mulberry-fan-guavaberry.glitch.me Open in urlscan Pro
54.87.211.83  Malicious Activity! Public Scan

Submitted URL: http://mulberry-fan-guavaberry.glitch.me/
Effective URL: https://mulberry-fan-guavaberry.glitch.me/
Submission: On April 05 via manual from US — Scanned from US

Summary

This website contacted 9 IPs in 2 countries across 6 domains to perform 15 HTTP transactions. The main IP is 54.87.211.83, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is mulberry-fan-guavaberry.glitch.me.
TLS certificate: Issued by Amazon RSA 2048 M03 on December 4th 2023. Valid for: a year.
This is the only time mulberry-fan-guavaberry.glitch.me was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 54.87.211.83 14618 (AMAZON-AES)
3 2a04:4e42:200... 54113 (FASTLY)
1 2606:4700:303... 13335 (CLOUDFLAR...)
3 104.17.24.14 13335 (CLOUDFLAR...)
1 172.67.221.5 13335 (CLOUDFLAR...)
1 2606:4700:303... 13335 (CLOUDFLAR...)
4 2603:1062:10:... ()
1 2606:2800:21f... ()
15 9
Domain Requested by
4 aadcdn.msauth.net ds.nokiatool.ru
3 cdnjs.cloudflare.com yvewpdh.nokiatool.ru
ds.nokiatool.ru
3 code.jquery.com mulberry-fan-guavaberry.glitch.me
yvewpdh.nokiatool.ru
ds.nokiatool.ru
1 aadcdn.msftauth.net ds.nokiatool.ru
1 bm7sail.nokiatool.ru code.jquery.com
1 ds.nokiatool.ru yvewpdh.nokiatool.ru
1 yvewpdh.nokiatool.ru code.jquery.com
1 mulberry-fan-guavaberry.glitch.me
15 8

This site contains no links.

Subject Issuer Validity Valid
glitch.com
Amazon RSA 2048 M03
2023-12-04 -
2025-01-01
a year crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA
2023-07-11 -
2024-07-14
a year crt.sh
nokiatool.ru
GTS CA 1P5
2024-04-03 -
2024-07-02
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2023-07-03 -
2024-07-02
a year crt.sh
aadcdn.msauth.net
DigiCert SHA2 Secure Server CA
2024-01-29 -
2025-01-29
a year crt.sh
aadcdn.msftauth.net
DigiCert SHA2 Secure Server CA
2023-12-01 -
2024-12-01
a year crt.sh

This page contains 1 frames:

Primary Page: https://mulberry-fan-guavaberry.glitch.me/
Frame ID: 56FCD0B6C875E430AAF72A8FDD60C97D
Requests: 21 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://mulberry-fan-guavaberry.glitch.me/ HTTP 307
    https://mulberry-fan-guavaberry.glitch.me/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

15
Requests

100 %
HTTPS

63 %
IPv6

6
Domains

8
Subdomains

9
IPs

2
Countries

1491 kB
Transfer

2268 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://mulberry-fan-guavaberry.glitch.me/ HTTP 307
    https://mulberry-fan-guavaberry.glitch.me/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
mulberry-fan-guavaberry.glitch.me/
Redirect Chain
  • http://mulberry-fan-guavaberry.glitch.me/
  • https://mulberry-fan-guavaberry.glitch.me/
589 B
952 B
Document
General
Full URL
https://mulberry-fan-guavaberry.glitch.me/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.87.211.83 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-87-211-83.compute-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
a441b68e7820da3c5bb0869979389a8e3fb2d8467b80a2f5df6ab81f3974a5b4

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

accept-ranges
bytes
cache-control
no-cache
content-length
589
content-type
text/html; charset=utf-8
date
Fri, 05 Apr 2024 16:18:33 GMT
etag
"ca22b036acfd6a5e35fd377e4056bb47"
last-modified
Fri, 05 Apr 2024 14:02:29 GMT
server
AmazonS3
x-amz-id-2
2SCZqXoCI7G9gSBCGRydxdVewaCXxffGM6EWLcRcRsmGD9jBnv8P8B+KiAxAIHQtIpsj2f9Xc7M=
x-amz-request-id
T2Q8E52XVWMBSWRY
x-amz-server-side-encryption
AES256
x-amz-version-id
qg1onsb7Wfd3PVikXBLOFrBuBOCUH4v2

