swamp-reliable-estimate.glitch.me

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 5 HTTP transactions. The main IP is 3.225.240.80, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is swamp-reliable-estimate.glitch.me.

This is the only time swamp-reliable-estimate.glitch.me was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Facebook (Social Network)

Domain & IP information

	IP Address	AS Autonomous System
1	3.225.240.80 3.225.240.80	14618 (AMAZON-AES) (AMAZON-AES)
1 3	162.0.232.135 162.0.232.135	22612 (NAMECHEAP...) (NAMECHEAP-NET)
1	2606:4700:20:... 2606:4700:20::681a:64	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	67.202.94.93 67.202.94.93	32748 (STEADFAST) (STEADFAST)
1	2606:4700:10:... 2606:4700:10::6816:4bab	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	5

1 3.225.240.80 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-225-240-80.compute-1.amazonaws.com

swamp-reliable-estimate.glitch.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 162.0.232.135 (Canada) 1 redirects

ASN22612 (NAMECHEAP-NET, US)
PTR: premium138-5.web-hosting.com

unknow.bbbbbbbbmmmmmmmm.xyz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::681a:64 (United States)

ASN13335 (CLOUDFLARENET, US)

get.geojs.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 67.202.94.93 (Chicago, United States) 1 redirects

ASN32748 (STEADFAST, US)
PTR: amung.us

whos.amung.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6816:4bab (United States)

ASN13335 (CLOUDFLARENET, US)

widgets.amung.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	bbbbbbbbmmmmmmmm.xyz 1 redirects unknow.bbbbbbbbmmmmmmmm.xyz	502 KB
2	amung.us 1 redirects whos.amung.us widgets.amung.us	2 KB
1	geojs.io get.geojs.io	968 B
1	glitch.me swamp-reliable-estimate.glitch.me	1013 B
5	4

	Domain	Requested by
3	unknow.bbbbbbbbmmmmmmmm.xyz	1 redirects swamp-reliable-estimate.glitch.me
1	widgets.amung.us
1	whos.amung.us	1 redirects
1	get.geojs.io
1	swamp-reliable-estimate.glitch.me
5	5

This site contains no links.

Subject Issuer	Validity	Valid
unknow.bbbbbbbbmmmmmmmm.xyz Sectigo RSA Domain Validation Secure Server CA	`2020-09-02` - `2021-09-02`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-07-09` - `2021-07-09`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://swamp-reliable-estimate.glitch.me/
Frame ID: B51A4FF4DCE02EDFEBE6BF188B2E99B6
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Amazon Web Services (PaaS) Expand

Overall confidence: 100%
Detected patterns

headers server /^AmazonS3$/i

Amazon S3 (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

headers server /^AmazonS3$/i

Page Statistics

5
Requests

60 %
HTTPS

40 %
IPv6

4
Domains

5
Subdomains

5
IPs

2
Countries

506 kB
Transfer

773 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

https://unknow.bbbbbbbbmmmmmmmm.xyz/location HTTP 301
https://unknow.bbbbbbbbmmmmmmmm.xyz/location/

Request Chain 2

http://get.geojs.io/v1/ip/geo.json HTTP 307
https://get.geojs.io/v1/ip/geo.json

Request Chain 4

http://whos.amung.us/widget/cotizenew HTTP 307
http://widgets.amung.us/classic/00/3.png

5 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
swamp-reliable-estimate.glitch.me/ 541 B
1013 B 249ms
205ms Document
text/html 3.225.240.80
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: http://swamp-reliable-estimate.glitch.me/
Protocol: HTTP/1.1
Server: 3.225.240.80 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-225-240-80.compute-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: a92a4e76db956448c8552ad926631078f30dce0b578fca743ef518a5939af75d

Request headers

Host: swamp-reliable-estimate.glitch.me
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 10 Nov 2020 01:16:22 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 541
Connection: keep-alive
x-amz-id-2: g8huofJDN1ChqiUUE5un3PQxLx8z/+xCI/YqgMlqk59gZVhU7iCe0xQiAsyqgTTtyUu7Qu/rTLg=
x-amz-request-id: 8A02454832EB759D
last-modified: Fri, 23 Oct 2020 18:46:58 GMT
etag: "73d126142d9a5b345dd429a521eab2b0"
cache-control: no-cache
x-amz-version-id: PR28NXkrjqwkUeDmrQKGaMhV5gMIpwLx
accept-ranges: bytes
server: AmazonS3

