nrtw.glitch.me Open in urlscan Pro
107.23.110.216  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

5 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response nrtw.glitch.me/	21 KB 22 KB	899ms 392ms	Document text/html	107.23.110.216 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://nrtw.glitch.me/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 107.23.110.216 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-107-23-110-216.compute-1.amazonaws.com Software AmazonS3 / Resource Hash 9f1ea668eb8c9be0fbf15fb3af89c7bfcb04bfa248020972a4905d25fe25770d Request headers :method GET :authority nrtw.glitch.me :scheme https :path / pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 05 Aug 2021 15:34:22 GMT content-type text/html; charset=utf-8 content-length 21976 x-amz-id-2 ZAJ6O0sVg3QBC+B5Bi1SINkasaC8M4Xnw9Ju8PASea9DVpRTdcS+8bm2kkbwEDkJGLP0PdgtCf4= x-amz-request-id X775AVHMVMHWJ38C last-modified Thu, 05 Aug 2021 12:44:14 GMT etag "be969c774d19a855f566eed7fc7648d0" cache-control no-cache x-amz-version-id vUKgD2tb1azvJlvzts2by9jHgbVs9fq_ accept-ranges bytes server AmazonS3
GET H2	200	1200px-Microsoft_logo_%282012%29.svg.png upload.wikimedia.org/wikipedia/commons/thumb/9/96/Microsoft_logo_%282012%29.svg/	21 KB 22 KB	38ms 12ms	Image image/png	2620:0:862:ed1a::2:b WIKIMEDIA
General Check archive.org Show headers Download Go to Show image Full URL https://upload.wikimedia.org/wikipedia/commons/thumb/9/96/Microsoft_logo_%282012%29.svg/1200px-Microsoft_logo_%282012%29.svg.png Requested by Host: nrtw.glitch.me URL: https://nrtw.glitch.me/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:0:862:ed1a::2:b , United States, ASN14907 (WIKIMEDIA, US), Reverse DNS Software ATS/8.0.8 / Resource Hash cb1a18e7fe2e8c634beb774bb8f9398e47cfcf39c48101c43e70a6779d65df21 Security Headers Name Value Strict-Transport-Security max-age=106384710; includeSubDomains; preload Request headers Referer https://nrtw.glitch.me/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 05 Aug 2021 02:34:35 GMT nel { "report_to": "wm_nel", "max_age": 86400, "failure_fraction": 0.05, "success_fraction": 0.0} age 46788 x-cache-status hit-front x-cache cp3053 hit, cp3059 hit/1 content-disposition inline;filename*=UTF-8''Microsoft_logo_%282012%29.svg.png server-timing cache;desc="hit-front", host;desc="cp3059" content-length 21995 x-client-ip 2a01:4f8:192:5414::2 last-modified Thu, 29 Jul 2021 02:13:32 GMT server ATS/8.0.8 etag 32182617115151f436fccb53538176ed strict-transport-security max-age=106384710; includeSubDomains; preload report-to { "group": "wm_nel", "max_age": 86400, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] } content-type image/png access-control-allow-origin * x-timestamp 1627524811.08783 permissions-policy interest-cohort=() accept-ranges bytes timing-allow-origin * access-control-expose-headers Age, Date, Content-Length, Content-Range, X-Content-Duration, X-Cache
GET H2	200	folder.png spoprod-a.akamaihd.net/files/fabric-cdn-prod_20210115.001/assets/item-types/32_2x/	444 B 912 B	994ms 21ms	Image image/png	2.16.106.91 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://spoprod-a.akamaihd.net/files/fabric-cdn-prod_20210115.001/assets/item-types/32_2x/folder.png Requested by Host: nrtw.glitch.me URL: https://nrtw.glitch.me/ Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 2.16.106.91 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS a2-16-106-91.deploy.static.akamaitechnologies.com Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash e302d91cdc5ea6c82c8ff2f491c7259aedb9912894da313043ee00c7f7d08eaa Request headers Referer https://nrtw.glitch.me/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers x-ms-lease-status unlocked x-ms-blob-type BlockBlob date Thu, 05 Aug 2021 15:34:23 GMT last-modified Fri, 15 Jan 2021 19:39:57 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 content-md5 RLL5gHuYw8pCjo0/TAtEsg== etag 0x8D8B98D570EBC35 content-type image/png access-control-allow-origin * x-ms-request-id d43b9fda-a01e-00f3-0dfd-05cebb000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=17014822 x-ms-version 2009-09-19 timing-allow-origin * content-length 444
GET H2	404	microsoft-logo.png nrtw.glitch.me/_layouts/15/images/	4 KB 4 KB	199ms 198ms	Image text/html	107.23.110.216 AMAZON-AES
General Check archive.org Show headers Download Go to Show image Full URL https://nrtw.glitch.me/_layouts/15/images/microsoft-logo.png Requested by Host: nrtw.glitch.me URL: https://nrtw.glitch.me/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 107.23.110.216 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-107-23-110-216.compute-1.amazonaws.com Software / Resource Hash 5d1f9eac141b63c19a274eb9c099d629a0c4f747c8683dee8b93191b4ce0c1fd Request headers :path /_layouts/15/images/microsoft-logo.png pragma no-cache accept-encoding gzip, deflate, br accept-language en-US user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority nrtw.glitch.me referer https://nrtw.glitch.me/ :scheme https sec-fetch-site same-origin :method GET Referer https://nrtw.glitch.me/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 05 Aug 2021 15:34:23 GMT cache-control max-age=0 content-length 3616
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.2.1/	85 KB 30 KB	7ms 6ms	Script text/javascript	2a00:1450:4001:829::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js Requested by Host: nrtw.glitch.me URL: https://nrtw.glitch.me/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://nrtw.glitch.me/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 05 Aug 2021 15:08:14 GMT content-encoding gzip x-content-type-options nosniff age 1569 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30306 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Fri, 05 Aug 2022 15:08:14 GMT
GET DATA	200 OK	truncated /	2 KB 2 KB		Font application/octet-stream
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 29b7a9358abdc68c51db5a5af4a4f4e2e041a67527adee2366b1f84f116fe9a5 Request headers Origin https://nrtw.glitch.me Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type application/octet-stream

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OneDrive (Online)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
nrtw.glitch.me
spoprod-a.akamaihd.net
upload.wikimedia.org
107.23.110.216
2.16.106.91
2620:0:862:ed1a::2:b
2a00:1450:4001:829::200a
29b7a9358abdc68c51db5a5af4a4f4e2e041a67527adee2366b1f84f116fe9a5
5d1f9eac141b63c19a274eb9c099d629a0c4f747c8683dee8b93191b4ce0c1fd
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
9f1ea668eb8c9be0fbf15fb3af89c7bfcb04bfa248020972a4905d25fe25770d
cb1a18e7fe2e8c634beb774bb8f9398e47cfcf39c48101c43e70a6779d65df21
e302d91cdc5ea6c82c8ff2f491c7259aedb9912894da313043ee00c7f7d08eaa