att-support-ticket.com Open in urlscan Pro
111.90.142.34 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
http://att-support-ticket.com/stores
Submission: On September 03 via manual (September 3rd 2019, 6:19:12 pm UTC) from JP

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 9 HTTP transactions. The main IP is 111.90.142.34, located in Malaysia and belongs to SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY. The main domain is att-support-ticket.com.

This is the only time att-support-ticket.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: AT&T (Telecommunication)

Domain & IP information

	IP Address		AS Autonomous System
3 12	111.90.142.34 111.90.142.34		45839 (SHINJIRU-...) (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd)
9	1

12 111.90.142.34 (Malaysia) 3 redirects

ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY)
PTR: marten25.metaldns.com

att-support-ticket.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	att-support-ticket.com 3 redirects att-support-ticket.com	15 KB
9	1

	Domain	Requested by
12	att-support-ticket.com	3 redirects att-support-ticket.com
9	1

This site contains no links.

Subject Issuer	Validity	Valid
att-support-ticket.com.att-support-tickets.com att-support-ticket.com.att-support-tickets.com	`2019-08-30` - `2020-08-29`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://att-support-ticket.com/stores
Frame ID: 12AC2EAE2C09ACA62EBC03CE4843037C
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

LiteSpeed (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^LiteSpeed$/i

Page Statistics

9
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

14 kB
Transfer

21 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://att-support-ticket.com/stores_files/login.css HTTP 301
https://att-support-ticket.com/stores_files/login.css

Request Chain 1

http://att-support-ticket.com/stores_files/login_att_logo_transp.gif HTTP 301
https://att-support-ticket.com/stores_files/login_att_logo_transp.gif

Request Chain 2

http://att-support-ticket.com/stores_files/buttons.css HTTP 301
https://att-support-ticket.com/stores_files/buttons.css

