grey-snow-shaker.glitch.me Open in urlscan Pro
3.225.250.122 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://grey-snow-shaker.glitch.me/public/processed.htm
Submission: On July 30 via api (July 30th 2024, 3:35:47 pm UTC) from US — Scanned from DE

Summary HTTP 12 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 12 HTTP transactions. The main IP is 3.225.250.122, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is grey-snow-shaker.glitch.me.
TLS certificate: Issued by Amazon RSA 2048 M03 on December 4th 2023. Valid for: a year.

This is the only time grey-snow-shaker.glitch.me was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: ID.me (Online)

Domain & IP information

	IP Address	AS Autonomous System
6 13	3.225.250.122 3.225.250.122	14618 (AMAZON-AES) (AMAZON-AES)
1	2a00:1450:400... 2a00:1450:4001:80b::200a	15169 (GOOGLE) (GOOGLE)
1	195.80.159.133 195.80.159.133	29152 (DECKNET-AS) (DECKNET-AS)
2	2a02:26f0:ab0... 2a02:26f0:ab00::214:8e73	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2600:9000:235... 2600:9000:235a:5000:1b:ef38:3680:21	16509 (AMAZON-02) (AMAZON-02)
12	5

13 3.225.250.122 (Ashburn, United States) 6 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-225-250-122.compute-1.amazonaws.com

grey-snow-shaker.glitch.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 195.80.159.133 (France)

ASN29152 (DECKNET-AS, FR)

l2.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:ab00::214:8e73 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

api.id.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:235a:5000:1b:ef38:3680:21 (United States)

ASN16509 (AMAZON-02, US)

d21y75miwcfqoq.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	glitch.me 6 redirects grey-snow-shaker.glitch.me	641 KB
2	id.me api.id.me — Cisco Umbrella Rank: 82693	2 KB
1	cloudfront.net d21y75miwcfqoq.cloudfront.net	458 B
1	l2.io l2.io — Cisco Umbrella Rank: 227889	230 B
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 641	33 KB
12	5

	Domain	Requested by
13	grey-snow-shaker.glitch.me	6 redirects grey-snow-shaker.glitch.me
2	api.id.me	grey-snow-shaker.glitch.me
1	d21y75miwcfqoq.cloudfront.net	grey-snow-shaker.glitch.me
1	l2.io	grey-snow-shaker.glitch.me
1	ajax.googleapis.com	grey-snow-shaker.glitch.me
12	5

This site contains links to these domains. Also see Links.

Domain
www.id.me

Subject Issuer	Validity	Valid
glitch.com Amazon RSA 2048 M03	`2023-12-04` - `2025-01-01`	a year	crt.sh
upload.video.google.com WR2	`2024-07-01` - `2024-09-23`	3 months	crt.sh
l2.io R10	`2024-07-04` - `2024-10-02`	3 months	crt.sh
api.id.me DigiCert Global G3 TLS ECC SHA384 2020 CA1	`2024-05-11` - `2024-09-17`	4 months	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2023-10-10` - `2024-09-19`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://grey-snow-shaker.glitch.me/public/processed.htm
Frame ID: A22905118CBE6F41DB2BBDCEE0E183EC
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in to ID.me - ID.me

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

50 %
HTTPS

60 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

676 kB
Transfer

747 kB
Size

0
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://www.id.me/about
Title: What is ID.me?

Search URL Search Domain Scan URL

URL: https://www.id.me/terms
Title: Terms of Service

Search URL Search Domain Scan URL

URL: https://www.id.me/privacy
Title: Privacy Policy

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4

https://grey-snow-shaker.glitch.me/public/4_files/image_pxlho1.svg HTTP 302
https://grey-snow-shaker.glitch.me/

Request Chain 5

https://grey-snow-shaker.glitch.me/public/4_files/upload2.html HTTP 302
https://grey-snow-shaker.glitch.me/

Request Chain 6

https://grey-snow-shaker.glitch.me/assets/Poppins-Regular-849c718edde71e76ae38c89f93b10073e06b6b48d5368090b3e05a412f5b94f4.woff HTTP 302
https://grey-snow-shaker.glitch.me/

