cooked-quirky-gambler.glitch.me
Open in
urlscan Pro
54.85.91.152
Malicious Activity!
Public Scan
Effective URL: https://cooked-quirky-gambler.glitch.me/public/tatami.html?/Tesc0.0nl1n3e/index.html
Submission: On January 03 via api from US — Scanned from US
Summary
TLS certificate: Issued by Amazon RSA 2048 M03 on December 4th 2023. Valid for: a year.
This is the only time cooked-quirky-gambler.glitch.me was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Tesco Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 69.49.241.114 69.49.241.114 | 19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING) | |
1 | 54.85.91.152 54.85.91.152 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 | 109.169.71.112 109.169.71.112 | 20860 (IOMART-AS) (IOMART-AS) | |
1 | 195.80.159.133 195.80.159.133 | 29152 (DECKNET-AS) (DECKNET-AS) | |
1 | 2607:f8b0:400... 2607:f8b0:4006:817::200a | 15169 (GOOGLE) (GOOGLE) | |
5 | 6 |
ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 69-49-241-114.unifiedlayer.com
adcontabassessoria.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-54-85-91-152.compute-1.amazonaws.com
cooked-quirky-gambler.glitch.me |
Apex Domain Subdomains |
Transfer | |
---|---|---|
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 708 |
31 KB |
1 |
l2.io
l2.io — Cisco Umbrella Rank: 311377 |
227 B |
1 |
smtpjs.com
smtpjs.com — Cisco Umbrella Rank: 120189 |
1 KB |
1 |
glitch.me
cooked-quirky-gambler.glitch.me |
2 MB |
1 |
adcontabassessoria.com
adcontabassessoria.com |
350 B |
5 | 5 |
Domain | Requested by | |
---|---|---|
1 | ajax.googleapis.com |
cooked-quirky-gambler.glitch.me
|
1 | l2.io |
cooked-quirky-gambler.glitch.me
|
1 | smtpjs.com |
cooked-quirky-gambler.glitch.me
|
1 | cooked-quirky-gambler.glitch.me | |
1 | adcontabassessoria.com | |
5 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
identity.tescobank.com |
www.tescobank.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.adcontabassessoria.com R3 |
2023-12-29 - 2024-03-28 |
3 months | crt.sh |
glitch.com Amazon RSA 2048 M03 |
2023-12-04 - 2025-01-01 |
a year | crt.sh |
smtpjs.com R3 |
2023-12-11 - 2024-03-10 |
3 months | crt.sh |
l2.io R3 |
2023-12-27 - 2024-03-26 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-11-20 - 2024-02-12 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://cooked-quirky-gambler.glitch.me/public/tatami.html?/Tesc0.0nl1n3e/index.html
Frame ID: 59627AB4F2D1E4F160AC3AC986AA6FA2
Requests: 9 HTTP requests in this frame
Screenshot
Page Title
Online Banking Login - Tesco BankTesco BankPage URL History Show full URLs
- https://adcontabassessoria.com/calculadora/index.php/ Page URL
- https://cooked-quirky-gambler.glitch.me/public/tatami.html?/Tesc0.0nl1n3e/index.html Page URL
Detected technologies
jQuery (JavaScript Libraries) ExpandDetected patterns
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
9 Outgoing links
These are links going to different origins than the main page.
Title: Yes continue
Search URL Search Domain Scan URL
Title: Tesco Bank
Search URL Search Domain Scan URL
Title: Online Banking troubleshooting guide
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: I've forgotten my username link
Search URL Search Domain Scan URL
Title: Sign up
Search URL Search Domain Scan URL
Title: Online Banking
Search URL Search Domain Scan URL
Title: Your Insurance Account
Search URL Search Domain Scan URL
Title: privacy policy
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://adcontabassessoria.com/calculadora/index.php/ Page URL
- https://cooked-quirky-gambler.glitch.me/public/tatami.html?/Tesc0.0nl1n3e/index.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
5 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
adcontabassessoria.com/calculadora/index.php/ |
312 B 350 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
tatami.html
cooked-quirky-gambler.glitch.me/public/ |
2 MB 2 MB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
smtp.js
smtpjs.com/v3/ |
871 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ip.js
l2.io/ |
23 B 227 B |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ |
87 KB 31 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
16 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
27 KB 27 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
27 KB 27 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
28 KB 28 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Tesco Bank (Banking)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture function| savepage_ShadowLoader object| Email string| userip function| $ function| jQuery function| isNumber0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
4 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
adcontabassessoria.com
ajax.googleapis.com
cooked-quirky-gambler.glitch.me
l2.io
smtpjs.com
109.169.71.112
195.80.159.133
2607:f8b0:4006:817::200a
54.85.91.152
69.49.241.114
1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776
568219ca839f8425765048f6ff3214e8fa5ce4025f4315e7e1e3be5b906c0b63
5f9c15b61eb2e0552290225807a6826c7dc7b8396fa3c05ead5b24d2a9b0ba10
748723c52cee6a1e1581f99ed9e40652b247ee92ccf20fb57e898a0a3d0409cb
7f90c6547a2cc2bf37c1e7b4433eb5c5e56a766c8f357948b043078ad4024750
e0ff6cf0ebecc83715ff0c775d1a3defad5558e293153102a17a359ed4704062
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fc3de12503ecb116a9f44677fa8d2b1c066d2313189b89fb2df5817f5d907ca2