: 394BEA09D3D2401B531E4B2748B9001D
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

AT&T Security Server: Login

Page Statistics

18
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

58 kB
Transfer

187 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
ticketsatt.com/ 		90 KB
14 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
acb02d20893644cb74c637dfa840d9b4c6ca9a030bed80e779af5c5b94ed4959

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
75b192ec8d68bbeb-FRA
content-encoding
br
content-type
text/html
date
Sun, 16 Oct 2022 14:44:41 GMT
last-modified
Thu, 13 Oct 2022 13:23:12 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e52vCFj088%2FnVzkaaZ6cCE2w07bHF1lj%2FAqA%2F3P4Lf8NHpZeWQLt%2BiolO%2F6j%2FXQdBy5fhqmqOU2ATu4B%2Fu%2B9RCqJmNoSmBH4E8Zvs%2FUVECoItwZc%2F5cADC97PZhXLSgZ1TCmNqRH%2BcY0t36Rzg%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
main.css
ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/ 		21 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/main.css
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c41481de4849386293a1c4d39814b5760e27248e080bd33f24e95089c0a0c3c4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ticketsatt.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sun, 16 Oct 2022 14:44:41 GMT
content-encoding
br
cf-cache-status
EXPIRED
last-modified
Thu, 13 Oct 2022 13:19:45 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"5449-5eaea5ce69505-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ep8nCusfXSCladUec2%2BtfwfLE92rA26IBcR62ilTcCQttAPYPV1kkHYHuU0MJc1kEvOMfPRlCPX8GYYp4TIbgPNCKqc0HlZfl46Xc3vKXxr9Ft%2B%2FfLx8q9%2FdvlRhrujuRRu1Xv5zmdchQRtlmg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
75b192ee5a2ebbeb-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
fonts.css
ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/ 		823 B
501 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
58a0b4bfbb00810bfa147c8e32d7646cef1570d2d487b8b14d1af06e638e58a1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ticketsatt.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sun, 16 Oct 2022 14:44:41 GMT
content-encoding
br
cf-cache-status
EXPIRED
last-modified
Thu, 13 Oct 2022 13:19:44 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"337-5eaea5cdc82dd-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=flYfJlMmyPvBeE170XGYNtkGVsK8PGXSYYNxtZPRC2A5ArP1c1cm%2B%2BaJvEGtA909Xnk0PSzKFPiq08yVRw%2Ble62XsjFuLxOGPDtwbNmcbnnF12%2FxhZNGI5KieP2Cn%2BzLdUrzJ9h41CFprGuOOw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
75b192ee5a31bbeb-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
att_logo_97x40.png
ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/att_logo_97x40.png
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5f43c44a03507663f45f0275597874d6ed132cf38a09775d997ba3669f64edb4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ticketsatt.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sun, 16 Oct 2022 14:44:41 GMT
cf-cache-status
REVALIDATED
last-modified
Thu, 13 Oct 2022 13:19:42 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"cf0-5eaea5cc030c5"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=P3jHRi27v1yfAdc8ASrppjF9nhhN9BM6LAlUk0y6%2BSkrxyjhHcgxg%2BECvB3dN3e7lGUp%2FxlI5tFPBUTVf9DkMdkPDR5enelZW%2BWa7EuwQlMdwV%2FgwOyKnwBEczY9YkVTy80yGfU5LfRBZRZN9g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
75b192ee6a64bbeb-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
3312
GLO_Question_Icon.png
ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/ 		223 B
546 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/GLO_Question_Icon.png
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4a6500fffb1823beca8bd2c203014d05111e97a82dbbb8516a642abb03bf7bf2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ticketsatt.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sun, 16 Oct 2022 14:44:41 GMT
cf-cache-status
REVALIDATED
last-modified
Thu, 13 Oct 2022 13:19:45 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"df-5eaea5ce1a361"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bvmbycPKl2FFRav6S3j6jBbUsUrLOAhIWzIK1aJtEvn9pnEC%2BYFrofmdjPH65owWcKEN9zdlDbPOXf1x3b7J7pVE7uQ8PK4MNhneDWOkSsKzdksW7ubmY3%2Fq1ssRUEYr20HB57O92PsTEu06Yg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
75b192ee6a68bbeb-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
223
flat_down_icon_rgb_blu_modified_12x12.png
ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/ 		623 B
931 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/flat_down_icon_rgb_blu_modified_12x12.png
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
46ae8c20ff718133d1b34e09314a6636df03de7a39e84a459ee38bb06c05e885