Request Chain 7

https://grey-snow-shaker.glitch.me/assets/Poppins-SemiBold-7d4187c3373ec4c000f03314ad24b93cacbddcf62b7bc32689ead9fd2ad574ec.woff HTTP 302
https://grey-snow-shaker.glitch.me/

Request Chain 8

https://grey-snow-shaker.glitch.me/assets/OpenSans-Semibold-98e308576c54531be8643d249d1daf2d2111252237210e733774cef1545da023.woff HTTP 302
https://grey-snow-shaker.glitch.me/

Request Chain 9

https://grey-snow-shaker.glitch.me/assets/Poppins-Medium-94ff9c11734ed5e68a5b736baea74adefff71364c2f605c0983c501606ce0080.woff HTTP 302
https://grey-snow-shaker.glitch.me/

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request processed.htm Show response
grey-snow-shaker.glitch.me/public/ 631 KB
632 KB 1178ms
284ms Document
text/html 3.225.250.122
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://grey-snow-shaker.glitch.me/public/processed.htm
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.225.250.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-225-250-122.compute-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: bf896c2f65f1222a7b3a29d08eab82fbc27d553ce83bcb1f99002dd2d29ebaac

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: no-cache
content-length: 646443
content-type: text/html; charset=utf-8
date: Tue, 30 Jul 2024 15:35:37 GMT
etag: "92f54dcda78a745c089ba49a6e2e3d79"
last-modified: Mon, 29 Jul 2024 12:15:11 GMT
server: AmazonS3
x-amz-id-2: mKoGXWKRheEITp1a/7BV9rennerYJVCcj0GEgbHOsnPxn3HYN/bOACAPbUyxviTWogbZ6Tdf7SA=
x-amz-request-id: 80JJGXSB2JEZXZGJ
x-amz-server-side-encryption: AES256
x-amz-version-id: null

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.7.1/ 92 KB
33 KB 77ms
23ms Script
text/javascript 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js

Requested by

Host: grey-snow-shaker.glitch.me
URL: https://grey-snow-shaker.glitch.me/public/processed.htm

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

88171413fc76dda23ab32baa17b11e4fff89141c633ece737852445f1ba6c1bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://grey-snow-shaker.glitch.me/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Tue, 30 Jul 2024 15:05:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1811
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33333
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 30 Jul 2025 15:05:31 GMT

GET
H/1.1 200
OK ip.js Show response
l2.io/ 26 B
230 B 108ms
33ms Script
text/html 195.80.159.133
DECKNET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://l2.io/ip.js?var=userip
Requested by: Host: grey-snow-shaker.glitch.me
URL: https://grey-snow-shaker.glitch.me/public/processed.htm
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 195.80.159.133 , France, ASN29152 (DECKNET-AS, FR),
Reverse DNS
Software: Apache/2.4.38 (Debian) /
Resource Hash: a041c9e87bd42fecf01227a532e4d3dd7153b07ea7412cde2e48280e61659bb5

Request headers

Referer: https://grey-snow-shaker.glitch.me/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date: Tue, 30 Jul 2024 15:35:42 GMT
Server: Apache/2.4.38 (Debian)
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 26
Content-Type: text/html; charset=UTF-8

GET
H2 200 idme-logo-1d96899e99d393974ec16fa17a820e78fca132bd8ea53e01f12bdc000baf674f.svg
api.id.me/assets/logos/ 3 KB
2 KB 220ms
42ms Image
image/svg+xml 2a02:26f0:ab00::214:8e73
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://api.id.me/assets/logos/idme-logo-1d96899e99d393974ec16fa17a820e78fca132bd8ea53e01f12bdc000baf674f.svg
Requested by: Host: grey-snow-shaker.glitch.me
URL: https://grey-snow-shaker.glitch.me/public/processed.htm
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:ab00::214:8e73 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: eb439f785d33858dfe7300098e5f38c7ebb471ccfe409dde80df79c90c11e5e9

