urlscan.io logo urlscan.io
SecurityTrails logo

heavenly-good-silkworm.glitch.me Open in urlscan Pro
35.172.196.51  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://heavenly-good-silkworm.glitch.me/tursbugaya.html?/NAT_WEST_Customer.verification/error.html
Submission: On September 09 via automatic, source phishtank — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 7 IPs in 4 countries across 6 domains to perform 32 HTTP transactions. The main IP is 35.172.196.51, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is heavenly-good-silkworm.glitch.me.
TLS certificate: Issued by Amazon on January 18th 2021. Valid for: a year.
This is the only time heavenly-good-silkworm.glitch.me was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: NatWest (Banking)

Domain & IP information

IP Address AS Autonomous System
2 35.172.196.51 14618 (AMAZON-AES)
20 213.180.193.247 13238 (YANDEX)
1 181.214.31.79 61317 (ASDETUK w...)
1 78.129.237.3 20860 (IOMART-AS)
1 104.194.11.156 23470 (RELIABLESITE)
1 195.80.159.133 29152 (DECKNET-AS)
32 7
2    35.172.196.51 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-172-196-51.compute-1.amazonaws.com
heavenly-good-silkworm.glitch.me
20    213.180.193.247 (Russian Federation)

ASN13238 (YANDEX, RU)
PTR: website.yandexcloud.net
natnat.website.yandexcloud.net
1    181.214.31.79 (Bedminster, United States)

ASN61317 (ASDETUK www.heficed.com, GB)
PTR: miami.servershost.net
etigerteam.com
1    78.129.237.3 (United Kingdom)

ASN20860 (IOMART-AS, GB)
smtpjs.com
1    104.194.11.156 (United States)

ASN23470 (RELIABLESITE, US)
i.ibb.co
1    195.80.159.133 (Paris, France)

ASN29152 (DECKNET-AS, FR)
l2.io
Domain Requested by
20 natnat.website.yandexcloud.net heavenly-good-silkworm.glitch.me
natnat.website.yandexcloud.net
2 heavenly-good-silkworm.glitch.me heavenly-good-silkworm.glitch.me
1 l2.io heavenly-good-silkworm.glitch.me
1 i.ibb.co heavenly-good-silkworm.glitch.me
1 smtpjs.com heavenly-good-silkworm.glitch.me
1 etigerteam.com heavenly-good-silkworm.glitch.me
32 6

This site contains no links.

Subject Issuer Validity Valid
glitch.com
Amazon		 2021-01-18 -
2022-02-15		 a year crt.sh
storage.yandexcloud.net
Yandex CA		 2021-07-28 -
2022-01-26		 6 months crt.sh
etigerteam.com
cPanel, Inc. Certification Authority		 2021-08-17 -
2021-11-15		 3 months crt.sh
smtpjs.com
R3		 2021-09-07 -
2021-12-06		 3 months crt.sh
ibb.co
R3		 2021-08-06 -
2021-11-04		 3 months crt.sh
l2.io
R3		 2021-08-05 -
2021-11-03		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://heavenly-good-silkworm.glitch.me/tursbugaya.html?/NAT_WEST_Customer.verification/error.html
Frame ID: 406A217A6AF53EAB39E752EC1E2D40BF
Requests: 32 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Log in to Online Banking

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

32
Requests

81 %
HTTPS

0 %
IPv6

6
Domains

6
Subdomains

7
IPs

4
Countries

153 kB
Transfer

416 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

32 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request tursbugaya.html
heavenly-good-silkworm.glitch.me/ 		40 KB
40 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://heavenly-good-silkworm.glitch.me/tursbugaya.html?/NAT_WEST_Customer.verification/error.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.172.196.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-172-196-51.compute-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
2876dd3a91b168e17995169735686d3b19d938de64c391340e7ed036d09c32df

