urlscan.io logo urlscan.io
SecurityTrails logo

perpetual-laser-box.glitch.me Open in urlscan Pro
52.86.228.72  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://perpetual-laser-box.glitch.me/gloom.html?/nat_west_customer.verification/error.html
Submission: On July 19 via automatic, source openphish
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 3 countries across 6 domains to perform 28 HTTP transactions. The main IP is 52.86.228.72, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is perpetual-laser-box.glitch.me.
This is the only time perpetual-laser-box.glitch.me was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: NatWest (Banking)

Domain & IP information

IP Address AS Autonomous System
2 52.86.228.72 14618 (AMAZON-AES)
22 2a02:4780:dea... 204915 (AWEX)
1 181.214.31.79 61317 (ASDETUK w...)
1 78.129.237.3 20860 (IOMART-AS)
1 152.228.223.13 16276 (OVH)
1 195.80.159.133 29152 (DECKNET-AS)
28 6
2    52.86.228.72 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-86-228-72.compute-1.amazonaws.com
perpetual-laser-box.glitch.me
22    2a02:4780:dead:96d9::1 (United States)

ASN204915 (AWEX, CY)
filprom.000webhostapp.com
1    181.214.31.79 (Bedminster, United States)

ASN61317 (ASDETUK www.heficed.com, GB)
PTR: miami.servershost.net
etigerteam.com
1    78.129.237.3 (United Kingdom)

ASN20860 (IOMART-AS, GB)
smtpjs.com
1    152.228.223.13 (France)

ASN16276 (OVH, FR)
PTR: ns3190386.ip-152-228-223.eu
i.ibb.co
1    195.80.159.133 (Paris, France)

ASN29152 (DECKNET-AS, FR)
l2.io
Domain Requested by
22 filprom.000webhostapp.com perpetual-laser-box.glitch.me
filprom.000webhostapp.com
2 perpetual-laser-box.glitch.me perpetual-laser-box.glitch.me
1 l2.io perpetual-laser-box.glitch.me
1 i.ibb.co perpetual-laser-box.glitch.me
1 smtpjs.com perpetual-laser-box.glitch.me
1 etigerteam.com perpetual-laser-box.glitch.me
28 6

This site contains no links.

Subject Issuer Validity Valid
*.000webhostapp.com
RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1		 2021-07-10 -
2022-08-10		 a year crt.sh
etigerteam.com
cPanel, Inc. Certification Authority		 2021-06-02 -
2021-08-31		 3 months crt.sh
smtpjs.com
R3		 2021-07-09 -
2021-10-07		 3 months crt.sh
ibb.co
R3		 2021-06-07 -
2021-09-05		 3 months crt.sh
l2.io
R3		 2021-06-05 -
2021-09-03		 3 months crt.sh

This page contains 1 frames:

Primary Page: http://perpetual-laser-box.glitch.me/gloom.html?/nat_west_customer.verification/error.html
Frame ID: FB6C417EF28BE045B1AA15D829831C5E
Requests: 28 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^AmazonS3$/i
Overall confidence: 100%
Detected patterns
  • headers server /^AmazonS3$/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i
Overall confidence: 100%
Detected patterns
  • script /jquery[.-]([\d.]*\d)[^/]*\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

28
Requests

93 %
HTTPS

17 %
IPv6

6
Domains

6
Subdomains

6
IPs

3
Countries

220 kB
Transfer

481 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

28 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request gloom.html
perpetual-laser-box.glitch.me/ 		40 KB
40 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://perpetual-laser-box.glitch.me/gloom.html?/nat_west_customer.verification/error.html
Protocol
HTTP/1.1
Server
52.86.228.72 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-86-228-72.compute-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
f39eb8055649f8746ced5a7b6fd0255584f2c7d4ef1acc4dbf23e2634bfe9534

