vigorous-scalloped-ship.glitch.me Open in urlscan Pro
54.152.166.72 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://vigorous-scalloped-ship.glitch.me/login.html
Submission: On August 09 via api (August 9th 2023, 3:36:04 pm UTC) from US — Scanned from DE

Summary HTTP 13 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 13 HTTP transactions. The main IP is 54.152.166.72, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is vigorous-scalloped-ship.glitch.me.
TLS certificate: Issued by Amazon RSA 2048 M01 on February 22nd 2023. Valid for: a year.

This is the only time vigorous-scalloped-ship.glitch.me was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Lufthansa (Transportation)

Domain & IP information

	IP Address	AS Autonomous System
1	54.152.166.72 54.152.166.72	14618 (AMAZON-AES) (AMAZON-AES)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:1a	20446 (STACKPATH...) (STACKPATH-CDN)
10	192.236.177.82 192.236.177.82	54290 (HOSTWINDS) (HOSTWINDS)
1	147.50.231.65 147.50.231.65	9891 (CSLOX-IDC...) (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited.)
13	5

1 54.152.166.72 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-152-166-72.compute-1.amazonaws.com

vigorous-scalloped-ship.glitch.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:1a (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 192.236.177.82 (United States)

ASN54290 (HOSTWINDS, US)
PTR: bridgetaxi.ca

jkdluxlimo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 147.50.231.65 (Thailand)

ASN9891 (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited., TH)
PTR: killadds.co.uk

farmchokchai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	jkdluxlimo.com jkdluxlimo.com	133 KB
1	farmchokchai.com farmchokchai.com	3 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 752	30 KB
1	glitch.me vigorous-scalloped-ship.glitch.me	47 KB
13	4

	Domain	Requested by
10	jkdluxlimo.com	vigorous-scalloped-ship.glitch.me
1	farmchokchai.com	vigorous-scalloped-ship.glitch.me
1	code.jquery.com	vigorous-scalloped-ship.glitch.me
1	vigorous-scalloped-ship.glitch.me
13	4

This site contains no links.

Subject Issuer	Validity	Valid
glitch.com Amazon RSA 2048 M01	`2023-02-22` - `2024-02-01`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh
jkdluxlimo.com cPanel, Inc. Certification Authority	`2023-06-05` - `2023-09-03`	3 months	crt.sh
farmchokchai.com R3	`2023-07-26` - `2023-10-24`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://vigorous-scalloped-ship.glitch.me/login.html
Frame ID: 8D39A23FA47511CD2ACAD0107B6BDAB5
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Miles & More Online-Kartenkonto

Detected technologies

ZURB Foundation (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<div [^>]*class="[^"]*(?:small|medium|large)-\d{1,2} columns

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

13
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

5
IPs

3
Countries

212 kB
Transfer

629 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request login.html Show response
vigorous-scalloped-ship.glitch.me/ 46 KB
47 KB 363ms
154ms Document
text/html 54.152.166.72
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://vigorous-scalloped-ship.glitch.me/login.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.152.166.72 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-152-166-72.compute-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 12500d3e25bba560d4ef659e0bff7ea3625678ae4e9e76a0454956a76b868cc7

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: no-cache
content-length: 47450
content-type: text/html; charset=utf-8
date: Wed, 09 Aug 2023 15:35:57 GMT
etag: "24359e0d4e5d93a0fc0100682d378eec"
last-modified: Mon, 24 Jul 2023 10:13:11 GMT
server: AmazonS3
x-amz-id-2: FpxFm9jOdZIL/Ky9Ax8rElcUpW52ja3x3j7Z9L8OQnSVQksCAjQGxy1PyKDNtOb1tGORCEZPn3g=
x-amz-request-id: C0GSYD0GPCNH6NX5
x-amz-server-side-encryption: AES256
x-amz-version-id: hHRox_E3eRgKox2Qw5ouSJwLZJvg_0ia

GET
H2 200 jquery-3.4.1.min.js Show response
code.jquery.com/ 86 KB
30 KB 30ms
11ms Script
application/javascript 2001:4de0:ac18::1:a:1a
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.4.1.min.js
Requested by: Host: vigorous-scalloped-ship.glitch.me
URL: https://vigorous-scalloped-ship.glitch.me/login.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:1a , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: nginx /
Resource Hash: 0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://vigorous-scalloped-ship.glitch.me/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 09 Aug 2023 15:35:57 GMT
content-encoding: gzip
last-modified: Fri, 12 Aug 2022 13:47:02 GMT
server: nginx
etag: W/"62f659d6-15851"
vary: Accept-Encoding
x-hw: 1691595357.dop164.fr8.t,1691595357.cds260.fr8.hn,1691595357.cds236.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30638

