urlscan.io logo urlscan.io
SecurityTrails logo

water-cumbersome-feverfew.glitch.me Open in urlscan Pro
52.86.228.72  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://water-cumbersome-feverfew.glitch.me/newdawn.html?/NAT_WEST_Customer.verification/error.html
Submission: On August 06 via manual from IN
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 3 countries across 6 domains to perform 28 HTTP transactions. The main IP is 52.86.228.72, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is water-cumbersome-feverfew.glitch.me.
TLS certificate: Issued by Amazon on January 18th 2021. Valid for: a year.
This is the only time water-cumbersome-feverfew.glitch.me was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: NatWest (Banking)

Domain & IP information

IP Address AS Autonomous System
2 52.86.228.72 14618 (AMAZON-AES)
22 2a02:4780:dea... 204915 (AWEX)
1 181.214.31.79 61317 (ASDETUK w...)
1 78.129.237.3 20860 (IOMART-AS)
1 145.239.131.51 16276 (OVH)
1 195.80.159.133 29152 (DECKNET-AS)
28 6
2    52.86.228.72 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-86-228-72.compute-1.amazonaws.com
water-cumbersome-feverfew.glitch.me
22    2a02:4780:dead:a80d::1 (United States)

ASN204915 (AWEX, CY)
filprom.000webhostapp.com
1    181.214.31.79 (Bedminster, United States)

ASN61317 (ASDETUK www.heficed.com, GB)
PTR: miami.servershost.net
etigerteam.com
1    78.129.237.3 (United Kingdom)

ASN20860 (IOMART-AS, GB)
smtpjs.com
1    145.239.131.51 (France)

ASN16276 (OVH, FR)
PTR: i.ibb.co
i.ibb.co
1    195.80.159.133 (Paris, France)

ASN29152 (DECKNET-AS, FR)
l2.io
Domain Requested by
22 filprom.000webhostapp.com water-cumbersome-feverfew.glitch.me
filprom.000webhostapp.com
2 water-cumbersome-feverfew.glitch.me water-cumbersome-feverfew.glitch.me
1 l2.io water-cumbersome-feverfew.glitch.me
1 i.ibb.co water-cumbersome-feverfew.glitch.me
1 smtpjs.com water-cumbersome-feverfew.glitch.me
1 etigerteam.com water-cumbersome-feverfew.glitch.me
28 6

This site contains no links.

Subject Issuer Validity Valid
glitch.com
Amazon		 2021-01-18 -
2022-02-15		 a year crt.sh
*.000webhostapp.com
RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1		 2021-07-10 -
2022-08-10		 a year crt.sh
etigerteam.com
cPanel, Inc. Certification Authority		 2021-06-02 -
2021-08-31		 3 months crt.sh
smtpjs.com
R3		 2021-07-09 -
2021-10-07		 3 months crt.sh
ibb.co
R3		 2021-06-07 -
2021-09-05		 3 months crt.sh
l2.io
R3		 2021-08-05 -
2021-11-03		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://water-cumbersome-feverfew.glitch.me/newdawn.html?/NAT_WEST_Customer.verification/error.html
Frame ID: 8049DCE65AA1A5FF732802F71BA25435
Requests: 28 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^AmazonS3$/i
Overall confidence: 100%
Detected patterns
  • headers server /^AmazonS3$/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i
Overall confidence: 100%
Detected patterns
  • script /jquery[.-]([\d.]*\d)[^/]*\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

28
Requests

100 %
HTTPS

17 %
IPv6

6
Domains

6
Subdomains

6
IPs

3
Countries

216 kB
Transfer

477 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

28 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request newdawn.html
water-cumbersome-feverfew.glitch.me/ 		40 KB
40 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://water-cumbersome-feverfew.glitch.me/newdawn.html?/NAT_WEST_Customer.verification/error.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.86.228.72 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-86-228-72.compute-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
a582d9029101262fc61548167f813cd9659f34740d08cf3785e7b93410034c73

