tickets-att.com Open in urlscan Pro
181.174.165.122 Malicious Activity! Public Scan

URL:
http://tickets-att.com/
Submission: On June 03 via manual (June 3rd 2019, 12:39:59 pm UTC) from US

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 9 HTTP transactions. The main IP is 181.174.165.122, located in Panama and belongs to Offshore Racks S.A, PA. The main domain is tickets-att.com.

This is the only time tickets-att.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: AT&T (Telecommunication)

Domain & IP information

	IP Address	AS Autonomous System
1	181.174.165.122 181.174.165.122	52469 (Offshore ...) (Offshore Racks S.A)
8	144.161.200.106 144.161.200.106	797 (AMERITECH-AS) (AMERITECH-AS - AT&T Services)
9	2

1 181.174.165.122 (Panama)

ASN52469 (Offshore Racks S.A, PA)
PTR: cpanel12.offshoreracks.com

tickets-att.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 144.161.200.106 (United States)

ASN797 (AMERITECH-AS - AT&T Services, Inc., US)

opus.att.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	att.net opus.att.net	18 KB
1	tickets-att.com tickets-att.com	2 KB
9	2

	Domain	Requested by
8	opus.att.net	tickets-att.com
1	tickets-att.com
9	2

This site contains no links.

Subject Issuer	Validity	Valid
opus.att.net DigiCert SHA2 Secure Server CA	`2018-07-16` - `2020-07-16`	2 years	crt.sh

This page contains 1 frames:

Primary Page: http://tickets-att.com/
Frame ID: D8161B62872F0CF22118729E5B8D05CA
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|)HTTPD)/i

Page Statistics

9
Requests

89 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

20 kB
Transfer

20 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
tickets-att.com/ 4 KB
2 KB 519ms
163ms Document
text/html 181.174.165.122
Offshore Racks S.A

General

Check archive.org

Show headers Download Go to

Full URL

http://tickets-att.com/

Protocol

HTTP/1.1

Server

181.174.165.122 , Panama, ASN52469 (Offshore Racks S.A, PA),

Reverse DNS

cpanel12.offshoreracks.com

Software

Apache /

Resource Hash

54dc9271b7b1a3edbe2137b9ced6b1f3f81006b53beff83a1512fb388ae1bda1

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Host: tickets-att.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 03 Jun 2019 12:39:21 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1696
Keep-Alive: timeout=1, max=60
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK login.css
opus.att.net/opus/newlnf/common/css/ 4 KB
4 KB 2266ms
178ms Stylesheet
text/css 144.161.200.106
AT&T Services

General

Check archive.org

Show headers Download Go to

Full URL: https://opus.att.net/opus/newlnf/common/css/login.css
Requested by: Host: tickets-att.com
URL: http://tickets-att.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 144.161.200.106 , United States, ASN797 (AMERITECH-AS - AT&T Services, Inc., US),
Reverse DNS
Software: Apache /
Resource Hash: fa5436f6541f9f66aba15e61bad0e69d9e11b8e76b3b82fe79acb0be76022071

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 03 Jun 2019 12:39:24 GMT
Last-Modified: Tue, 28 May 2019 22:13:26 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 4044

GET
H/1.1 200
OK login_att_logo_transp.gif
opus.att.net/opus/newlnf/common/images/login/ 4 KB
5 KB 2626ms
176ms Image
image/gif 144.161.200.106
AT&T Services

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://opus.att.net/opus/newlnf/common/images/login/login_att_logo_transp.gif
Requested by: Host: tickets-att.com
URL: http://tickets-att.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 144.161.200.106 , United States, ASN797 (AMERITECH-AS - AT&T Services, Inc., US),
Reverse DNS
Software: Apache /
Resource Hash: 42caf65fb1b92a4b194306e828ddc2e262aff6d94383fc488b85b4c52fc8c2ba

Request headers

Referer: http://tickets-att.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 03 Jun 2019 12:39:24 GMT
Last-Modified: Tue, 28 May 2019 22:13:28 GMT
Server: Apache
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 4527

GET
H/1.1 200
OK buttons.css
opus.att.net/opus/newlnf/common/css/ 2 KB
2 KB 2449ms
183ms Stylesheet
text/css 144.161.200.106
AT&T Services

General

Check archive.org

Show headers Download Go to

Full URL: https://opus.att.net/opus/newlnf/common/css/buttons.css
Requested by: Host: tickets-att.com
URL: http://tickets-att.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 144.161.200.106 , United States, ASN797 (AMERITECH-AS - AT&T Services, Inc., US),
Reverse DNS
Software: Apache /
Resource Hash: 684a7fbf6aade434db61528ea38da5605c50ae361ce650291f03fccd7eb76799

Request headers

Referer: http://tickets-att.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 03 Jun 2019 12:39:24 GMT
Last-Modified: Tue, 28 May 2019 22:13:26 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 2248

GET
H/1.1 200
OK login_box.gif
opus.att.net/opus/newlnf/common/images/login/ 1 KB
2 KB 399ms
224ms Image
image/gif 144.161.200.106
AT&T Services

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://opus.att.net/opus/newlnf/common/images/login/login_box.gif
Requested by: Host: tickets-att.com
URL: http://tickets-att.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 144.161.200.106 , United States, ASN797 (AMERITECH-AS - AT&T Services, Inc., US),
Reverse DNS
Software: Apache /
Resource Hash: 7b5d643e0bd4d6d012ce9ee12b90376ab42b5ee9f07fd1f2c918185768d88862