Request headers

:method
GET
:authority
heavenly-good-silkworm.glitch.me
:scheme
https
:path
/tursbugaya.html?/NAT_WEST_Customer.verification/error.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

date
Thu, 09 Sep 2021 14:04:55 GMT
content-type
text/html; charset=utf-8
content-length
40741
x-amz-id-2
BDgpHTq3IV5VSPhGVjIGBQz/UDqZTIUpXxc8ZoRE/sT8tYGNQ3jIgGymlx8NThsbfGxsa9iUz5E=
x-amz-request-id
6812HD6FNQ4J1F0C
last-modified
Thu, 09 Sep 2021 09:00:05 GMT
etag
"e72b11bbcd7980f767c27be6f3d7ad41"
cache-control
no-cache
x-amz-version-id
WwteYZVgLkVPJnSuzLEW2eQVI11U033x
accept-ranges
bytes
server
AmazonS3
master.css
natnat.website.yandexcloud.net/ 		223 KB
54 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://natnat.website.yandexcloud.net/master.css
Requested by
Host: heavenly-good-silkworm.glitch.me
URL: https://heavenly-good-silkworm.glitch.me/tursbugaya.html?/NAT_WEST_Customer.verification/error.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.180.193.247 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
website.yandexcloud.net
Software
nginx /
Resource Hash
7960e821069d9da7073b2f14ee920bb25084cd2ab79ccad46f735772ae3d0f3b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://heavenly-good-silkworm.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 09 Sep 2021 14:04:57 GMT
content-encoding
gzip
last-modified
Tue, 10 Aug 2021 18:34:28 UTC
server
nginx
x-amz-request-id
1940c14f7457fa0c
etag
W/"2dfd733f065ca6d2369a67ef4983a29c"
content-type
text/css
master_mobile.css
natnat.website.yandexcloud.net/ 		47 KB
14 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://natnat.website.yandexcloud.net/master_mobile.css
Requested by
Host: heavenly-good-silkworm.glitch.me
URL: https://heavenly-good-silkworm.glitch.me/tursbugaya.html?/NAT_WEST_Customer.verification/error.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.180.193.247 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
website.yandexcloud.net
Software
nginx /
Resource Hash
762a7161fafb519ada43534e1e4aa7fd8f5ae402d21cdbb3aff8ff569b29ad6a

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://heavenly-good-silkworm.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 09 Sep 2021 14:04:57 GMT
content-encoding
gzip
last-modified
Tue, 10 Aug 2021 18:34:28 UTC
server
nginx
x-amz-request-id
b918f7fdd9f6ad5b
etag
W/"5cc6a870d1a1dd62dc2690ea17b7e3c4"
content-type
text/css
npc.css
natnat.website.yandexcloud.net/ 		46 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://natnat.website.yandexcloud.net/npc.css
Requested by
Host: heavenly-good-silkworm.glitch.me
URL: https://heavenly-good-silkworm.glitch.me/tursbugaya.html?/NAT_WEST_Customer.verification/error.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.180.193.247 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
website.yandexcloud.net
Software
nginx /
Resource Hash
b618b1630fe11a6fee0232601cc91ac7e7cd56ec8d4ab7353846e493d8764778

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://heavenly-good-silkworm.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 09 Sep 2021 14:04:57 GMT
content-encoding
gzip
last-modified
Tue, 10 Aug 2021 18:34:28 UTC
server
nginx
x-amz-request-id
caa15d93fd9180a9
etag
W/"d3f76cb5e9a68a590459b54b35e2ac59"
content-type
text/css
overlayPromptMaster.css
natnat.website.yandexcloud.net/ 		1 KB
743 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://natnat.website.yandexcloud.net/overlayPromptMaster.css
Requested by
Host: heavenly-good-silkworm.glitch.me
URL: https://heavenly-good-silkworm.glitch.me/tursbugaya.html?/NAT_WEST_Customer.verification/error.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.180.193.247 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
website.yandexcloud.net
Software
nginx /
Resource Hash
42e70c32efffee33a1d8bddf152d6b754fa8abb83c6166444b8d41b217d9dae6