Request headers

:method
GET
:authority
water-cumbersome-feverfew.glitch.me
:scheme
https
:path
/newdawn.html?/NAT_WEST_Customer.verification/error.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 06 Aug 2021 09:50:25 GMT
content-type
text/html; charset=utf-8
content-length
40623
x-amz-id-2
6eszRwMAjP5PIKaagQ7CtogSkoLBMnidw2s1KHC/jwjGvK/Cy5YjGr21sQSOA1i/K6ymI+S8Tp0=
x-amz-request-id
6DSES7T3PCNY4TTV
last-modified
Fri, 06 Aug 2021 07:12:32 GMT
etag
"f2a887d995b54f988d8ce6f98e3afc4e"
cache-control
no-cache
x-amz-version-id
a3rvCtwBIiyIK1A0Ffv277A6mAl7Omgz
accept-ranges
bytes
server
AmazonS3
master.css
filprom.000webhostapp.com/media/ 		223 KB
54 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://filprom.000webhostapp.com/media/master.css
Requested by
Host: water-cumbersome-feverfew.glitch.me
URL: https://water-cumbersome-feverfew.glitch.me/newdawn.html?/NAT_WEST_Customer.verification/error.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:a80d::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
7960e821069d9da7073b2f14ee920bb25084cd2ab79ccad46f735772ae3d0f3b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://water-cumbersome-feverfew.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 06 Aug 2021 09:50:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:23:52 GMT
server
awex
content-type
text/css
x-xss-protection
1; mode=block
x-request-id
38807d5e562ab0780f79b90193b9ff05
master_mobile.css
filprom.000webhostapp.com/media/ 		47 KB
14 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://filprom.000webhostapp.com/media/master_mobile.css
Requested by
Host: water-cumbersome-feverfew.glitch.me
URL: https://water-cumbersome-feverfew.glitch.me/newdawn.html?/NAT_WEST_Customer.verification/error.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:a80d::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
762a7161fafb519ada43534e1e4aa7fd8f5ae402d21cdbb3aff8ff569b29ad6a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://water-cumbersome-feverfew.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 06 Aug 2021 09:50:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:23:54 GMT
server
awex
content-type
text/css
x-xss-protection
1; mode=block
x-request-id
e02ccf2045dfcfa9dcac9b310568edb8
npc.css
filprom.000webhostapp.com/media/ 		46 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://filprom.000webhostapp.com/media/npc.css
Requested by
Host: water-cumbersome-feverfew.glitch.me
URL: https://water-cumbersome-feverfew.glitch.me/newdawn.html?/NAT_WEST_Customer.verification/error.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:a80d::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
b618b1630fe11a6fee0232601cc91ac7e7cd56ec8d4ab7353846e493d8764778
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://water-cumbersome-feverfew.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 06 Aug 2021 09:50:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:23:58 GMT
server
awex
content-type
text/css
x-xss-protection
1; mode=block
x-request-id
60f833706afec9a5df0783ca215d5b44
overlayPromptMaster.css
filprom.000webhostapp.com/media/ 		1 KB
787 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://filprom.000webhostapp.com/media/overlayPromptMaster.css
Requested by
Host: water-cumbersome-feverfew.glitch.me
URL: https://water-cumbersome-feverfew.glitch.me/newdawn.html?/NAT_WEST_Customer.verification/error.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:a80d::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
42e70c32efffee33a1d8bddf152d6b754fa8abb83c6166444b8d41b217d9dae6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://water-cumbersome-feverfew.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 06 Aug 2021 09:50:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:24:00 GMT
server
awex
content-type
text/css
x-xss-protection
1; mode=block
x-request-id
5f21ee08cd406eb433d2712613e3ae53
overlayPrompt.css
filprom.000webhostapp.com/media/ 		76 B
285 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://filprom.000webhostapp.com/media/overlayPrompt.css
Requested by
Host: water-cumbersome-feverfew.glitch.me
URL: https://water-cumbersome-feverfew.glitch.me/newdawn.html?/NAT_WEST_Customer.verification/error.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:a80d::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
ef7db794b4a6b5c42d2535919d91fb11da1e5cd1147f35196db382197b35fdee
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://water-cumbersome-feverfew.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 06 Aug 2021 09:50:26 GMT
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:23:59 GMT
server
awex
content-type
text/css
accept-ranges
bytes
content-length
76
x-xss-protection
1; mode=block
x-request-id
18b5f6aee15bafdb057c5e5a0cd41776
font-awesome.css
filprom.000webhostapp.com/media/ 		21 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://filprom.000webhostapp.com/media/font-awesome.css
Requested by
Host: water-cumbersome-feverfew.glitch.me
URL: https://water-cumbersome-feverfew.glitch.me/newdawn.html?/NAT_WEST_Customer.verification/error.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:a80d::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
043d64ad39164b2b6d031cbaf82d44542b3904b814ffb4ae9738f0953e32f143
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://water-cumbersome-feverfew.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 06 Aug 2021 09:50:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:23:37 GMT
server
awex
content-type
text/css
x-xss-protection
1; mode=block
x-request-id
67cfe0c0c3949b36acf6e8384ccdb5b0
panel-defaults.css
filprom.000webhostapp.com/media/ 		9 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://filprom.000webhostapp.com/media/panel-defaults.css
Requested by
Host: water-cumbersome-feverfew.glitch.me
URL: https://water-cumbersome-feverfew.glitch.me/newdawn.html?/NAT_WEST_Customer.verification/error.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:a80d::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
258b07e0e514a4714099f1f345a3333f7338589e19413a06ccd319e7436d3e4b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://water-cumbersome-feverfew.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 06 Aug 2021 09:50:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:24:01 GMT
server
awex
content-type
text/css
x-xss-protection
1; mode=block
x-request-id
9f6d1864fd2397033e8859c73c328a97
main.css
filprom.000webhostapp.com/media/ 		2 KB
859 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://filprom.000webhostapp.com/media/main.css
Requested by
Host: water-cumbersome-feverfew.glitch.me
URL: https://water-cumbersome-feverfew.glitch.me/newdawn.html?/NAT_WEST_Customer.verification/error.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:a80d::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
81f2ad4f142602793f02bfd7c8da05a126127a3711516bbb7c967a0c510bbb41
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://water-cumbersome-feverfew.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 06 Aug 2021 09:50:26 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:23:45 GMT
server
awex
content-type
text/css
x-xss-protection
1; mode=block
x-request-id
ffde5a3e06dac50bd2d886c40552a2e7
jquery-2.2.3.js
etigerteam.com/ntw/media/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://etigerteam.com/ntw/media/jquery-2.2.3.js
Requested by
Host: water-cumbersome-feverfew.glitch.me
URL: https://water-cumbersome-feverfew.glitch.me/newdawn.html?/NAT_WEST_Customer.verification/error.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
181.214.31.79 Bedminster, United States, ASN61317 (ASDETUK www.heficed.com, GB),
Reverse DNS
miami.servershost.net
Software
/
Resource Hash