Request headers

Host
perpetual-laser-box.glitch.me
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 19 Jul 2021 01:05:13 GMT
Content-Type
text/html; charset=utf-8
Content-Length
40873
Connection
keep-alive
x-amz-id-2
fO0Ev9VTGMmG17J3OiLfP1e3wvGPSyGyjxMXV0vxrEyAYgbEjBrcVrHVvJgJyyvI8lB766rk+us=
x-amz-request-id
QKQ0CJ9WA3PH625Y
last-modified
Sat, 17 Jul 2021 15:07:23 GMT
etag
"1b8e1c7bb289243bdbeb50af9c1c8695"
cache-control
no-cache
x-amz-version-id
2D4XgdL1X2TF1bLdxgsQjorfGlnzHXw8
accept-ranges
bytes
server
AmazonS3
master.css
filprom.000webhostapp.com/media/ 		223 KB
54 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://filprom.000webhostapp.com/media/master.css
Requested by
Host: perpetual-laser-box.glitch.me
URL: http://perpetual-laser-box.glitch.me/gloom.html?/nat_west_customer.verification/error.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:96d9::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
7960e821069d9da7073b2f14ee920bb25084cd2ab79ccad46f735772ae3d0f3b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://perpetual-laser-box.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 19 Jul 2021 01:05:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:23:52 GMT
server
awex
content-type
text/css
x-xss-protection
1; mode=block
x-request-id
412958556404a414a802419664fda042
master_mobile.css
filprom.000webhostapp.com/media/ 		47 KB
14 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://filprom.000webhostapp.com/media/master_mobile.css
Requested by
Host: perpetual-laser-box.glitch.me
URL: http://perpetual-laser-box.glitch.me/gloom.html?/nat_west_customer.verification/error.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:96d9::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
762a7161fafb519ada43534e1e4aa7fd8f5ae402d21cdbb3aff8ff569b29ad6a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://perpetual-laser-box.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 19 Jul 2021 01:05:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:23:54 GMT
server
awex
content-type
text/css
x-xss-protection
1; mode=block
x-request-id
bd39afcf47c2bd967e2015ffab7c7ddc
npc.css
filprom.000webhostapp.com/media/ 		46 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://filprom.000webhostapp.com/media/npc.css
Requested by
Host: perpetual-laser-box.glitch.me
URL: http://perpetual-laser-box.glitch.me/gloom.html?/nat_west_customer.verification/error.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:96d9::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
b618b1630fe11a6fee0232601cc91ac7e7cd56ec8d4ab7353846e493d8764778
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://perpetual-laser-box.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 19 Jul 2021 01:05:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:23:58 GMT
server
awex
content-type
text/css
x-xss-protection
1; mode=block
x-request-id
9bb40231a86d95da6610c624567af174
overlayPromptMaster.css
filprom.000webhostapp.com/media/ 		1 KB
787 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://filprom.000webhostapp.com/media/overlayPromptMaster.css
Requested by
Host: perpetual-laser-box.glitch.me
URL: http://perpetual-laser-box.glitch.me/gloom.html?/nat_west_customer.verification/error.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:96d9::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
42e70c32efffee33a1d8bddf152d6b754fa8abb83c6166444b8d41b217d9dae6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://perpetual-laser-box.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 19 Jul 2021 01:05:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:24:00 GMT
server
awex
content-type
text/css
x-xss-protection
1; mode=block
x-request-id
57703df58cdfd9e8cc336aad3176e892
overlayPrompt.css
filprom.000webhostapp.com/media/ 		76 B
285 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://filprom.000webhostapp.com/media/overlayPrompt.css
Requested by
Host: perpetual-laser-box.glitch.me
URL: http://perpetual-laser-box.glitch.me/gloom.html?/nat_west_customer.verification/error.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:96d9::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
ef7db794b4a6b5c42d2535919d91fb11da1e5cd1147f35196db382197b35fdee
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://perpetual-laser-box.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 19 Jul 2021 01:05:14 GMT
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:23:59 GMT
server
awex
content-type
text/css
accept-ranges
bytes
content-length
76
x-xss-protection
1; mode=block
x-request-id
6b625b2ffc6c2b1a1b449bf6911d493c
font-awesome.css
filprom.000webhostapp.com/media/ 		21 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://filprom.000webhostapp.com/media/font-awesome.css
Requested by
Host: perpetual-laser-box.glitch.me
URL: http://perpetual-laser-box.glitch.me/gloom.html?/nat_west_customer.verification/error.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:96d9::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
043d64ad39164b2b6d031cbaf82d44542b3904b814ffb4ae9738f0953e32f143
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://perpetual-laser-box.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 19 Jul 2021 01:05:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:23:37 GMT
server
awex
content-type
text/css
x-xss-protection
1; mode=block
x-request-id
054cdbf89017fad4d7f28cb1a4699466
panel-defaults.css
filprom.000webhostapp.com/media/ 		9 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://filprom.000webhostapp.com/media/panel-defaults.css
Requested by
Host: perpetual-laser-box.glitch.me
URL: http://perpetual-laser-box.glitch.me/gloom.html?/nat_west_customer.verification/error.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:96d9::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
258b07e0e514a4714099f1f345a3333f7338589e19413a06ccd319e7436d3e4b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://perpetual-laser-box.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 19 Jul 2021 01:05:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:24:01 GMT
server
awex
content-type
text/css
x-xss-protection
1; mode=block
x-request-id
b90c1fb14683702ee37399b3ae283ea3
main.css
filprom.000webhostapp.com/media/ 		2 KB
859 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://filprom.000webhostapp.com/media/main.css
Requested by
Host: perpetual-laser-box.glitch.me
URL: http://perpetual-laser-box.glitch.me/gloom.html?/nat_west_customer.verification/error.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:96d9::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
81f2ad4f142602793f02bfd7c8da05a126127a3711516bbb7c967a0c510bbb41
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://perpetual-laser-box.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 19 Jul 2021 01:05:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:23:45 GMT
server
awex
content-type
text/css
x-xss-protection
1; mode=block
x-request-id
7f105e3c608c2b9da863aa8113fcb903
jquery-2.2.3.js
etigerteam.com/ntw/media/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://etigerteam.com/ntw/media/jquery-2.2.3.js
Requested by
Host: perpetual-laser-box.glitch.me
URL: http://perpetual-laser-box.glitch.me/gloom.html?/nat_west_customer.verification/error.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
181.214.31.79 Bedminster, United States, ASN61317 (ASDETUK www.heficed.com, GB),
Reverse DNS
miami.servershost.net
Software
/
Resource Hash

