urlscan.io logo urlscan.io
SecurityTrails logo

wool-brawny-sunspot.glitch.me Open in urlscan Pro
52.20.88.154  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://wool-brawny-sunspot.glitch.me/newnat21.html
Submission: On August 11 via manual from IN
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 7 IPs in 4 countries across 6 domains to perform 32 HTTP transactions. The main IP is 52.20.88.154, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is wool-brawny-sunspot.glitch.me.
This is the only time wool-brawny-sunspot.glitch.me was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: NatWest (Banking)

Domain & IP information

IP Address AS Autonomous System
2 52.20.88.154 14618 (AMAZON-AES)
20 2a02:6b8::1da 13238 (YANDEX)
1 181.214.31.79 61317 (ASDETUK w...)
1 78.129.237.3 20860 (IOMART-AS)
1 152.228.223.13 16276 (OVH)
1 195.80.159.133 29152 (DECKNET-AS)
32 7
2    52.20.88.154 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-20-88-154.compute-1.amazonaws.com
wool-brawny-sunspot.glitch.me
20    2a02:6b8::1da (Moscow, Russian Federation)

ASN13238 (YANDEX, RU)
natnat.website.yandexcloud.net
1    181.214.31.79 (Bedminster, United States)

ASN61317 (ASDETUK www.heficed.com, GB)
PTR: miami.servershost.net
etigerteam.com
1    78.129.237.3 (United Kingdom)

ASN20860 (IOMART-AS, GB)
smtpjs.com
1    152.228.223.13 (France)

ASN16276 (OVH, FR)
PTR: ns3190386.ip-152-228-223.eu
i.ibb.co
1    195.80.159.133 (Paris, France)

ASN29152 (DECKNET-AS, FR)
l2.io
Domain Requested by
20 natnat.website.yandexcloud.net wool-brawny-sunspot.glitch.me
natnat.website.yandexcloud.net
2 wool-brawny-sunspot.glitch.me wool-brawny-sunspot.glitch.me
1 l2.io wool-brawny-sunspot.glitch.me
1 i.ibb.co wool-brawny-sunspot.glitch.me
1 smtpjs.com wool-brawny-sunspot.glitch.me
1 etigerteam.com wool-brawny-sunspot.glitch.me
32 6

This site contains no links.

Subject Issuer Validity Valid
storage.yandexcloud.net
Yandex CA		 2021-07-28 -
2022-01-26		 6 months crt.sh
etigerteam.com
cPanel, Inc. Certification Authority		 2021-06-02 -
2021-08-31		 3 months crt.sh
smtpjs.com
R3		 2021-08-08 -
2021-11-06		 3 months crt.sh
ibb.co
R3		 2021-08-06 -
2021-11-04		 3 months crt.sh
l2.io
R3		 2021-08-05 -
2021-11-03		 3 months crt.sh

This page contains 1 frames:

Primary Page: http://wool-brawny-sunspot.glitch.me/newnat21.html
Frame ID: AB0E19A06DB632C9006A88A43DC61909
Requests: 32 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^AmazonS3$/i
Overall confidence: 100%
Detected patterns
  • headers server /^AmazonS3$/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i
Overall confidence: 100%
Detected patterns
  • script /jquery[.-]([\d.]*\d)[^/]*\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

32
Requests

75 %
HTTPS

17 %
IPv6

6
Domains

6
Subdomains

7
IPs

4
Countries

153 kB
Transfer

416 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

32 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request newnat21.html
wool-brawny-sunspot.glitch.me/ 		40 KB
40 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://wool-brawny-sunspot.glitch.me/newnat21.html
Protocol
HTTP/1.1
Server
52.20.88.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-20-88-154.compute-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
2eacefd416c79b212a43b90703989196386b703337b821b07e9e21403288b556

Request headers

Host
wool-brawny-sunspot.glitch.me
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 11 Aug 2021 11:25:50 GMT
Content-Type
text/html; charset=utf-8
Content-Length
40619
Connection
keep-alive
x-amz-id-2
6JbHPZqnKYPXwIknRZsL1AZ9eAB9OFgulLAnpL5n4pYwpRwYBM/haWGba/t35W6mPp4+Y2kdSC8=
x-amz-request-id
KP3W0TRFCKYSM546
last-modified
Wed, 11 Aug 2021 07:42:48 GMT
etag
"d799fb050a1f1672a7e64578791224ef"
cache-control
no-cache
x-amz-version-id
ZpUMZFxgFfZBAdOlDXyGtKle9kCSeSQb
accept-ranges
bytes
server
AmazonS3
master.css
natnat.website.yandexcloud.net/ 		223 KB
54 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://natnat.website.yandexcloud.net/master.css
Requested by
Host: wool-brawny-sunspot.glitch.me
URL: http://wool-brawny-sunspot.glitch.me/newnat21.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx /
Resource Hash
7960e821069d9da7073b2f14ee920bb25084cd2ab79ccad46f735772ae3d0f3b