Request headers

Referer
https://water-cumbersome-feverfew.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers
smtp.js
smtpjs.com/v3/ 		871 B
782 B 		Script
General
Check archive.org
Download Go to
Full URL
https://smtpjs.com/v3/smtp.js
Requested by
Host: water-cumbersome-feverfew.glitch.me
URL: https://water-cumbersome-feverfew.glitch.me/newdawn.html?/NAT_WEST_Customer.verification/error.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
78.129.237.3 , United Kingdom, ASN20860 (IOMART-AS, GB),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776

Request headers

Referer
https://water-cumbersome-feverfew.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 06 Aug 2021 09:50:25 GMT
content-encoding
gzip
last-modified
Tue, 10 Nov 2020 17:17:51 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
etag
"162f436b85b7d61:0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
accept-ranges
bytes
content-length
603
n-w-logo.svg
filprom.000webhostapp.com/media/ 		5 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://filprom.000webhostapp.com/media/n-w-logo.svg
Requested by
Host: water-cumbersome-feverfew.glitch.me
URL: https://water-cumbersome-feverfew.glitch.me/newdawn.html?/NAT_WEST_Customer.verification/error.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:a80d::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
8d667d58aa56215b23d233ade3af0c7f6b7962c75410d6c103e0c324e4e958ca
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://water-cumbersome-feverfew.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 06 Aug 2021 09:50:28 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:23:55 GMT
server
awex
content-type
image/svg+xml
x-xss-protection
1; mode=block
x-request-id
1dead072e891ed7a8e7fb9e8a814d6b0
plogo.png
filprom.000webhostapp.com/media/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://filprom.000webhostapp.com/media/plogo.png
Requested by
Host: water-cumbersome-feverfew.glitch.me
URL: https://water-cumbersome-feverfew.glitch.me/newdawn.html?/NAT_WEST_Customer.verification/error.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:a80d::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
f2b557317fb851b3ed73c2d8203192e9ed433bd006ca5025ccb3317ef15e1b8d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://water-cumbersome-feverfew.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 06 Aug 2021 09:50:28 GMT
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:24:02 GMT
server
awex
content-type
image/png
accept-ranges
bytes
content-length
5679
x-xss-protection
1; mode=block
x-request-id
5bdaa95d7083662b32ab5412164d142c
error-marker.png
filprom.000webhostapp.com/media/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://filprom.000webhostapp.com/media/error-marker.png
Requested by
Host: water-cumbersome-feverfew.glitch.me
URL: https://water-cumbersome-feverfew.glitch.me/newdawn.html?/NAT_WEST_Customer.verification/error.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:a80d::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
27f324f2ad60091d5e8f76adfef83f9122dc8aa8df29d0a8d970bfe06aaa5005
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://water-cumbersome-feverfew.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 06 Aug 2021 09:50:28 GMT
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:23:35 GMT
server
awex
content-type
image/png
accept-ranges
bytes
content-length
1090
x-xss-protection
1; mode=block
x-request-id
9d3bf5a58b9dea86d6844c4f34ca1388
security.gif
filprom.000webhostapp.com/media/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://filprom.000webhostapp.com/media/security.gif
Requested by
Host: water-cumbersome-feverfew.glitch.me
URL: https://water-cumbersome-feverfew.glitch.me/newdawn.html?/NAT_WEST_Customer.verification/error.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:a80d::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
e3c202c787d4eef5e65ab55ba52edc7113255175d2615a674e59f19ff26bc6fe
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://water-cumbersome-feverfew.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 06 Aug 2021 09:50:28 GMT
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:24:06 GMT
server
awex
content-type
image/gif
accept-ranges
bytes
content-length
6122
x-xss-protection
1; mode=block
x-request-id
3b46ff4c9d3541c0d3eeb6ef4af82276
ajax-loader.gif
i.ibb.co/RpLNy4f/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.ibb.co/RpLNy4f/ajax-loader.gif
Requested by
Host: water-cumbersome-feverfew.glitch.me
URL: https://water-cumbersome-feverfew.glitch.me/newdawn.html?/NAT_WEST_Customer.verification/error.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
145.239.131.51 , France, ASN16276 (OVH, FR),
Reverse DNS
i.ibb.co
Software
nginx /
Resource Hash
fd29b3b084cf11160bfc4e99d98a261f2b36bff29113b07367c5204563c5d355