Request headers

Referer: https://grey-snow-shaker.glitch.me/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 30 Jul 2024 15:35:42 GMT
content-encoding: gzip
etag: "6356e7a5-554"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=2555583
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1722353742298_34901615_21270424_43_15807_20_26_219";dur=1
accept-ranges: bytes
content-length: 1364
x-node: war-machine-07.idmeinc.net

GET
H2 200 ff1f8948
d21y75miwcfqoq.cloudfront.net/ 68 B
458 B 678ms
614ms Image
image/png 2600:9000:235a:5000:1b:ef38:3680:21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d21y75miwcfqoq.cloudfront.net/ff1f8948
Requested by: Host: grey-snow-shaker.glitch.me
URL: https://grey-snow-shaker.glitch.me/public/processed.htm
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:235a:5000:1b:ef38:3680:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058

Request headers

Referer: https://grey-snow-shaker.glitch.me/public/processed.htm
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 30 Jul 2024 15:35:43 GMT
x-amz-version-id: null
via: 1.1 3677df2c828d68a6a84555cd8a40cf50.cloudfront.net (CloudFront)
last-modified: Wed, 19 May 2021 14:53:19 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P9
etag: "91e42db1c66c0b276abf6234dc50b2eb"
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
content-type: image/png
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 68
x-amz-cf-id: yvrWMMKeRKrAMDRWniyg_q9GegSCoM9iCG7WP1FNgqYSPNsv5MANQQ==

GET
H2

200

/
grey-snow-shaker.glitch.me/
Redirect Chain

https://grey-snow-shaker.glitch.me/public/4_files/image_pxlho1.svg
https://grey-snow-shaker.glitch.me/

3 KB
3 KB

156ms
156ms

Image
text/html

3.225.250.122
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://grey-snow-shaker.glitch.me/
Requested by: Host: grey-snow-shaker.glitch.me
URL: https://grey-snow-shaker.glitch.me/public/processed.htm
Protocol: H2
Server: 3.225.250.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-225-250-122.compute-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://grey-snow-shaker.glitch.me/public/processed.htm
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 30 Jul 2024 15:35:42 GMT
x-amz-version-id: null
last-modified: Mon, 29 Jul 2024 12:15:11 GMT
server: AmazonS3
x-amz-request-id: AJW6VWM39E729X0C
etag: "63484e56d8b08df988173e018a6e0bc6"
x-amz-server-side-encryption: AES256
content-type: text/html; charset=utf-8
cache-control: no-cache
accept-ranges: bytes
content-length: 3431
x-amz-id-2: KmUv6aIng2XNgZLnYTFDijGR8auwM2L0B/3sIz+S8G4PZka3yZm8wCckY7QM2XqoSl0ckeW/Ryk=

Redirect headers

location: /
date: Tue, 30 Jul 2024 15:35:42 GMT
content-length: 23
vary: Accept
content-type: text/plain; charset=utf-8

GET
H2

200

/
grey-snow-shaker.glitch.me/
Redirect Chain

https://grey-snow-shaker.glitch.me/public/4_files/upload2.html
https://grey-snow-shaker.glitch.me/

3 KB
3 KB

311ms
156ms

Image
text/html

3.225.250.122
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://grey-snow-shaker.glitch.me/
Requested by: Host: grey-snow-shaker.glitch.me
URL: https://grey-snow-shaker.glitch.me/public/processed.htm
Protocol: H2
Server: 3.225.250.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-225-250-122.compute-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://grey-snow-shaker.glitch.me/public/processed.htm
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 30 Jul 2024 15:35:42 GMT
x-amz-version-id: null
last-modified: Mon, 29 Jul 2024 12:15:11 GMT
server: AmazonS3
x-amz-request-id: AJWDCNA5VW0296MV
etag: "63484e56d8b08df988173e018a6e0bc6"
x-amz-server-side-encryption: AES256
content-type: text/html; charset=utf-8
cache-control: no-cache
accept-ranges: bytes
content-length: 3431
x-amz-id-2: mk2SKjhCrnZYXbMQOoP7KEWSXoZ9wS0FBD2OQw9q4gRKlam4R3TVyRcEd8YfCCUE9ljAUtmCg3U=

