storm-cosmic-slope.glitch.me

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 3 HTTP transactions. The main IP is 54.166.126.46, located in United States and belongs to AMAZON-AES, US. The main domain is storm-cosmic-slope.glitch.me.
TLS certificate: Issued by Amazon RSA 2048 M03 on December 4th 2023. Valid for: a year.

This is the only time storm-cosmic-slope.glitch.me was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 1	104.21.68.4 104.21.68.4	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	54.166.126.46 54.166.126.46	14618 (AMAZON-AES) (AMAZON-AES)
1	152.199.4.44 152.199.4.44	15133 (EDGECAST) (EDGECAST)
1 1	199.232.192.193 199.232.192.193	54113 (FASTLY) (FASTLY)
1	146.75.28.193 146.75.28.193	54113 (FASTLY) (FASTLY)
3	3

1 104.21.68.4 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

e.vg	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.166.126.46 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-166-126-46.compute-1.amazonaws.com

storm-cosmic-slope.glitch.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 152.199.4.44 (United States)

ASN15133 (EDGECAST, US)

aadcdn.msftauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.192.193 (United States) 1 redirects

ASN54113 (FASTLY, US)

imgur.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.28.193 (Ashburn, United States)

ASN54113 (FASTLY, US)

i.imgur.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	imgur.com 1 redirects imgur.com — Cisco Umbrella Rank: 5239 i.imgur.com — Cisco Umbrella Rank: 7364	279 KB
1	msftauth.net aadcdn.msftauth.net — Cisco Umbrella Rank: 974	2 KB
1	glitch.me storm-cosmic-slope.glitch.me	5 KB
1	e.vg 1 redirects e.vg	411 B
3	4

	Domain	Requested by
1	i.imgur.com	storm-cosmic-slope.glitch.me
1	imgur.com	1 redirects
1	aadcdn.msftauth.net	storm-cosmic-slope.glitch.me
1	storm-cosmic-slope.glitch.me
1	e.vg	1 redirects
3	5

This site contains no links.

Subject Issuer	Validity	Valid
glitch.com Amazon RSA 2048 M03	`2023-12-04` - `2025-01-01`	a year	crt.sh
aadcdn.msftauth.net DigiCert SHA2 Secure Server CA	`2023-12-01` - `2024-12-01`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://storm-cosmic-slope.glitch.me/obl782iopaaKLs.html
Frame ID: 4EBF31FD3474AFEF38A00F041130AFFF
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Excel Mobile

Page URL History Show full URLs

https://e.vg/nwdanNjF HTTP 302
https://storm-cosmic-slope.glitch.me/obl782iopaaKLs.html Page URL

Page Statistics

3
Requests

67 %
HTTPS

0 %
IPv6

4
Domains

5
Subdomains

3
IPs

2
Countries

285 kB
Transfer

286 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://e.vg/nwdanNjF HTTP 302
https://storm-cosmic-slope.glitch.me/obl782iopaaKLs.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

https://imgur.com/vAVJT9c.png HTTP 301
https://i.imgur.com/vAVJT9c.png

3 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request obl782iopaaKLs.html Show response
storm-cosmic-slope.glitch.me/
Redirect Chain

https://e.vg/nwdanNjF
https://storm-cosmic-slope.glitch.me/obl782iopaaKLs.html

4 KB
5 KB

243ms
197ms

Document
text/html

54.166.126.46
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://storm-cosmic-slope.glitch.me/obl782iopaaKLs.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.166.126.46 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-166-126-46.compute-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 631762c5746e1350c4917d566a249d2cc759bf817295213065cbb1675a8c71af

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: no-cache
content-length: 4290
content-type: text/html; charset=utf-8
date: Sun, 10 Dec 2023 02:49:48 GMT
etag: "9d5de1d165b15f053942971c306efe7f"
last-modified: Tue, 05 Dec 2023 22:02:02 GMT
server: AmazonS3
x-amz-id-2: 8D5tHmC/p4nt7HgmyuvKV7t0hALrSHbw+UOElhqToMpgufYXiO5/WxRVORvM6u/QpCZQHyHZ5MY=
x-amz-request-id: HGRXSEJSE4YBG6B6
x-amz-server-side-encryption: AES256
x-amz-version-id: 5nZG6bSddEEy0EI0nGyVPuhIWB_wqNGm

