![](/screenshots/755c44d6-a3c8-4d39-a5cd-6821b0bae8be.png)
zigzag-diamond-vessel.glitch.me
Open in
urlscan Pro
18.205.205.44
Malicious Activity!
Public Scan
Effective URL: https://zigzag-diamond-vessel.glitch.me/1314.html
Submission: On April 08 via manual from US — Scanned from CA
Summary
TLS certificate: Issued by Amazon on February 1st 2022. Valid for: a year.
This is the only time zigzag-diamond-vessel.glitch.me was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Outlook Web Access (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 198.50.137.113 198.50.137.113 | 16276 (OVH) (OVH) | |
1 3 | 185.176.43.108 185.176.43.108 | 44476 (ZETTA-AS) (ZETTA-AS) | |
2 | 18.205.205.44 18.205.205.44 | 14618 (AMAZON-AES) (AMAZON-AES) | |
2 2 | 2607:f8b0:400... 2607:f8b0:4006:820::2004 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2607:f8b0:400... 2607:f8b0:4006:806::2004 | 15169 (GOOGLE) (GOOGLE) | |
3 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:3b | 20446 (STACKPATH...) (STACKPATH-CDN) | |
2 | 2606:4700::68... 2606:4700::6811:180e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
4 | 2606:4700::68... 2606:4700::6812:bcf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2607:f8b0:400... 2607:f8b0:4006:81f::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2607:f8b0:400... 2607:f8b0:4006:81c::2004 | 15169 (GOOGLE) (GOOGLE) | |
17 | 10 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-18-205-205-44.compute-1.amazonaws.com
zigzag-diamond-vessel.glitch.me |
ASN13335 (CLOUDFLARENET, US)
stackpath.bootstrapcdn.com | |
maxcdn.bootstrapcdn.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
bootstrapcdn.com
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 2388 maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 682 |
54 KB |
3 |
jquery.com
code.jquery.com — Cisco Umbrella Rank: 647 |
77 KB |
3 |
scienceontheweb.net
1 redirects
kingnonny.scienceontheweb.net |
1 KB |
2 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 238 |
13 KB |
2 |
gstatic.com
t2.gstatic.com t0.gstatic.com |
2 KB |
2 |
google.com
2 redirects
www.google.com — Cisco Umbrella Rank: 4 |
397 B |
2 |
glitch.me
zigzag-diamond-vessel.glitch.me |
48 KB |
1 |
googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 282 |
30 KB |
1 |
abseilersrus.com.au
bag.abseilersrus.com.au |
684 B |
17 | 9 |
Domain | Requested by | |
---|---|---|
3 | code.jquery.com |
zigzag-diamond-vessel.glitch.me
|
3 | kingnonny.scienceontheweb.net |
1 redirects
bag.abseilersrus.com.au
kingnonny.scienceontheweb.net |
2 | maxcdn.bootstrapcdn.com |
zigzag-diamond-vessel.glitch.me
|
2 | stackpath.bootstrapcdn.com |
zigzag-diamond-vessel.glitch.me
|
2 | cdnjs.cloudflare.com |
zigzag-diamond-vessel.glitch.me
|
2 | www.google.com | 2 redirects |
2 | zigzag-diamond-vessel.glitch.me |
kingnonny.scienceontheweb.net
zigzag-diamond-vessel.glitch.me |
1 | t0.gstatic.com |
zigzag-diamond-vessel.glitch.me
|
1 | ajax.googleapis.com |
zigzag-diamond-vessel.glitch.me
|
1 | t2.gstatic.com |
zigzag-diamond-vessel.glitch.me
|
1 | bag.abseilersrus.com.au | |
17 | 11 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
glitch.com Amazon |
2022-02-01 - 2023-03-02 |
a year | crt.sh |
*.jquery.com Sectigo RSA Domain Validation Secure Server CA |
2021-07-14 - 2022-08-14 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-09-21 - 2022-09-20 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2022-03-21 - 2022-06-13 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://zigzag-diamond-vessel.glitch.me/1314.html
Frame ID: 51CA9D05C3C92AF398C66301844C6F7A
Requests: 23 HTTP requests in this frame
Screenshot
![](/screenshots/755c44d6-a3c8-4d39-a5cd-6821b0bae8be.png)
Page Title
OutlookPage URL History Show full URLs
- http://bag.abseilersrus.com.au/cardowa.html Page URL
- http://kingnonny.scienceontheweb.net/hash.html Page URL
-
http://kingnonny.scienceontheweb.net/function.php?cardinal=bWFybG9ucGFpZ2VAZ21haWwuY29tIG9uIHNreXBl&email=anna.am...
