amber-like-hellebore.glitch.me
Open in
urlscan Pro
54.157.90.217
Malicious Activity!
Public Scan
Submission: On May 30 via api from US — Scanned from DE
Summary
TLS certificate: Issued by Amazon RSA 2048 M03 on December 4th 2023. Valid for: a year.
This is the only time amber-like-hellebore.glitch.me was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Sharepoint (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 54.157.90.217 54.157.90.217 | 14618 (AMAZON-AES) (AMAZON-AES) | |
2 | 2a04:4e42::485 2a04:4e42::485 | 54113 (FASTLY) (FASTLY) | |
4 | 104.21.235.69 104.21.235.69 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 199.232.196.193 199.232.196.193 | 54113 (FASTLY) (FASTLY) | |
9 | 4 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-54-157-90-217.compute-1.amazonaws.com
amber-like-hellebore.glitch.me |
Apex Domain Subdomains |
Transfer | |
---|---|---|
4 |
iili.io
iili.io — Cisco Umbrella Rank: 44461 |
22 KB |
2 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 310 |
59 KB |
2 |
glitch.me
amber-like-hellebore.glitch.me |
6 KB |
1 |
imgur.com
i.imgur.com — Cisco Umbrella Rank: 7840 |
|
9 | 4 |
Domain | Requested by | |
---|---|---|
4 | iili.io |
amber-like-hellebore.glitch.me
|
2 | cdn.jsdelivr.net |
amber-like-hellebore.glitch.me
|
2 | amber-like-hellebore.glitch.me | |
1 | i.imgur.com |
amber-like-hellebore.glitch.me
|
9 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
glitch.com Amazon RSA 2048 M03 |
2023-12-04 - 2025-01-01 |
a year | crt.sh |
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2023 Q3 |
2023-09-27 - 2024-10-28 |
a year | crt.sh |
iili.io E1 |
2024-04-03 - 2024-07-02 |
3 months | crt.sh |
*.imgur.com Sectigo RSA Domain Validation Secure Server CA |
2024-02-15 - 2025-02-14 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://amber-like-hellebore.glitch.me/
Frame ID: F3BDF049DA9DB19455D586559517D0D7
Requests: 9 HTTP requests in this frame
Screenshot
Page Title
Share PointDetected technologies
Bootstrap (Web Frameworks) ExpandDetected patterns
- <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
- bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
jsDelivr (CDN) Expand
Detected patterns
- <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
amber-like-hellebore.glitch.me/ |
2 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/ |
227 KB 34 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
JWGZ4SI.jpg
iili.io/ |
4 KB 5 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
JWM95sn.png
iili.io/ |
6 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
JWM98mB.png
iili.io/ |
6 KB 7 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
JWM9veV.png
iili.io/ |
3 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.bundle.min.js
cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/js/ |
79 KB 25 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
itghkuI.mp4
i.imgur.com/ |
3 MB 0 |
Media
video/mp4 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
amber-like-hellebore.glitch.me/ |
4 KB 4 KB |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Sharepoint (Online)2 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
number| uidEvent object| bootstrap0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
amber-like-hellebore.glitch.me
cdn.jsdelivr.net
i.imgur.com
iili.io
104.21.235.69
199.232.196.193
2a04:4e42::485
54.157.90.217
2784f6ffefbd5fcae302d112e1629907deed1e36f9c2050ea6d7038eec3f649c
366bbfc35dcf61144966072a06f0af6516524277c5af0e3d1e90583d35425308
4c5dd7de6771a53e4d1e5af8b8cde7a66392873a0d53522cc2ba8dc90ef83ce6
6f57e04f440bf20be8a6c12471c3ca39db32091aeb45dd569499393045a7ffd1
7f1d37f0d90b6385354c2ac10e2bb91563c46bd7a266ed351222ebcac8496c2a
aa53d582f97eb594c2a5cc5824574707f9ba9837bce3046bfa5f3556860f4e04
dbca210f1f945c932af2f7a0605e31b2e61644929c065eb7990f99e7bceedfd4
ef074cbad951b08e1161a248aa52ecf3c6d526e8b40729a05eccd3728397221b