Redirect headers

alt-svc: h3=":443"; ma=86400
cf-ray: 83322d39dc6a43a9-EWR
content-length: 0
date: Sun, 10 Dec 2023 02:49:47 GMT
location: https://storm-cosmic-slope.glitch.me/obl782iopaaKLs.html
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7fn9ADBmZiMDk4BgG69Vmbepp8Nx7fBxUPwDuxhD0N2Wz2NvhYtGpU%2BmpVurNxIBFvNKFxZseTbAmxNHBRgCdwmiNeYSyKQzb3aPtqNK7lamI7Bq6U1b"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 200 microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
aadcdn.msftauth.net/shared/1.0/content/images/ 4 KB
2 KB 52ms
10ms Image
image/svg+xml 152.199.4.44
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Requested by: Host: storm-cosmic-slope.glitch.me
URL: https://storm-cosmic-slope.glitch.me/obl782iopaaKLs.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.4.44 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (nya/797F) /
Resource Hash: 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://storm-cosmic-slope.glitch.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sun, 10 Dec 2023 02:49:48 GMT
content-encoding: gzip
content-md5: nzaLxFgP7ZB3dfMcaybWzw==
age: 12188695
x-cache: HIT
content-length: 1435
x-ms-lease-status: unlocked
last-modified: Thu, 16 Jan 2020 00:32:52 GMT
server: ECAcc (nya/797F)
etag: 0x8D79A1B9F5E121A
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 2679dfe2-d01e-0064-0938-bcb7da000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2

200

vAVJT9c.png
i.imgur.com/
Redirect Chain

https://imgur.com/vAVJT9c.png
https://i.imgur.com/vAVJT9c.png

278 KB
279 KB

116ms
40ms

Image
image/jpeg

146.75.28.193
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.imgur.com/vAVJT9c.png

Requested by

Host: storm-cosmic-slope.glitch.me
URL: https://storm-cosmic-slope.glitch.me/obl782iopaaKLs.html

Protocol

H2

Server

146.75.28.193 Ashburn, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

cat factory 1.0 /

Resource Hash

32d6b5039dd56f1484ef8670ee8e8033337b627dde78c6bbf515bfac27ef944c

Security Headers

Name	Value
Strict-Transport-Security	max-age=300
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://storm-cosmic-slope.glitch.me/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sun, 10 Dec 2023 02:49:48 GMT
strict-transport-security: max-age=300
x-content-type-options: nosniff
x-amz-cf-pop: IAD12-P2
age: 2131266
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront, HIT
content-length: 284670
x-served-by: cache-iad-kiad7000023-IAD
last-modified: Tue, 25 Jul 2023 08:04:04 GMT
server: cat factory 1.0
x-timer: S1702176588.335176,VS0,VE3
etag: "45eeb21f5d92a99999af4f168ab4109f"
access-control-allow-methods: GET, OPTIONS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
x-amz-cf-id: L65Stab-GoCIqSgCIRA7yQuXFOwHoUfm0mgXrqmXffz83kiWnIKhTg==
x-cache-hits: 1

Redirect headers

x-cache-hits: 0
date: Sun, 10 Dec 2023 02:49:48 GMT
strict-transport-security: max-age=300
server: cat factory 1.0
x-timer: S1702176588.244870,VS0,VE0
x-frame-options: DENY
x-cache: HIT
location: https://i.imgur.com/vAVJT9c.png
access-control-allow-origin: https://imgur.com
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
access-control-allow-credentials: false
accept-ranges: bytes
content-length: 0
retry-after: 0
x-served-by: cache-lga21931-LGA

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msftauth.net
e.vg
i.imgur.com
imgur.com
storm-cosmic-slope.glitch.me
104.21.68.4
146.75.28.193
152.199.4.44
199.232.192.193
54.166.126.46
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
32d6b5039dd56f1484ef8670ee8e8033337b627dde78c6bbf515bfac27ef944c
631762c5746e1350c4917d566a249d2cc759bf817295213065cbb1675a8c71af

storm-cosmic-slope.glitch.me Open in urlscan Pro 54.166.126.46 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

3 Requests

67 %HTTPS

0 %IPv6

4 Domains

5 Subdomains

3 IPs

2 Countries

285 kBTransfer

286 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

0 Cookies

Indicators

storm-cosmic-slope.glitch.me Open in urlscan Pro
54.166.126.46 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

3
Requests

67 %
HTTPS

0 %
IPv6

4
Domains

5
Subdomains

3
IPs

2
Countries

285 kB
Transfer

286 kB
Size

0
Cookies

3 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!