Redirect headers

Location
https://mulberry-fan-guavaberry.glitch.me/
Non-Authoritative-Reason
HttpsUpgrades
jquery-3.1.1.min.js
code.jquery.com/
85 KB
30 KB
Script
General
Full URL
https://code.jquery.com/jquery-3.1.1.min.js
Requested by
Host: mulberry-fan-guavaberry.glitch.me
URL: https://mulberry-fan-guavaberry.glitch.me/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://mulberry-fan-guavaberry.glitch.me/
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Apr 2024 16:18:33 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
age
9791498
x-cache
HIT, HIT
content-length
30070
x-served-by
cache-lga21947-LGA, cache-ewr18159-EWR
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
x-timer
S1712333914.945618,VS0,VE0
etag
W/"28feccc0-152b5"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=604800
accept-ranges
bytes
x-cache-hits
29471, 39605
/
yvewpdh.nokiatool.ru/
18 KB
8 KB
Script
General
Full URL
https://yvewpdh.nokiatool.ru/?_=1712333913980
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.1.1.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::ac43:dd05 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c2bdfca0d54a01f431d6f054e86c0e6cf4d25385e1d8708c94a1dc4d4ddbb545

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://mulberry-fan-guavaberry.glitch.me/
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Fri, 05 Apr 2024 16:18:35 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0Hvxbyw7RoHNGWGEQTH8mLTmeluj303sdmYAWbi50E07AnFBE50MZNdSnRbDj7mjYWWQRvIKO4M5iE74r9unIqDoCO%2FH9obYnEuF8SXVnHBUos4YDnzn9P3XXSWUs%2FQrRz4X7waluMEiiII69g4dLauiDA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=UTF-8
cache-control
no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
cf-ray
86fadad349034bbb-BUF
alt-svc
h3=":443"; ma=86400
expires
Thu, 1 Jan 1970 00:00:00 GMT
crypto-js.min.js
cdnjs.cloudflare.com/ajax/libs/crypto-js/4.2.0/
59 KB
20 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.2.0/crypto-js.min.js
Requested by
Host: yvewpdh.nokiatool.ru
URL: https://yvewpdh.nokiatool.ru/?_=1712333913980
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
769a555de553babc35a3338f344dd7aa16260c93cea2c7db290707c90484e7cc
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://mulberry-fan-guavaberry.glitch.me/
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Apr 2024 16:18:35 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
1175420
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
19621
last-modified
Tue, 24 Oct 2023 23:03:52 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"65384d58-4ca5"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O6RHW0HIo5ODDxEMklIuOA3293KA0oK2AdY4N6%2FOWeJeDQ0FWkqbZOI70ByPODlhdWCzIxRPhWXK2QHkpLu5drZ8zSEOXTGgEk%2BjYIsb%2Fa2OmSv0DsGdn72si148teEidiHgjE6k"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
86fadadbb9705407-YYZ
expires
Wed, 26 Mar 2025 16:18:35 GMT
jquery-3.1.1.min.js
code.jquery.com/
85 KB
29 KB
Script
General
Full URL
https://code.jquery.com/jquery-3.1.1.min.js
Requested by
Host: yvewpdh.nokiatool.ru
URL: https://yvewpdh.nokiatool.ru/?_=1712333913980
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://mulberry-fan-guavaberry.glitch.me/
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Apr 2024 16:18:35 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
age
9791500
x-cache
HIT, HIT
content-length
30070
x-served-by
cache-lga21947-LGA, cache-ewr18159-EWR
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
x-timer
S1712333915.474435,VS0,VE0
etag
W/"28feccc0-152b5"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=604800
accept-ranges
bytes
x-cache-hits
29471, 39606
js.php
ds.nokiatool.ru/attachment/
17 KB
8 KB
Script
General
Full URL
https://ds.nokiatool.ru/attachment/js.php
Requested by
Host: yvewpdh.nokiatool.ru
URL: https://yvewpdh.nokiatool.ru/?_=1712333913980
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.221.5 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4505b40b0f66c7c1f5b71a56f2407531a02b656e49810944c610aaae91f762ba