Redirect headers

location: /
date: Tue, 30 Jul 2024 15:35:42 GMT
content-length: 23
vary: Accept
content-type: text/plain; charset=utf-8

GET
H2

200

/
grey-snow-shaker.glitch.me/
Redirect Chain

https://grey-snow-shaker.glitch.me/assets/Poppins-Regular-849c718edde71e76ae38c89f93b10073e06b6b48d5368090b3e05a412f5b94f4.woff
https://grey-snow-shaker.glitch.me/

3 KB
253 B

907ms
147ms

Font
text/html

3.225.250.122
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://grey-snow-shaker.glitch.me/
Requested by: Host: grey-snow-shaker.glitch.me
URL: https://grey-snow-shaker.glitch.me/public/processed.htm
Protocol: H2
Server: 3.225.250.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-225-250-122.compute-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 37d5370246f380814ccca66052bb10d3886b52159e3e73639a0baa3c143e9e8f

Request headers

Referer: https://grey-snow-shaker.glitch.me/public/processed.htm
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 30 Jul 2024 15:35:43 GMT
x-amz-version-id: null
last-modified: Mon, 29 Jul 2024 12:15:11 GMT
server: AmazonS3
x-amz-request-id: KY9A5TJNK59RF884
etag: "63484e56d8b08df988173e018a6e0bc6"
x-amz-server-side-encryption: AES256
content-type: text/html; charset=utf-8
cache-control: no-cache
accept-ranges: bytes
content-length: 3431
x-amz-id-2: /b1PWiyEgMHUF14W9Y8pKQjUgNP3wFeBjEtJ7w6LPzYQmceIH6YqPy7Hz7FTO+7cVG9Uwjvz5B4=

Redirect headers

location: /
date: Tue, 30 Jul 2024 15:35:42 GMT
content-length: 23
vary: Accept
content-type: text/plain; charset=utf-8

GET
H2

200

/
grey-snow-shaker.glitch.me/
Redirect Chain

https://grey-snow-shaker.glitch.me/assets/Poppins-SemiBold-7d4187c3373ec4c000f03314ad24b93cacbddcf62b7bc32689ead9fd2ad574ec.woff
https://grey-snow-shaker.glitch.me/

3 KB
277 B

458ms
154ms

Font
text/html

3.225.250.122
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://grey-snow-shaker.glitch.me/
Requested by: Host: grey-snow-shaker.glitch.me
URL: https://grey-snow-shaker.glitch.me/public/processed.htm
Protocol: H2
Server: 3.225.250.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-225-250-122.compute-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 37d5370246f380814ccca66052bb10d3886b52159e3e73639a0baa3c143e9e8f

Request headers

Referer: https://grey-snow-shaker.glitch.me/public/processed.htm
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 30 Jul 2024 15:35:42 GMT
x-amz-version-id: null
last-modified: Mon, 29 Jul 2024 12:15:11 GMT
server: AmazonS3
x-amz-request-id: AJWDEE32B62SBSYF
etag: "63484e56d8b08df988173e018a6e0bc6"
x-amz-server-side-encryption: AES256
content-type: text/html; charset=utf-8
cache-control: no-cache
accept-ranges: bytes
content-length: 3431
x-amz-id-2: nti3spVy118Ju/wWW+laBBZELArhF6S6pdfLjHxBZwgHuJch4ouFvuRuZXW5rIRskOw8JUxfl1Drr9WRT0CPk3NFOm3Y3r60N05bJ3n6sxk=

Redirect headers

location: /
date: Tue, 30 Jul 2024 15:35:42 GMT
content-length: 23
vary: Accept
content-type: text/plain; charset=utf-8

