fuchsia-cerulean-switch.glitch.me Open in urlscan Pro
34.197.3.188  Malicious Activity! Public Scan

4 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://www.maes.com.pk/js.php Page URL
2. https://fuchsia-cerulean-switch.glitch.me/365.html Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	js.php Show response www.maes.com.pk/	2 KB 1 KB	8394ms 7846ms	Document text/html	217.79.245.244 HVC-AS
General Check archive.org Show headers Download Go to Full URL https://www.maes.com.pk/js.php Protocol H2 Security TLS 1.3, , AES_128_GCM Server 217.79.245.244 Tampa, United States, ASN29802 (HVC-AS, US), Reverse DNS 217-79-245-244.static.hvvc.us Software LiteSpeed / Resource Hash 6c7bd85a2762b196ea873c865432649109cf0687b712bd3fc44e53d5adcfb515 Request headers :method GET :authority www.maes.com.pk :scheme https :path /js.php pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent phishfarmer accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent phishfarmer Response headers content-type text/html; charset=UTF-8 content-length 1033 content-encoding br vary Accept-Encoding date Sat, 04 Sep 2021 00:54:08 GMT server LiteSpeed alt-svc quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000
GET DATA	200 OK	truncated /	2 KB 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash cfb365099ae602f8e7994580e16d7cdc2349275b0b7e70fd283bf21905813b00 Request headers Referer User-Agent phishfarmer Response headers Content-Type image/gif
GET H2	200	Primary Request 365.html Show response fuchsia-cerulean-switch.glitch.me/	59 KB 59 KB	446ms 234ms	Document text/html	34.197.3.188 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://fuchsia-cerulean-switch.glitch.me/365.html Requested by Host: www.maes.com.pk URL: https://www.maes.com.pk/js.php Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.197.3.188 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-34-197-3-188.compute-1.amazonaws.com Software AmazonS3 / Resource Hash 95077e504dfe8ea13be1093f2f860542b9d54af950675b87d3d19ebc9cf47031 Request headers :method GET :authority fuchsia-cerulean-switch.glitch.me :scheme https :path /365.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent phishfarmer accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest document referer https://www.maes.com.pk/ accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent phishfarmer Referer https://www.maes.com.pk/ Response headers date Sat, 04 Sep 2021 00:54:09 GMT content-type text/html; charset=utf-8 content-length 60096 x-amz-id-2 f1MnCuEn4jCHVQN60gYilP/EVyoHvO/ewc0CShqWSATonYv9+9p52ONq2CI1/dkrziqpTrLNcC4= x-amz-request-id EAXF17KFH4E01YNY last-modified Wed, 01 Sep 2021 10:42:00 GMT etag "0f59696186fd793949fb257fb05bfb22" cache-control no-cache x-amz-version-id PO2WYOsN1Hb0jd1jHa8IOjURbOZpZOy6 accept-ranges bytes server AmazonS3
GET H/1.1	200 OK	converged.v2.login.min_xu7km3oxm4bwp2b-mqyozg2.css secure.aadcdn.microsoftonline-p.com/ests/2.1.8576.13/content/cdnbundles/	100 KB 19 KB	36ms 6ms	Stylesheet text/css	2a02:26f0:6c00:2a7::35c1 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8576.13/content/cdnbundles/converged.v2.login.min_xu7km3oxm4bwp2b-mqyozg2.css Requested by Host: fuchsia-cerulean-switch.glitch.me URL: https://fuchsia-cerulean-switch.glitch.me/365.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:2a7::35c1 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 6013f9292bbf154cd978a519e9ba6d501c57c50118e1535a374b0e6473fec91c Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Origin https://fuchsia-cerulean-switch.glitch.me Referer https://fuchsia-cerulean-switch.glitch.me/ User-Agent phishfarmer Response headers Date Sat, 04 Sep 2021 00:54:09 GMT Content-Encoding gzip Last-Modified Sun, 19 May 2019 07:53:51 GMT Content-MD5 xI6nFIlAZcVgw+oZ8mpIWA== Vary Accept-Encoding Connection keep-alive Content-Type text/css Access-Control-Allow-Origin * Cache-Control public, max-age=17592790 Strict-Transport-Security max-age=31536000 Content-Length 18788