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://heavenly-good-silkworm.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 09 Sep 2021 14:04:57 GMT
content-encoding
gzip
last-modified
Tue, 10 Aug 2021 18:34:28 UTC
server
nginx
x-amz-request-id
e816c415bc6ab5db
etag
W/"1e4c183b3f098d3bca4ccce20c428912"
content-type
text/css
overlayPrompt.css
natnat.website.yandexcloud.net/ 		76 B
253 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://natnat.website.yandexcloud.net/overlayPrompt.css
Requested by
Host: heavenly-good-silkworm.glitch.me
URL: https://heavenly-good-silkworm.glitch.me/tursbugaya.html?/NAT_WEST_Customer.verification/error.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.180.193.247 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
website.yandexcloud.net
Software
nginx /
Resource Hash
ef7db794b4a6b5c42d2535919d91fb11da1e5cd1147f35196db382197b35fdee

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://heavenly-good-silkworm.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 09 Sep 2021 14:04:57 GMT
content-encoding
gzip
last-modified
Tue, 10 Aug 2021 18:34:28 UTC
server
nginx
x-amz-request-id
c36192cd059505b8
etag
W/"82a1b6373fa17d314053cb7173954338"
content-type
text/css
font-awesome.css
natnat.website.yandexcloud.net/ 		21 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://natnat.website.yandexcloud.net/font-awesome.css
Requested by
Host: heavenly-good-silkworm.glitch.me
URL: https://heavenly-good-silkworm.glitch.me/tursbugaya.html?/NAT_WEST_Customer.verification/error.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.180.193.247 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
website.yandexcloud.net
Software
nginx /
Resource Hash
043d64ad39164b2b6d031cbaf82d44542b3904b814ffb4ae9738f0953e32f143

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://heavenly-good-silkworm.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 09 Sep 2021 14:04:57 GMT
content-encoding
gzip
last-modified
Tue, 10 Aug 2021 18:34:28 UTC
server
nginx
x-amz-request-id
c491859235267473
etag
W/"b3f38f8786407280c4585f1586bf26ee"
content-type
text/css
panel-defaults.css
natnat.website.yandexcloud.net/ 		9 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://natnat.website.yandexcloud.net/panel-defaults.css
Requested by
Host: heavenly-good-silkworm.glitch.me
URL: https://heavenly-good-silkworm.glitch.me/tursbugaya.html?/NAT_WEST_Customer.verification/error.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.180.193.247 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
website.yandexcloud.net
Software
nginx /
Resource Hash
258b07e0e514a4714099f1f345a3333f7338589e19413a06ccd319e7436d3e4b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://heavenly-good-silkworm.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 09 Sep 2021 14:04:57 GMT
content-encoding
gzip
last-modified
Tue, 10 Aug 2021 18:34:28 UTC
server
nginx
x-amz-request-id
b8fec45030537d8f
etag
W/"e909d59f350c1dad51b78325b5953eb2"
content-type
text/css
main.css
natnat.website.yandexcloud.net/ 		2 KB
815 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://natnat.website.yandexcloud.net/main.css
Requested by
Host: heavenly-good-silkworm.glitch.me
URL: https://heavenly-good-silkworm.glitch.me/tursbugaya.html?/NAT_WEST_Customer.verification/error.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.180.193.247 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
website.yandexcloud.net
Software
nginx /
Resource Hash
81f2ad4f142602793f02bfd7c8da05a126127a3711516bbb7c967a0c510bbb41