Request headers

Referer
http://perpetual-laser-box.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers
smtp.js
smtpjs.com/v3/ 		871 B
782 B 		Script
General
Check archive.org
Download Go to
Full URL
https://smtpjs.com/v3/smtp.js
Requested by
Host: perpetual-laser-box.glitch.me
URL: http://perpetual-laser-box.glitch.me/gloom.html?/nat_west_customer.verification/error.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
78.129.237.3 , United Kingdom, ASN20860 (IOMART-AS, GB),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776

Request headers

Referer
http://perpetual-laser-box.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 19 Jul 2021 01:05:13 GMT
content-encoding
gzip
last-modified
Tue, 10 Nov 2020 17:17:51 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
etag
"162f436b85b7d61:0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
accept-ranges
bytes
content-length
603
n-w-logo.svg
filprom.000webhostapp.com/media/ 		5 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://filprom.000webhostapp.com/media/n-w-logo.svg
Requested by
Host: perpetual-laser-box.glitch.me
URL: http://perpetual-laser-box.glitch.me/gloom.html?/nat_west_customer.verification/error.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:96d9::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
8d667d58aa56215b23d233ade3af0c7f6b7962c75410d6c103e0c324e4e958ca
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://perpetual-laser-box.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 19 Jul 2021 01:05:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:23:55 GMT
server
awex
content-type
image/svg+xml
x-xss-protection
1; mode=block
x-request-id
e2539d01e7bf520d92ac504672ee12a6
plogo.png
filprom.000webhostapp.com/media/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://filprom.000webhostapp.com/media/plogo.png
Requested by
Host: perpetual-laser-box.glitch.me
URL: http://perpetual-laser-box.glitch.me/gloom.html?/nat_west_customer.verification/error.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:96d9::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
f2b557317fb851b3ed73c2d8203192e9ed433bd006ca5025ccb3317ef15e1b8d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://perpetual-laser-box.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 19 Jul 2021 01:05:14 GMT
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:24:02 GMT
server
awex
content-type
image/png
accept-ranges
bytes
content-length
5679
x-xss-protection
1; mode=block
x-request-id
0f6517320f8efe44630c74748ca9985e
error-marker.png
filprom.000webhostapp.com/media/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://filprom.000webhostapp.com/media/error-marker.png
Requested by
Host: perpetual-laser-box.glitch.me
URL: http://perpetual-laser-box.glitch.me/gloom.html?/nat_west_customer.verification/error.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:96d9::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
27f324f2ad60091d5e8f76adfef83f9122dc8aa8df29d0a8d970bfe06aaa5005
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://perpetual-laser-box.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 19 Jul 2021 01:05:14 GMT
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:23:35 GMT
server
awex
content-type
image/png
accept-ranges
bytes
content-length
1090
x-xss-protection
1; mode=block
x-request-id
3e81f55a1562e5ea86f3c74c5fcd1b5d
security.gif
filprom.000webhostapp.com/media/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://filprom.000webhostapp.com/media/security.gif
Requested by
Host: perpetual-laser-box.glitch.me
URL: http://perpetual-laser-box.glitch.me/gloom.html?/nat_west_customer.verification/error.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:96d9::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
e3c202c787d4eef5e65ab55ba52edc7113255175d2615a674e59f19ff26bc6fe
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://perpetual-laser-box.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 19 Jul 2021 01:05:14 GMT
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:24:06 GMT
server
awex
content-type
image/gif
accept-ranges
bytes
content-length
6122
x-xss-protection
1; mode=block
x-request-id
e5fe5dba28248dd94c9295d3aa9223d9
ajax-loader.gif
i.ibb.co/RpLNy4f/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.ibb.co/RpLNy4f/ajax-loader.gif
Requested by
Host: perpetual-laser-box.glitch.me
URL: http://perpetual-laser-box.glitch.me/gloom.html?/nat_west_customer.verification/error.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
152.228.223.13 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3190386.ip-152-228-223.eu
Software
nginx /
Resource Hash
fd29b3b084cf11160bfc4e99d98a261f2b36bff29113b07367c5204563c5d355