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request stores Show response att-support-ticket.com/	4 KB 2 KB	442ms 259ms	Document text/html	111.90.142.34 SHINJIRU-MY-AS-AP...
General Check archive.org Show headers Download Go to Full URL http://att-support-ticket.com/stores Protocol HTTP/1.1 Server 111.90.142.34 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY), Reverse DNS marten25.metaldns.com Software LiteSpeed / PHP/7.0.33 Resource Hash `8d31381494d4ebfe7f9bc5af57993467d61858c06649d2b9d7410dc46ff5ff0c` Request headers Host att-support-ticket.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Connection Keep-Alive X-Powered-By PHP/7.0.33 Content-Type text/html; charset=UTF-8 Content-Length 1940 Content-Encoding gzip Vary Accept-Encoding Date Tue, 03 Sep 2019 18:18:51 GMT Server LiteSpeed
GET H2	200	login.css att-support-ticket.com/stores_files/ Redirect Chain http://att-support-ticket.com/stores_files/login.css https://att-support-ticket.com/stores_files/login.css	4 KB 1 KB	553ms 184ms	Stylesheet text/css	111.90.142.34 SHINJIRU-MY-AS-AP...
General Check archive.org Show headers Download Go to Full URL https://att-support-ticket.com/stores_files/login.css Requested by Host: att-support-ticket.com URL: http://att-support-ticket.com/stores Protocol H2 Security TLS 1.3, , AES_128_GCM Server 111.90.142.34 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY), Reverse DNS marten25.metaldns.com Software LiteSpeed / Resource Hash `d1ee656f4afd603b3c7248e06696e305ae3e4e0c99c9b0ab755035794e5990d2` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 03 Sep 2019 18:18:52 GMT content-encoding br last-modified Tue, 03 Sep 2019 18:11:28 GMT server LiteSpeed vary Accept-Encoding content-type text/css status 200 cache-control public, max-age=604800 accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="39,43,46", h3-22=":443"; ma=2592000 content-length 843 expires Tue, 10 Sep 2019 18:18:52 GMT Redirect headers Location https://att-support-ticket.com/stores_files/login.css Date Tue, 03 Sep 2019 18:18:52 GMT Server LiteSpeed Connection Keep-Alive Content-Length 617 Content-Type text/html
GET H2	200	login_att_logo_transp.gif att-support-ticket.com/stores_files/ Redirect Chain http://att-support-ticket.com/stores_files/login_att_logo_transp.gif https://att-support-ticket.com/stores_files/login_att_logo_transp.gif	4 KB 4 KB	440ms 249ms	Image image/gif	111.90.142.34 SHINJIRU-MY-AS-AP...
General Check archive.org Show headers Download Go to Show image Full URL https://att-support-ticket.com/stores_files/login_att_logo_transp.gif Requested by Host: att-support-ticket.com URL: http://att-support-ticket.com/stores Protocol H2 Security TLS 1.3, , AES_128_GCM Server 111.90.142.34 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY), Reverse DNS marten25.metaldns.com Software LiteSpeed / Resource Hash `42caf65fb1b92a4b194306e828ddc2e262aff6d94383fc488b85b4c52fc8c2ba` Request headers Referer http://att-support-ticket.com/stores User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 03 Sep 2019 18:18:52 GMT last-modified Tue, 03 Sep 2019 18:11:28 GMT server LiteSpeed content-type image/gif status 200 cache-control public, max-age=604800 accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="39,43,46", h3-22=":443"; ma=2592000 content-length 4527 expires Tue, 10 Sep 2019 18:18:52 GMT Redirect headers Location https://att-support-ticket.com/stores_files/login_att_logo_transp.gif Date Tue, 03 Sep 2019 18:18:52 GMT Server LiteSpeed Connection Keep-Alive Content-Length 617 Content-Type text/html
GET H2	200	buttons.css att-support-ticket.com/stores_files/ Redirect Chain http://att-support-ticket.com/stores_files/buttons.css https://att-support-ticket.com/stores_files/buttons.css	2 KB 737 B	439ms 248ms	Stylesheet text/css	111.90.142.34 SHINJIRU-MY-AS-AP...
General Check archive.org Show headers Download Go to Full URL https://att-support-ticket.com/stores_files/buttons.css Requested by Host: att-support-ticket.com URL: http://att-support-ticket.com/stores Protocol H2 Security TLS 1.3, , AES_128_GCM Server 111.90.142.34 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY), Reverse DNS marten25.metaldns.com Software LiteSpeed / Resource Hash `016ae3a8a3c4f0d998232cca1a98eda5f4905cc8f54470c4b84dce8fa1499df2` Request headers Referer http://att-support-ticket.com/stores User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 03 Sep 2019 18:18:52 GMT content-encoding br last-modified Tue, 03 Sep 2019 18:11:27 GMT server LiteSpeed vary Accept-Encoding content-type text/css status 200 cache-control public, max-age=604800 accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="39,43,46", h3-22=":443"; ma=2592000 content-length 680 expires Tue, 10 Sep 2019 18:18:52 GMT Redirect headers Location https://att-support-ticket.com/stores_files/buttons.css Date Tue, 03 Sep 2019 18:18:52 GMT Server LiteSpeed Connection Keep-Alive Content-Length 617 Content-Type text/html
GET H2	200	login_box.gif att-support-ticket.com/dealer_files/	1 KB 1 KB	183ms 183ms	Image image/gif	111.90.142.34 SHINJIRU-MY-AS-AP...
General Check archive.org Show headers Download Go to Show image Full URL https://att-support-ticket.com/dealer_files/login_box.gif Requested by Host: att-support-ticket.com URL: http://att-support-ticket.com/stores Protocol H2 Security TLS 1.3, , AES_128_GCM Server 111.90.142.34 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY), Reverse DNS marten25.metaldns.com Software LiteSpeed / Resource Hash `7b5d643e0bd4d6d012ce9ee12b90376ab42b5ee9f07fd1f2c918185768d88862` Request headers Sec-Fetch-Mode no-cors Referer https://att-support-ticket.com/stores_files/login.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 03 Sep 2019 18:18:52 GMT last-modified Tue, 03 Sep 2019 18:10:57 GMT server LiteSpeed content-type image/gif status 200 cache-control public, max-age=604800 accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="39,43,46", h3-22=":443"; ma=2592000 content-length 1461 expires Tue, 10 Sep 2019 18:18:52 GMT
GET H2	200	login_hdrRight.gif att-support-ticket.com/dealer_files/	2 KB 2 KB	183ms 183ms	Image image/gif	111.90.142.34 SHINJIRU-MY-AS-AP...
General Check archive.org Show headers Download Go to Show image Full URL https://att-support-ticket.com/dealer_files/login_hdrRight.gif Requested by Host: att-support-ticket.com URL: http://att-support-ticket.com/stores Protocol H2 Security TLS 1.3, , AES_128_GCM Server 111.90.142.34 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY), Reverse DNS marten25.metaldns.com Software LiteSpeed / Resource Hash `46ba56c15f0971a5a0853079cb584bf89aa18f4679d4aa971f4d70b5347f333c` Request headers Sec-Fetch-Mode no-cors Referer https://att-support-ticket.com/stores_files/login.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 03 Sep 2019 18:18:52 GMT last-modified Tue, 03 Sep 2019 18:10:58 GMT server LiteSpeed content-type image/gif status 200 cache-control public, max-age=604800 accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="39,43,46", h3-22=":443"; ma=2592000 content-length 1979 expires Tue, 10 Sep 2019 18:18:52 GMT
GET H2	200	login_hdrLeft.gif att-support-ticket.com/dealer_files/	884 B 917 B	184ms 183ms	Image image/gif	111.90.142.34 SHINJIRU-MY-AS-AP...
General Check archive.org Show headers Download Go to Show image Full URL https://att-support-ticket.com/dealer_files/login_hdrLeft.gif Requested by Host: att-support-ticket.com URL: http://att-support-ticket.com/stores Protocol H2 Security TLS 1.3, , AES_128_GCM Server 111.90.142.34 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY), Reverse DNS marten25.metaldns.com Software LiteSpeed / Resource Hash `a80aa647835daff153b7c9743c1740de76611f41b60c8c8a10cc2e00e6631a7d` Request headers Sec-Fetch-Mode no-cors Referer https://att-support-ticket.com/stores_files/login.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 03 Sep 2019 18:18:52 GMT last-modified Tue, 03 Sep 2019 18:10:57 GMT server LiteSpeed content-type image/gif status 200 cache-control public, max-age=604800 accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="39,43,46", h3-22=":443"; ma=2592000 content-length 884 expires Tue, 10 Sep 2019 18:18:52 GMT
GET H2	200	btn_orange_left.gif att-support-ticket.com/dealer_files/	394 B 451 B	184ms 183ms	Image image/gif	111.90.142.34 SHINJIRU-MY-AS-AP...
General Check archive.org Show headers Download Go to Show image Full URL https://att-support-ticket.com/dealer_files/btn_orange_left.gif Requested by Host: att-support-ticket.com URL: http://att-support-ticket.com/stores Protocol H2 Security TLS 1.3, , AES_128_GCM Server 111.90.142.34 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY), Reverse DNS marten25.metaldns.com Software LiteSpeed / Resource Hash `f66938aa3ce5a8b3988fa3e433c70de530c7a50fea10f276654b25b3174569ba` Request headers Sec-Fetch-Mode no-cors Referer https://att-support-ticket.com/stores_files/buttons.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 03 Sep 2019 18:18:52 GMT last-modified Tue, 03 Sep 2019 18:10:54 GMT server LiteSpeed content-type image/gif status 200 cache-control public, max-age=604800 accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="39,43,46", h3-22=":443"; ma=2592000 content-length 394 expires Tue, 10 Sep 2019 18:18:52 GMT
GET H2	200	btn_orange_right.gif att-support-ticket.com/dealer_files/	1 KB 1 KB	184ms 184ms	Image image/gif	111.90.142.34 SHINJIRU-MY-AS-AP...
General Check archive.org Show headers Download Go to Show image Full URL https://att-support-ticket.com/dealer_files/btn_orange_right.gif Requested by Host: att-support-ticket.com URL: http://att-support-ticket.com/stores Protocol H2 Security TLS 1.3, , AES_128_GCM Server 111.90.142.34 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY), Reverse DNS marten25.metaldns.com Software LiteSpeed / Resource Hash `964b84ec9e395a1036983047510d5ce3ab4577597bbfa4f41037cc3f69718122` Request headers Sec-Fetch-Mode no-cors Referer https://att-support-ticket.com/stores_files/buttons.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Tue, 03 Sep 2019 18:18:52 GMT last-modified Tue, 03 Sep 2019 18:10:54 GMT server LiteSpeed content-type image/gif status 200 cache-control public, max-age=604800 accept-ranges bytes alt-svc quic=":443"; ma=2592000; v="39,43,46", h3-22=":443"; ma=2592000 content-length 1040 expires Tue, 10 Sep 2019 18:18:52 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: AT&T (Telecommunication)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| handleOnLoad

