mammoth-kind-flax.glitch.me
Open in
urlscan Pro
44.209.12.242
Malicious Activity!
Public Scan
Submission: On March 14 via api from JP — Scanned from JP
Summary
This is the only time mammoth-kind-flax.glitch.me was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Tesco Bank (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 44.209.12.242 44.209.12.242 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 | 109.169.71.112 109.169.71.112 | 20860 (IOMART-AS) (IOMART-AS) | |
1 | 195.80.159.133 195.80.159.133 | 29152 (DECKNET-AS) (DECKNET-AS) | |
1 | 2404:6800:400... 2404:6800:4004:811::200a | 15169 (GOOGLE) (GOOGLE) | |
5 | 5 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-44-209-12-242.compute-1.amazonaws.com
mammoth-kind-flax.glitch.me |
Apex Domain Subdomains |
Transfer | |
---|---|---|
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 305 |
31 KB |
1 |
l2.io
l2.io — Cisco Umbrella Rank: 187374 |
231 B |
1 |
smtpjs.com
smtpjs.com — Cisco Umbrella Rank: 104272 |
1 KB |
1 |
glitch.me
mammoth-kind-flax.glitch.me |
794 KB |
0 |
tescobank.com
Failed
identity.tescobank.com Failed |
|
5 | 5 |
Domain | Requested by | |
---|---|---|
1 | ajax.googleapis.com |
mammoth-kind-flax.glitch.me
|
1 | l2.io |
mammoth-kind-flax.glitch.me
|
1 | smtpjs.com |
mammoth-kind-flax.glitch.me
|
1 | mammoth-kind-flax.glitch.me | |
0 | identity.tescobank.com Failed |
mammoth-kind-flax.glitch.me
|
5 | 5 |
This site contains links to these domains. Also see Links.
Domain |
---|
identity.tescobank.com |
www.tescobank.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
smtpjs.com R3 |
2023-02-14 - 2023-05-15 |
3 months | crt.sh |
l2.io R3 |
2023-01-30 - 2023-04-30 |
3 months | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-02-20 - 2023-05-15 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
http://mammoth-kind-flax.glitch.me/mhj.HTM
Frame ID: 340144FF292110E7AB8C6AFA0C83300A
Requests: 9 HTTP requests in this frame
9 Outgoing links
These are links going to different origins than the main page.
Title: Yes continue
Search URL Search Domain Scan URL
Title: Tesco Bank
Search URL Search Domain Scan URL
Title: Online Banking troubleshooting guide
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: I've forgotten my username link
Search URL Search Domain Scan URL
Title: Sign up
Search URL Search Domain Scan URL
Title: Online Banking
Search URL Search Domain Scan URL
Title: Your Insurance Account
Search URL Search Domain Scan URL
Title: privacy policy
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
5 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
mhj.HTM
mammoth-kind-flax.glitch.me/ |
793 KB 794 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
smtp.js
smtpjs.com/v3/ |
871 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ip.js
l2.io/ |
27 B 231 B |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.5.1/ |
87 KB 31 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
16 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
/
identity.tescobank.com/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
27 KB 27 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
27 KB 27 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
28 KB 28 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- identity.tescobank.com
- URL
- https://identity.tescobank.com/
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Tesco Bank (Banking)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless function| savepage_ShadowLoader object| Email string| userip function| $ function| jQuery function| isNumber0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
6 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
identity.tescobank.com
l2.io
mammoth-kind-flax.glitch.me
smtpjs.com
identity.tescobank.com
109.169.71.112
195.80.159.133
2404:6800:4004:811::200a
44.209.12.242
1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776
568219ca839f8425765048f6ff3214e8fa5ce4025f4315e7e1e3be5b906c0b63
5f9c15b61eb2e0552290225807a6826c7dc7b8396fa3c05ead5b24d2a9b0ba10
7f90c6547a2cc2bf37c1e7b4433eb5c5e56a766c8f357948b043078ad4024750
c0a4c285cd8ac8ac1bbf5748f3fee31b3907418f3772b8213569ac692671fdb2
e27350c0c74ac2b925006085e5682bb77986bcb5a741bfcd462828a12a456f76
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fc3de12503ecb116a9f44677fa8d2b1c066d2313189b89fb2df5817f5d907ca2