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://mulberry-fan-guavaberry.glitch.me/
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

pragma
no-cache
date
Fri, 05 Apr 2024 16:18:36 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jobAcPkNsgCHoLB8H7oblwnQqcUSxEYuDWUeUA%2BZPmUP%2FKCr45gZxK%2F2hrhWJ6w%2FXOrM7VaylqTgh4wZkwnFTwRdR4jS9YoBkPneJ0B%2BkW5awMzTtSmJ%2FYtsYoEl7r6PB98%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=UTF-8
cache-control
no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
cf-ray
86fadadd1cc94bcd-BUF
alt-svc
h3=":443"; ma=86400
expires
Thu, 1 Jan 1970 00:00:00 GMT
/
bm7sail.nokiatool.ru/attachment/
2 MB
1 MB
XHR
General
Full URL
https://bm7sail.nokiatool.ru/attachment/
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.1.1.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3036::6815:18ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c1d222dc2ced0b439f5805f8844dc4b423f8346d2aca3dbc006333dbdf8b8d3e

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8
Accept
*/*
Referer
https://mulberry-fan-guavaberry.glitch.me/
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Apr 2024 16:18:37 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6qgkQkp2Ldyq1wL0Q31h6syYeGbdWi4zxHfqjXLT%2FQPekMwuVaaFgrpJoDojnm04IGI0v%2BWKETIVkhJ6vZFGGwa3PD4aykHVarZZAf9MmwAHNlCHQ3uO3syHeplZY9LChuQs7yhA70GQRue163ZSYXV6Ng%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
cf-ray
86fadae52e794bcf-BUF
alt-svc
h3=":443"; ma=86400
crypto-js.min.js
cdnjs.cloudflare.com/ajax/libs/crypto-js/4.2.0/
59 KB
20 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.2.0/crypto-js.min.js
Requested by
Host: ds.nokiatool.ru
URL: https://ds.nokiatool.ru/attachment/js.php
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
769a555de553babc35a3338f344dd7aa16260c93cea2c7db290707c90484e7cc
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://mulberry-fan-guavaberry.glitch.me/
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Apr 2024 16:18:36 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
1175421
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
19621
last-modified
Tue, 24 Oct 2023 23:03:52 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"65384d58-4ca5"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c41gB4vG15kLeam3vlQpAHnnBtY%2FL7JMELxzuRV9Yv2gOwfcT82lYwzeiEYLKddy4zm8amMxekOOX0pZ%2FhAq4Bes0MeB%2Fdx6CVGEH1Nh3tLzVXaWsdPx1DkxgE46iUELIBrAICoL"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
86fadae48da55407-YYZ
expires
Wed, 26 Mar 2025 16:18:36 GMT
font-awesome.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/
37 KB
6 KB
Stylesheet
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css
Requested by
Host: ds.nokiatool.ru
URL: https://ds.nokiatool.ru/attachment/js.php
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://mulberry-fan-guavaberry.glitch.me/
Origin
https://mulberry-fan-guavaberry.glitch.me
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Apr 2024 16:18:38 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
61525
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
5884
last-modified
Mon, 04 May 2020 16:10:07 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e5f-9226"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NRukDvZrbSOwLyuKbQhihvg3EkZWxCc24jgM235yPEZHx1L0GJdCUhtI0G%2BBnLZEKxkhCSZMLBzEFFxWe0tzSu1iFbOC%2FV8WHHvAaEP4kQcZql4NawAlGWpvdG5VUlDUEVhhroxO"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
86fadaed6cf55485-YYZ
expires
Wed, 26 Mar 2025 16:18:38 GMT
jquery-3.1.1.min.js
code.jquery.com/
85 KB
29 KB
Script
General
Full URL
https://code.jquery.com/jquery-3.1.1.min.js
Requested by
Host: ds.nokiatool.ru
URL: https://ds.nokiatool.ru/attachment/js.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://mulberry-fan-guavaberry.glitch.me/
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Apr 2024 16:18:38 GMT
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
age
9791503
x-cache
HIT, HIT
content-length
30070
x-served-by
cache-lga21947-LGA, cache-ewr18159-EWR
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
x-timer
S1712333918.292050,VS0,VE0
etag
W/"28feccc0-152b5"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=604800
accept-ranges
bytes
x-cache-hits
29471, 39607
picker_verify_fluent_authenticator_59892f1e05e3adf9fd2f71b42d92a27f.svg
aadcdn.msauth.net/shared/1.0/content/images/
7 KB
3 KB
Image
General
Full URL
https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_fluent_authenticator_59892f1e05e3adf9fd2f71b42d92a27f.svg
Requested by
Host: ds.nokiatool.ru
URL: https://ds.nokiatool.ru/attachment/js.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2603:1062:10:14::1 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
a7ee799dd5b6f6dbb70b043b766362a6724e71458f9839306c995f06b218c2f8

