seemly-bolder-fireplant.glitch.me Open in urlscan Pro
34.195.35.45 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://seemly-bolder-fireplant.glitch.me/public/zano.html
Submission: On April 14 via automatic, source phishtank (April 14th 2024, 7:34:48 pm UTC) — Scanned from DE

Summary HTTP 4 Redirects Links 12 Behaviour Indicators

Summary

This website contacted 4 IPs in 3 countries across 3 domains to perform 4 HTTP transactions. The main IP is 34.195.35.45, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is seemly-bolder-fireplant.glitch.me.
TLS certificate: Issued by Amazon RSA 2048 M03 on December 4th 2023. Valid for: a year.

This is the only time seemly-bolder-fireplant.glitch.me was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Santander (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1	34.195.35.45 34.195.35.45	14618 (AMAZON-AES) (AMAZON-AES)
1	195.80.159.133 195.80.159.133	29152 (DECKNET-AS) (DECKNET-AS)
1	104.17.25.14 104.17.25.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	4

1 34.195.35.45 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-195-35-45.compute-1.amazonaws.com

seemly-bolder-fireplant.glitch.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 195.80.159.133 (France)

ASN29152 (DECKNET-AS, FR)

l2.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.25.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 239	6 KB
1	l2.io l2.io — Cisco Umbrella Rank: 182514	226 B
1	glitch.me seemly-bolder-fireplant.glitch.me	845 KB
4	3

	Domain	Requested by
1	cdnjs.cloudflare.com	seemly-bolder-fireplant.glitch.me
1	l2.io	seemly-bolder-fireplant.glitch.me
1	seemly-bolder-fireplant.glitch.me
4	3

This site contains links to these domains. Also see Links.

Domain
www.santander.co.uk
retail.santander.co.uk
business.santander.co.uk
corporate.santander.co.uk
onetrust.com

Subject Issuer	Validity	Valid
glitch.com Amazon RSA 2048 M03	`2023-12-04` - `2025-01-01`	a year	crt.sh
l2.io R3	`2024-03-05` - `2024-06-03`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-07-03` - `2024-07-02`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://seemly-bolder-fireplant.glitch.me/public/zano.html
Frame ID: D4944FF596ECFEB78584EB3DAF899C86
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Personal Online Banking: Log on or sign up

Detected technologies

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Page Statistics

4
Requests

75 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

1127 kB
Transfer

1233 kB
Size

0
Cookies

12 Outgoing links

These are links going to different origins than the main page.

URL: https://www.santander.co.uk/

Search URL Search Domain Scan URL

URL: https://retail.santander.co.uk/ENRIUK_NS_ENS/BtoChannelDriver.ssobto?dse_operationName=Access_ENRIUK
Title: Sign up

Search URL Search Domain Scan URL

URL: https://business.santander.co.uk/olb/app/logon/access/
Title: Business

Search URL Search Domain Scan URL

URL: https://corporate.santander.co.uk/LOGSCU_NS_ENS/BtoChannelDriver.bto?dse_operationName=OP_LOG_ON
Title: Corporate

Search URL Search Domain Scan URL

URL: https://retail.santander.co.uk/olb/app/reset/
Title: Forgotten details?

Search URL Search Domain Scan URL

URL: https://www.santander.co.uk/personal/support/fraud-and-security
Title: fraud and security

Search URL Search Domain Scan URL

URL: https://www.santander.co.uk/personal/support/ways-to-bank/online-and-mobile-banking-commitment
Title: Online Banking Guarantee

Search URL Search Domain Scan URL

URL: https://www.santander.co.uk/personal/support/customer-support/accessibility
Title: Accessibility

Search URL Search Domain Scan URL

URL: https://www.santander.co.uk/personal/support/customer-support/legal-information
Title: Security & Privacy

Search URL Search Domain Scan URL

URL: https://www.santander.co.uk/personal/support/ways-to-bank/online-banking-service-terms-conditions
Title: Terms & Conditions

Search URL Search Domain Scan URL

URL: https://onetrust.com/poweredbyonetrust

Search URL Search Domain Scan URL

URL: https://retail.santander.co.uk/olb/app/logon/access/
Title: View Privacy Notice

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request zano.html Show response
seemly-bolder-fireplant.glitch.me/public/ 844 KB
845 KB 356ms
161ms Document
text/html 34.195.35.45
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://seemly-bolder-fireplant.glitch.me/public/zano.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.195.35.45 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-195-35-45.compute-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 4f51b60d2b5fa166c7da581743b7de958d1139de60d65af5a0b627a51bb3ce0a

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

accept-ranges: bytes
cache-control: no-cache
content-length: 863868
content-type: text/html; charset=utf-8
date: Sun, 14 Apr 2024 19:34:43 GMT
etag: "d365c10bac7e14fc0441c5f1703b1db9"
last-modified: Sat, 13 Apr 2024 14:22:04 GMT
server: AmazonS3
x-amz-id-2: PGKfPU33AAY0MS//4MBuWYkYtrIyS+/S5Dph3Pdmf6fj5zeGEYy1WR1bbaantfFd0x0/MAvLGGk=
x-amz-request-id: R0WQ9VF9R23X7YCN
x-amz-server-side-encryption: AES256
x-amz-version-id: null

