urlscan.io logo urlscan.io
SecurityTrails logo

lean-knotty-atlasaurus.glitch.me Open in urlscan Pro
34.239.210.153  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://lean-knotty-atlasaurus.glitch.me/u.html?l=dhl-dtracking_=_jehfuq_vjoxk0qwhtogydw=_jehfuq_vjoxk0qwhtogydw=_jehfuq_vjoxk0qwhto=
Submission: On September 08 via api from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 7 HTTP transactions. The main IP is 34.239.210.153, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is lean-knotty-atlasaurus.glitch.me.
TLS certificate: Issued by Amazon RSA 2048 M01 on February 22nd 2023. Valid for: a year.
This is the only time lean-knotty-atlasaurus.glitch.me was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: DocuSign (Online)

Domain & IP information

IP Address AS Autonomous System
6 34.239.210.153 14618 (AMAZON-AES)
2 3 64.207.217.77 62856 (DOCUS-6-PROD)
7 3
Apex Domain
Subdomains		 Transfer
6 glitch.me
lean-knotty-atlasaurus.glitch.me
231 KB
3 docusign.com
account.docusign.com — Cisco Umbrella Rank: 11606
2 KB
7 2
Domain Requested by
6 lean-knotty-atlasaurus.glitch.me lean-knotty-atlasaurus.glitch.me
3 account.docusign.com 2 redirects lean-knotty-atlasaurus.glitch.me
7 2

This site contains no links.

Subject Issuer Validity Valid
glitch.com
Amazon RSA 2048 M01		 2023-02-22 -
2024-02-01		 a year crt.sh

This page contains 1 frames:

Primary Page: https://lean-knotty-atlasaurus.glitch.me/u.html?l=dhl-dtracking_=_jehfuq_vjoxk0qwhtogydw=_jehfuq_vjoxk0qwhtogydw=_jehfuq_vjoxk0qwhto=
Frame ID: A0F38206E40B8E41BA132348D39729A8
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

D0cuSign L0gin

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

7
Requests

86 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

231 kB
Transfer

234 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 5
  • https://account.docusign.com/LoginAppNext/images/social/social_auth_providers.png HTTP 302
  • https://account.docusign.com/error/404?aspxerrorpath=/LoginAppNext/images/social/social_auth_providers.png HTTP 302
  • https://account.docusign.com/

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request u.html
lean-knotty-atlasaurus.glitch.me/ 		11 KB
12 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://lean-knotty-atlasaurus.glitch.me/u.html?l=dhl-dtracking_=_jehfuq_vjoxk0qwhtogydw=_jehfuq_vjoxk0qwhtogydw=_jehfuq_vjoxk0qwhto=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.239.210.153 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-239-210-153.compute-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
223fd588d3e39b9ce51e81402da16d3778b3cb52261c72d51ff6c8c0e7222a04

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

accept-ranges
bytes
cache-control
no-cache
content-length
11590
content-type
text/html; charset=utf-8
date
Fri, 08 Sep 2023 01:18:23 GMT
etag
"a28225dd8a90e30c787ff7ac742def38"
last-modified
Thu, 31 Aug 2023 14:59:35 GMT
server
AmazonS3
x-amz-id-2
0m+9cHy/1rptoaPExOyw1Lj/jTgO0cafq4dmKADF4XuHvLddc0Tt5cgqKnHCHnpLSSLvJ8Ju17w=
x-amz-request-id
QGRNNE6T3C8QV5AM
x-amz-server-side-encryption
AES256
x-amz-version-id
9fcDjcyxfceEI8opgCQ.AwSRyXk9cNpw
facebox.css
lean-knotty-atlasaurus.glitch.me/ 		1 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://lean-knotty-atlasaurus.glitch.me/facebox.css
Requested by
Host: lean-knotty-atlasaurus.glitch.me
URL: https://lean-knotty-atlasaurus.glitch.me/u.html?l=dhl-dtracking_=_jehfuq_vjoxk0qwhtogydw=_jehfuq_vjoxk0qwhtogydw=_jehfuq_vjoxk0qwhto=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.239.210.153 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-239-210-153.compute-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
d995d7bf8a4581d8c99751290769a4e24d2f80d4ceffac75b7877d974c927066