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://mulberry-fan-guavaberry.glitch.me/
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 05 Apr 2024 16:18:38 GMT
content-encoding
gzip
content-md5
nTculR1Fom7eLci0F6rk+A==
x-cache
TCP_HIT
content-length
2407
x-ms-lease-status
unlocked
last-modified
Wed, 24 May 2023 10:11:49 GMT
etag
0x8DB5C3F499A9B99
x-azure-ref
0XiQQZgAAAAA0lLw6HTdYRbvNxQg7ql0XTU5aMjIxMDYwNjEyMDE3ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
36421a95-301e-006d-7832-8778a7000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg
aadcdn.msauth.net/shared/1.0/content/images/
250 B
447 B
Image
General
Full URL
https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_sms_27a6d18b56f46818420e60a773c36d4e.svg
Requested by
Host: ds.nokiatool.ru
URL: https://ds.nokiatool.ru/attachment/js.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2603:1062:10:14::1 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
8ed8f3acb9b87f99e42c74463d4e2be96ee85b8a87cd6eb874295ace420a5904

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://mulberry-fan-guavaberry.glitch.me/
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 05 Apr 2024 16:18:38 GMT
content-encoding
gzip
content-md5
Ibdh8rH9N/WH1yIgI7CSdg==
x-cache
TCP_HIT
content-length
199
x-ms-lease-status
unlocked
last-modified
Fri, 17 Jan 2020 19:28:39 GMT
etag
0x8D79B8374CE7F93
x-azure-ref
0XiQQZgAAAACIx94PbQE9TJuRLMT5WfSDTU5aMjIxMDYwNjEyMDE3ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
cdf95de0-101e-006f-7023-862ea3000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg
aadcdn.msauth.net/shared/1.0/content/images/
3 KB
1 KB
Image
General
Full URL
https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_call_fe87496cc7a44412f7893a72099c120a.svg
Requested by
Host: ds.nokiatool.ru
URL: https://ds.nokiatool.ru/attachment/js.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2603:1062:10:14::1 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
55ce3b0ce5bc71339308107982cd7671f96014256ded0be36dc8062e64c847f1

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://mulberry-fan-guavaberry.glitch.me/
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 05 Apr 2024 16:18:38 GMT
content-encoding
gzip
content-md5
XHrPYKKsqlxUvysuxtSE2A==
x-cache
TCP_HIT
content-length
1173
x-ms-lease-status
unlocked
last-modified
Fri, 17 Jan 2020 19:28:39 GMT
etag
0x8D79B83749623C9
x-azure-ref
0XiQQZgAAAACIQcA4FSPeRYU13O5nmQE/TU5aMjIxMDYwNjEyMDE3ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
23653313-a01e-0038-7a2d-819c9e000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg
aadcdn.msauth.net/shared/1.0/content/images/
7 KB
3 KB
Image
General
Full URL
https://aadcdn.msauth.net/shared/1.0/content/images/picker_verify_fluent_authenticator_b59c16ca9bf156438a8a96d45e33db64.svg
Requested by
Host: ds.nokiatool.ru
URL: https://ds.nokiatool.ru/attachment/js.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2603:1062:10:14::1 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
a7ee799dd5b6f6dbb70b043b766362a6724e71458f9839306c995f06b218c2f8