GET H2	200	53_8b36337037cff88c3df203bb73d58e41.png aadcdn.msauth.net/shared/1.0/content/images/applogos/	5 KB 6 KB	28ms 10ms	Image image/png	2620:1ec:bdf::63 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png Requested by Host: fuchsia-cerulean-switch.glitch.me URL: https://fuchsia-cerulean-switch.glitch.me/365.html Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:bdf::63 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash e4e1e65871749d18aea150643c07e0aab2057da057c6c57ec1c3c43580e1c898 Request headers Referer https://fuchsia-cerulean-switch.glitch.me/ User-Agent phishfarmer Response headers x-ms-blob-type BlockBlob date Sat, 04 Sep 2021 00:54:09 GMT x-azure-ref-originshield 0U2swYQAAAAAKcw31xFuUT62yE2wkbPIhTE9OMjFFREdFMTUyMAAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY= content-md5 izYzcDfP+Iw98gO7c9WOQQ== x-cache TCP_HIT content-length 5139 x-ms-lease-status unlocked last-modified Wed, 12 Feb 2020 03:12:12 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8D7AF695A8C44DC x-azure-ref 0scMyYQAAAACbxUmjE9qlSLUQA/1/OyajRlJBRURHRTEwMDkAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2 content-type image/png access-control-allow-origin * x-ms-request-id 7ebce588-101e-0026-66b9-9f5c4c000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19
GET H/1.1	200 OK	microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg secure.aadcdn.microsoftonline-p.com/ests/2.1.8576.13/content/images/	4 KB 2 KB	22ms 6ms	Image image/svg+xml	2a02:26f0:6c00:2a7::35c1 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8576.13/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg Requested by Host: fuchsia-cerulean-switch.glitch.me URL: https://fuchsia-cerulean-switch.glitch.me/365.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:2a7::35c1 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://fuchsia-cerulean-switch.glitch.me/ User-Agent phishfarmer Response headers Date Sat, 04 Sep 2021 00:54:09 GMT Content-Encoding gzip Last-Modified Sun, 19 May 2019 07:54:57 GMT Content-MD5 nzaLxFgP7ZB3dfMcaybWzw== Vary Accept-Encoding Connection keep-alive Content-Type image/svg+xml Access-Control-Allow-Origin * Cache-Control public, max-age=17586670 Strict-Transport-Security max-age=31536000 Content-Length 1435
GET H/1.1	404 Not Found	bg2.jpg www.oddstips.co.uk/wp-content/themes/focusblog/	0 0	1378ms 1323ms	Image text/html	87.117.239.10 IOMART-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.oddstips.co.uk/wp-content/themes/focusblog/bg2.jpg Requested by Host: fuchsia-cerulean-switch.glitch.me URL: https://fuchsia-cerulean-switch.glitch.me/365.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 87.117.239.10 Poplar, United Kingdom, ASN20860 (IOMART-AS, GB), Reverse DNS oddstips.co.uk Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://fuchsia-cerulean-switch.glitch.me/ User-Agent phishfarmer Response headers
GET DATA	200 OK	truncated /	3 KB 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash ba1f7e7f63a74f50f9e76b5cb1e445545126fac7bd1cb6b6d7fb5ab51acf9f66 Request headers Referer User-Agent phishfarmer Response headers Content-Type image/gif