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ticketsatt.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sun, 16 Oct 2022 14:44:41 GMT
cf-cache-status
REVALIDATED
last-modified
Thu, 13 Oct 2022 13:19:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"26f-5eaea5cc7260b"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9y4r7X6Byh6CYrT%2FpgaEQk2q8JOrRfqcNPYltmnepuE%2BKdP0T8fN5CkM33sqWiy15w880aZl4Rl65bNXHqjPPKy2HrHV%2Blu9Fu3L5XSf%2FDJqJVvDSUc1nUydjzQUZMslXMGFLg9kE0v2o2%2BGXg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
75b192ee6a6abbeb-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
623
flat_faq-reverse_icon_rgb_blu_modified_18x18.png
ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/ 		1023 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/flat_faq-reverse_icon_rgb_blu_modified_18x18.png
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
287e57ae4b394a4912f51899e4537fb4a9c3a9f307ad0e1f539f8aeb46bdb042

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ticketsatt.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sun, 16 Oct 2022 14:44:41 GMT
cf-cache-status
REVALIDATED
last-modified
Thu, 13 Oct 2022 13:19:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"3ff-5eaea5ccbf86f"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QsYmUmKTUUhqoReg5i8zIPQTJCrwl1YnpvlDSFIzKkw%2BfFvLlCq7SIM7HkdRrF11UdJPmtWQGBDG4u9XQNE5e5rvEhflUK3JRXhpCoG5XqcoTudS8t86yvdJoCnF5i8W8BruTo3w%2FxiZlzCUvA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
75b192ee6a6cbbeb-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1023
ATTAleckSans_W_Rg.html
ticketsatt.com/fonts/WOFF/ 		2 KB
2 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/fonts/WOFF/ATTAleckSans_W_Rg.html
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
98e36061bbf00199c1e0130f0d1e2a938940cb9bed3a0d1ca5c28a9d9fdff609

Request headers

Referer
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Origin
https://ticketsatt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sun, 16 Oct 2022 14:44:41 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Thu, 13 Oct 2022 13:19:54 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uGXFrP%2FGnPdjKcB9J2vWMsxt449FW6%2BMgUxfx5Am9ij5hmXHUnj%2BF%2BtvuT076nHQZCHmSgebzM%2Bw3D2wKmsfsyXaHeTpvz6VuBi%2BXNeB3r%2BxAqKuMr5MB5P1sTJbGmM%2F0dkzSA6H2y6QySltwQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cf-ray
75b192f00e7490dd-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
ATTAleckSans_W_Md.html
ticketsatt.com/fonts/WOFF/ 		2 KB
1 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/fonts/WOFF/ATTAleckSans_W_Md.html
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d76a066a0cd2118d482546d1b9bd8183223a2dc7bdfca392bd4c687b860ca143

Request headers

Referer
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Origin
https://ticketsatt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sun, 16 Oct 2022 14:44:41 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Thu, 13 Oct 2022 13:19:54 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4Ual5EnqzW8zMMRIxFBBs1zcFgl7fy89wC1ACNOz9N9iQY%2FNOyeMN2DIG7C0Tg4QZ3xpv7G8jUhh4iLJpFbZrH3ZVfyYRCxIwKY0niOg4tp3vz0s%2Bm4vAPpUeVXIvESB4UA8Tp0fQ6vbR49y6Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cf-ray
75b192f00e7790dd-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
invisible.js
ticketsatt.com/cdn-cgi/challenge-platform/h/g/scripts/alpha/ Frame 394B 		38 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1665921600
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c100b60c92858c5a293a1273fd779fb15730f825a36f5980365c58918539f5c9