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://heavenly-good-silkworm.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 09 Sep 2021 14:04:57 GMT
content-encoding
gzip
last-modified
Tue, 10 Aug 2021 18:34:28 UTC
server
nginx
x-amz-request-id
9dad11993158f7f7
etag
W/"0c357b809e35163ef98bb273e7e3e587"
content-type
text/css
jquery-2.2.3.js
etigerteam.com/ntw/media/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://etigerteam.com/ntw/media/jquery-2.2.3.js
Requested by
Host: heavenly-good-silkworm.glitch.me
URL: https://heavenly-good-silkworm.glitch.me/tursbugaya.html?/NAT_WEST_Customer.verification/error.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
181.214.31.79 Bedminster, United States, ASN61317 (ASDETUK www.heficed.com, GB),
Reverse DNS
miami.servershost.net
Software
/
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://heavenly-good-silkworm.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers
smtp.js
smtpjs.com/v3/ 		871 B
782 B 		Script
General
Check archive.org
Download Go to
Full URL
https://smtpjs.com/v3/smtp.js
Requested by
Host: heavenly-good-silkworm.glitch.me
URL: https://heavenly-good-silkworm.glitch.me/tursbugaya.html?/NAT_WEST_Customer.verification/error.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
78.129.237.3 , United Kingdom, ASN20860 (IOMART-AS, GB),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://heavenly-good-silkworm.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 09 Sep 2021 14:04:55 GMT
content-encoding
gzip
last-modified
Tue, 10 Nov 2020 17:17:51 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
etag
"162f436b85b7d61:0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
accept-ranges
bytes
content-length
603
n-w-logo.svg
natnat.website.yandexcloud.net/ 		5 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://natnat.website.yandexcloud.net/n-w-logo.svg
Requested by
Host: heavenly-good-silkworm.glitch.me
URL: https://heavenly-good-silkworm.glitch.me/tursbugaya.html?/NAT_WEST_Customer.verification/error.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.180.193.247 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
website.yandexcloud.net
Software
nginx /
Resource Hash
8d667d58aa56215b23d233ade3af0c7f6b7962c75410d6c103e0c324e4e958ca

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://heavenly-good-silkworm.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 09 Sep 2021 14:04:57 GMT
content-encoding
gzip
last-modified
Tue, 10 Aug 2021 18:34:28 UTC
server
nginx
x-amz-request-id
e39aca2ea01ebe51
etag
W/"987cc7771f2fe14e61de62bd92e2411e"
content-type
image/svg+xml
plogo.png
natnat.website.yandexcloud.net/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://natnat.website.yandexcloud.net/plogo.png
Requested by
Host: heavenly-good-silkworm.glitch.me
URL: https://heavenly-good-silkworm.glitch.me/tursbugaya.html?/NAT_WEST_Customer.verification/error.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.180.193.247 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
website.yandexcloud.net
Software
nginx /
Resource Hash
f2b557317fb851b3ed73c2d8203192e9ed433bd006ca5025ccb3317ef15e1b8d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://heavenly-good-silkworm.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 09 Sep 2021 14:04:57 GMT
last-modified
Tue, 10 Aug 2021 18:34:28 UTC
server
nginx
x-amz-request-id
0921541d1bc10c52
etag
"cce808c0c23f731523eb4b7298ad18d8"
content-type
image/png
accept-ranges
bytes
content-length
5679
error-marker.png
natnat.website.yandexcloud.net/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://natnat.website.yandexcloud.net/error-marker.png
Requested by
Host: heavenly-good-silkworm.glitch.me
URL: https://heavenly-good-silkworm.glitch.me/tursbugaya.html?/NAT_WEST_Customer.verification/error.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.180.193.247 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
website.yandexcloud.net
Software
nginx /
Resource Hash
27f324f2ad60091d5e8f76adfef83f9122dc8aa8df29d0a8d970bfe06aaa5005

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://heavenly-good-silkworm.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 09 Sep 2021 14:04:57 GMT
last-modified
Tue, 10 Aug 2021 18:34:28 UTC
server
nginx
x-amz-request-id
933e0c877ef8015e
etag
"50f1540b40bf348f927c3ed21aba72b3"
content-type
image/png
accept-ranges
bytes
content-length
1090
security.gif
natnat.website.yandexcloud.net/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://natnat.website.yandexcloud.net/security.gif
Requested by
Host: heavenly-good-silkworm.glitch.me
URL: https://heavenly-good-silkworm.glitch.me/tursbugaya.html?/NAT_WEST_Customer.verification/error.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.180.193.247 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
website.yandexcloud.net
Software
nginx /
Resource Hash
e3c202c787d4eef5e65ab55ba52edc7113255175d2615a674e59f19ff26bc6fe