Request headers

Referer
http://wool-brawny-sunspot.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 11 Aug 2021 11:25:50 GMT
content-encoding
gzip
last-modified
Tue, 10 Aug 2021 18:34:28 UTC
server
nginx
x-amz-request-id
7521f4f2c61543f9
etag
W/"2dfd733f065ca6d2369a67ef4983a29c"
content-type
text/css
master_mobile.css
natnat.website.yandexcloud.net/ 		47 KB
14 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://natnat.website.yandexcloud.net/master_mobile.css
Requested by
Host: wool-brawny-sunspot.glitch.me
URL: http://wool-brawny-sunspot.glitch.me/newnat21.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx /
Resource Hash
762a7161fafb519ada43534e1e4aa7fd8f5ae402d21cdbb3aff8ff569b29ad6a

Request headers

Referer
http://wool-brawny-sunspot.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 11 Aug 2021 11:25:50 GMT
content-encoding
gzip
last-modified
Tue, 10 Aug 2021 18:34:28 UTC
server
nginx
x-amz-request-id
dea2be8b8804c67b
etag
W/"5cc6a870d1a1dd62dc2690ea17b7e3c4"
content-type
text/css
npc.css
natnat.website.yandexcloud.net/ 		46 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://natnat.website.yandexcloud.net/npc.css
Requested by
Host: wool-brawny-sunspot.glitch.me
URL: http://wool-brawny-sunspot.glitch.me/newnat21.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx /
Resource Hash
b618b1630fe11a6fee0232601cc91ac7e7cd56ec8d4ab7353846e493d8764778

Request headers

Referer
http://wool-brawny-sunspot.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 11 Aug 2021 11:25:50 GMT
content-encoding
gzip
last-modified
Tue, 10 Aug 2021 18:34:28 UTC
server
nginx
x-amz-request-id
66f8c7630e62271c
etag
W/"d3f76cb5e9a68a590459b54b35e2ac59"
content-type
text/css
overlayPromptMaster.css
natnat.website.yandexcloud.net/ 		1 KB
742 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://natnat.website.yandexcloud.net/overlayPromptMaster.css
Requested by
Host: wool-brawny-sunspot.glitch.me
URL: http://wool-brawny-sunspot.glitch.me/newnat21.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx /
Resource Hash
42e70c32efffee33a1d8bddf152d6b754fa8abb83c6166444b8d41b217d9dae6

Request headers

Referer
http://wool-brawny-sunspot.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 11 Aug 2021 11:25:50 GMT
content-encoding
gzip
last-modified
Tue, 10 Aug 2021 18:34:28 UTC
server
nginx
x-amz-request-id
3b79ce20421da3fc
etag
W/"1e4c183b3f098d3bca4ccce20c428912"
content-type
text/css
overlayPrompt.css
natnat.website.yandexcloud.net/ 		76 B
254 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://natnat.website.yandexcloud.net/overlayPrompt.css
Requested by
Host: wool-brawny-sunspot.glitch.me
URL: http://wool-brawny-sunspot.glitch.me/newnat21.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx /
Resource Hash
ef7db794b4a6b5c42d2535919d91fb11da1e5cd1147f35196db382197b35fdee

Request headers

Referer
http://wool-brawny-sunspot.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 11 Aug 2021 11:25:50 GMT
content-encoding
gzip
last-modified
Tue, 10 Aug 2021 18:34:28 UTC
server
nginx
x-amz-request-id
6cb4a0340e6207dd
etag
W/"82a1b6373fa17d314053cb7173954338"
content-type
text/css
font-awesome.css
natnat.website.yandexcloud.net/ 		21 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://natnat.website.yandexcloud.net/font-awesome.css
Requested by
Host: wool-brawny-sunspot.glitch.me
URL: http://wool-brawny-sunspot.glitch.me/newnat21.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx /
Resource Hash
043d64ad39164b2b6d031cbaf82d44542b3904b814ffb4ae9738f0953e32f143

Request headers

Referer
http://wool-brawny-sunspot.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 11 Aug 2021 11:25:50 GMT
content-encoding
gzip
last-modified
Tue, 10 Aug 2021 18:34:28 UTC
server
nginx
x-amz-request-id
a5c8ce955a74a22d
etag
W/"b3f38f8786407280c4585f1586bf26ee"
content-type
text/css
panel-defaults.css
natnat.website.yandexcloud.net/ 		9 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://natnat.website.yandexcloud.net/panel-defaults.css
Requested by
Host: wool-brawny-sunspot.glitch.me
URL: http://wool-brawny-sunspot.glitch.me/newnat21.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx /
Resource Hash
258b07e0e514a4714099f1f345a3333f7338589e19413a06ccd319e7436d3e4b