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sun, 16 Oct 2022 14:44:41 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dlb5qds8Z%2BjoQQfOy2sC4b5uQogsFKPFnOvwsJHtwdjIp%2FPMNwshiU2UJwzkP1JbjZBy%2BQYHmI%2FcUo4lsFvcXNQkC5BJRwkg%2B2j1bwOMl859diDRmt9Us%2FBd3FoogGcaj7ntIJX9mtvmFyiYFg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400, public
x-control-type-options
nosniff
cf-ray
75b192f02eb590dd-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
pica.js
ticketsatt.com/cdn-cgi/challenge-platform/h/g/scripts/ Frame 394B 		21 KB
8 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/cdn-cgi/challenge-platform/h/g/scripts/pica.js
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8248f30628cea56c2bebcc348c98749f72cdf15aab9ea06fd2e85645589c462f

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sun, 16 Oct 2022 14:44:41 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S1fyEy4lZygT6HB9f480KT9emtQqVI4MvfChROOsmtqfWM%2FJ6fl20TTpuwXIhOqqMKBbXGG9vH6o%2BAw8NkmINKdwiz2q44JlEtoS4GDpDXJ6C%2FnZZGuf0qD3V%2FyqkjC3VRCR2xUJsfKmG4W0Fw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400, public
x-control-type-options
nosniff
cf-ray
75b192f07f7190dd-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
75b192ec8d68bbeb
ticketsatt.com/cdn-cgi/challenge-platform/h/g/cv/result/ Frame 394B 		2 B
660 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/cdn-cgi/challenge-platform/h/g/cv/result/75b192ec8d68bbeb
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/cdn-cgi/challenge-platform/h/g/scripts/alpha/invisible.js?ts=1665921600
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
Content-Type
application/json

Response headers

date
Sun, 16 Oct 2022 14:44:42 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CSMLWaUtEOpXI8bYLZv8m6fz3EKzo6PD196XcrC89dg7t7rnsef90JEmlL33h8oYWl%2F6JxpmIaqTx6E%2FMdoBGrubzcXM4gpYUJAe8qaKm5SukVcU%2Fm%2B0pPiNelk%2BKV6VY%2Bl6w3mF9AtN%2FZAI7g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/plain; charset=UTF-8
cf-ray
75b192f25b9d90dd-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
ATTAleckSans_W_Rg.html
ticketsatt.com/fonts/WOFF2/ 		2 KB
1 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/fonts/WOFF2/ATTAleckSans_W_Rg.html
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
87fc729882a4c3da08d2f420cfb6c112705a191b12970320a0f11096e709c6be

Request headers

Referer
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Origin
https://ticketsatt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sun, 16 Oct 2022 14:44:42 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Thu, 13 Oct 2022 13:19:55 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E6pXNoCb%2FPXCxuLQKmo2XVu%2BiK9%2BP1YmIkT5s8Cs%2BN1IsjjtImEi3Hg0kAjMvS3MVH5aE9sEzhIqyzQg6pUWy7dPD2TuM2%2B4linmpID3WP7Yc1B5VrgINqe09B%2FePjAL4TaS%2F3Mu7k6HfA6ENw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cf-ray
75b192f25ba190dd-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
ATTAleckSans_W_Md.html
ticketsatt.com/fonts/WOFF2/ 		2 KB
1 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/fonts/WOFF2/ATTAleckSans_W_Md.html
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b19d30a867b7afd9751e2aaf349a69f8cee06c1a37a051d9277de98fb636f3ee

Request headers

Referer
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Origin
https://ticketsatt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sun, 16 Oct 2022 14:44:42 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Thu, 13 Oct 2022 13:19:55 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X1NBcsmnARHJUy2mEfv5eF6v8WzPh7Ggod3RE%2FNUDT57dW0dscZcTtBi5pf2Zfw0KzA0Qkx2nvsxffOFjBwRR8KNxg0iVK%2FYipqMgfeU7sBZOAAfrFnNA1v3TGoluXD3mBPjDmo%2FHUnnrm3hFA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cf-ray
75b192f25ba490dd-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
ATTAleckSans_W_Md.html
ticketsatt.com/fonts/TTF/ 		603 B
800 B 		Font
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/fonts/TTF/ATTAleckSans_W_Md.html
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
16508bfc149892115b8dace9a71e5280bdf199b59c6028423e2de16f0b7e2f11