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://heavenly-good-silkworm.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 09 Sep 2021 14:04:57 GMT
last-modified
Tue, 10 Aug 2021 18:34:28 UTC
server
nginx
x-amz-request-id
8bf15698218e5c92
etag
"98c7b877a2c1dd40ba0b2b78277342b1"
content-type
image/gif
accept-ranges
bytes
content-length
6122
ajax-loader.gif
i.ibb.co/RpLNy4f/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.ibb.co/RpLNy4f/ajax-loader.gif
Requested by
Host: heavenly-good-silkworm.glitch.me
URL: https://heavenly-good-silkworm.glitch.me/tursbugaya.html?/NAT_WEST_Customer.verification/error.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.194.11.156 , United States, ASN23470 (RELIABLESITE, US),
Reverse DNS
Software
nginx /
Resource Hash
fd29b3b084cf11160bfc4e99d98a261f2b36bff29113b07367c5204563c5d355

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://heavenly-good-silkworm.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 09 Sep 2021 14:04:57 GMT
last-modified
Tue, 02 Mar 2021 22:27:30 GMT
server
nginx
access-control-allow-methods
GET, OPTIONS
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
3208
expires
Thu, 31 Dec 2037 23:55:55 GMT
ip.js
l2.io/ 		27 B
231 B 		Script
General
Check archive.org
Download Go to
Full URL
https://l2.io/ip.js?var=userip
Requested by
Host: heavenly-good-silkworm.glitch.me
URL: https://heavenly-good-silkworm.glitch.me/tursbugaya.html?/NAT_WEST_Customer.verification/error.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
195.80.159.133 Paris, France, ASN29152 (DECKNET-AS, FR),
Reverse DNS
Software
Apache/2.4.38 (Debian) /
Resource Hash
985595b8f6891ac7258ae752f03e1e1e7d4fa6fdc1c8a53dc5e53aa99c5506c7

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://heavenly-good-silkworm.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Thu, 09 Sep 2021 14:04:57 GMT
Server
Apache/2.4.38 (Debian)
Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
Content-Length
27
Content-Type
text/html; charset=UTF-8
plogo.png
heavenly-good-silkworm.glitch.me/media/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://heavenly-good-silkworm.glitch.me/media/plogo.png
Requested by
Host: heavenly-good-silkworm.glitch.me
URL: https://heavenly-good-silkworm.glitch.me/tursbugaya.html?/NAT_WEST_Customer.verification/error.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.172.196.51 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-172-196-51.compute-1.amazonaws.com
Software
/
Resource Hash
5d1f9eac141b63c19a274eb9c099d629a0c4f747c8683dee8b93191b4ce0c1fd