GET
H/1.1 200
OK ip.js Show response
l2.io/ 22 B
226 B 153ms
17ms Script
text/html 195.80.159.133
DECKNET-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://l2.io/ip.js?var=userip
Requested by: Host: seemly-bolder-fireplant.glitch.me
URL: https://seemly-bolder-fireplant.glitch.me/public/zano.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 195.80.159.133 , France, ASN29152 (DECKNET-AS, FR),
Reverse DNS
Software: Apache/2.4.38 (Debian) /
Resource Hash: 779aada7e0e32c82f38045402b3a66a248602f8f67a382236c4529a60a340f17

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://seemly-bolder-fireplant.glitch.me/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Sun, 14 Apr 2024 19:34:43 GMT
Server: Apache/2.4.38 (Debian)
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 22
Content-Type: text/html; charset=UTF-8

GET
H3 200 font-awesome.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/ 30 KB
6 KB 31ms
21ms Stylesheet
text/css 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css

Requested by

Host: seemly-bolder-fireplant.glitch.me
URL: https://seemly-bolder-fireplant.glitch.me/public/zano.html

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://seemly-bolder-fireplant.glitch.me/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 14 Apr 2024 19:34:43 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 258446
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 5631
last-modified: Mon, 04 May 2020 16:10:07 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e5f-7918"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dsqstNB4PZxFhALYb1AOK3ilDES67ufdUFRz7jc%2BYNU%2B10dvZ1f140Lf68hLphkhh68e2g%2FnrFLszoywcU0A2mIUkMbA7xPMZFPpQvZImDJ1cAX9yqPCSFzKnI6stG%2FjrPoGHIY9"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8746228a593437e9-FRA
expires: Fri, 04 Apr 2025 19:34:43 GMT

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f700c3638638b62b07e614c8cae5665cf4bfa956452ab4e6fea5a15965fc40f7

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 138 KB
138 KB Font
application/octet-stream

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3c34b516dc489a5ff3cb121a73b6cfc25ec0920394b2d3b742d30201e71e6e24

Request headers

Referer
Origin: https://seemly-bolder-fireplant.glitch.me
Accept-Language: de-DE,de;q=0.9;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type: application/octet-stream

GET
DATA 200
OK truncated
/ 138 KB
138 KB Font
application/octet-stream

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cf2166ed0037c6f2797c0774063ecc0275cd08473aeff74cf79dc510bb60398b

Request headers

Referer
Origin: https://seemly-bolder-fireplant.glitch.me
Accept-Language: de-DE,de;q=0.9;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type: application/octet-stream

GET
DATA 200
OK truncated
/ 77 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 08f86c6496d80636195dd2e2037f5c141f65ed6b969514531e61512ea239c5d8

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1bca034dc76dab33232d41f7f9705fced08c4b48c90e23bd737e4b610d1b6df8

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Santander (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 function| savepage_ShadowLoader string| userip function| isNumber

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://seemly-bolder-fireplant.glitch.me/public/zano.html(Line 423) Message: X-Frame-Options may only be set via an HTTP header sent along with a document. It may not be set inside <meta>.
recommendation	warning	URL: https://seemly-bolder-fireplant.glitch.me/public/zano.html Message: [DOM] Found 5 elements with non-unique id #disable-pwd-mgr-1: (More info: https://goo.gl/9p2vKq) %o %o %o %o %o
recommendation	warning	URL: https://seemly-bolder-fireplant.glitch.me/public/zano.html Message: [DOM] Found 5 elements with non-unique id #disable-pwd-mgr-2: (More info: https://goo.gl/9p2vKq) %o %o %o %o %o
recommendation	warning	URL: https://seemly-bolder-fireplant.glitch.me/public/zano.html Message: [DOM] Found 9 elements with non-unique id #pid: (More info: https://goo.gl/9p2vKq) %o %o %o %o %o %o %o %o %o
recommendation	warning	URL: https://seemly-bolder-fireplant.glitch.me/public/zano.html Message: [DOM] Found 5 elements with non-unique id #submitbtn: (More info: https://goo.gl/9p2vKq) %o %o %o %o %o
recommendation	verbose	URL: https://seemly-bolder-fireplant.glitch.me/public/zano.html Message: [DOM] Password forms should have (optionally hidden) username fields for accessibility: (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
l2.io
seemly-bolder-fireplant.glitch.me
104.17.25.14
195.80.159.133
34.195.35.45
08f86c6496d80636195dd2e2037f5c141f65ed6b969514531e61512ea239c5d8
1bca034dc76dab33232d41f7f9705fced08c4b48c90e23bd737e4b610d1b6df8
3c34b516dc489a5ff3cb121a73b6cfc25ec0920394b2d3b742d30201e71e6e24
4f51b60d2b5fa166c7da581743b7de958d1139de60d65af5a0b627a51bb3ce0a
779aada7e0e32c82f38045402b3a66a248602f8f67a382236c4529a60a340f17
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
cf2166ed0037c6f2797c0774063ecc0275cd08473aeff74cf79dc510bb60398b
f015bef1be25452dbec6c07a0608534230b0e69d99401f0a332c278c2235f6bf
f700c3638638b62b07e614c8cae5665cf4bfa956452ab4e6fea5a15965fc40f7

seemly-bolder-fireplant.glitch.me Open in urlscan Pro 34.195.35.45 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

4 Requests

75 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

4 IPs

3 Countries

1127 kBTransfer

1233 kBSize

0 Cookies

12 Outgoing links

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

6 Console Messages

Indicators

seemly-bolder-fireplant.glitch.me Open in urlscan Pro
34.195.35.45 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

75 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

3
Countries

1127 kB
Transfer

1233 kB
Size

0
Cookies

4 HTTP transactions
4 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!