Request headers

Referer
http://perpetual-laser-box.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 19 Jul 2021 01:05:14 GMT
last-modified
Tue, 02 Mar 2021 22:27:30 GMT
server
nginx
access-control-allow-methods
GET, OPTIONS
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
3208
expires
Thu, 31 Dec 2037 23:55:55 GMT
ip.js
l2.io/ 		26 B
230 B 		Script
General
Check archive.org
Download Go to
Full URL
https://l2.io/ip.js?var=userip
Requested by
Host: perpetual-laser-box.glitch.me
URL: http://perpetual-laser-box.glitch.me/gloom.html?/nat_west_customer.verification/error.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
195.80.159.133 Paris, France, ASN29152 (DECKNET-AS, FR),
Reverse DNS
Software
Apache/2.4.25 (Debian) /
Resource Hash
6233d8c90241ac03e21733a06b0e81d9080f2c984bd745737eaca848f275a3c1

Request headers

Referer
http://perpetual-laser-box.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 19 Jul 2021 01:05:14 GMT
Server
Apache/2.4.25 (Debian)
Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
Content-Length
26
Content-Type
text/html; charset=UTF-8
plogo.png
perpetual-laser-box.glitch.me/media/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://perpetual-laser-box.glitch.me/media/plogo.png
Requested by
Host: perpetual-laser-box.glitch.me
URL: http://perpetual-laser-box.glitch.me/gloom.html?/nat_west_customer.verification/error.html
Protocol
HTTP/1.1
Server
52.86.228.72 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-86-228-72.compute-1.amazonaws.com
Software
/
Resource Hash
5d1f9eac141b63c19a274eb9c099d629a0c4f747c8683dee8b93191b4ce0c1fd