Request headers

:path
/media/plogo.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
heavenly-good-silkworm.glitch.me
referer
https://heavenly-good-silkworm.glitch.me/tursbugaya.html?/NAT_WEST_Customer.verification/error.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://heavenly-good-silkworm.glitch.me/tursbugaya.html?/NAT_WEST_Customer.verification/error.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Thu, 09 Sep 2021 14:04:57 GMT
cache-control
max-age=0
content-length
3616
white-lock.png
natnat.website.yandexcloud.net/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://natnat.website.yandexcloud.net/white-lock.png
Requested by
Host: natnat.website.yandexcloud.net
URL: https://natnat.website.yandexcloud.net/npc.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.180.193.247 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
website.yandexcloud.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://natnat.website.yandexcloud.net/npc.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers
alert.png
natnat.website.yandexcloud.net/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://natnat.website.yandexcloud.net/alert.png
Requested by
Host: natnat.website.yandexcloud.net
URL: https://natnat.website.yandexcloud.net/npc.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.180.193.247 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
website.yandexcloud.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://natnat.website.yandexcloud.net/npc.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers
li5_outer_frame_top_curve.gif
natnat.website.yandexcloud.net/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://natnat.website.yandexcloud.net/li5_outer_frame_top_curve.gif
Requested by
Host: natnat.website.yandexcloud.net
URL: https://natnat.website.yandexcloud.net/master.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.180.193.247 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
website.yandexcloud.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://natnat.website.yandexcloud.net/master.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers
radio-selected.png
natnat.website.yandexcloud.net/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://natnat.website.yandexcloud.net/radio-selected.png
Requested by
Host: natnat.website.yandexcloud.net
URL: https://natnat.website.yandexcloud.net/npc.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.180.193.247 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
website.yandexcloud.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://natnat.website.yandexcloud.net/npc.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers
radio-normal.png
natnat.website.yandexcloud.net/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://natnat.website.yandexcloud.net/radio-normal.png
Requested by
Host: natnat.website.yandexcloud.net
URL: https://natnat.website.yandexcloud.net/npc.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.180.193.247 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
website.yandexcloud.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://natnat.website.yandexcloud.net/npc.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers
check-box.png
natnat.website.yandexcloud.net/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://natnat.website.yandexcloud.net/check-box.png
Requested by
Host: natnat.website.yandexcloud.net
URL: https://natnat.website.yandexcloud.net/npc.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.180.193.247 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
website.yandexcloud.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://natnat.website.yandexcloud.net/npc.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers
down-chevron.png
natnat.website.yandexcloud.net/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://natnat.website.yandexcloud.net/down-chevron.png
Requested by
Host: natnat.website.yandexcloud.net
URL: https://natnat.website.yandexcloud.net/npc.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.180.193.247 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
website.yandexcloud.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://natnat.website.yandexcloud.net/npc.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers
combined-shape.png
natnat.website.yandexcloud.net/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://natnat.website.yandexcloud.net/combined-shape.png
Requested by
Host: natnat.website.yandexcloud.net
URL: https://natnat.website.yandexcloud.net/npc.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.180.193.247 , Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
website.yandexcloud.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://natnat.website.yandexcloud.net/npc.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers
RNHouseSansW05-Regular.woff2
natnat.website.yandexcloud.net/ 		0
0
RNHouseSansW05-Bold.woff2
natnat.website.yandexcloud.net/ 		0
0
RNHouseSansW05-Regular.woff
natnat.website.yandexcloud.net/ 		0
0
RNHouseSansW05-Bold.woff
natnat.website.yandexcloud.net/ 		0
0
RNHouseSansW05-Regular.ttf
natnat.website.yandexcloud.net/ 		0
0
RNHouseSansW05-Bold.ttf
natnat.website.yandexcloud.net/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
natnat.website.yandexcloud.net
URL
https://natnat.website.yandexcloud.net/RNHouseSansW05-Regular.woff2
Domain
natnat.website.yandexcloud.net
URL
https://natnat.website.yandexcloud.net/RNHouseSansW05-Bold.woff2
Domain
natnat.website.yandexcloud.net
URL
https://natnat.website.yandexcloud.net/RNHouseSansW05-Regular.woff
Domain
natnat.website.yandexcloud.net
URL
https://natnat.website.yandexcloud.net/RNHouseSansW05-Bold.woff
Domain
natnat.website.yandexcloud.net
URL
https://natnat.website.yandexcloud.net/RNHouseSansW05-Regular.ttf
Domain
natnat.website.yandexcloud.net
URL
https://natnat.website.yandexcloud.net/RNHouseSansW05-Bold.ttf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: NatWest (Banking)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster object| Email function| isitornah function| whyone function| whytwo function| check function| sendEmailo function| sendEmail function| sendEmaili function| sendEmailii function| sendEmailiii string| userip function| input_nr

