kitceramics.com.au
Open in
urlscan Pro
148.66.138.153
Malicious Activity!
Public Scan
Submission Tags: phishing
Submission: On November 26 via api from US — Scanned from DE
Summary
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on September 29th 2021. Valid for: a year.
This is the only time kitceramics.com.au was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: AT&T (Telecommunication)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 148.66.138.153 148.66.138.153 | 26496 (AS-26496-...) (AS-26496-GO-DADDY-COM-LLC) | |
4 | 2a02:26f0:6c0... 2a02:26f0:6c00:2af::2db1 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 2606:4700:10:... 2606:4700:10::6816:35fc | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
5 | 144.160.125.207 144.160.125.207 | 797 (AMERITECH-AS) (AMERITECH-AS) | |
1 | 88.221.221.147 88.221.221.147 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 142.250.186.70 142.250.186.70 | 15169 (GOOGLE) (GOOGLE) | |
4 | 34.69.196.104 34.69.196.104 | 15169 (GOOGLE) (GOOGLE) | |
1 | 35.226.2.182 35.226.2.182 | 15169 (GOOGLE) (GOOGLE) | |
1 | 23.79.143.47 23.79.143.47 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
21 | 10 |
ASN797 (AMERITECH-AS, US)
PTR: clcontent-da.att.com
signin-static-js.att.com | |
signin.att.com |
ASN20940 (AKAMAI-ASN1, NL)
PTR: a88-221-221-147.deploy.static.akamaitechnologies.com
img1.wsimg.com |
ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f6.1e100.net
fls.doubleclick.net |
ASN15169 (GOOGLE, US)
PTR: 104.196.69.34.bc.googleusercontent.com
att-app.quantummetric.com |
ASN15169 (GOOGLE, US)
PTR: 182.2.226.35.bc.googleusercontent.com
att-sync.quantummetric.com |
ASN16625 (AKAMAI-AS, US)
PTR: a23-79-143-47.deploy.static.akamaitechnologies.com
img.secureserver.net |
Apex Domain Subdomains |
Transfer | |
---|---|---|
9 |
att.com
www.att.com signin-static-js.att.com signin.att.com |
297 KB |
6 |
quantummetric.com
cdn.quantummetric.com att-app.quantummetric.com att-sync.quantummetric.com |
110 KB |
1 |
secureserver.net
img.secureserver.net |
379 B |
1 |
doubleclick.net
fls.doubleclick.net |
723 B |
1 |
wsimg.com
img1.wsimg.com |
5 KB |
1 |
kitceramics.com.au
kitceramics.com.au |
4 KB |
0 |
Failed
function sub() { [native code] }. Failed |
|
21 | 7 |
Domain | Requested by | |
---|---|---|
4 | att-app.quantummetric.com |
cdn.quantummetric.com
|
4 | signin.att.com |
kitceramics.com.au
signin.att.com |
4 | www.att.com |
kitceramics.com.au
www.att.com |
1 | img.secureserver.net | |
1 | att-sync.quantummetric.com |
cdn.quantummetric.com
|
1 | fls.doubleclick.net |
www.att.com
|
1 | img1.wsimg.com |
kitceramics.com.au
|
1 | signin-static-js.att.com |
kitceramics.com.au
|
1 | cdn.quantummetric.com |
kitceramics.com.au
|
1 | kitceramics.com.au | |
0 | 66f84f86-d3ab-41cb-8e63-2e76288df6a6 Failed |
kitceramics.com.au
|
21 | 11 |
This site contains links to these domains. Also see Links.
Domain |
---|
attreg.att.net |
www.att.com |
about.att.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
kitceramics.com.au Go Daddy Secure Certificate Authority - G2 |
2021-09-29 - 2022-10-31 |
a year | crt.sh |
*.att.com DigiCert SHA2 Secure Server CA |
2021-01-05 - 2022-01-09 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-07-17 - 2022-07-16 |
a year | crt.sh |
*.wsimg.com Starfield Secure Certificate Authority - G2 |
2021-09-24 - 2022-10-26 |
a year | crt.sh |
*.doubleclick.net GTS CA 1C3 |
2021-11-01 - 2022-01-24 |
3 months | crt.sh |
*.quantummetric.com Sectigo RSA Domain Validation Secure Server CA |
2021-01-18 - 2022-02-13 |
a year | crt.sh |
*.secureserver.net Starfield Secure Certificate Authority - G2 |
2021-09-16 - 2022-10-18 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://kitceramics.com.au/Adob/
Frame ID: B65608690B1D70652F6603461493C7F6
Requests: 17 HTTP requests in this frame
Frame:
https://att-app.quantummetric.com/?T=B&u=https%3A%2F%2Fkitceramics.com.au%2FAdob%2F&t=1637946002949&v=1637946002969&z=1&S=0&N=0&P=0
Frame ID: 40FA0240B0FAC667DFD5E20B2C606AB2
Requests: 5 HTTP requests in this frame
6 Outgoing links
These are links going to different origins than the main page.