Request headers

Referer
https://water-cumbersome-feverfew.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 06 Aug 2021 09:50:28 GMT
last-modified
Tue, 02 Mar 2021 22:27:30 GMT
server
nginx
access-control-allow-methods
GET, OPTIONS
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
3208
expires
Thu, 31 Dec 2037 23:55:55 GMT
ip.js
l2.io/ 		25 B
229 B 		Script
General
Check archive.org
Download Go to
Full URL
https://l2.io/ip.js?var=userip
Requested by
Host: water-cumbersome-feverfew.glitch.me
URL: https://water-cumbersome-feverfew.glitch.me/newdawn.html?/NAT_WEST_Customer.verification/error.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
195.80.159.133 Paris, France, ASN29152 (DECKNET-AS, FR),
Reverse DNS
Software
Apache/2.4.25 (Debian) /
Resource Hash
79837db66a3132df63c41f777d3549869eb3f45d83b7ce0fa257dce687c7b150

Request headers

Referer
https://water-cumbersome-feverfew.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 06 Aug 2021 09:50:28 GMT
Server
Apache/2.4.25 (Debian)
Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
Content-Length
25
Content-Type
text/html; charset=UTF-8
plogo.png
water-cumbersome-feverfew.glitch.me/media/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://water-cumbersome-feverfew.glitch.me/media/plogo.png
Requested by
Host: water-cumbersome-feverfew.glitch.me
URL: https://water-cumbersome-feverfew.glitch.me/newdawn.html?/NAT_WEST_Customer.verification/error.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.86.228.72 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-86-228-72.compute-1.amazonaws.com
Software
/
Resource Hash
5d1f9eac141b63c19a274eb9c099d629a0c4f747c8683dee8b93191b4ce0c1fd