Request headers

Referer: https://opus.att.net/opus/newlnf/common/css/login.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 03 Jun 2019 12:39:24 GMT
Last-Modified: Tue, 28 May 2019 21:13:28 GMT
Server: Apache
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 1461

GET
H/1.1 200
OK login_hdrRight.gif
opus.att.net/opus/newlnf/common/images/login/ 2 KB
2 KB 607ms
207ms Image
image/gif 144.161.200.106
AT&T Services

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://opus.att.net/opus/newlnf/common/images/login/login_hdrRight.gif
Requested by: Host: tickets-att.com
URL: http://tickets-att.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 144.161.200.106 , United States, ASN797 (AMERITECH-AS - AT&T Services, Inc., US),
Reverse DNS
Software: Apache /
Resource Hash: 46ba56c15f0971a5a0853079cb584bf89aa18f4679d4aa971f4d70b5347f333c

Request headers

Referer: https://opus.att.net/opus/newlnf/common/css/login.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 03 Jun 2019 12:39:24 GMT
Last-Modified: Tue, 28 May 2019 22:13:28 GMT
Server: Apache
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 1979

GET
H/1.1 200
OK login_hdrLeft.gif
opus.att.net/opus/newlnf/common/images/login/ 884 B
1 KB 696ms
262ms Image
image/gif 144.161.200.106
AT&T Services

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://opus.att.net/opus/newlnf/common/images/login/login_hdrLeft.gif
Requested by: Host: tickets-att.com
URL: http://tickets-att.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 144.161.200.106 , United States, ASN797 (AMERITECH-AS - AT&T Services, Inc., US),
Reverse DNS
Software: Apache /
Resource Hash: a80aa647835daff153b7c9743c1740de76611f41b60c8c8a10cc2e00e6631a7d

Request headers

Referer: https://opus.att.net/opus/newlnf/common/css/login.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 03 Jun 2019 12:39:24 GMT
Last-Modified: Tue, 28 May 2019 21:13:28 GMT
Server: Apache
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 884

GET
H/1.1 200
OK btn_orange_left.gif
opus.att.net/opus/newlnf/common/images/btn/ 394 B
636 B 815ms
209ms Image
image/gif 144.161.200.106
AT&T Services

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://opus.att.net/opus/newlnf/common/images/btn/btn_orange_left.gif
Requested by: Host: tickets-att.com
URL: http://tickets-att.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 144.161.200.106 , United States, ASN797 (AMERITECH-AS - AT&T Services, Inc., US),
Reverse DNS
Software: Apache /
Resource Hash: f66938aa3ce5a8b3988fa3e433c70de530c7a50fea10f276654b25b3174569ba

Request headers

Referer: https://opus.att.net/opus/newlnf/common/css/buttons.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 03 Jun 2019 12:39:25 GMT
Last-Modified: Tue, 28 May 2019 21:13:28 GMT
Server: Apache
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 394

GET
H/1.1 200
OK btn_orange_right.gif
opus.att.net/opus/newlnf/common/images/btn/ 1 KB
1 KB 849ms
154ms Image
image/gif 144.161.200.106
AT&T Services

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://opus.att.net/opus/newlnf/common/images/btn/btn_orange_right.gif
Requested by: Host: tickets-att.com
URL: http://tickets-att.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 144.161.200.106 , United States, ASN797 (AMERITECH-AS - AT&T Services, Inc., US),
Reverse DNS
Software: Apache /
Resource Hash: 964b84ec9e395a1036983047510d5ce3ab4577597bbfa4f41037cc3f69718122

Request headers

Referer: https://opus.att.net/opus/newlnf/common/css/buttons.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 03 Jun 2019 12:39:25 GMT
Last-Modified: Tue, 28 May 2019 21:13:28 GMT
Server: Apache
Content-Type: image/gif
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=96
Content-Length: 1040

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: AT&T (Telecommunication)

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

opus.att.net
tickets-att.com
144.161.200.106
181.174.165.122
42caf65fb1b92a4b194306e828ddc2e262aff6d94383fc488b85b4c52fc8c2ba
46ba56c15f0971a5a0853079cb584bf89aa18f4679d4aa971f4d70b5347f333c
54dc9271b7b1a3edbe2137b9ced6b1f3f81006b53beff83a1512fb388ae1bda1
684a7fbf6aade434db61528ea38da5605c50ae361ce650291f03fccd7eb76799
7b5d643e0bd4d6d012ce9ee12b90376ab42b5ee9f07fd1f2c918185768d88862
964b84ec9e395a1036983047510d5ce3ab4577597bbfa4f41037cc3f69718122
a80aa647835daff153b7c9743c1740de76611f41b60c8c8a10cc2e00e6631a7d
f66938aa3ce5a8b3988fa3e433c70de530c7a50fea10f276654b25b3174569ba
fa5436f6541f9f66aba15e61bad0e69d9e11b8e76b3b82fe79acb0be76022071

tickets-att.com Open in urlscan Pro 181.174.165.122 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

9 Requests

89 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

20 kBTransfer

20 kBSize

0 Cookies

0 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

3 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

tickets-att.com Open in urlscan Pro
181.174.165.122 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

89 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

20 kB
Transfer

20 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!