Request headers

Referer
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Origin
https://ticketsatt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sun, 16 Oct 2022 14:44:42 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Thu, 13 Oct 2022 13:19:53 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BGASYkAIE%2B6mwqFmZf7vEVQVCXHzu64Mab34jHqFZRHscrbE17ct830kt04OvKlyaBaYQQkakQeUdK5gUyYDbb5DFfa%2BjmdvkyYfeymzwdfASaImIIJnUkl5vnwZbf%2FbKQCMVtwTspU%2FSWR%2BOw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cf-ray
75b192f30cf990dd-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
ATTAleckSans_W_Rg.html
ticketsatt.com/fonts/TTF/ 		603 B
797 B 		Font
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/fonts/TTF/ATTAleckSans_W_Rg.html
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1f1a1686bcc1f037cff5cf62ec09ab8cb7e9c5daeab5f0b5cc4278eef98c167c

Request headers

Referer
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Origin
https://ticketsatt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sun, 16 Oct 2022 14:44:42 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Thu, 13 Oct 2022 13:19:53 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1LzX8MtsDNLcK8vnQ%2Fl4M5NWvFPAnMIa%2Ffv4V6gqgmJOnIhAo1lWV6eIlx8%2FGyURr1I%2FHUOkSGUZvtLFo6IwPZbud3NWGqPr6uylI4JIemzwsVRN%2Fzr5aJqeKOMnjPrDwekUaxBF4WfJGDFygA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cf-ray
75b192f31d2790dd-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
ATTAleckSans_W_Md.html
ticketsatt.com/fonts/EOT/ 		603 B
801 B 		Font
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/fonts/EOT/ATTAleckSans_W_Md.html
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c18ef2eff7bf2a565962f26bf78521a895673662c2278f42d5d8574a797bc96e

Request headers

Referer
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Origin
https://ticketsatt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sun, 16 Oct 2022 14:44:42 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Thu, 13 Oct 2022 13:19:51 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=j%2FLD%2Bwx9Ujs0CXt7ez%2BWnHlBvtZXPQ6ERCfDJuVVwbJ15oc6t%2B66ZailTExUHaUHfugMhCt6qmweRLchplpbeao%2BKPJgysEpNVfEnUH0bzWxFDQ1ds%2F4%2FhpKQicStSuIV%2BvdjZ394JCJfWzd5g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cf-ray
75b192f3dec790dd-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
ATTAleckSans_W_Rg.html
ticketsatt.com/fonts/EOT/ 		603 B
793 B 		Font
General
Check archive.org
Download Go to
Full URL
https://ticketsatt.com/fonts/EOT/ATTAleckSans_W_Rg.html
Requested by
Host: ticketsatt.com
URL: https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::ac43:be1e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a87e4c497298cf0734b2f42280983882834dfea528a025d763092af3fc87e31b

Request headers

Referer
https://ticketsatt.com/AT%26T%20Security%20Server_%20Login_files/fonts.css
Origin
https://ticketsatt.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Sun, 16 Oct 2022 14:44:42 GMT
content-encoding
br
cf-cache-status
DYNAMIC
last-modified
Thu, 13 Oct 2022 13:19:51 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SfhlDL0t0R2BhGXpvHXMFrPCnoubRW2FXitt8Bo79%2Ba2qg%2BPQ0rdvKjCmBntzIiU2%2BYiaTDRwj6Ro8u5oDefcvpg6MFDXjTEPT9huuQG5PfjAA%2Bhph1E6Ba9WEeZstFTF0aFStGKVnn7Ey5Qcg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html
cf-ray
75b192f3ff2b90dd-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: AT&T (Telecommunication)

