longhaired-lackadaisical-run.glitch.me Open in urlscan Pro
184.72.157.74 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://longhaired-lackadaisical-run.glitch.me/step2.html
Submission: On September 18 via automatic, source openphish (September 18th 2024, 2:24:55 pm UTC) — Scanned from DE

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 9 HTTP transactions. The main IP is 184.72.157.74, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is longhaired-lackadaisical-run.glitch.me.
TLS certificate: Issued by Amazon RSA 2048 M03 on December 4th 2023. Valid for: a year.

This is the only time longhaired-lackadaisical-run.glitch.me was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Charles Schwab (Financial)

Domain & IP information

	IP Address	AS Autonomous System
1	184.72.157.74 184.72.157.74	14618 (AMAZON-AES) (AMAZON-AES)
8	51.222.41.85 51.222.41.85	16276 (OVH) (OVH)
9	2

1 184.72.157.74 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-184-72-157-74.compute-1.amazonaws.com

longhaired-lackadaisical-run.glitch.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 51.222.41.85 (Beauharnois, Canada)

ASN16276 (OVH, FR)
PTR: twentyseven.geonta.com

13610mangononsdfgsgedfzmalcolm.sarjeicontractorslimited.co.ke	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	sarjeicontractorslimited.co.ke 13610mangononsdfgsgedfzmalcolm.sarjeicontractorslimited.co.ke	50 KB
1	glitch.me longhaired-lackadaisical-run.glitch.me	4 KB
9	2

	Domain	Requested by
8	13610mangononsdfgsgedfzmalcolm.sarjeicontractorslimited.co.ke	longhaired-lackadaisical-run.glitch.me
1	longhaired-lackadaisical-run.glitch.me
9	2

This site contains no links.

Subject Issuer	Validity	Valid
glitch.com Amazon RSA 2048 M03	`2023-12-04` - `2025-01-01`	a year	crt.sh
www.mangcolm.sarjeicontractorslimited.co.ke R11	`2024-08-26` - `2024-11-24`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://longhaired-lackadaisical-run.glitch.me/step2.html
Frame ID: 9F4A75045D47E40340291880DA3B99B8
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Verify Your Identity