Request headers

accept-language
en-US,en;q=0.9
Referer
https://lean-knotty-atlasaurus.glitch.me/u.html?l=dhl-dtracking_=_jehfuq_vjoxk0qwhtogydw=_jehfuq_vjoxk0qwhtogydw=_jehfuq_vjoxk0qwhto=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date
Fri, 08 Sep 2023 01:18:23 GMT
x-amz-version-id
0kU9tR.UE9pMJp9khFIyejoJH1S8TbXv
last-modified
Thu, 31 Aug 2023 14:59:35 GMT
server
AmazonS3
x-amz-request-id
QGRTT5NWXNJF9MK9
etag
"bad8ba1b93e4311d87f2bfbfaab656c4"
x-amz-server-side-encryption
AES256
content-type
text/css; charset=utf-8
cache-control
no-cache
accept-ranges
bytes
content-length
1154
x-amz-id-2
390jUD7C/j5J/EvKon1DSo579ZA0rBbJq37drjdhSh9AX1q/Ljs8hlHZQ79XQcdnyfMe3ShRg4w=
jquery-1.6.2.min.js
lean-knotty-atlasaurus.glitch.me/ 		89 KB
90 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://lean-knotty-atlasaurus.glitch.me/jquery-1.6.2.min.js
Requested by
Host: lean-knotty-atlasaurus.glitch.me
URL: https://lean-knotty-atlasaurus.glitch.me/u.html?l=dhl-dtracking_=_jehfuq_vjoxk0qwhtogydw=_jehfuq_vjoxk0qwhtogydw=_jehfuq_vjoxk0qwhto=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.239.210.153 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-239-210-153.compute-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
d16d07a0353405fcec95f7efc50a2621bc7425f9a5e8895078396fb0dc460c4f

Request headers

accept-language
en-US,en;q=0.9
Referer
https://lean-knotty-atlasaurus.glitch.me/u.html?l=dhl-dtracking_=_jehfuq_vjoxk0qwhtogydw=_jehfuq_vjoxk0qwhtogydw=_jehfuq_vjoxk0qwhto=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date
Fri, 08 Sep 2023 01:18:23 GMT
x-amz-version-id
DmsFyOozk.CsnLnRcbESDhcAzEHVLSLO
last-modified
Thu, 31 Aug 2023 14:59:35 GMT
server
AmazonS3
x-amz-request-id
QGRJE6GMQXX55YY1
etag
"a1a8cb16a060f6280a767187fd22e037"
x-amz-server-side-encryption
AES256
content-type
application/javascript; charset=utf-8
cache-control
no-cache
accept-ranges
bytes
content-length
91556
x-amz-id-2
MwiHxt2frq58bPLeNY+bKoR78blGj30+Z93U9tRpeuakOeF+2jzJgPdx3HpAHpqcJ3IilEijNnM=
facebox.js
lean-knotty-atlasaurus.glitch.me/ 		9 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://lean-knotty-atlasaurus.glitch.me/facebox.js
Requested by
Host: lean-knotty-atlasaurus.glitch.me
URL: https://lean-knotty-atlasaurus.glitch.me/u.html?l=dhl-dtracking_=_jehfuq_vjoxk0qwhtogydw=_jehfuq_vjoxk0qwhtogydw=_jehfuq_vjoxk0qwhto=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.239.210.153 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-239-210-153.compute-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
983747e7938326bd872ecf4734d559a8d811dbd4488fd46c05fe6f99e9b0a867