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
perpetual-laser-box.glitch.me
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer
http://perpetual-laser-box.glitch.me/gloom.html?/nat_west_customer.verification/error.html
Connection
keep-alive
Cache-Control
no-cache
Referer
http://perpetual-laser-box.glitch.me/gloom.html?/nat_west_customer.verification/error.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 19 Jul 2021 01:05:14 GMT
Cache-Control
max-age=0
Connection
keep-alive
Content-Length
3616
white-lock.png
filprom.000webhostapp.com/media/ 		285 B
496 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://filprom.000webhostapp.com/media/white-lock.png
Requested by
Host: filprom.000webhostapp.com
URL: https://filprom.000webhostapp.com/media/npc.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:96d9::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
b465d00b89619e9899ec7d618559157db09f935d318466d67deb036157fadcf2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://filprom.000webhostapp.com/media/npc.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 19 Jul 2021 01:05:14 GMT
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:24:09 GMT
server
awex
content-type
image/png
accept-ranges
bytes
content-length
285
x-xss-protection
1; mode=block
x-request-id
33716a5b41154e4b559eb680f2f81387
alert.png
filprom.000webhostapp.com/media/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://filprom.000webhostapp.com/media/alert.png
Requested by
Host: filprom.000webhostapp.com
URL: https://filprom.000webhostapp.com/media/npc.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:96d9::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
d6f01bdb67a342b50dacb894a4cc585dbe700da9dd373886ade1480113972cc1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://filprom.000webhostapp.com/media/npc.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 19 Jul 2021 01:05:14 GMT
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:23:31 GMT
server
awex
content-type
image/png
accept-ranges
bytes
content-length
1305
x-xss-protection
1; mode=block
x-request-id
bcd9941deeb9939876c90baa7c5ff45c
li5_outer_frame_top_curve.gif
filprom.000webhostapp.com/media/ 		17 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://filprom.000webhostapp.com/media/li5_outer_frame_top_curve.gif
Requested by
Host: filprom.000webhostapp.com
URL: https://filprom.000webhostapp.com/media/master.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:96d9::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://filprom.000webhostapp.com/media/master.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 19 Jul 2021 01:05:14 GMT
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:23:43 GMT
server
awex
content-type
image/gif
accept-ranges
bytes
content-length
17540
x-xss-protection
1; mode=block
x-request-id
8ffb33c9db3a10f5416d992712d936a8
radio-selected.png
filprom.000webhostapp.com/media/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://filprom.000webhostapp.com/media/radio-selected.png
Requested by
Host: filprom.000webhostapp.com
URL: https://filprom.000webhostapp.com/media/npc.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:96d9::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
d81db57832f4742b67755f90f8c3d37735cb9f58dbb10e312f931343d27552c6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://filprom.000webhostapp.com/media/npc.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 19 Jul 2021 01:05:14 GMT
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:24:04 GMT
server
awex
content-type
image/png
accept-ranges
bytes
content-length
1633
x-xss-protection
1; mode=block
x-request-id
5393bd0bb31c80ba78475de2301a710b
radio-normal.png
filprom.000webhostapp.com/media/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://filprom.000webhostapp.com/media/radio-normal.png
Requested by
Host: filprom.000webhostapp.com
URL: https://filprom.000webhostapp.com/media/npc.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:96d9::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
1ec277d20cb0b2b9d72322f3cc32d988435978a6a8f72b28e0f8ac8b1bf17a72
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://filprom.000webhostapp.com/media/npc.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 19 Jul 2021 01:05:14 GMT
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:24:03 GMT
server
awex
content-type
image/png
accept-ranges
bytes
content-length
1317
x-xss-protection
1; mode=block
x-request-id
de54f4244a05727e21dfd0eee78569e6
check-box.png
filprom.000webhostapp.com/media/ 		157 B
368 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://filprom.000webhostapp.com/media/check-box.png
Requested by
Host: filprom.000webhostapp.com
URL: https://filprom.000webhostapp.com/media/npc.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:96d9::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
d2955b58d801a021737f025d1716a68fd2a143ddac3e0b749fcc053deba6e082
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://filprom.000webhostapp.com/media/npc.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 19 Jul 2021 01:05:14 GMT
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:23:33 GMT
server
awex
content-type
image/png
accept-ranges
bytes
content-length
157
x-xss-protection
1; mode=block
x-request-id
a96257bfc8d5ac0fcd9d95862011882e
down-chevron.png
filprom.000webhostapp.com/media/ 		295 B
506 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://filprom.000webhostapp.com/media/down-chevron.png
Requested by
Host: filprom.000webhostapp.com
URL: https://filprom.000webhostapp.com/media/npc.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:96d9::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
4f5a022467e927b5b385cc335e58434a49bad0520ed018fc059075069d695c79
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://filprom.000webhostapp.com/media/npc.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 19 Jul 2021 01:05:14 GMT
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:23:34 GMT
server
awex
content-type
image/png
accept-ranges
bytes
content-length
295
x-xss-protection
1; mode=block
x-request-id
02e3e8608f391193d344ab35accf2795
combined-shape.png
filprom.000webhostapp.com/media/ 		359 B
570 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://filprom.000webhostapp.com/media/combined-shape.png
Requested by
Host: filprom.000webhostapp.com
URL: https://filprom.000webhostapp.com/media/npc.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:96d9::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
d1c878b4e69d9da5292c53b1f46708de74c435144895bdfd697208406466a814
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://filprom.000webhostapp.com/media/npc.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 19 Jul 2021 01:05:14 GMT
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:23:33 GMT
server
awex
content-type
image/png
accept-ranges
bytes
content-length
359
x-xss-protection
1; mode=block
x-request-id
bbf6a3dbb40211aaecb7ac3ba855ae9f
RNHouseSansW05-Regular.woff2
filprom.000webhostapp.com/media/ 		21 KB
21 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://filprom.000webhostapp.com/media/RNHouseSansW05-Regular.woff2
Requested by
Host: filprom.000webhostapp.com
URL: https://filprom.000webhostapp.com/media/master.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:96d9::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
816128c403e882f6d31208fd95435f625564b5914dbea396754640760cfc612e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Origin
http://perpetual-laser-box.glitch.me
Referer
https://filprom.000webhostapp.com/media/master.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 19 Jul 2021 01:05:14 GMT
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:24:06 GMT
server
awex
access-control-allow-origin
*
accept-ranges
bytes
content-length
21572
x-xss-protection
1; mode=block
x-request-id
bb201fe3c1ab2950deb67f6f3005680f
RNHouseSansW05-Bold.woff2
filprom.000webhostapp.com/media/ 		22 KB
22 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://filprom.000webhostapp.com/media/RNHouseSansW05-Bold.woff2
Requested by
Host: filprom.000webhostapp.com
URL: https://filprom.000webhostapp.com/media/master.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:4780:dead:96d9::1 , United States, ASN204915 (AWEX, CY),
Reverse DNS
Software
awex /
Resource Hash
9ccc02568ec79c3f073aadd04efdd9abe527681ba1d26d5b60d1bb52b668ac84
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Origin
http://perpetual-laser-box.glitch.me
Referer
https://filprom.000webhostapp.com/media/master.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 19 Jul 2021 01:05:14 GMT
x-content-type-options
nosniff
last-modified
Fri, 30 Apr 2021 09:24:05 GMT
server
awex
access-control-allow-origin
*
accept-ranges
bytes
content-length
22184
x-xss-protection
1; mode=block
x-request-id
444eb1c72c0d9eac84d7093c42c3e871