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

54 kB
Transfer

52 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request step2.html Show response longhaired-lackadaisical-run.glitch.me/	4 KB 4 KB	403ms 164ms	Document text/html	184.72.157.74 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://longhaired-lackadaisical-run.glitch.me/step2.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 184.72.157.74 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-184-72-157-74.compute-1.amazonaws.com Software AmazonS3 / Resource Hash `f234eaaf59391212b5603749e9a22ae7b0f542e2483f4daf97a1252019ffcabc` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers accept-ranges bytes cache-control no-cache content-length 4023 content-type text/html; charset=utf-8 date Wed, 18 Sep 2024 14:24:50 GMT etag "95833753557ae9bb87b9dad3e09b6dcf" last-modified Tue, 17 Sep 2024 12:40:53 GMT server AmazonS3 x-amz-id-2 DYaluWwnHzrCnKQHjSucJcBuXwWavglR9kJp2PNc4t5j9JkvGWZ1RlddXALi3CFIcvBmitI2P8fXkwdclcJ7NNe5yDrZfTAERNO8Nx2NlzU= x-amz-request-id FQ57R2150Y0CENED x-amz-server-side-encryption AES256 x-amz-version-id HgUiy2pu34076M7OgwNvDq5IbAtLl5v9
GET H/1.1	200 OK	f8.png 13610mangononsdfgsgedfzmalcolm.sarjeicontractorslimited.co.ke/.well-known/acme-challenge/-/schwab_policy/home/images/	5 KB 5 KB	730ms 109ms	Image image/png	51.222.41.85 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://13610mangononsdfgsgedfzmalcolm.sarjeicontractorslimited.co.ke/.well-known/acme-challenge/-/schwab_policy/home/images/f8.png Requested by Host: longhaired-lackadaisical-run.glitch.me URL: https://longhaired-lackadaisical-run.glitch.me/step2.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 51.222.41.85 Beauharnois, Canada, ASN16276 (OVH, FR), Reverse DNS twentyseven.geonta.com Software Apache / Resource Hash `7ed5c41dff95486fd8b967ab09ab6b184f3c0af62e9189157a32e4b5f707729f` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://longhaired-lackadaisical-run.glitch.me/ Response headers Connection Keep-Alive Accept-Ranges bytes Content-Length 4881 Keep-Alive timeout=5, max=99 Date Wed, 18 Sep 2024 14:24:51 GMT Last-Modified Tue, 09 Nov 2021 13:13:32 GMT Content-Type image/png Server Apache
GET H/1.1	200 OK	f1.png 13610mangononsdfgsgedfzmalcolm.sarjeicontractorslimited.co.ke/.well-known/acme-challenge/-/schwab_policy/home/images/	4 KB 4 KB	617ms 117ms	Image image/png	51.222.41.85 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://13610mangononsdfgsgedfzmalcolm.sarjeicontractorslimited.co.ke/.well-known/acme-challenge/-/schwab_policy/home/images/f1.png Requested by Host: longhaired-lackadaisical-run.glitch.me URL: https://longhaired-lackadaisical-run.glitch.me/step2.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 51.222.41.85 Beauharnois, Canada, ASN16276 (OVH, FR), Reverse DNS twentyseven.geonta.com Software Apache / Resource Hash `bdbde31506647bc883a2f9d67e2676722f53f3bea20e221b19c25c9f6ef636dc` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://longhaired-lackadaisical-run.glitch.me/ Response headers Connection Keep-Alive Accept-Ranges bytes Content-Length 4105 Keep-Alive timeout=5, max=100 Date Wed, 18 Sep 2024 14:24:51 GMT Last-Modified Tue, 09 Nov 2021 13:13:32 GMT Content-Type image/png Server Apache
GET H/1.1	200 OK	w1.png 13610mangononsdfgsgedfzmalcolm.sarjeicontractorslimited.co.ke/.well-known/acme-challenge/-/schwab_policy/home/images/	6 KB 6 KB	589ms 116ms	Image image/png	51.222.41.85 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://13610mangononsdfgsgedfzmalcolm.sarjeicontractorslimited.co.ke/.well-known/acme-challenge/-/schwab_policy/home/images/w1.png Requested by Host: longhaired-lackadaisical-run.glitch.me URL: https://longhaired-lackadaisical-run.glitch.me/step2.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 51.222.41.85 Beauharnois, Canada, ASN16276 (OVH, FR), Reverse DNS twentyseven.geonta.com Software Apache / Resource Hash `5f5615debca103a7b17df3e42563e24937decbfffec54432d244413fdf8a578c` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://longhaired-lackadaisical-run.glitch.me/ Response headers Connection Keep-Alive Accept-Ranges bytes Content-Length 5907 Keep-Alive timeout=5, max=100 Date Wed, 18 Sep 2024 14:24:51 GMT Last-Modified Tue, 09 Nov 2021 13:13:32 GMT Content-Type image/png Server Apache
GET H/1.1	200 OK	h2.png 13610mangononsdfgsgedfzmalcolm.sarjeicontractorslimited.co.ke/.well-known/acme-challenge/-/schwab_policy/home/images/	212 B 454 B	585ms 112ms	Image image/png	51.222.41.85 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://13610mangononsdfgsgedfzmalcolm.sarjeicontractorslimited.co.ke/.well-known/acme-challenge/-/schwab_policy/home/images/h2.png Requested by Host: longhaired-lackadaisical-run.glitch.me URL: https://longhaired-lackadaisical-run.glitch.me/step2.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 51.222.41.85 Beauharnois, Canada, ASN16276 (OVH, FR), Reverse DNS twentyseven.geonta.com Software Apache / Resource Hash `ed04fd18ebae13eb850846d21c8dd94cdb6804d01e9539579e4d34913dbef0a8` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://longhaired-lackadaisical-run.glitch.me/ Response headers Connection Keep-Alive Accept-Ranges bytes Content-Length 212 Keep-Alive timeout=5, max=100 Date Wed, 18 Sep 2024 14:24:51 GMT Last-Modified Tue, 09 Nov 2021 13:13:32 GMT Content-Type image/png Server Apache
GET H/1.1	200 OK	w11.png 13610mangononsdfgsgedfzmalcolm.sarjeicontractorslimited.co.ke/.well-known/acme-challenge/-/schwab_policy/home/images/	30 KB 30 KB	586ms 113ms	Image image/png	51.222.41.85 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://13610mangononsdfgsgedfzmalcolm.sarjeicontractorslimited.co.ke/.well-known/acme-challenge/-/schwab_policy/home/images/w11.png Requested by Host: longhaired-lackadaisical-run.glitch.me URL: https://longhaired-lackadaisical-run.glitch.me/step2.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 51.222.41.85 Beauharnois, Canada, ASN16276 (OVH, FR), Reverse DNS twentyseven.geonta.com Software Apache / Resource Hash `a50e3a98a0b72a5f57fd1d4c8e85e2289f28e6b227aaa843d1596d9f8f3b30ab` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://longhaired-lackadaisical-run.glitch.me/ Response headers Connection Keep-Alive Accept-Ranges bytes Content-Length 30708 Keep-Alive timeout=5, max=100 Date Wed, 18 Sep 2024 14:24:51 GMT Last-Modified Tue, 09 Nov 2021 13:13:32 GMT Content-Type image/png Server Apache
GET H/1.1	200 OK	f3.png 13610mangononsdfgsgedfzmalcolm.sarjeicontractorslimited.co.ke/.well-known/acme-challenge/-/schwab_policy/home/images/	763 B 1005 B	592ms 119ms	Image image/png	51.222.41.85 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://13610mangononsdfgsgedfzmalcolm.sarjeicontractorslimited.co.ke/.well-known/acme-challenge/-/schwab_policy/home/images/f3.png Requested by Host: longhaired-lackadaisical-run.glitch.me URL: https://longhaired-lackadaisical-run.glitch.me/step2.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 51.222.41.85 Beauharnois, Canada, ASN16276 (OVH, FR), Reverse DNS twentyseven.geonta.com Software Apache / Resource Hash `0d104052f8c9b280050e1033e6a9b2b75894b033a24ba6170e0d0cfede5b43c6` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://longhaired-lackadaisical-run.glitch.me/ Response headers Connection Keep-Alive Accept-Ranges bytes Content-Length 763 Keep-Alive timeout=5, max=100 Date Wed, 18 Sep 2024 14:24:51 GMT Last-Modified Tue, 09 Nov 2021 13:13:32 GMT Content-Type image/png Server Apache
GET H/1.1	200 OK	btn1.png 13610mangononsdfgsgedfzmalcolm.sarjeicontractorslimited.co.ke/.well-known/acme-challenge/-/schwab_policy/home/images/	888 B 1 KB	558ms 115ms	Image image/png	51.222.41.85 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://13610mangononsdfgsgedfzmalcolm.sarjeicontractorslimited.co.ke/.well-known/acme-challenge/-/schwab_policy/home/images/btn1.png Requested by Host: longhaired-lackadaisical-run.glitch.me URL: https://longhaired-lackadaisical-run.glitch.me/step2.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 51.222.41.85 Beauharnois, Canada, ASN16276 (OVH, FR), Reverse DNS twentyseven.geonta.com Software Apache / Resource Hash `b47c37c7068a9045266f59c14b4b979a1f269d3cf2a790046596eb9a02f3d119` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://longhaired-lackadaisical-run.glitch.me/ Response headers Connection Keep-Alive Accept-Ranges bytes Content-Length 888 Keep-Alive timeout=5, max=100 Date Wed, 18 Sep 2024 14:24:51 GMT Last-Modified Tue, 09 Nov 2021 13:13:32 GMT Content-Type image/png Server Apache
GET H/1.1	200 OK	favicon.ico 13610mangononsdfgsgedfzmalcolm.sarjeicontractorslimited.co.ke/.well-known/acme-challenge/-/schwab_policy/home/images/	1 KB 2 KB	125ms 125ms	Other image/x-icon	51.222.41.85 OVH
General Check archive.org Show headers Download Go to Full URL https://13610mangononsdfgsgedfzmalcolm.sarjeicontractorslimited.co.ke/.well-known/acme-challenge/-/schwab_policy/home/images/favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 51.222.41.85 Beauharnois, Canada, ASN16276 (OVH, FR), Reverse DNS twentyseven.geonta.com Software Apache / Resource Hash `11c9dd52aa0864cd40fa2ab09029613f615aa3f486eb7deb5057db755edd0c20` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://longhaired-lackadaisical-run.glitch.me/ Response headers Connection Keep-Alive Accept-Ranges bytes Content-Length 1406 Keep-Alive timeout=5, max=98 Date Wed, 18 Sep 2024 14:24:51 GMT Last-Modified Tue, 09 Nov 2021 13:13:32 GMT Content-Type image/x-icon Server Apache

