sso-att.com - urlscan.io

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 1 HTTP transactions. The main IP is 193.143.1.14, located in Moscow, Russian Federation and belongs to PROTON66, RU. The main domain is sso-att.com.
TLS certificate: Issued by R10 on September 10th 2024. Valid for: 3 months.

This is the only time sso-att.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: AT&T (Telecommunication)

Domain & IP information

	IP Address		AS Autonomous System
1 2	193.143.1.14 193.143.1.14		198953 (PROTON66) (PROTON66)
1	2

2 193.143.1.14 (Moscow, Russian Federation) 1 redirects

ASN198953 (PROTON66, RU)

sso-att.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	sso-att.com 1 redirects sso-att.com	82 KB
1	1

	Domain	Requested by
2	sso-att.com	1 redirects
1	1

This site contains links to these domains. Also see Links.

Domain
www.att.com

Subject Issuer	Validity	Valid
sso-att.com R10	`2024-09-10` - `2024-12-09`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://sso-att.com/login.php
Frame ID: 111AD083765359BCE3C02B41DB0CB182
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

AT&T Security Server: Login

Page URL History Show full URLs

http://sso-att.com/ HTTP 307
https://sso-att.com/ HTTP 302
https://sso-att.com/login.php Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

1
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

137 kB
Transfer

200 kB
Size

0
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: http://www.att.com/legal/terms.attWebsiteTermsOfUse.html
Title: Terms

Search URL Search Domain Scan URL

URL: http://www.att.com/privacy
Title: Privacy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://sso-att.com/ HTTP 307
https://sso-att.com/ HTTP 302
https://sso-att.com/login.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions
6 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request login.php Show response sso-att.com/ Redirect Chain http://sso-att.com/ https://sso-att.com/ https://sso-att.com/login.php	126 KB 82 KB	194ms 193ms	Document text/html	193.143.1.14 PROTON66
General Check archive.org Show headers Download Go to Full URL https://sso-att.com/login.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 193.143.1.14 Moscow, Russian Federation, ASN198953 (PROTON66, RU), Reverse DNS Software LiteSpeed / Resource Hash `fd4b820fde3e535ba24380c3ecdd6e1c5830ab5213523c1c174bed4f5803ab58` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers content-encoding br content-type text/html; charset=UTF-8 date Wed, 11 Sep 2024 12:59:37 GMT server LiteSpeed vary Accept-Encoding Redirect headers alt-svc h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46" cache-control no-cache, no-store, must-revalidate, max-age=0 content-length 0 content-type text/html; charset=UTF-8 date Wed, 11 Sep 2024 12:59:37 GMT location login.php server LiteSpeed
GET DATA	200 OK	truncated /	10 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `11645608a78d077e22935d051a53996e4edd0ec4d783b78d9847622a62a887f4` Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	223 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `4a6500fffb1823beca8bd2c203014d05111e97a82dbbb8516a642abb03bf7bf2` Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	18 KB 18 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `e2740c7b209e33aca7176250d80f94b4924e5e5d18076ee3b95f32a0e20d1f58` Request headers Referer Origin https://sso-att.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	9 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `adcfe7d308651f937a03cf9b9bdd684074a95be39186aa8cd229b57485f929b8` Request headers Referer User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	19 KB 19 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `59ea63b5ffe0f060e37c24a44b6406943df9e4fca39e2ef43023c2ae9783f220` Request headers Referer Origin https://sso-att.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Content-Type font/woff2
GET DATA	200 OK	truncated /	18 KB 18 KB		Font font/woff2
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `37a1212cc1ab5c935d9a3fee05c98c940eaa895a23510e5f83d550dfbb0d763f` Request headers Referer Origin https://sso-att.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Content-Type font/woff2

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: AT&T (Telecommunication)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://sso-att.com/login.php Message: [DOM] Multiple forms should be contained in their own form elements; break up complex forms into ones that represent a single action: (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

sso-att.com
193.143.1.14
11645608a78d077e22935d051a53996e4edd0ec4d783b78d9847622a62a887f4
37a1212cc1ab5c935d9a3fee05c98c940eaa895a23510e5f83d550dfbb0d763f
4a6500fffb1823beca8bd2c203014d05111e97a82dbbb8516a642abb03bf7bf2
59ea63b5ffe0f060e37c24a44b6406943df9e4fca39e2ef43023c2ae9783f220
adcfe7d308651f937a03cf9b9bdd684074a95be39186aa8cd229b57485f929b8
e2740c7b209e33aca7176250d80f94b4924e5e5d18076ee3b95f32a0e20d1f58
fd4b820fde3e535ba24380c3ecdd6e1c5830ab5213523c1c174bed4f5803ab58

sso-att.com Open in urlscan Pro 193.143.1.14 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

1 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

2 IPs

1 Countries

137 kBTransfer

200 kBSize

0 Cookies

2 Outgoing links

Page URL History

Redirected requests

1 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

sso-att.com Open in urlscan Pro
193.143.1.14 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

1
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

2
IPs

1
Countries

137 kB
Transfer

200 kB
Size

0
Cookies

1 HTTP transactions
6 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!