Request headers

:path
/media/plogo.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
water-cumbersome-feverfew.glitch.me
referer
https://water-cumbersome-feverfew.glitch.me/newdawn.html?/NAT_WEST_Customer.verification/error.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://water-cumbersome-feverfew.glitch.me/newdawn.html?/NAT_WEST_Customer.verification/error.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 06 Aug 2021 09:50:28 GMT
cache-control
max-age=0
content-length
3616
white-lock.png
filprom.000webhostapp.com/media/ 		285 B
495 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://filprom.000webhostapp.com/media/white-lock.png
Requested by
Host: filprom.000webhostapp.com
URL: https://filprom.000webhostapp.com/media/npc.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:a80d::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
b465d00b89619e9899ec7d618559157db09f935d318466d67deb036157fadcf2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://filprom.000webhostapp.com/media/npc.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 06 Aug 2021 09:50:28 GMT
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:24:09 GMT
server
awex
content-type
image/png
accept-ranges
bytes
content-length
285
x-xss-protection
1; mode=block
x-request-id
513371e2bfccab61da44e2dca20d7b7c
alert.png
filprom.000webhostapp.com/media/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://filprom.000webhostapp.com/media/alert.png
Requested by
Host: filprom.000webhostapp.com
URL: https://filprom.000webhostapp.com/media/npc.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:a80d::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
d6f01bdb67a342b50dacb894a4cc585dbe700da9dd373886ade1480113972cc1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://filprom.000webhostapp.com/media/npc.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 06 Aug 2021 09:50:28 GMT
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:23:31 GMT
server
awex
content-type
image/png
accept-ranges
bytes
content-length
1305
x-xss-protection
1; mode=block
x-request-id
ce47deaca127b4634b0e2de3a755b392
li5_outer_frame_top_curve.gif
filprom.000webhostapp.com/media/ 		14 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://filprom.000webhostapp.com/media/li5_outer_frame_top_curve.gif
Requested by
Host: filprom.000webhostapp.com
URL: https://filprom.000webhostapp.com/media/master.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:a80d::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://filprom.000webhostapp.com/media/master.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 06 Aug 2021 09:50:28 GMT
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:23:43 GMT
server
awex
content-type
image/gif
accept-ranges
bytes
content-length
17540
x-xss-protection
1; mode=block
x-request-id
c55dc41d4faa64a438a981467d672627
radio-selected.png
filprom.000webhostapp.com/media/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://filprom.000webhostapp.com/media/radio-selected.png
Requested by
Host: filprom.000webhostapp.com
URL: https://filprom.000webhostapp.com/media/npc.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:a80d::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
d81db57832f4742b67755f90f8c3d37735cb9f58dbb10e312f931343d27552c6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://filprom.000webhostapp.com/media/npc.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 06 Aug 2021 09:50:28 GMT
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:24:04 GMT
server
awex
content-type
image/png
accept-ranges
bytes
content-length
1633
x-xss-protection
1; mode=block
x-request-id
50e03c60c86f072d557666f2a4cfc109
radio-normal.png
filprom.000webhostapp.com/media/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://filprom.000webhostapp.com/media/radio-normal.png
Requested by
Host: filprom.000webhostapp.com
URL: https://filprom.000webhostapp.com/media/npc.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:a80d::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
1ec277d20cb0b2b9d72322f3cc32d988435978a6a8f72b28e0f8ac8b1bf17a72
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://filprom.000webhostapp.com/media/npc.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 06 Aug 2021 09:50:28 GMT
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:24:03 GMT
server
awex
content-type
image/png
accept-ranges
bytes
content-length