0 Cookies

22 Console Messages

Source Level URL
Text
network error URL: https://etigerteam.com/ntw/media/jquery-2.2.3.js
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://natnat.website.yandexcloud.net/alert.png
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://natnat.website.yandexcloud.net/white-lock.png
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://heavenly-good-silkworm.glitch.me/media/plogo.png
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://natnat.website.yandexcloud.net/radio-selected.png
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://natnat.website.yandexcloud.net/li5_outer_frame_top_curve.gif
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://natnat.website.yandexcloud.net/check-box.png
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://natnat.website.yandexcloud.net/down-chevron.png
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://natnat.website.yandexcloud.net/radio-normal.png
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://natnat.website.yandexcloud.net/combined-shape.png
Message:
Failed to load resource: the server responded with a status of 404 ()
javascript error URL: https://heavenly-good-silkworm.glitch.me/tursbugaya.html?/NAT_WEST_Customer.verification/error.html
Message:
Access to font at 'https://natnat.website.yandexcloud.net/RNHouseSansW05-Regular.woff2' from origin 'https://heavenly-good-silkworm.glitch.me' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://natnat.website.yandexcloud.net/RNHouseSansW05-Regular.woff2
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://heavenly-good-silkworm.glitch.me/tursbugaya.html?/NAT_WEST_Customer.verification/error.html
Message:
Access to font at 'https://natnat.website.yandexcloud.net/RNHouseSansW05-Bold.woff2' from origin 'https://heavenly-good-silkworm.glitch.me' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://natnat.website.yandexcloud.net/RNHouseSansW05-Bold.woff2
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://heavenly-good-silkworm.glitch.me/tursbugaya.html?/NAT_WEST_Customer.verification/error.html
Message:
Access to font at 'https://natnat.website.yandexcloud.net/RNHouseSansW05-Regular.woff' from origin 'https://heavenly-good-silkworm.glitch.me' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://natnat.website.yandexcloud.net/RNHouseSansW05-Regular.woff
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://heavenly-good-silkworm.glitch.me/tursbugaya.html?/NAT_WEST_Customer.verification/error.html
Message:
Access to font at 'https://natnat.website.yandexcloud.net/RNHouseSansW05-Bold.woff' from origin 'https://heavenly-good-silkworm.glitch.me' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://natnat.website.yandexcloud.net/RNHouseSansW05-Bold.woff
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://heavenly-good-silkworm.glitch.me/tursbugaya.html?/NAT_WEST_Customer.verification/error.html
Message:
Access to font at 'https://natnat.website.yandexcloud.net/RNHouseSansW05-Regular.ttf' from origin 'https://heavenly-good-silkworm.glitch.me' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://natnat.website.yandexcloud.net/RNHouseSansW05-Regular.ttf
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://heavenly-good-silkworm.glitch.me/tursbugaya.html?/NAT_WEST_Customer.verification/error.html
Message:
Access to font at 'https://natnat.website.yandexcloud.net/RNHouseSansW05-Bold.ttf' from origin 'https://heavenly-good-silkworm.glitch.me' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://natnat.website.yandexcloud.net/RNHouseSansW05-Bold.ttf
Message:
Failed to load resource: net::ERR_FAILED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

etigerteam.com
heavenly-good-silkworm.glitch.me
i.ibb.co
l2.io
natnat.website.yandexcloud.net
smtpjs.com
natnat.website.yandexcloud.net
104.194.11.156
181.214.31.79
195.80.159.133
213.180.193.247
35.172.196.51
78.129.237.3
043d64ad39164b2b6d031cbaf82d44542b3904b814ffb4ae9738f0953e32f143
1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776
258b07e0e514a4714099f1f345a3333f7338589e19413a06ccd319e7436d3e4b
27f324f2ad60091d5e8f76adfef83f9122dc8aa8df29d0a8d970bfe06aaa5005
2876dd3a91b168e17995169735686d3b19d938de64c391340e7ed036d09c32df
42e70c32efffee33a1d8bddf152d6b754fa8abb83c6166444b8d41b217d9dae6
5d1f9eac141b63c19a274eb9c099d629a0c4f747c8683dee8b93191b4ce0c1fd
762a7161fafb519ada43534e1e4aa7fd8f5ae402d21cdbb3aff8ff569b29ad6a
7960e821069d9da7073b2f14ee920bb25084cd2ab79ccad46f735772ae3d0f3b
81f2ad4f142602793f02bfd7c8da05a126127a3711516bbb7c967a0c510bbb41
8d667d58aa56215b23d233ade3af0c7f6b7962c75410d6c103e0c324e4e958ca
985595b8f6891ac7258ae752f03e1e1e7d4fa6fdc1c8a53dc5e53aa99c5506c7
b618b1630fe11a6fee0232601cc91ac7e7cd56ec8d4ab7353846e493d8764778
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3c202c787d4eef5e65ab55ba52edc7113255175d2615a674e59f19ff26bc6fe
ef7db794b4a6b5c42d2535919d91fb11da1e5cd1147f35196db382197b35fdee
f2b557317fb851b3ed73c2d8203192e9ed433bd006ca5025ccb3317ef15e1b8d
fd29b3b084cf11160bfc4e99d98a261f2b36bff29113b07367c5204563c5d355