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

att-support-ticket.com
111.90.142.34
016ae3a8a3c4f0d998232cca1a98eda5f4905cc8f54470c4b84dce8fa1499df2
42caf65fb1b92a4b194306e828ddc2e262aff6d94383fc488b85b4c52fc8c2ba
46ba56c15f0971a5a0853079cb584bf89aa18f4679d4aa971f4d70b5347f333c
7b5d643e0bd4d6d012ce9ee12b90376ab42b5ee9f07fd1f2c918185768d88862
8d31381494d4ebfe7f9bc5af57993467d61858c06649d2b9d7410dc46ff5ff0c
964b84ec9e395a1036983047510d5ce3ab4577597bbfa4f41037cc3f69718122
a80aa647835daff153b7c9743c1740de76611f41b60c8c8a10cc2e00e6631a7d
d1ee656f4afd603b3c7248e06696e305ae3e4e0c99c9b0ab755035794e5990d2
f66938aa3ce5a8b3988fa3e433c70de530c7a50fea10f276654b25b3174569ba

att-support-ticket.com Open in urlscan Pro 111.90.142.34 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

9 Requests

0 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

14 kBTransfer

21 kBSize

0 Cookies

0 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

Indicators

att-support-ticket.com Open in urlscan Pro
111.90.142.34 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

14 kB
Transfer

21 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!