view-payment-online.glitch.me Open in urlscan Pro
52.20.88.154  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response view-payment-online.glitch.me/	640 KB 641 KB	350ms 309ms	Document text/html	52.20.88.154 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL http://view-payment-online.glitch.me/ Protocol HTTP/1.1 Server 52.20.88.154 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-20-88-154.compute-1.amazonaws.com Software AmazonS3 / Resource Hash cfe1e679e2ff24604b01ef87e63102fe1e4dafc5e2bc500294a47697933805da Request headers Host view-payment-online.glitch.me Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers Date Thu, 27 May 2021 12:20:09 GMT Content-Type text/html; charset=utf-8 Content-Length 655774 Connection keep-alive x-amz-id-2 C+0PTUgugIpiK0X1Dll22FvDL0oUrGeNc79Ks4s99FTUTutCV9IMI90l48bUmGRQDi52YwZ4SBk= x-amz-request-id 64GG4JCN73XPZJ4Q last-modified Wed, 26 May 2021 01:05:17 GMT etag "97766fba3368899cd1f4b05dc0b39ac1" cache-control no-cache x-amz-version-id YdqLm4v3XCIyDIx0a.Hlxoqbs.ArYMiR accept-ranges bytes server AmazonS3
GET DATA	200 OK	truncated /	330 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 173ccb5de106362df171d127b711be29c5b9d6c9bca6970ed1b13961584f8c3a Request headers Referer http://view-payment-online.glitch.me/ User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers Content-Type image/png
GET H2	200	jquery.min.js Show response cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/	85 KB 27 KB	36ms 35ms	Script application/javascript	2606:4700::6810:125e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js Requested by Host: view-payment-online.glitch.me URL: http://view-payment-online.glitch.me/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Referer http://view-payment-online.glitch.me/ User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers date Thu, 27 May 2021 12:20:10 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"report_to":"cf-nel","max_age":604800} age 58254 cross-origin-resource-policy cross-origin alt-svc h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 27277 cf-request-id 0a4f5da7110000c2b826bdc000000001 timing-allow-origin * last-modified Mon, 04 May 2020 16:11:48 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03ec4-15283" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=8rGKVXnqQ434HBno3QRBYqy4Ch0J83%2BL2xTzI%2BCdAlHlk3KHg0kfJwbBWUxXxZ%2FcyKm%2Fz%2B4boeYrDfLIbMId4UOCjqZ01%2BT36dx68sZBxNczOwDpq1YPF1Sjc65rq39qnXFMq9OXbRTE%2BrzLjQ%3D%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 655f321e8f1fc2b8-FRA expires Tue, 17 May 2022 12:20:10 GMT
GET DATA	200 OK	truncated /	80 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 40ce82b3cbf8de9e2dd6ecfa54a4ad3986d89a90b1df1371b99d97f01c8dd72f Request headers Referer http://view-payment-online.glitch.me/ User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers Content-Type image/png
GET H/1.1	200 OK	/ Show response api.ipify.org/	22 B 267 B	5360ms 5015ms	XHR application/json	23.21.48.44 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.ipify.org/?format=json Requested by Host: cdnjs.cloudflare.com URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 23.21.48.44 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-23-21-48-44.compute-1.amazonaws.com Software Cowboy / Resource Hash 9fb0c09407084f238536a6a5e7627f0305505ff8883d646f5cab3327624f41bf Request headers Accept application/json, text/javascript, */*; q=0.01 Referer http://view-payment-online.glitch.me/ User-Agent Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36 Response headers Date Thu, 27 May 2021 12:20:16 GMT Via 1.1 vegur Server Cowboy Vary Origin Content-Type application/json Access-Control-Allow-Origin http://view-payment-online.glitch.me Connection keep-alive Content-Length 22

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Excel / PDF download (Online)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery function| submitForm

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.ipify.org
cdnjs.cloudflare.com
view-payment-online.glitch.me
23.21.48.44
2606:4700::6810:125e
52.20.88.154
173ccb5de106362df171d127b711be29c5b9d6c9bca6970ed1b13961584f8c3a
40ce82b3cbf8de9e2dd6ecfa54a4ad3986d89a90b1df1371b99d97f01c8dd72f
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
9fb0c09407084f238536a6a5e7627f0305505ff8883d646f5cab3327624f41bf
cfe1e679e2ff24604b01ef87e63102fe1e4dafc5e2bc500294a47697933805da