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://mulberry-fan-guavaberry.glitch.me/
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 05 Apr 2024 16:18:38 GMT
content-encoding
gzip
content-md5
nTculR1Fom7eLci0F6rk+A==
x-cache
TCP_HIT
content-length
2407
x-ms-lease-status
unlocked
last-modified
Fri, 11 Mar 2022 11:11:29 GMT
etag
0x8DA034FE445C10D
x-azure-ref
0XiQQZgAAAAAdUc+ClryIRb66TL83o/P/TU5aMjIxMDYwNjEyMDE3ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
42396650-601e-0070-1a2d-81179e000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
picker_verify_call_c2616792e1950f83fdef6e72dab97293.svg
aadcdn.msftauth.net/shared/1.0/content/images/
3 KB
2 KB
Image
General
Full URL
https://aadcdn.msftauth.net/shared/1.0/content/images/picker_verify_call_c2616792e1950f83fdef6e72dab97293.svg
Requested by
Host: ds.nokiatool.ru
URL: https://ds.nokiatool.ru/attachment/js.php
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:21f:1b88:6342:f8de:86c:e98b -, , ASN (),
Reverse DNS
Software
ECAcc (nyd/D149) /
Resource Hash
55ce3b0ce5bc71339308107982cd7671f96014256ded0be36dc8062e64c847f1

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://mulberry-fan-guavaberry.glitch.me/
accept-language
en-US,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 05 Apr 2024 16:18:38 GMT
content-encoding
gzip
content-md5
XHrPYKKsqlxUvysuxtSE2A==
age
981196
x-cache
HIT
content-length
1173
x-ms-lease-status
unlocked
last-modified
Wed, 24 May 2023 10:11:50 GMT
server
ECAcc (nyd/D149)
etag
0x8DB5C3F4A98E9BB
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
1ec52d6b-a01e-00f9-6b88-7e8c60000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
truncated
/
4 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
756 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
899 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b7fcd37eaafe3f08647ed072d5289eadfff6c660a26cdef31532b3fcfb4a0bb2

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
513 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/
13 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
753aacf7fc4ddd09c6b32e2f8db80ae285122637d4b0e97c2adcb79afd89da9b

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type
image/webp
truncated
/
39 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f82b2c77864cd88541032f9d64ebef6fca0f9d2658273406a00a25426457c62a

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| $ function| jQuery string| b string| t string| u string| x function| a0_0x2e83 function| loadScript function| a0_0x31c373 function| _0x14cd8b function| a0_0x4960 object| CryptoJS function| a0_0x5239c1 string| caffeine string| ur function| Caffeine function| a0_0x3ba3 object| script function| a0_0xc284 function| _0x530b11

0 Cookies

3 Console Messages

Source Level URL
Text
javascript warning URL: https://ds.nokiatool.ru/attachment/js.php
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.1.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://ds.nokiatool.ru/attachment/js.php
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.1.1.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
recommendation verbose URL: https://mulberry-fan-guavaberry.glitch.me/
Message:
[DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msauth.net
aadcdn.msftauth.net
bm7sail.nokiatool.ru
cdnjs.cloudflare.com
code.jquery.com
ds.nokiatool.ru
mulberry-fan-guavaberry.glitch.me
yvewpdh.nokiatool.ru
104.17.24.14
172.67.221.5
2603:1062:10:14::1
2606:2800:21f:1b88:6342:f8de:86c:e98b
2606:4700:3036::6815:18ea
2606:4700:3036::ac43:dd05
2a04:4e42:200::649
54.87.211.83
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
36e0a7e08bee65774168528938072c536437669c1b7458ac77976ec788e4439c
4505b40b0f66c7c1f5b71a56f2407531a02b656e49810944c610aaae91f762ba
55ce3b0ce5bc71339308107982cd7671f96014256ded0be36dc8062e64c847f1
5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69
753aacf7fc4ddd09c6b32e2f8db80ae285122637d4b0e97c2adcb79afd89da9b
769a555de553babc35a3338f344dd7aa16260c93cea2c7db290707c90484e7cc
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
8ed8f3acb9b87f99e42c74463d4e2be96ee85b8a87cd6eb874295ace420a5904
a441b68e7820da3c5bb0869979389a8e3fb2d8467b80a2f5df6ab81f3974a5b4
a7ee799dd5b6f6dbb70b043b766362a6724e71458f9839306c995f06b218c2f8
b7fcd37eaafe3f08647ed072d5289eadfff6c660a26cdef31532b3fcfb4a0bb2
c1d222dc2ced0b439f5805f8844dc4b423f8346d2aca3dbc006333dbdf8b8d3e
c2bdfca0d54a01f431d6f054e86c0e6cf4d25385e1d8708c94a1dc4d4ddbb545
f82b2c77864cd88541032f9d64ebef6fca0f9d2658273406a00a25426457c62a