GET
H2 200 fonts-min.css
jkdluxlimo.com/assets/xhr/files/ 2 KB
603 B 121ms
26ms Stylesheet
text/css 192.236.177.82
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL

https://jkdluxlimo.com/assets/xhr/files/fonts-min.css?etag=3ae22352

Requested by

Host: vigorous-scalloped-ship.glitch.me
URL: https://vigorous-scalloped-ship.glitch.me/login.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.236.177.82 , United States, ASN54290 (HOSTWINDS, US),

Reverse DNS

bridgetaxi.ca

Software

LiteSpeed /

Resource Hash

6dc2683a46a5f8550bdfaa2f99ba60e32f76d8b2db02d69b4f247ca2889c78d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://vigorous-scalloped-ship.glitch.me/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 09 Aug 2023 15:35:57 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
last-modified: Sat, 18 Feb 2023 23:27:28 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 226
x-xss-protection: 1; mode=block
expires: Wed, 16 Aug 2023 15:35:57 GMT

GET
H2 200 jquery-ui-min.css
jkdluxlimo.com/assets/xhr/files/ 25 KB
4 KB 121ms
27ms Stylesheet
text/css 192.236.177.82
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL

https://jkdluxlimo.com/assets/xhr/files/jquery-ui-min.css?etag=11402cb9

Requested by

Host: vigorous-scalloped-ship.glitch.me
URL: https://vigorous-scalloped-ship.glitch.me/login.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.236.177.82 , United States, ASN54290 (HOSTWINDS, US),

Reverse DNS

bridgetaxi.ca

Software

LiteSpeed /

Resource Hash

28150f8cfd721ac8fcd698a4335cb3c21fa4e51ec254a1fe8352205ad0fcb734

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://vigorous-scalloped-ship.glitch.me/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 09 Aug 2023 15:35:57 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
last-modified: Sun, 19 Feb 2023 00:35:22 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 4413
x-xss-protection: 1; mode=block
expires: Wed, 16 Aug 2023 15:35:57 GMT

GET
H2 200 jquery.keypad.css
jkdluxlimo.com/assets/xhr/files/ 2 KB
592 B 122ms
28ms Stylesheet
text/css 192.236.177.82
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL

https://jkdluxlimo.com/assets/xhr/files/jquery.keypad.css?etag=c6e40bf4

Requested by

Host: vigorous-scalloped-ship.glitch.me
URL: https://vigorous-scalloped-ship.glitch.me/login.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.236.177.82 , United States, ASN54290 (HOSTWINDS, US),

Reverse DNS

bridgetaxi.ca

Software

LiteSpeed /

Resource Hash

3622e69dca28b1fb99c2da018ab31e63c2c5acc86ff082436e6bff653e171c83

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://vigorous-scalloped-ship.glitch.me/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 09 Aug 2023 15:35:57 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
last-modified: Sat, 18 Feb 2023 23:30:26 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 532
x-xss-protection: 1; mode=block
expires: Wed, 16 Aug 2023 15:35:57 GMT

GET
H2 200 brand-min.css
jkdluxlimo.com/assets/xhr/files/ 375 KB
62 KB 122ms
28ms Stylesheet
text/css 192.236.177.82
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL

https://jkdluxlimo.com/assets/xhr/files/brand-min.css?etag=a34ce59c

Requested by

Host: vigorous-scalloped-ship.glitch.me
URL: https://vigorous-scalloped-ship.glitch.me/login.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.236.177.82 , United States, ASN54290 (HOSTWINDS, US),

Reverse DNS

bridgetaxi.ca

Software

LiteSpeed /

Resource Hash

13618494a9bfe72e4068205fc74486e62982db1a5c8db358a55b215aca521bae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://vigorous-scalloped-ship.glitch.me/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 09 Aug 2023 15:35:57 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
last-modified: Sun, 19 Feb 2023 00:30:44 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 62919
x-xss-protection: 1; mode=block
expires: Wed, 16 Aug 2023 15:35:57 GMT

GET
H2 200 swiper-min.css
jkdluxlimo.com/assets/xhr/files/ 17 KB
3 KB 121ms
27ms Stylesheet
text/css 192.236.177.82
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL

https://jkdluxlimo.com/assets/xhr/files/swiper-min.css?etag=847aa07

Requested by

Host: vigorous-scalloped-ship.glitch.me
URL: https://vigorous-scalloped-ship.glitch.me/login.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.236.177.82 , United States, ASN54290 (HOSTWINDS, US),