HTTP 302
http://kingnonny.scienceontheweb.net/base.php?newadd=&email=anna.ameduri%20@%20glidewelldental.com&you=YW5uYS5hbW... Page URL
- https://zigzag-diamond-vessel.glitch.me/1314.html Page URL
Detected technologies
![](/vendor/wappa/icons/Bootstrap.png)
Detected patterns
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
![](/vendor/wappa/icons/Popper.png)
Detected patterns
- /popper\.js/([0-9.]+)
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- /([\d.]+)/jquery(?:\.min)?\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- http://bag.abseilersrus.com.au/cardowa.html Page URL
- http://kingnonny.scienceontheweb.net/hash.html Page URL
-
http://kingnonny.scienceontheweb.net/function.php?cardinal=bWFybG9ucGFpZ2VAZ21haWwuY29tIG9uIHNreXBl&email=anna.ameduri%20@%20glidewelldental.com
HTTP 302
http://kingnonny.scienceontheweb.net/base.php?newadd=&email=anna.ameduri%20@%20glidewelldental.com&you=YW5uYS5hbWVkdXJpIEAgZ2xpZGV3ZWxsZGVudGFsLmNvbQ== Page URL
- https://zigzag-diamond-vessel.glitch.me/1314.html Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 2- http://kingnonny.scienceontheweb.net/function.php?cardinal=bWFybG9ucGFpZ2VAZ21haWwuY29tIG9uIHNreXBl&email=anna.ameduri%20@%20glidewelldental.com HTTP 302
- http://kingnonny.scienceontheweb.net/base.php?newadd=&email=anna.ameduri%20@%20glidewelldental.com&you=YW5uYS5hbWVkdXJpIEAgZ2xpZGV3ZWxsZGVudGFsLmNvbQ==
- https://www.google.com/s2/favicons?domain=king.com HTTP 301
- https://t2.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://king.com&size=16
- https://www.google.com/s2/favicons?domain=glidewelldental.com HTTP 301
- https://t0.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://glidewelldental.com&size=16
17 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
cardowa.html
bag.abseilersrus.com.au/ |
460 B 684 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
hash.html
kingnonny.scienceontheweb.net/ |
704 B 893 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
base.php
kingnonny.scienceontheweb.net/ Redirect Chain
|
120 B 308 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
1314.html
zigzag-diamond-vessel.glitch.me/ |
47 KB 48 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
faviconV2
t2.gstatic.com/ Redirect Chain
|
543 B 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.3.1.min.js
code.jquery.com/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/ |
20 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/ |
49 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.3.1.slim.min.js
code.jquery.com/ |
68 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/ |
36 KB 11 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.2.1.slim.min.js
code.jquery.com/ |
68 KB 23 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ |
19 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ |
48 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ |
84 KB 30 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/ |
50 KB 15 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
8 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
1 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
segoeui-regular.ttf
zigzag-diamond-vessel.glitch.me/owa/auth/15.1.1591/themes/resources/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
faviconV2
t0.gstatic.com/ Redirect Chain
|
268 B 937 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Outlook Web Access (Online)13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
function| structuredClone object| oncontextlost object| oncontextrestored function| getScreenDetails object| mainLogonDiv function| $ function| jQuery function| Popper object| bootstrap string| feedUpdateResponse object| feedUpdateSplit number| x string| che0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
bag.abseilersrus.com.au
cdnjs.cloudflare.com
code.jquery.com
kingnonny.scienceontheweb.net
maxcdn.bootstrapcdn.com
stackpath.bootstrapcdn.com
t0.gstatic.com
t2.gstatic.com
www.google.com
zigzag-diamond-vessel.glitch.me
18.205.205.44
185.176.43.108
198.50.137.113
2001:4de0:ac18::1:a:3b
2606:4700::6811:180e
2606:4700::6812:bcf
2607:f8b0:4006:806::2004
2607:f8b0:4006:81c::2004
2607:f8b0:4006:81f::200a
2607:f8b0:4006:820::2004
02835066969199e9924f1332f7172a5d7e552f023a20c3d8ba03bb6c51ce5be5
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
07f38b8b8c1f96ed85ecd96988f0454a95d1f665427086a507c72e55ff3ce0e7
08c9e8f26b59a3c6c4833d015ecaac6f99aa3e3449e4ebd547c326d7cf286415
0bca10549df770ab6790046799e5a9e920c286453ebbb2afb0d3055339245339
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
4de8fc175826d9f78fce9f9f2b71a63fe832fc7507e0394125c823b0909fa54a
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
6710ee6e22d5e3e82f70554804806c37aac5789b110d944383ea393d93eb627a
765867e7511714fef4824379993256d901c7560ea51fd971835ec3616240daca
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
a39fa77ff14b57760c5f8e521a71ef1a02f524e7008bcffdb5256f5635610d5e
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
a7c14ee84d81a536a4cd54e3a144f388f2174a4a5c409ae118ea49f0da6b4aa6
ccf4e634885f1b781a48293600c46565842d6ce6c941b1cedeabf382de5740ce
d9ed6586942003696afe4e52b09f343f8342244b51a9e175b75162d7e615207b
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b