GET
H2

200

/
grey-snow-shaker.glitch.me/
Redirect Chain

https://grey-snow-shaker.glitch.me/assets/OpenSans-Semibold-98e308576c54531be8643d249d1daf2d2111252237210e733774cef1545da023.woff
https://grey-snow-shaker.glitch.me/

3 KB
250 B

605ms
146ms

Font
text/html

3.225.250.122
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://grey-snow-shaker.glitch.me/
Requested by: Host: grey-snow-shaker.glitch.me
URL: https://grey-snow-shaker.glitch.me/public/processed.htm
Protocol: H2
Server: 3.225.250.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-225-250-122.compute-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 37d5370246f380814ccca66052bb10d3886b52159e3e73639a0baa3c143e9e8f

Request headers

Referer: https://grey-snow-shaker.glitch.me/public/processed.htm
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 30 Jul 2024 15:35:42 GMT
x-amz-version-id: null
last-modified: Mon, 29 Jul 2024 12:15:11 GMT
server: AmazonS3
x-amz-request-id: AJW0SV04Z86TDWJ4
etag: "63484e56d8b08df988173e018a6e0bc6"
x-amz-server-side-encryption: AES256
content-type: text/html; charset=utf-8
cache-control: no-cache
accept-ranges: bytes
content-length: 3431
x-amz-id-2: mCf7b5R4y7tQyhtH4J8rVuYabUD0oAabyxKeRPKfRiMyIUJhHzRakTlSrIlJchE2yJO/oI3L/9g=

Redirect headers

location: /
date: Tue, 30 Jul 2024 15:35:42 GMT
content-length: 23
vary: Accept
content-type: text/plain; charset=utf-8

GET
H2

200

/
grey-snow-shaker.glitch.me/
Redirect Chain

https://grey-snow-shaker.glitch.me/assets/Poppins-Medium-94ff9c11734ed5e68a5b736baea74adefff71364c2f605c0983c501606ce0080.woff
https://grey-snow-shaker.glitch.me/

3 KB
252 B

764ms
161ms

Font
text/html

3.225.250.122
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://grey-snow-shaker.glitch.me/
Requested by: Host: grey-snow-shaker.glitch.me
URL: https://grey-snow-shaker.glitch.me/public/processed.htm
Protocol: H2
Server: 3.225.250.122 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-225-250-122.compute-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 37d5370246f380814ccca66052bb10d3886b52159e3e73639a0baa3c143e9e8f

Request headers

Referer: https://grey-snow-shaker.glitch.me/public/processed.htm
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 30 Jul 2024 15:35:43 GMT
x-amz-version-id: null
last-modified: Mon, 29 Jul 2024 12:15:11 GMT
server: AmazonS3
x-amz-request-id: KY903F63ARKMA6GX
etag: "63484e56d8b08df988173e018a6e0bc6"
x-amz-server-side-encryption: AES256
content-type: text/html; charset=utf-8
cache-control: no-cache
accept-ranges: bytes
content-length: 3431
x-amz-id-2: pao+29nrcY7kKhA6t4cTNavCOEipvKKGp3Oazs+UQsSp7A4yvS2C+pWywZZPS/CIBoG/sX9iw4A=

Redirect headers

location: /
date: Tue, 30 Jul 2024 15:35:42 GMT
content-length: 23
vary: Accept
content-type: text/plain; charset=utf-8

GET
H2 200 favicon-3b57957bde0ba341f2e080013aa6d42d303e29a4594c8f231c013514b22241f0.ico
api.id.me/assets/icons/favicon/ 1 KB
730 B 34ms
33ms Other
image/x-icon 2a02:26f0:ab00::214:8e73
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://api.id.me/assets/icons/favicon/favicon-3b57957bde0ba341f2e080013aa6d42d303e29a4594c8f231c013514b22241f0.ico
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:ab00::214:8e73 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 09fe42dff8b0fb2b4ea51818ecd86fb540615a1f185bb98b40168638a9d8a563