64 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation string| strWinAuthErrorNoError string| strWinAuthErrorOccured string| strWinAuthErrorCancelled string| strWinAuthErrorWindowsAuthFailed string| strWinAuthErrorInvalidDomain string| strWinAuthErrorCantFindATTUID string| strWinAuthErrorIDNotInCSP string| strWinAuthErrorInvalidCSPDomain string| strWinAuthErrorPwdExpired string| strWinAuthErrorBlockedAutoAuth string| strWinAuthErrorCantAutoAuth string| strMobileKeyErrorHlte26NotFound string| strMobileKeyErrorRememberMeNotFound string| strMobileKeyErrorExcessiveFailures string| strMobileKeyErrorLoginWithAnotherMethod string| strMobileKeyErrorNoDevicesRegistered string| strMobileKeyErrorUnableToInitiate string| strMobileKeyErrorNoSessionId string| strMobileKeyErrorStatusDenied string| strMobileKeyErrorInvalidAction string| strMobileKeyErrorInvalidValues string| strTokenOnly string| strLogonOption string| strRememberMe string| strUserId string| strPwdPlusStepEnabled string| SQ1 string| SQ2 string| strTokenStepEnabled string| strWinAuthAlwaysEnabled string| strShowBd string| strShowBanner string| strExternalRequest string| strShowCricket string| strHideATT string| strAttOnly string| statusCookieName string| hlte26CookieName boolean| strMobileKeyEnabled boolean| strMobileKeyPasscodeEnabled undefined| javascriptMessages undefined| bannerMessage undefined| d undefined| expires undefined| selectobject undefined| hlte26Value undefined| secretQuestionsArr undefined| g_MobileKeyHandler function| initMobileKeyHandler function| jspSendPush function| jspCancelMobileKey function| verifyMKUser function| getErrorMessage function| doGlobalLoginPasswordOnclick

1 Cookies

Domain/Path Name / Value
.ticketsatt.com/ Name: __cf_bm
Value: E5zL80wxvQjEMljpBaYdcT.k44QkdAIa.0RvMBVfxEI-1665931481-0-ATB2F7PHbCIb3IktDP8yHwzbv1oQO3r3DzCfKH1nAezG61hNQh7shXfUrn/Uhi81WEXxbYhdql0oh50DN30B3gywJSkNv7k7Lwoe+jlhheeSO8D52+wgAsigGrhThclZAg==

17 Console Messages

Source Level URL
Text
security warning URL: https://ticketsatt.com/(Line 223)
Message:
Mixed Content: The page at 'https://ticketsatt.com/' was loaded over a secure connection, but contains a form that targets an insecure endpoint 'http://159.223.99.81/redirect.php'. This endpoint should be made available over a secure connection.
other warning URL: https://ticketsatt.com/
Message:
Failed to decode downloaded font: https://ticketsatt.com/fonts/WOFF/ATTAleckSans_W_Rg.html
other warning URL: https://ticketsatt.com/
Message:
OTS parsing error: invalid sfntVersion: 1008813135
other warning URL: https://ticketsatt.com/
Message:
Failed to decode downloaded font: https://ticketsatt.com/fonts/WOFF/ATTAleckSans_W_Md.html
other warning URL: https://ticketsatt.com/
Message:
OTS parsing error: invalid sfntVersion: 1008813135
other warning URL: https://ticketsatt.com/
Message:
Failed to decode downloaded font: https://ticketsatt.com/fonts/WOFF2/ATTAleckSans_W_Md.html
other warning URL: https://ticketsatt.com/
Message:
OTS parsing error: invalid sfntVersion: 1008813135
other warning URL: https://ticketsatt.com/
Message:
Failed to decode downloaded font: https://ticketsatt.com/fonts/WOFF2/ATTAleckSans_W_Rg.html
other warning URL: https://ticketsatt.com/
Message:
OTS parsing error: invalid sfntVersion: 1008813135
other warning URL: https://ticketsatt.com/
Message:
Failed to decode downloaded font: https://ticketsatt.com/fonts/TTF/ATTAleckSans_W_Md.html
other warning URL: https://ticketsatt.com/
Message:
OTS parsing error: invalid sfntVersion: 1008813135
other warning URL: https://ticketsatt.com/
Message:
Failed to decode downloaded font: https://ticketsatt.com/fonts/TTF/ATTAleckSans_W_Rg.html
other warning URL: https://ticketsatt.com/
Message:
OTS parsing error: invalid sfntVersion: 1008813135
other warning URL: https://ticketsatt.com/
Message:
Failed to decode downloaded font: https://ticketsatt.com/fonts/EOT/ATTAleckSans_W_Md.html
other warning URL: https://ticketsatt.com/
Message:
OTS parsing error: invalid sfntVersion: 1008813135
other warning URL: https://ticketsatt.com/
Message:
Failed to decode downloaded font: https://ticketsatt.com/fonts/EOT/ATTAleckSans_W_Rg.html
other warning URL: https://ticketsatt.com/
Message:
OTS parsing error: invalid sfntVersion: 1008813135