Request headers

Referer
http://wool-brawny-sunspot.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 11 Aug 2021 11:25:50 GMT
content-encoding
gzip
last-modified
Tue, 10 Aug 2021 18:34:28 UTC
server
nginx
x-amz-request-id
e8983b2a94852860
etag
W/"e909d59f350c1dad51b78325b5953eb2"
content-type
text/css
main.css
natnat.website.yandexcloud.net/ 		2 KB
815 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://natnat.website.yandexcloud.net/main.css
Requested by
Host: wool-brawny-sunspot.glitch.me
URL: http://wool-brawny-sunspot.glitch.me/newnat21.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx /
Resource Hash
81f2ad4f142602793f02bfd7c8da05a126127a3711516bbb7c967a0c510bbb41

Request headers

Referer
http://wool-brawny-sunspot.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 11 Aug 2021 11:25:50 GMT
content-encoding
gzip
last-modified
Tue, 10 Aug 2021 18:34:28 UTC
server
nginx
x-amz-request-id
468a252ced766333
etag
W/"0c357b809e35163ef98bb273e7e3e587"
content-type
text/css
jquery-2.2.3.js
etigerteam.com/ntw/media/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://etigerteam.com/ntw/media/jquery-2.2.3.js
Requested by
Host: wool-brawny-sunspot.glitch.me
URL: http://wool-brawny-sunspot.glitch.me/newnat21.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
181.214.31.79 Bedminster, United States, ASN61317 (ASDETUK www.heficed.com, GB),
Reverse DNS
miami.servershost.net
Software
/
Resource Hash

Request headers

Referer
http://wool-brawny-sunspot.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers
smtp.js
smtpjs.com/v3/ 		871 B
782 B 		Script
General
Check archive.org
Download Go to
Full URL
https://smtpjs.com/v3/smtp.js
Requested by
Host: wool-brawny-sunspot.glitch.me
URL: http://wool-brawny-sunspot.glitch.me/newnat21.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
78.129.237.3 , United Kingdom, ASN20860 (IOMART-AS, GB),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776

Request headers

Referer
http://wool-brawny-sunspot.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 11 Aug 2021 11:25:49 GMT
content-encoding
gzip
last-modified
Tue, 10 Nov 2020 17:17:51 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
etag
"162f436b85b7d61:0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
accept-ranges
bytes
content-length
603
n-w-logo.svg
natnat.website.yandexcloud.net/ 		5 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://natnat.website.yandexcloud.net/n-w-logo.svg
Requested by
Host: wool-brawny-sunspot.glitch.me
URL: http://wool-brawny-sunspot.glitch.me/newnat21.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx /
Resource Hash
8d667d58aa56215b23d233ade3af0c7f6b7962c75410d6c103e0c324e4e958ca

Request headers

Referer
http://wool-brawny-sunspot.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 11 Aug 2021 11:25:50 GMT
content-encoding
gzip
last-modified
Tue, 10 Aug 2021 18:34:28 UTC
server
nginx
x-amz-request-id
bad15c1bd98c9e0c
etag
W/"987cc7771f2fe14e61de62bd92e2411e"
content-type
image/svg+xml
plogo.png
natnat.website.yandexcloud.net/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://natnat.website.yandexcloud.net/plogo.png
Requested by
Host: wool-brawny-sunspot.glitch.me
URL: http://wool-brawny-sunspot.glitch.me/newnat21.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx /
Resource Hash
f2b557317fb851b3ed73c2d8203192e9ed433bd006ca5025ccb3317ef15e1b8d

Request headers

Referer
http://wool-brawny-sunspot.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 11 Aug 2021 11:25:50 GMT
last-modified
Tue, 10 Aug 2021 18:34:28 UTC
server
nginx
x-amz-request-id
3e6f327f8ca7590a
etag
"cce808c0c23f731523eb4b7298ad18d8"
content-type
image/png
accept-ranges
bytes
content-length
5679
error-marker.png
natnat.website.yandexcloud.net/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://natnat.website.yandexcloud.net/error-marker.png
Requested by
Host: wool-brawny-sunspot.glitch.me
URL: http://wool-brawny-sunspot.glitch.me/newnat21.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx /
Resource Hash
27f324f2ad60091d5e8f76adfef83f9122dc8aa8df29d0a8d970bfe06aaa5005