Title: Create one now
Search URL Search Domain Scan URL
Title: Legal policy center
Search URL Search Domain Scan URL
Title: Privacy policy
Search URL Search Domain Scan URL
Title: Terms of use
Search URL Search Domain Scan URL
Title: Accessibility
Search URL Search Domain Scan URL
Title: Do not sell my personal info
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
21 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
kitceramics.com.au/Adob/ |
14 KB 4 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
webrtc-patch.js
66f84f86-d3ab-41cb-8e63-2e76288df6a6/scripts/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
detm-container-hdr.js
www.att.com/scripts/adobe/prod/ |
105 KB 30 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
quantum-att.js
cdn.quantummetric.com/qscripts/ |
549 KB 109 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
att_common.js
signin-static-js.att.com/scripts/ |
229 KB 130 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ssaf-uc.js
www.att.com/scripts/ssaf_universal_client/prod/ |
109 KB 21 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
styles.css
signin.att.com/static/siam/en/halo_c/halo-c-login/ |
154 KB 33 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
logo.svg
signin.att.com/static/siam/en/halo_c/halo-c-login/assets/images/ |
8 KB 9 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
detm-container-ftr.js
www.att.com/scripts/adobe/prod/ |
666 B 738 B |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
tcc_l.combined.1.0.6.min.js
img1.wsimg.com/tcc/ |
12 KB 5 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
mbox-contents.js
www.att.com/scripts/adobe/prod/ |
110 KB 36 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET BLOB |
800ec8cf-0a36-43b5-b031-47ba72f1cc8d
https://kitceramics.com.au/ |
17 KB 0 |
Other
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
json
fls.doubleclick.net/ |
40 B 723 B |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ATTAleckSans_W_Rg.woff2
signin.att.com/static/siam/en/halo_c/halo-c-login/assets/fonts/att/ATTAleckSans/woff2/ |
18 KB 18 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ATTAleckSans_W_Md.woff2
signin.att.com/static/siam/en/halo_c/halo-c-login/assets/fonts/att/ATTAleckSans/woff2/ |
19 KB 20 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
/
att-app.quantummetric.com/ Frame 40FA |
90 B 430 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
/
att-sync.quantummetric.com/ Frame 40FA |
0 157 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
89 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
att-app.quantummetric.com/ Frame 40FA |
28 B 251 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
/
att-app.quantummetric.com/ Frame 40FA |
0 156 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
/
att-app.quantummetric.com/ Frame 40FA |
0 156 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
event
img.secureserver.net/t/1/tl/ |
43 B 379 B |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- 66f84f86-d3ab-41cb-8e63-2e76288df6a6
- URL
- moz-extension://66f84f86-d3ab-41cb-8e63-2e76288df6a6/scripts/webrtc-patch.js
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: AT&T (Telecommunication)91 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler string| detmScriptLoadType string| hcc string| mid string| adobe_mc number| ts string| href object| hcc_check undefined| analytics_app_visitor_id undefined| newurl undefined| halo_app_visitor_id object| detm_last_link_info function| isIE function| _pageLoadDetector function| _earlyAnalytics function| e boolean| disableAudienceManager object| visitor object| DataMappingInterface string| detm_tag_notification_key string| legacyModeKey string| retireDLKey object| scripts object| script