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Charles Schwab (Financial)

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

13610mangononsdfgsgedfzmalcolm.sarjeicontractorslimited.co.ke
longhaired-lackadaisical-run.glitch.me
184.72.157.74
51.222.41.85
0d104052f8c9b280050e1033e6a9b2b75894b033a24ba6170e0d0cfede5b43c6
11c9dd52aa0864cd40fa2ab09029613f615aa3f486eb7deb5057db755edd0c20
5f5615debca103a7b17df3e42563e24937decbfffec54432d244413fdf8a578c
7ed5c41dff95486fd8b967ab09ab6b184f3c0af62e9189157a32e4b5f707729f
a50e3a98a0b72a5f57fd1d4c8e85e2289f28e6b227aaa843d1596d9f8f3b30ab
b47c37c7068a9045266f59c14b4b979a1f269d3cf2a790046596eb9a02f3d119
bdbde31506647bc883a2f9d67e2676722f53f3bea20e221b19c25c9f6ef636dc
ed04fd18ebae13eb850846d21c8dd94cdb6804d01e9539579e4d34913dbef0a8
f234eaaf59391212b5603749e9a22ae7b0f542e2483f4daf97a1252019ffcabc

longhaired-lackadaisical-run.glitch.me Open in urlscan Pro 184.72.157.74 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

9 Requests

100 %HTTPS

0 %IPv6

2 Domains

2 Subdomains

2 IPs

2 Countries

54 kBTransfer

52 kBSize

0 Cookies

0 Outgoing links

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

0 JavaScript Global Variables

0 Cookies

Indicators

longhaired-lackadaisical-run.glitch.me Open in urlscan Pro
184.72.157.74 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

2
Countries

54 kB
Transfer

52 kB
Size

0
Cookies

9 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!