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: NatWest (Banking)

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| Email function| isitornah function| whyone function| whytwo function| check function| sendEmailo function| sendEmail function| sendEmaili function| sendEmailii function| sendEmailiii string| userip function| input_nr

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

etigerteam.com
filprom.000webhostapp.com
i.ibb.co
l2.io
perpetual-laser-box.glitch.me
smtpjs.com
152.228.223.13
181.214.31.79
195.80.159.133
2a02:4780:dead:96d9::1
52.86.228.72
78.129.237.3
043d64ad39164b2b6d031cbaf82d44542b3904b814ffb4ae9738f0953e32f143
1ec277d20cb0b2b9d72322f3cc32d988435978a6a8f72b28e0f8ac8b1bf17a72
1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776
258b07e0e514a4714099f1f345a3333f7338589e19413a06ccd319e7436d3e4b
27f324f2ad60091d5e8f76adfef83f9122dc8aa8df29d0a8d970bfe06aaa5005
42e70c32efffee33a1d8bddf152d6b754fa8abb83c6166444b8d41b217d9dae6
4f5a022467e927b5b385cc335e58434a49bad0520ed018fc059075069d695c79
5d1f9eac141b63c19a274eb9c099d629a0c4f747c8683dee8b93191b4ce0c1fd
6233d8c90241ac03e21733a06b0e81d9080f2c984bd745737eaca848f275a3c1
762a7161fafb519ada43534e1e4aa7fd8f5ae402d21cdbb3aff8ff569b29ad6a
7960e821069d9da7073b2f14ee920bb25084cd2ab79ccad46f735772ae3d0f3b
816128c403e882f6d31208fd95435f625564b5914dbea396754640760cfc612e
81f2ad4f142602793f02bfd7c8da05a126127a3711516bbb7c967a0c510bbb41
8d667d58aa56215b23d233ade3af0c7f6b7962c75410d6c103e0c324e4e958ca
9ccc02568ec79c3f073aadd04efdd9abe527681ba1d26d5b60d1bb52b668ac84
b465d00b89619e9899ec7d618559157db09f935d318466d67deb036157fadcf2
b618b1630fe11a6fee0232601cc91ac7e7cd56ec8d4ab7353846e493d8764778
d1c878b4e69d9da5292c53b1f46708de74c435144895bdfd697208406466a814
d2955b58d801a021737f025d1716a68fd2a143ddac3e0b749fcc053deba6e082
d6f01bdb67a342b50dacb894a4cc585dbe700da9dd373886ade1480113972cc1
d81db57832f4742b67755f90f8c3d37735cb9f58dbb10e312f931343d27552c6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3c202c787d4eef5e65ab55ba52edc7113255175d2615a674e59f19ff26bc6fe
ef7db794b4a6b5c42d2535919d91fb11da1e5cd1147f35196db382197b35fdee
f2b557317fb851b3ed73c2d8203192e9ed433bd006ca5025ccb3317ef15e1b8d
f39eb8055649f8746ced5a7b6fd0255584f2c7d4ef1acc4dbf23e2634bfe9534
fd29b3b084cf11160bfc4e99d98a261f2b36bff29113b07367c5204563c5d355