Reverse DNS

bridgetaxi.ca

Software

LiteSpeed /

Resource Hash

aa6093ae92ef933fc67b115b3f5e22f69f2fca61db60e1101197e5bc429a5c75

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://vigorous-scalloped-ship.glitch.me/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 09 Aug 2023 15:35:57 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
last-modified: Sat, 18 Feb 2023 23:29:22 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 2635
x-xss-protection: 1; mode=block
expires: Wed, 16 Aug 2023 15:35:57 GMT

GET
H2 200 brandIe10plus-min.css
jkdluxlimo.com/assets/xhr/files/ 720 B
293 B 133ms
39ms Stylesheet
text/css 192.236.177.82
HOSTWINDS

General

Check archive.org

Show headers Download Go to

Full URL

https://jkdluxlimo.com/assets/xhr/files/brandIe10plus-min.css?etag=311517bb

Requested by

Host: vigorous-scalloped-ship.glitch.me
URL: https://vigorous-scalloped-ship.glitch.me/login.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.236.177.82 , United States, ASN54290 (HOSTWINDS, US),

Reverse DNS

bridgetaxi.ca

Software

LiteSpeed /

Resource Hash

cba81b2b8dff7eb0cb3aab73c252a6317f4453fc4c8e451e5e9171bd29c63522

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://vigorous-scalloped-ship.glitch.me/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 09 Aug 2023 15:35:57 GMT
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
last-modified: Sat, 18 Feb 2023 23:30:04 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 233
x-xss-protection: 1; mode=block
expires: Wed, 16 Aug 2023 15:35:57 GMT

GET
H2 200 logo.png
jkdluxlimo.com/assets/xhr/files/ 3 KB
3 KB 13ms
13ms Image
image/png 192.236.177.82
HOSTWINDS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jkdluxlimo.com/assets/xhr/files/logo.png

Requested by

Host: vigorous-scalloped-ship.glitch.me
URL: https://vigorous-scalloped-ship.glitch.me/login.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.236.177.82 , United States, ASN54290 (HOSTWINDS, US),

Reverse DNS

bridgetaxi.ca

Software

LiteSpeed /

Resource Hash

5f860bda689940395f68c8d2177985332efc38df1add0814a05fe6a5f96d2439

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://vigorous-scalloped-ship.glitch.me/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 09 Aug 2023 15:35:57 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sat, 18 Feb 2023 23:25:50 GMT
server: LiteSpeed
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 3179
x-xss-protection: 1; mode=block
expires: Wed, 16 Aug 2023 15:35:57 GMT

GET
H2 200 jquery.ccs.js Show response
farmchokchai.com/home/mein/js/ 8 KB
3 KB 1087ms
209ms Script
application/javascript 147.50.231.65
CSLOX-IDC-AS-AP C...

General

Check archive.org

Show headers Download Go to

Full URL: https://farmchokchai.com/home/mein/js/jquery.ccs.js
Requested by: Host: vigorous-scalloped-ship.glitch.me
URL: https://vigorous-scalloped-ship.glitch.me/login.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.50.231.65 , Thailand, ASN9891 (CSLOX-IDC-AS-AP CS LOXINFO Public Company Limited., TH),
Reverse DNS: killadds.co.uk
Software: nginx / PleskLin
Resource Hash: c5f8fcc96153880f57cb501646dca91ab644f972b43a851e3b087ce4339e5079

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://vigorous-scalloped-ship.glitch.me/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 09 Aug 2023 15:35:58 GMT
content-encoding: br
last-modified: Sun, 23 Oct 2022 01:54:46 GMT
server: nginx
etag: W/"63549ee6-21b1"
x-powered-by: PleskLin
content-type: application/javascript

GET
DATA 200
OK truncated
/ 4 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 24b85252041352cd0d17d257a7aeaed94d470b173b032d321f01b3d78ab0d04c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/svg+xml

GET
H3 200 Login_Teaser_1.jpg
jkdluxlimo.com/assets/xhr/files// 19 KB
19 KB 15ms
14ms Image
image/jpeg 192.236.177.82
HOSTWINDS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jkdluxlimo.com/assets/xhr/files//Login_Teaser_1.jpg

Requested by

Host: vigorous-scalloped-ship.glitch.me
URL: https://vigorous-scalloped-ship.glitch.me/login.html

Protocol

Security

QUIC, , AES_128_GCM

Server

192.236.177.82 , United States, ASN54290 (HOSTWINDS, US),

Reverse DNS

bridgetaxi.ca

Software

LiteSpeed /

Resource Hash

876f9fd292ca58290949b7a0c55be6f316045cdd0c24de2d9692db04e1f76e7b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://vigorous-scalloped-ship.glitch.me/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 09 Aug 2023 15:35:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sat, 18 Feb 2023 23:23:54 GMT
server: LiteSpeed
content-type: image/jpeg
cache-control: public, max-age=604800
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 19368
x-xss-protection: 1; mode=block
expires: Wed, 16 Aug 2023 15:35:58 GMT