GET
H2 200 / Show response
unknow.bbbbbbbbmmmmmmmm.xyz/ 717 KB
502 KB 526ms
186ms Script
application/javascript 162.0.232.135
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://unknow.bbbbbbbbmmmmmmmm.xyz/?api=1&lan=facebooknew&ht=1&counter0=cotizenew
Requested by: Host: swamp-reliable-estimate.glitch.me
URL: http://swamp-reliable-estimate.glitch.me/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.232.135 , Canada, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium138-5.web-hosting.com
Software: Apache / PHP/7.2.34
Resource Hash: 62ee83b0c5e41ba7e63d907e0da87b4d0db9b006e08b536e4af06118a2a622d8

Request headers

Referer: http://swamp-reliable-estimate.glitch.me/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 10 Nov 2020 01:16:22 GMT
content-encoding: gzip
server: Apache
x-powered-by: PHP/7.2.34
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: no-store, no-cache, must-revalidate
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2

200

/ Show response
unknow.bbbbbbbbmmmmmmmm.xyz/location/
Redirect Chain

https://unknow.bbbbbbbbmmmmmmmm.xyz/location
https://unknow.bbbbbbbbmmmmmmmm.xyz/location/

1 KB
619 B

171ms
170ms

Script
application/javascript

162.0.232.135
NAMECHEAP-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://unknow.bbbbbbbbmmmmmmmm.xyz/location/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 162.0.232.135 , Canada, ASN22612 (NAMECHEAP-NET, US),
Reverse DNS: premium138-5.web-hosting.com
Software: Apache / PHP/7.2.34
Resource Hash: 9dbf86c020f175462495bd90cf8d10ee6d73350105401e7f6e578cba3f5297f0

Request headers

Referer: http://swamp-reliable-estimate.glitch.me/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 10 Nov 2020 01:16:24 GMT
content-encoding: gzip
server: Apache
x-powered-by: PHP/7.2.34
vary: Accept-Encoding
content-type: application/javascript
status: 200
content-length: 462

Redirect headers

status: 301
date: Tue, 10 Nov 2020 01:16:24 GMT
server: Apache
content-length: 253
location: https://unknow.bbbbbbbbmmmmmmmm.xyz/location/
content-type: text/html; charset=iso-8859-1

GET
H2

200

geo.json Show response
get.geojs.io/v1/ip/
Redirect Chain

http://get.geojs.io/v1/ip/geo.json
https://get.geojs.io/v1/ip/geo.json

304 B
968 B

36ms
21ms

XHR
application/json

2606:4700:20::681a:64
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://get.geojs.io/v1/ip/geo.json

Protocol

H2

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:64 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cddd2f68d75962d7685fc9ce22823afe813a133d37399afb096ce2890d3dc0bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://swamp-reliable-estimate.glitch.me/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 10 Nov 2020 01:16:24 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","max_age":604800}
status: 200
access-control-allow-methods: GET
cf-request-id: 065152ca62000005fd798d6000000001
x-request-id: ab21d34349e7d56c2ba49cbf47c61064-AMS
x-geojs-location: AMS
pragma: no-cache
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=1QeEV4UwWP4rpi%2F%2F9SyS6kcIkOgTv8VpovuY9DJkxkSqmqHLOK23HR7tVeokx0BMKcQEOdv27N%2B2UzIlezXShBy4cPmoXGqjm5uzOLSZy2IB71kvvKOg0Vw%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, private, max-age=0
cf-ray: 5efbed8a3e6705fd-FRA

Redirect headers

Location: https://get.geojs.io/v1/ip/geo.json
Non-Authoritative-Reason: HSTS
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: http://swamp-reliable-estimate.glitch.me

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1230532f79456753fb73f559ece9b95c17cfb36325dc313a3eda5ac22dfd9a2b

Request headers

Referer: http://swamp-reliable-estimate.glitch.me/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1