Request headers

accept-language
en-US,en;q=0.9
Referer
https://lean-knotty-atlasaurus.glitch.me/u.html?l=dhl-dtracking_=_jehfuq_vjoxk0qwhtogydw=_jehfuq_vjoxk0qwhtogydw=_jehfuq_vjoxk0qwhto=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date
Fri, 08 Sep 2023 01:18:23 GMT
x-amz-version-id
xsvbwc7L6BxKXkP7B.RyBc5Yf.yFxYYR
last-modified
Thu, 31 Aug 2023 14:59:35 GMT
server
AmazonS3
x-amz-request-id
QGRTXTAEYKBRCFJM
etag
"ff71550da45ca702920b4aefc06269a0"
x-amz-server-side-encryption
AES256
content-type
application/javascript; charset=utf-8
cache-control
no-cache
accept-ranges
bytes
content-length
9223
x-amz-id-2
1hV7BfUXCrGJVbigY3A55xvOVXrNEwPqotw5ubkTdUEco8ltkuG95aa9V3J+cuT5FhndX3DuRcs=
jquery.watermark.js
lean-knotty-atlasaurus.glitch.me/ 		18 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://lean-knotty-atlasaurus.glitch.me/jquery.watermark.js
Requested by
Host: lean-knotty-atlasaurus.glitch.me
URL: https://lean-knotty-atlasaurus.glitch.me/u.html?l=dhl-dtracking_=_jehfuq_vjoxk0qwhtogydw=_jehfuq_vjoxk0qwhtogydw=_jehfuq_vjoxk0qwhto=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.239.210.153 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-239-210-153.compute-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
d76d8ccf3c229b319c08e3b8f44a9b3cbc00d72b25a5cdbe40609ef4856a8c98

Request headers

accept-language
en-US,en;q=0.9
Referer
https://lean-knotty-atlasaurus.glitch.me/u.html?l=dhl-dtracking_=_jehfuq_vjoxk0qwhtogydw=_jehfuq_vjoxk0qwhtogydw=_jehfuq_vjoxk0qwhto=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date
Fri, 08 Sep 2023 01:18:23 GMT
x-amz-version-id
SQ8ALWZGZw694z9Odn4f1JjsAQkoY7GS
last-modified
Thu, 31 Aug 2023 14:59:35 GMT
server
AmazonS3
x-amz-request-id
QGRGH89Z6K8SKAN4
etag
"f1643f5fbf5f6697de4b409f5a4a3497"
x-amz-server-side-encryption
AES256
content-type
application/javascript; charset=utf-8
cache-control
no-cache
accept-ranges
bytes
content-length
18666
x-amz-id-2
p1CzwnjXeZSYCbwsPK4Sw3vEkgkw/hCdpNNhds6Ky4vrrklNbVVLIzACPrMoJMnnQyAxZfDIk50=
javascript1.js
lean-knotty-atlasaurus.glitch.me/ 		100 KB
100 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://lean-knotty-atlasaurus.glitch.me/javascript1.js
Requested by
Host: lean-knotty-atlasaurus.glitch.me
URL: https://lean-knotty-atlasaurus.glitch.me/u.html?l=dhl-dtracking_=_jehfuq_vjoxk0qwhtogydw=_jehfuq_vjoxk0qwhtogydw=_jehfuq_vjoxk0qwhto=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.239.210.153 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-239-210-153.compute-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
51363da3612001a15e17529ea098d1f49c662a67ec356d7c02a8814ec1f8503b

Request headers

accept-language
en-US,en;q=0.9
Referer
https://lean-knotty-atlasaurus.glitch.me/u.html?l=dhl-dtracking_=_jehfuq_vjoxk0qwhtogydw=_jehfuq_vjoxk0qwhtogydw=_jehfuq_vjoxk0qwhto=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