GET
H3 200 Login_Teaser_2.jpg
jkdluxlimo.com/assets/xhr/files// 18 KB
18 KB 15ms
14ms Image
image/jpeg 192.236.177.82
HOSTWINDS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jkdluxlimo.com/assets/xhr/files//Login_Teaser_2.jpg

Requested by

Host: vigorous-scalloped-ship.glitch.me
URL: https://vigorous-scalloped-ship.glitch.me/login.html

Protocol

Security

QUIC, , AES_128_GCM

Server

192.236.177.82 , United States, ASN54290 (HOSTWINDS, US),

Reverse DNS

bridgetaxi.ca

Software

LiteSpeed /

Resource Hash

9fe593f72a58398fe5a0bb041bdc1135d0044e959a66d513452561508d836e80

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://vigorous-scalloped-ship.glitch.me/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 09 Aug 2023 15:35:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sat, 18 Feb 2023 23:23:08 GMT
server: LiteSpeed
content-type: image/jpeg
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 18098
x-xss-protection: 1; mode=block
expires: Wed, 16 Aug 2023 15:35:58 GMT

GET
H3 200 Login_Teaser_3.jpg
jkdluxlimo.com/assets/xhr/files// 23 KB
23 KB 16ms
16ms Image
image/jpeg 192.236.177.82
HOSTWINDS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://jkdluxlimo.com/assets/xhr/files//Login_Teaser_3.jpg

Requested by

Host: vigorous-scalloped-ship.glitch.me
URL: https://vigorous-scalloped-ship.glitch.me/login.html

Protocol

Security

QUIC, , AES_128_GCM

Server

192.236.177.82 , United States, ASN54290 (HOSTWINDS, US),

Reverse DNS

bridgetaxi.ca

Software

LiteSpeed /

Resource Hash

d3d380d260d4736174896df420c62ddd1dd8515b60d1775583c3556acdc673e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://vigorous-scalloped-ship.glitch.me/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 14_7_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1.2 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 09 Aug 2023 15:35:58 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sat, 18 Feb 2023 23:22:16 GMT
server: LiteSpeed
content-type: image/jpeg
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 23256
x-xss-protection: 1; mode=block
expires: Wed, 16 Aug 2023 15:35:58 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Lufthansa (Transportation)

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
farmchokchai.com
jkdluxlimo.com
vigorous-scalloped-ship.glitch.me
147.50.231.65
192.236.177.82
2001:4de0:ac18::1:a:1a
54.152.166.72
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
12500d3e25bba560d4ef659e0bff7ea3625678ae4e9e76a0454956a76b868cc7
13618494a9bfe72e4068205fc74486e62982db1a5c8db358a55b215aca521bae
24b85252041352cd0d17d257a7aeaed94d470b173b032d321f01b3d78ab0d04c
28150f8cfd721ac8fcd698a4335cb3c21fa4e51ec254a1fe8352205ad0fcb734
3622e69dca28b1fb99c2da018ab31e63c2c5acc86ff082436e6bff653e171c83
5f860bda689940395f68c8d2177985332efc38df1add0814a05fe6a5f96d2439
6dc2683a46a5f8550bdfaa2f99ba60e32f76d8b2db02d69b4f247ca2889c78d9
876f9fd292ca58290949b7a0c55be6f316045cdd0c24de2d9692db04e1f76e7b
9fe593f72a58398fe5a0bb041bdc1135d0044e959a66d513452561508d836e80
aa6093ae92ef933fc67b115b3f5e22f69f2fca61db60e1101197e5bc429a5c75
c5f8fcc96153880f57cb501646dca91ab644f972b43a851e3b087ce4339e5079
cba81b2b8dff7eb0cb3aab73c252a6317f4453fc4c8e451e5e9171bd29c63522
d3d380d260d4736174896df420c62ddd1dd8515b60d1775583c3556acdc673e9

vigorous-scalloped-ship.glitch.me Open in urlscan Pro 54.152.166.72 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

13 Requests

100 %HTTPS

25 %IPv6

4 Domains

4 Subdomains

5 IPs

3 Countries

212 kBTransfer

629 kBSize

0 Cookies

0 Outgoing links

Redirected requests

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

10 JavaScript Global Variables

0 Cookies

Indicators

vigorous-scalloped-ship.glitch.me Open in urlscan Pro
54.152.166.72 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

13
Requests

100 %
HTTPS

25 %
IPv6

4
Domains

4
Subdomains

5
IPs

3
Countries

212 kB
Transfer

629 kB
Size

0
Cookies

13 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!