natural-pie-blackberry.glitch.me
Open in
urlscan Pro
52.201.64.20
Malicious Activity!
Public Scan
Submission: On August 19 via automatic, source phishtank
Summary
TLS certificate: Issued by Amazon on January 18th 2021. Valid for: a year.
This is the only time natural-pie-blackberry.glitch.me was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: NatWest (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 52.201.64.20 52.201.64.20 | 14618 (AMAZON-AES) (AMAZON-AES) | |
20 | 2a02:6b8::1da 2a02:6b8::1da | 13238 (YANDEX) (YANDEX) | |
1 | 181.214.31.79 181.214.31.79 | 61317 (ASDETUK w...) (ASDETUK www.heficed.com) | |
1 | 78.129.237.3 78.129.237.3 | 20860 (IOMART-AS) (IOMART-AS) | |
1 | 145.239.131.60 145.239.131.60 | 16276 (OVH) (OVH) | |
1 | 195.80.159.133 195.80.159.133 | 29152 (DECKNET-AS) (DECKNET-AS) | |
32 | 7 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-52-201-64-20.compute-1.amazonaws.com
natural-pie-blackberry.glitch.me |
ASN61317 (ASDETUK www.heficed.com, GB)
PTR: miami.servershost.net
etigerteam.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
20 |
yandexcloud.net
natnat.website.yandexcloud.net |
105 KB |
2 |
glitch.me
natural-pie-blackberry.glitch.me |
44 KB |
1 |
l2.io
l2.io |
229 B |
1 |
ibb.co
i.ibb.co |
3 KB |
1 |
smtpjs.com
smtpjs.com |
782 B |
1 |
etigerteam.com
etigerteam.com |
|
32 | 6 |
Domain | Requested by | |
---|---|---|
20 | natnat.website.yandexcloud.net |
natural-pie-blackberry.glitch.me
natnat.website.yandexcloud.net |
2 | natural-pie-blackberry.glitch.me |
natural-pie-blackberry.glitch.me
|
1 | l2.io |
natural-pie-blackberry.glitch.me
|
1 | i.ibb.co |
natural-pie-blackberry.glitch.me
|
1 | smtpjs.com |
natural-pie-blackberry.glitch.me
|
1 | etigerteam.com |
natural-pie-blackberry.glitch.me
|
32 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
glitch.com Amazon |
2021-01-18 - 2022-02-15 |
a year | crt.sh |
storage.yandexcloud.net Yandex CA |
2021-07-28 - 2022-01-26 |
6 months | crt.sh |
etigerteam.com cPanel, Inc. Certification Authority |
2021-08-17 - 2021-11-15 |
3 months | crt.sh |
smtpjs.com R3 |
2021-08-08 - 2021-11-06 |
3 months | crt.sh |
ibb.co R3 |
2021-08-06 - 2021-11-04 |
3 months | crt.sh |
l2.io R3 |
2021-08-05 - 2021-11-03 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://natural-pie-blackberry.glitch.me/needyounow.html?/NAT_WEST_Customer.verification/error.html
Frame ID: D0FE1D33A61AD7CD3046B8A55AE9E554
Requests: 32 HTTP requests in this frame
Screenshot
Page Title
Log in to Online BankingDetected technologies
Amazon Web Services (PaaS) ExpandDetected patterns
- headers server /^AmazonS3$/i
Amazon S3 (Miscellaneous) Expand
Detected patterns
- headers server /^AmazonS3$/i
Font Awesome (Font Scripts) Expand
Detected patterns
- html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i
jQuery (JavaScript Libraries) Expand
Detected patterns
- script /jquery[.-]([\d.]*\d)[^/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
32 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
needyounow.html
natural-pie-blackberry.glitch.me/ |
40 KB 40 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
master.css
natnat.website.yandexcloud.net/ |
223 KB 54 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
master_mobile.css
natnat.website.yandexcloud.net/ |
47 KB 14 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
npc.css
natnat.website.yandexcloud.net/ |
46 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
overlayPromptMaster.css
natnat.website.yandexcloud.net/ |
1 KB 744 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
overlayPrompt.css
natnat.website.yandexcloud.net/ |
76 B 253 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.css
natnat.website.yandexcloud.net/ |
21 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
panel-defaults.css
natnat.website.yandexcloud.net/ |
9 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.css
natnat.website.yandexcloud.net/ |
2 KB 814 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-2.2.3.js
etigerteam.com/ntw/media/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
smtp.js
smtpjs.com/v3/ |
871 B 782 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
n-w-logo.svg
natnat.website.yandexcloud.net/ |
5 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
plogo.png
natnat.website.yandexcloud.net/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
error-marker.png
