att-tickets.com
Open in
urlscan Pro
134.209.219.56
Malicious Activity!
Public Scan
Submission: On June 17 via automatic, source phishtank
Summary
This is the only time att-tickets.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: AT&T (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 134.209.219.56 134.209.219.56 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN - DigitalOcean) | |
5 | 144.161.200.106 144.161.200.106 | 797 (AMERITECH-AS) (AMERITECH-AS - AT&T Services) | |
7 | 3 |
ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US)
att-tickets.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
5 |
att.net
opus.att.net |
14 KB |
1 |
att-tickets.com
att-tickets.com |
2 KB |
7 | 2 |
Domain | Requested by | |
---|---|---|
5 | opus.att.net |
att-tickets.com
|
1 | att-tickets.com | |
7 | 2 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
opus.att.net DigiCert SHA2 Secure Server CA |
2018-07-16 - 2020-07-16 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
http://att-tickets.com/
Frame ID: 85F9AB41478FED760F65E647B50FBD27
Requests: 7 HTTP requests in this frame
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
7 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
att-tickets.com/ |
4 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login.css
opus.att.net/opus/newlnf/common/css/ |
4 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login_att_logo_transp.gif
opus.att.net/opus/newlnf/common/images/login/ |
4 KB 5 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
buttons.css
opus.att.net/opus/newlnf/common/css/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login_box.gif
opus.att.net/opus/newlnf/common/images/login/ |
1 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login_hdrRight.gif
opus.att.net/opus/newlnf/common/images/login/ |
2 KB 2 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login_hdrLeft.gif
opus.att.net/opus/newlnf/common/images/login/ |
884 B 1 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- opus.att.net
- URL
- https://opus.att.net/opus/newlnf/common/css/buttons.css
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: AT&T (Telecommunication)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
att-tickets.com
opus.att.net
opus.att.net
134.209.219.56
144.161.200.106
42caf65fb1b92a4b194306e828ddc2e262aff6d94383fc488b85b4c52fc8c2ba
46ba56c15f0971a5a0853079cb584bf89aa18f4679d4aa971f4d70b5347f333c
68485cf8dbfd8742c2f11fb25d75dbae25e48334482c6e7cfdb36202939967fa
7b5d643e0bd4d6d012ce9ee12b90376ab42b5ee9f07fd1f2c918185768d88862
a80aa647835daff153b7c9743c1740de76611f41b60c8c8a10cc2e00e6631a7d
fa5436f6541f9f66aba15e61bad0e69d9e11b8e76b3b82fe79acb0be76022071