Request headers

Referer: https://grey-snow-shaker.glitch.me/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Tue, 30 Jul 2024 15:35:43 GMT
content-encoding: gzip
etag: "6356e7a5-1d0"
vary: Accept-Encoding
content-type: image/x-icon
cache-control: public, max-age=2412879
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1722353743260_34901615_21271008_36_11436_21_0_219";dur=1
accept-ranges: bytes
content-length: 464
x-node: war-machine-03.idmeinc.net

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: ID.me (Online)

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

12 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://grey-snow-shaker.glitch.me/public/processed.htm Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://grey-snow-shaker.glitch.me/public/processed.htm Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://grey-snow-shaker.glitch.me/public/processed.htm Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://l2.io/ip.js?var=userip, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
recommendation	verbose	URL: https://grey-snow-shaker.glitch.me/public/processed.htm Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
other	warning	URL: https://grey-snow-shaker.glitch.me/public/processed.htm Message: Failed to decode downloaded font: https://grey-snow-shaker.glitch.me/assets/Poppins-SemiBold-7d4187c3373ec4c000f03314ad24b93cacbddcf62b7bc32689ead9fd2ad574ec.woff
other	warning	URL: https://grey-snow-shaker.glitch.me/public/processed.htm Message: OTS parsing error: invalid sfntVersion: 1008813135
other	warning	URL: https://grey-snow-shaker.glitch.me/public/processed.htm Message: Failed to decode downloaded font: https://grey-snow-shaker.glitch.me/assets/OpenSans-Semibold-98e308576c54531be8643d249d1daf2d2111252237210e733774cef1545da023.woff
other	warning	URL: https://grey-snow-shaker.glitch.me/public/processed.htm Message: OTS parsing error: invalid sfntVersion: 1008813135
other	warning	URL: https://grey-snow-shaker.glitch.me/public/processed.htm Message: Failed to decode downloaded font: https://grey-snow-shaker.glitch.me/assets/Poppins-Medium-94ff9c11734ed5e68a5b736baea74adefff71364c2f605c0983c501606ce0080.woff
other	warning	URL: https://grey-snow-shaker.glitch.me/public/processed.htm Message: OTS parsing error: invalid sfntVersion: 1008813135
other	warning	URL: https://grey-snow-shaker.glitch.me/public/processed.htm Message: Failed to decode downloaded font: https://grey-snow-shaker.glitch.me/assets/Poppins-Regular-849c718edde71e76ae38c89f93b10073e06b6b48d5368090b3e05a412f5b94f4.woff
other	warning	URL: https://grey-snow-shaker.glitch.me/public/processed.htm Message: OTS parsing error: invalid sfntVersion: 1008813135

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
api.id.me
d21y75miwcfqoq.cloudfront.net
grey-snow-shaker.glitch.me
l2.io
195.80.159.133
2600:9000:235a:5000:1b:ef38:3680:21
2a00:1450:4001:80b::200a
2a02:26f0:ab00::214:8e73
3.225.250.122
09fe42dff8b0fb2b4ea51818ecd86fb540615a1f185bb98b40168638a9d8a563
37d5370246f380814ccca66052bb10d3886b52159e3e73639a0baa3c143e9e8f
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058
88171413fc76dda23ab32baa17b11e4fff89141c633ece737852445f1ba6c1bd
a041c9e87bd42fecf01227a532e4d3dd7153b07ea7412cde2e48280e61659bb5
bf896c2f65f1222a7b3a29d08eab82fbc27d553ce83bcb1f99002dd2d29ebaac
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eb439f785d33858dfe7300098e5f38c7ebb471ccfe409dde80df79c90c11e5e9

grey-snow-shaker.glitch.me Open in urlscan Pro 3.225.250.122 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

12 Requests

50 %HTTPS

60 %IPv6

5 Domains

5 Subdomains

5 IPs

3 Countries

676 kBTransfer

747 kBSize

0 Cookies

3 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

7 JavaScript Global Variables

0 Cookies

12 Console Messages

Indicators

grey-snow-shaker.glitch.me Open in urlscan Pro
3.225.250.122 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

50 %
HTTPS

60 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

676 kB
Transfer

747 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!