date
Fri, 08 Sep 2023 01:18:23 GMT
x-amz-version-id
yDvdYwtkrliHiuh7Z_qZxhzU6yJRntFm
last-modified
Thu, 31 Aug 2023 14:59:35 GMT
server
AmazonS3
x-amz-request-id
QGRWQKJJ6N1873T7
etag
"61976e288a66ef6b6fcdb307595c42e3"
x-amz-server-side-encryption
AES256
content-type
application/javascript; charset=utf-8
cache-control
no-cache
accept-ranges
bytes
content-length
102028
x-amz-id-2
V2RinR9ZvQdGCcM77ULAxrxF5nxLY+UBKDS9sWnLVtiMvX0NaGn8HzpOLORl+U+z1CdfGaitnsk=
/
account.docusign.com/
Redirect Chain
  • https://account.docusign.com/LoginAppNext/images/social/social_auth_providers.png
  • https://account.docusign.com/error/404?aspxerrorpath=/LoginAppNext/images/social/social_auth_providers.png
  • https://account.docusign.com/
0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://account.docusign.com/
Requested by
Host: lean-knotty-atlasaurus.glitch.me
URL: https://lean-knotty-atlasaurus.glitch.me/u.html?l=dhl-dtracking_=_jehfuq_vjoxk0qwhtogydw=_jehfuq_vjoxk0qwhtogydw=_jehfuq_vjoxk0qwhto=
Protocol
HTTP/1.1
Server
64.207.217.77 , United States, ASN62856 (DOCUS-6-PROD, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-US,en;q=0.9
Referer
https://lean-knotty-atlasaurus.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Redirect headers

Content-Security-Policy
default-src 'self' https:;script-src 'nonce-0vfByT56oqrWaxq94cg9CYScPnZxfpj9+JmC7SrMxwE=' 'unsafe-inline' 'self';style-src 'unsafe-inline' 'self';img-src data: https://docucdn-a.akamaihd.net 'self' https://*.docusign.com https://*.docusign.net https://www.docusign.com.au https://www.docusign.co.uk https://www.docusign.ca;font-src 'self' https://* data:;connect-src 'self' data: https://api-js.mixpanel.com https://docucdn-a.akamaihd.net https://telemetry.dev.docusign.net https://telemetry-s.docusign.net https://telemetry-d.docusign.net https://telemetry.docusign.net https://www.docusign.com https://account.docusign.com;object-src 'none';media-src 'none';frame-src 'self' https://docusign.sjv.io; report-uri /client-errors/csp/enforce
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Date
Fri, 08 Sep 2023 01:18:23 GMT
Content-Security-Policy-Report-Only
default-src 'self' ;script-src 'nonce-0vfByT56oqrWaxq94cg9CYScPnZxfpj9+JmC7SrMxwE=' 'self';style-src 'unsafe-inline' 'self';img-src data: https://docucdn-a.akamaihd.net https://www.docusign.com https://docusign.com https://www.docusign.com.au https://www.docusign.co.uk https://www.docusign.ca 'self';font-src https://docucdn-a.akamaihd.net 'self' data:;connect-src 'self' data: https://api-js.mixpanel.com https://docucdn-a.akamaihd.net https://telemetry.docusign.net;object-src 'none';media-src 'none';frame-src 'self' https://docusign.sjv.io https://app.docusign.com https://docucdn-a.akamaihd.net; report-uri /client-errors/csp/report
Content-Length
146
X-XSS-Protection
1; mode=block; report=/client-errors/xss
Pragma
no-cache
Referrer-Policy
no-referrer,strict-origin-when-cross-origin
X-DocuSign-TraceToken
cc7bb1d9-22f7-4893-b0c6-28e4eed8bcc8
X-DocuSign-Node
CH101FE63
X-Frame-Options
SAMEORIGIN
Vary
Accept-Encoding
Content-Type
text/html; charset=utf-8
Location
https://account.docusign.com/
Cache-Control
no-cache, no-store, must-revalidate
Expires
-1
truncated
/ 		5 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ee3cec3c33913424b8a94f2ba811277a4aaf0a8476d61653769c5d953ddeecbd

Request headers

accept-language
en-US,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.179 Safari/537.36

Response headers

Content-Type
image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: DocuSign (Online)

9 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture function| $ function| jQuery object| jQuery16209313620315313107 function| script function| click_to_download function| make_the_delay function| redirect_the function| now_download

0 Cookies