daffy-accessible-galliform.glitch.me
Open in
urlscan Pro
34.202.189.75
Malicious Activity!
Public Scan
Submission: On March 20 via api from US — Scanned from US
Summary
TLS certificate: Issued by Amazon RSA 2048 M03 on December 4th 2023. Valid for: a year.
This is the only time daffy-accessible-galliform.glitch.me was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Nationwide Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 34.202.189.75 34.202.189.75 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 | 195.80.159.133 195.80.159.133 | 29152 (DECKNET-AS) (DECKNET-AS) | |
2 | 3 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-34-202-189-75.compute-1.amazonaws.com
daffy-accessible-galliform.glitch.me |
Apex Domain Subdomains |
Transfer | |
---|---|---|
1 |
l2.io
l2.io — Cisco Umbrella Rank: 292385 |
227 B |
1 |
glitch.me
daffy-accessible-galliform.glitch.me |
831 KB |
2 | 2 |
Domain | Requested by | |
---|---|---|
1 | l2.io |
daffy-accessible-galliform.glitch.me
|
1 | daffy-accessible-galliform.glitch.me | |
2 | 2 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.nationwide.co.uk |
onlinebanking.nationwide.co.uk |
twitter.com |
www.facebook.com |
www.youtube.com |
www.linkedin.com |
www.fca.org.uk |
Subject Issuer | Validity | Valid | |
---|---|---|---|
glitch.com Amazon RSA 2048 M03 |
2023-12-04 - 2025-01-01 |
a year | crt.sh |
l2.io R3 |
2024-03-05 - 2024-06-03 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://daffy-accessible-galliform.glitch.me/public/zemem.HTM
Frame ID: 87A1CD58FE34358D7EA19DD49091DEA2
Requests: 9 HTTP requests in this frame
19 Outgoing links
These are links going to different origins than the main page.
Title: Nationwide.co.uk
Search URL Search Domain Scan URL
Title: Register now
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: Register
Search URL Search Domain Scan URL
Title: Order a new card reader
Search URL Search Domain Scan URL
Title: Security centre
Search URL Search Domain Scan URL
Title: Accessibility
Search URL Search Domain Scan URL
Title: Service status
Search URL Search Domain Scan URL
Title: Mobile Banking app
Search URL Search Domain Scan URL
Title: Internet Bank Terms and Conditions
Search URL Search Domain Scan URL
Title: Contact us
Search URL Search Domain Scan URL
Title: Cookies and privacy
Search URL Search Domain Scan URL
Title: Troubleshooting
Search URL Search Domain Scan URL
Title: Twitter (This link will open in a new window)
Search URL Search Domain Scan URL
Title: Facebook (This link will open in a new window)
Search URL Search Domain Scan URL
Title: Youtube (This link will open in a new window)
Search URL Search Domain Scan URL
Title: LinkedIn (This link will open in a new window)
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: www.fca.org.uk Opens in a new window
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
2 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
zemem.HTM
daffy-accessible-galliform.glitch.me/public/ |
829 KB 831 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ip.js
l2.io/ |
23 B 227 B |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
73 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
33 KB 33 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
161 KB 161 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
32 KB 32 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Nationwide Bank (Banking)3 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| savepage_ShadowLoader string| userip function| isNumber0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
daffy-accessible-galliform.glitch.me
l2.io
195.80.159.133
34.202.189.75
1179a312fd24a1546386f94b7c744562e65bd1ef8eea12d7d1f4f234289f3bad
154f369084c28c7ceaf71531663e84382b0f3ac78fffa7f91c4543499b8ee41b
590d65eaef8ef02772816925868c0961b94213ced0b8952bdadd90905ca628bb
5cfc1d72a6c4c817544222468ad1a2f27ed404481f529f223c05c1c52bb3ba2c
892ef25d857dbb17c3310310338578e0e19772646435a540fdc717b47979b13b
8e91107a6fedb480c4abca6ab165aae5d045bfc51c2511952dab9c0b81eb83df
ac07fbf105019336ea0feec19e3ea9ec28557b2748de0a790be3213884bff45c
c01ee414cef757dfcd67619395a9d6dac513d6eb9fe9baa8d70402d13b2a4647
f06722cdec025dcab10f4fab41dfd79ffe6a8888d7c7a9ce5efeb86a1170a38b