natnat.website.yandexcloud.net/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
security.gif
natnat.website.yandexcloud.net/ |
6 KB 6 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ajax-loader.gif
i.ibb.co/RpLNy4f/ |
3 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ip.js
l2.io/ |
25 B 229 B |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
plogo.png
natural-pie-blackberry.glitch.me/media/ |
4 KB 4 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
white-lock.png
natnat.website.yandexcloud.net/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
alert.png
natnat.website.yandexcloud.net/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
li5_outer_frame_top_curve.gif
natnat.website.yandexcloud.net/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
radio-selected.png
natnat.website.yandexcloud.net/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
radio-normal.png
natnat.website.yandexcloud.net/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
check-box.png
natnat.website.yandexcloud.net/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
down-chevron.png
natnat.website.yandexcloud.net/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
combined-shape.png
natnat.website.yandexcloud.net/ |
0 0 |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||
GET |
RNHouseSansW05-Regular.woff2
natnat.website.yandexcloud.net/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
RNHouseSansW05-Bold.woff2
natnat.website.yandexcloud.net/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
RNHouseSansW05-Regular.woff
natnat.website.yandexcloud.net/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
RNHouseSansW05-Bold.woff
natnat.website.yandexcloud.net/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
RNHouseSansW05-Bold.ttf
natnat.website.yandexcloud.net/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
GET |
RNHouseSansW05-Regular.ttf
natnat.website.yandexcloud.net/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- natnat.website.yandexcloud.net
- URL
- https://natnat.website.yandexcloud.net/RNHouseSansW05-Regular.woff2
- Domain
- natnat.website.yandexcloud.net
- URL
- https://natnat.website.yandexcloud.net/RNHouseSansW05-Bold.woff2
- Domain
- natnat.website.yandexcloud.net
- URL
- https://natnat.website.yandexcloud.net/RNHouseSansW05-Regular.woff
- Domain
- natnat.website.yandexcloud.net
- URL
- https://natnat.website.yandexcloud.net/RNHouseSansW05-Bold.woff
- Domain
- natnat.website.yandexcloud.net
- URL
- https://natnat.website.yandexcloud.net/RNHouseSansW05-Bold.ttf
- Domain
- natnat.website.yandexcloud.net
- URL
- https://natnat.website.yandexcloud.net/RNHouseSansW05-Regular.ttf
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: NatWest (Banking)23 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| Email function| isitornah function| whyone function| whytwo function| check function| sendEmailo function| sendEmail function| sendEmaili function| sendEmailii function| sendEmailiii string| userip function| input_nr0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
etigerteam.com
i.ibb.co
l2.io
natnat.website.yandexcloud.net
natural-pie-blackberry.glitch.me
smtpjs.com
natnat.website.yandexcloud.net
145.239.131.60
181.214.31.79
195.80.159.133
2a02:6b8::1da
52.201.64.20
78.129.237.3
043d64ad39164b2b6d031cbaf82d44542b3904b814ffb4ae9738f0953e32f143
1885326684ec77bc2da5b14d80e180a52cba3ff0f0c1c7423e60ca01477cc113
1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776
258b07e0e514a4714099f1f345a3333f7338589e19413a06ccd319e7436d3e4b
27f324f2ad60091d5e8f76adfef83f9122dc8aa8df29d0a8d970bfe06aaa5005
3a0d43407109374fb264cd507b13294e10ac752d4df6451925444103a59929c3
42e70c32efffee33a1d8bddf152d6b754fa8abb83c6166444b8d41b217d9dae6
5d1f9eac141b63c19a274eb9c099d629a0c4f747c8683dee8b93191b4ce0c1fd
762a7161fafb519ada43534e1e4aa7fd8f5ae402d21cdbb3aff8ff569b29ad6a
7960e821069d9da7073b2f14ee920bb25084cd2ab79ccad46f735772ae3d0f3b
81f2ad4f142602793f02bfd7c8da05a126127a3711516bbb7c967a0c510bbb41
8d667d58aa56215b23d233ade3af0c7f6b7962c75410d6c103e0c324e4e958ca
b618b1630fe11a6fee0232601cc91ac7e7cd56ec8d4ab7353846e493d8764778
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3c202c787d4eef5e65ab55ba52edc7113255175d2615a674e59f19ff26bc6fe
ef7db794b4a6b5c42d2535919d91fb11da1e5cd1147f35196db382197b35fdee
f2b557317fb851b3ed73c2d8203192e9ed433bd006ca5025ccb3317ef15e1b8d
fd29b3b084cf11160bfc4e99d98a261f2b36bff29113b07367c5204563c5d355