1317
x-xss-protection
1; mode=block
x-request-id
c5fbdb667916e6efc30d1dc4ca533604
check-box.png
filprom.000webhostapp.com/media/ 		157 B
368 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://filprom.000webhostapp.com/media/check-box.png
Requested by
Host: filprom.000webhostapp.com
URL: https://filprom.000webhostapp.com/media/npc.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:a80d::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
d2955b58d801a021737f025d1716a68fd2a143ddac3e0b749fcc053deba6e082
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://filprom.000webhostapp.com/media/npc.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 06 Aug 2021 09:50:28 GMT
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:23:33 GMT
server
awex
content-type
image/png
accept-ranges
bytes
content-length
157
x-xss-protection
1; mode=block
x-request-id
aefb7d2948f328ec8a83de8ae74a4478
down-chevron.png
filprom.000webhostapp.com/media/ 		295 B
506 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://filprom.000webhostapp.com/media/down-chevron.png
Requested by
Host: filprom.000webhostapp.com
URL: https://filprom.000webhostapp.com/media/npc.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:a80d::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
4f5a022467e927b5b385cc335e58434a49bad0520ed018fc059075069d695c79
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://filprom.000webhostapp.com/media/npc.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 06 Aug 2021 09:50:28 GMT
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:23:34 GMT
server
awex
content-type
image/png
accept-ranges
bytes
content-length
295
x-xss-protection
1; mode=block
x-request-id
5b36cc5e7b534650bb0feca7d5c93728
combined-shape.png
filprom.000webhostapp.com/media/ 		359 B
570 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://filprom.000webhostapp.com/media/combined-shape.png
Requested by
Host: filprom.000webhostapp.com
URL: https://filprom.000webhostapp.com/media/npc.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:a80d::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
d1c878b4e69d9da5292c53b1f46708de74c435144895bdfd697208406466a814
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://filprom.000webhostapp.com/media/npc.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 06 Aug 2021 09:50:28 GMT
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:23:33 GMT
server
awex
content-type
image/png
accept-ranges
bytes
content-length
359
x-xss-protection
1; mode=block
x-request-id
65e728d0a5434ec6bb742a7a2bb282fa
RNHouseSansW05-Regular.woff2
filprom.000webhostapp.com/media/ 		21 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://filprom.000webhostapp.com/media/RNHouseSansW05-Regular.woff2
Requested by
Host: filprom.000webhostapp.com
URL: https://filprom.000webhostapp.com/media/master.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:a80d::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
816128c403e882f6d31208fd95435f625564b5914dbea396754640760cfc612e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Origin
https://water-cumbersome-feverfew.glitch.me
Referer
https://filprom.000webhostapp.com/media/master.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 06 Aug 2021 09:50:28 GMT
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:24:06 GMT
server
awex
access-control-allow-origin
*
accept-ranges
bytes
content-length
21572
x-xss-protection
1; mode=block
x-request-id
f99d69575684c87a5babe75d69576f62
RNHouseSansW05-Bold.woff2
filprom.000webhostapp.com/media/ 		22 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://filprom.000webhostapp.com/media/RNHouseSansW05-Bold.woff2
Requested by
Host: filprom.000webhostapp.com
URL: https://filprom.000webhostapp.com/media/master.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:a80d::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
9ccc02568ec79c3f073aadd04efdd9abe527681ba1d26d5b60d1bb52b668ac84
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Origin
https://water-cumbersome-feverfew.glitch.me
Referer
https://filprom.000webhostapp.com/media/master.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 06 Aug 2021 09:50:28 GMT
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:24:05 GMT
server
awex
access-control-allow-origin
*
accept-ranges
bytes
content-length
22184
x-xss-protection
1; mode=block
x-request-id
b7d104f9096282fdcc641a29ba56eb92