GET H/1.1	200 OK	ellipsis_white_5ac590ee72bfe06a7cecfd75b588ad73.svg secure.aadcdn.microsoftonline-p.com/ests/2.1.8576.13/content/images/	915 B 643 B	6ms 6ms	Image image/svg+xml	2a02:26f0:6c00:2a7::35c1 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8576.13/content/images/ellipsis_white_5ac590ee72bfe06a7cecfd75b588ad73.svg Requested by Host: fuchsia-cerulean-switch.glitch.me URL: https://fuchsia-cerulean-switch.glitch.me/365.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:2a7::35c1 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://fuchsia-cerulean-switch.glitch.me/ User-Agent phishfarmer Response headers Date Sat, 04 Sep 2021 00:54:09 GMT Content-Encoding gzip Last-Modified Sun, 19 May 2019 07:54:27 GMT Content-MD5 HMwsHhNXdtrfirQDkzcqMA== Vary Accept-Encoding Connection keep-alive Content-Type image/svg+xml Access-Control-Allow-Origin * Cache-Control public, max-age=17592760 Strict-Transport-Security max-age=31536000 Content-Length 263
GET H/1.1	200 OK	ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.svg secure.aadcdn.microsoftonline-p.com/ests/2.1.8576.13/content/images/	915 B 643 B	13ms 6ms	Image image/svg+xml	2a02:26f0:6c00:2a7::35c1 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8576.13/content/images/ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.svg Requested by Host: fuchsia-cerulean-switch.glitch.me URL: https://fuchsia-cerulean-switch.glitch.me/365.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:2a7::35c1 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6 Security Headers Name Value Strict-Transport-Security max-age=31536000 Request headers Referer https://fuchsia-cerulean-switch.glitch.me/ User-Agent phishfarmer Response headers Date Sat, 04 Sep 2021 00:54:09 GMT Content-Encoding gzip Last-Modified Sun, 19 May 2019 07:54:56 GMT Content-MD5 /a3y/mpA+HRaVAiPACrsog== Vary Accept-Encoding Connection keep-alive Content-Type image/svg+xml Access-Control-Allow-Origin * Cache-Control public, max-age=17592746 Strict-Transport-Security max-age=31536000 Content-Length 263
GET H2	200	jquery-3.3.1.min.js Show response ajax.aspnetcdn.com/ajax/jQuery/	85 KB 30 KB	141ms 39ms	Script application/javascript	152.199.19.160 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.3.1.min.js Requested by Host: fuchsia-cerulean-switch.glitch.me URL: https://fuchsia-cerulean-switch.glitch.me/365.html Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.19.160 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (mil/6BA6) / Resource Hash 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://fuchsia-cerulean-switch.glitch.me/ User-Agent phishfarmer Response headers date Sat, 04 Sep 2021 00:54:09 GMT content-encoding gzip x-content-type-options nosniff age 8623371 x-cache HIT content-length 30394 x-xss-protection 1; mode=block last-modified Mon, 22 Jan 2018 19:27:49 GMT server ECAcc (mil/6BA6) etag "80288516b793d31:0" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control public,max-age=31536000 accept-ranges bytes timing-allow-origin *

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| myFunction function| $ function| jQuery function| get_email_hash function| validateEmail function| GetURLParameter function| randomString function| mg

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msauth.net
ajax.aspnetcdn.com
fuchsia-cerulean-switch.glitch.me
secure.aadcdn.microsoftonline-p.com
www.maes.com.pk
www.oddstips.co.uk
152.199.19.160
217.79.245.244
2620:1ec:bdf::63
2a02:26f0:6c00:2a7::35c1
34.197.3.188
87.117.239.10
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6
6013f9292bbf154cd978a519e9ba6d501c57c50118e1535a374b0e6473fec91c
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea
6c7bd85a2762b196ea873c865432649109cf0687b712bd3fc44e53d5adcfb515
95077e504dfe8ea13be1093f2f860542b9d54af950675b87d3d19ebc9cf47031
ba1f7e7f63a74f50f9e76b5cb1e445545126fac7bd1cb6b6d7fb5ab51acf9f66
cfb365099ae602f8e7994580e16d7cdc2349275b0b7e70fd283bf21905813b00
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4e1e65871749d18aea150643c07e0aab2057da057c6c57ec1c3c43580e1c898