200
OK

3.png
widgets.amung.us/classic/00/
Redirect Chain

http://whos.amung.us/widget/cotizenew
http://widgets.amung.us/classic/00/3.png

1 KB
2 KB

16ms
10ms

Image
image/png

2606:4700:10::6816:4bab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://widgets.amung.us/classic/00/3.png
Protocol: HTTP/1.1
Server: 2606:4700:10::6816:4bab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ec05bbdc9c3173963a0443eb265cc294f9e30737e17c85b662643765803e453c

Request headers

Referer: http://swamp-reliable-estimate.glitch.me/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 10 Nov 2020 01:16:24 GMT
CF-Cache-Status: HIT
Age: 166886
Connection: keep-alive
Content-Length: 1386
cf-request-id: 065152cb070000dfef5dad3000000001
last-modified: Sun, 13 Jun 2010 09:03:09 GMT
Server: cloudflare
etag: "4c149ecd-56a"
Vary: Accept-Encoding
Content-Type: image/png
access-control-allow-origin: *
cache-control: max-age=432000
Accept-Ranges: bytes
CF-RAY: 5efbed8b38c5dfef-FRA
expires: Mon, 09 Nov 2020 02:54:58 GMT

Redirect headers

location: http://widgets.amung.us/classic/00/3.png
date: Tue, 10 Nov 2020 01:16:24 GMT
cache-control: no-cache, no-store, must-revalidate
transfer-encoding: chunked
content-type: text/html; charset=UTF-8

GET
DATA 200
OK truncated
/ 51 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7281941fed81ed9caf5728727e05da4a94b442c36796e1a5b1d6106f242ed11f

Request headers

Referer: http://swamp-reliable-estimate.glitch.me/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://unknow.bbbbbbbbmmmmmmmm.xyz/?api=1&lan=facebooknew&ht=1&counter0=cotizenew(Line 89) Message: [object HTMLScriptElement]
console-api	log	URL: https://unknow.bbbbbbbbmmmmmmmm.xyz/?api=1&lan=facebooknew&ht=1&counter0=cotizenew(Line 89) Message: [object HTMLScriptElement]
console-api	log	URL: https://unknow.bbbbbbbbmmmmmmmm.xyz/?api=1&lan=facebooknew&ht=1&counter0=cotizenew(Line 89) Message: [object HTMLScriptElement]
console-api	log	URL: https://unknow.bbbbbbbbmmmmmmmm.xyz/?api=1&lan=facebooknew&ht=1&counter0=cotizenew(Line 89) Message: [object HTMLScriptElement]
console-api	log	URL: https://unknow.bbbbbbbbmmmmmmmm.xyz/?api=1&lan=facebooknew&ht=1&counter0=cotizenew(Line 89) Message: [object HTMLScriptElement]

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

get.geojs.io
swamp-reliable-estimate.glitch.me
unknow.bbbbbbbbmmmmmmmm.xyz
whos.amung.us
widgets.amung.us
162.0.232.135
2606:4700:10::6816:4bab
2606:4700:20::681a:64
3.225.240.80
67.202.94.93
1230532f79456753fb73f559ece9b95c17cfb36325dc313a3eda5ac22dfd9a2b
62ee83b0c5e41ba7e63d907e0da87b4d0db9b006e08b536e4af06118a2a622d8
7281941fed81ed9caf5728727e05da4a94b442c36796e1a5b1d6106f242ed11f
9dbf86c020f175462495bd90cf8d10ee6d73350105401e7f6e578cba3f5297f0
a92a4e76db956448c8552ad926631078f30dce0b578fca743ef518a5939af75d
cddd2f68d75962d7685fc9ce22823afe813a133d37399afb096ce2890d3dc0bb
ec05bbdc9c3173963a0443eb265cc294f9e30737e17c85b662643765803e453c

swamp-reliable-estimate.glitch.me Open in urlscan Pro 3.225.240.80 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

5 Requests

60 %HTTPS

40 %IPv6

4 Domains

5 Subdomains

5 IPs

2 Countries

506 kBTransfer

773 kBSize

0 Cookies

0 Outgoing links

Redirected requests

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

15 JavaScript Global Variables

0 Cookies

5 Console Messages

Indicators

swamp-reliable-estimate.glitch.me Open in urlscan Pro
3.225.240.80 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

5
Requests

60 %
HTTPS

40 %
IPv6

4
Domains

5
Subdomains

5
IPs

2
Countries

506 kB
Transfer

773 kB
Size

0
Cookies

5 HTTP transactions
2 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!