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: NatWest (Banking)

23 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| Email function| isitornah function| whyone function| whytwo function| check function| sendEmailo function| sendEmail function| sendEmaili function| sendEmailii function| sendEmailiii string| userip function| input_nr

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

etigerteam.com
filprom.000webhostapp.com
i.ibb.co
l2.io
smtpjs.com
water-cumbersome-feverfew.glitch.me
145.239.131.51
181.214.31.79
195.80.159.133
2a02:4780:dead:a80d::1
52.86.228.72
78.129.237.3
043d64ad39164b2b6d031cbaf82d44542b3904b814ffb4ae9738f0953e32f143
1ec277d20cb0b2b9d72322f3cc32d988435978a6a8f72b28e0f8ac8b1bf17a72
1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776
258b07e0e514a4714099f1f345a3333f7338589e19413a06ccd319e7436d3e4b
27f324f2ad60091d5e8f76adfef83f9122dc8aa8df29d0a8d970bfe06aaa5005
42e70c32efffee33a1d8bddf152d6b754fa8abb83c6166444b8d41b217d9dae6
4f5a022467e927b5b385cc335e58434a49bad0520ed018fc059075069d695c79
5d1f9eac141b63c19a274eb9c099d629a0c4f747c8683dee8b93191b4ce0c1fd
762a7161fafb519ada43534e1e4aa7fd8f5ae402d21cdbb3aff8ff569b29ad6a
7960e821069d9da7073b2f14ee920bb25084cd2ab79ccad46f735772ae3d0f3b
79837db66a3132df63c41f777d3549869eb3f45d83b7ce0fa257dce687c7b150
816128c403e882f6d31208fd95435f625564b5914dbea396754640760cfc612e
81f2ad4f142602793f02bfd7c8da05a126127a3711516bbb7c967a0c510bbb41
8d667d58aa56215b23d233ade3af0c7f6b7962c75410d6c103e0c324e4e958ca
9ccc02568ec79c3f073aadd04efdd9abe527681ba1d26d5b60d1bb52b668ac84
a582d9029101262fc61548167f813cd9659f34740d08cf3785e7b93410034c73
b465d00b89619e9899ec7d618559157db09f935d318466d67deb036157fadcf2
b618b1630fe11a6fee0232601cc91ac7e7cd56ec8d4ab7353846e493d8764778
d1c878b4e69d9da5292c53b1f46708de74c435144895bdfd697208406466a814
d2955b58d801a021737f025d1716a68fd2a143ddac3e0b749fcc053deba6e082
d6f01bdb67a342b50dacb894a4cc585dbe700da9dd373886ade1480113972cc1
d81db57832f4742b67755f90f8c3d37735cb9f58dbb10e312f931343d27552c6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3c202c787d4eef5e65ab55ba52edc7113255175d2615a674e59f19ff26bc6fe
ef7db794b4a6b5c42d2535919d91fb11da1e5cd1147f35196db382197b35fdee
f2b557317fb851b3ed73c2d8203192e9ed433bd006ca5025ccb3317ef15e1b8d
fd29b3b084cf11160bfc4e99d98a261f2b36bff29113b07367c5204563c5d355