string| src function| satelliteDetector function| scriptExecutor string| filesadded boolean| monecontwatched function| loadAdsFile function| injectHtmlTag function| executeMonetizationTagInjection function| injectMonetization function| iterateANConfigObj function| findAccurateConfig object| detmScriptLoaderConfig function| detmScriptLoader object| detmLoader boolean| AllowDelayedLoad function| dunBradstreet undefined| dnbvid object| earlyAnalytics object| chatAnalytics function| Visitor object| s_c_il number| s_c_in boolean| detmDisabled object| detmScriptExecutor function| detmDomainMapper object| detmTagControls string| path object| _satellite object| head_ab boolean| pageLoadFired function| targetView function| listAbVariants function| targetPageParams object| targetGlobalSettings function| ab$ function| ABJSFrameworkLibrary object| adobe function| mboxCreate function| mboxDefine function| mboxUpdate string| AB_LOCATION_CHANGE string| sdidUrl function| QuantumMetricInstrumentationStart object| QuantumMetricAPI function| qmflate function| docReady object| ddo function| AnalyticsNotificationFramework object| loginJspEnvVars string| loginLanguage function| detmExecuteFooter object| _trfd function| tcg function| tcp object| perfhandler object| TCCTracker object| _trfq object| true object| s_3_Integrate_DFA_get_0 object| uc_dfa_val number| dfaSuccess boolean| evaluation7 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.doubleclick.net/ | Name: test_cookie Value: CheckForPermission |
|
att-app.quantummetric.com/ | Name: s Value: 785d146d86a76b0b2def3ba79eae563b |
|
att-app.quantummetric.com/ | Name: U Value: 8c812a59dd9c93e7c8e8b7deabf8355c |
|
.kitceramics.com.au/ | Name: QuantumMetricSessionID Value: 785d146d86a76b0b2def3ba79eae563b |
|
.kitceramics.com.au/ | Name: QuantumMetricUserID Value: 8c812a59dd9c93e7c8e8b7deabf8355c |
|
kitceramics.com.au/ | Name: _tccl_visitor Value: 26064894-3802-4adb-a2c4-01c0de64c5aa |
|
kitceramics.com.au/ | Name: _tccl_visit Value: 26064894-3802-4adb-a2c4-01c0de64c5aa |
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
66f84f86-d3ab-41cb-8e63-2e76288df6a6
att-app.quantummetric.com
att-sync.quantummetric.com
cdn.quantummetric.com
fls.doubleclick.net
img.secureserver.net
img1.wsimg.com
kitceramics.com.au
signin-static-js.att.com
signin.att.com
www.att.com
66f84f86-d3ab-41cb-8e63-2e76288df6a6
142.250.186.70
144.160.125.207
148.66.138.153
23.79.143.47
2606:4700:10::6816:35fc
2a02:26f0:6c00:2af::2db1
34.69.196.104
35.226.2.182
88.221.221.147
106494daab79023e4494d867c23dcd60bb6dbb00cf9560ea46dd8adb13b9b8fa
12d77f615d7df0946899d769baa6094c8060d6006df35a1afb54c152b070871e
1ae55eee9d98c2f4c7fdb3e9add8ffec1f75fda9a2053df845a87e38d113873d
20b3ea9fd67b025594f01bc11055c903c202f7afe1eea503d25fffae7feac95e
43f774da83292822f54305d69e01286ca018b6f3f0fe86250451ad93d9252f9c
50e6072d26098d48004a30addeecabd5b22b91e5ccdf9dd86f96459783e3ac23
59ea63b5ffe0f060e37c24a44b6406943df9e4fca39e2ef43023c2ae9783f220
6982fbe858e30068de9301b49438c83838bc7beb058146703b22b701e6709c7e
6a4393001e5b6296cbb68796237ad3d4d9ae41e6fc170987645137d14df1ad5b
78968f7edcf2d2a6d4f7d7f2d11a51000b6d14e29449a95096d676f09a4e295e
80001c402149eff011b5e7e87c3dd72dc2de45d3d430d98418eb62c2ec5ad596
aa5c1ec4d2ea00eb517eadeb3b65e55b577b7a5ed42d7c2611d15d9050c18350
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
c3607f479b49de9f7cb4c26dd2331ac9eb6506975edec23120cfd6d7d18462d0
e2740c7b209e33aca7176250d80f94b4924e5e5d18076ee3b95f32a0e20d1f58
e32a6ae5e43f7f652674e0f03dc23f86839f839b29ee4e63c01c93da180bb0d0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f6965e98f020c4a13929d6a3629f6f58e46a515a03fa132d669ebc2ed2d08344
fc3f8b054526b4fdc8aea61ebe28698374077aa74532ebc27b2fbdab0959a10d