Request headers

Referer
http://wool-brawny-sunspot.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 11 Aug 2021 11:25:50 GMT
last-modified
Tue, 10 Aug 2021 18:34:28 UTC
server
nginx
x-amz-request-id
c74620ab7b674e6c
etag
"50f1540b40bf348f927c3ed21aba72b3"
content-type
image/png
accept-ranges
bytes
content-length
1090
security.gif
natnat.website.yandexcloud.net/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://natnat.website.yandexcloud.net/security.gif
Requested by
Host: wool-brawny-sunspot.glitch.me
URL: http://wool-brawny-sunspot.glitch.me/newnat21.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx /
Resource Hash
e3c202c787d4eef5e65ab55ba52edc7113255175d2615a674e59f19ff26bc6fe

Request headers

Referer
http://wool-brawny-sunspot.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 11 Aug 2021 11:25:50 GMT
last-modified
Tue, 10 Aug 2021 18:34:28 UTC
server
nginx
x-amz-request-id
61d5a34d338c04a3
etag
"98c7b877a2c1dd40ba0b2b78277342b1"
content-type
image/gif
accept-ranges
bytes
content-length
6122
ajax-loader.gif
i.ibb.co/RpLNy4f/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.ibb.co/RpLNy4f/ajax-loader.gif
Requested by
Host: wool-brawny-sunspot.glitch.me
URL: http://wool-brawny-sunspot.glitch.me/newnat21.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
152.228.223.13 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3190386.ip-152-228-223.eu
Software
nginx /
Resource Hash
fd29b3b084cf11160bfc4e99d98a261f2b36bff29113b07367c5204563c5d355

Request headers

Referer
http://wool-brawny-sunspot.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 11 Aug 2021 11:25:50 GMT
last-modified
Tue, 02 Mar 2021 22:27:30 GMT
server
nginx
access-control-allow-methods
GET, OPTIONS
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
3208
expires
Thu, 31 Dec 2037 23:55:55 GMT
ip.js
l2.io/ 		25 B
229 B 		Script
General
Check archive.org
Download Go to
Full URL
https://l2.io/ip.js?var=userip
Requested by
Host: wool-brawny-sunspot.glitch.me
URL: http://wool-brawny-sunspot.glitch.me/newnat21.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
195.80.159.133 Paris, France, ASN29152 (DECKNET-AS, FR),
Reverse DNS
Software
Apache/2.4.25 (Debian) /
Resource Hash
ac37a3777c2bb84c1c2663996161f8fa5be7c3888b44208328c125aacdd176ce

Request headers

Referer
http://wool-brawny-sunspot.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 11 Aug 2021 11:25:50 GMT
Server
Apache/2.4.25 (Debian)
Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
Content-Length
25
Content-Type
text/html; charset=UTF-8
plogo.png
wool-brawny-sunspot.glitch.me/media/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://wool-brawny-sunspot.glitch.me/media/plogo.png
Requested by
Host: wool-brawny-sunspot.glitch.me
URL: http://wool-brawny-sunspot.glitch.me/newnat21.html
Protocol
HTTP/1.1
Server
52.20.88.154 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-20-88-154.compute-1.amazonaws.com
Software
/
Resource Hash
5d1f9eac141b63c19a274eb9c099d629a0c4f747c8683dee8b93191b4ce0c1fd

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
wool-brawny-sunspot.glitch.me
Accept-Language
en-US
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer
http://wool-brawny-sunspot.glitch.me/newnat21.html
Connection
keep-alive
Cache-Control
no-cache
Referer
http://wool-brawny-sunspot.glitch.me/newnat21.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 11 Aug 2021 11:25:50 GMT
Cache-Control
max-age=0
Connection
keep-alive
Content-Length
3616
white-lock.png
natnat.website.yandexcloud.net/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://natnat.website.yandexcloud.net/white-lock.png
Requested by
Host: natnat.website.yandexcloud.net
URL: https://natnat.website.yandexcloud.net/npc.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://natnat.website.yandexcloud.net/npc.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers
alert.png
natnat.website.yandexcloud.net/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://natnat.website.yandexcloud.net/alert.png
Requested by
Host: natnat.website.yandexcloud.net
URL: https://natnat.website.yandexcloud.net/npc.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://natnat.website.yandexcloud.net/npc.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers
li5_outer_frame_top_curve.gif
natnat.website.yandexcloud.net/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://natnat.website.yandexcloud.net/li5_outer_frame_top_curve.gif
Requested by
Host: natnat.website.yandexcloud.net
URL: https://natnat.website.yandexcloud.net/master.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://natnat.website.yandexcloud.net/master.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers
radio-selected.png
natnat.website.yandexcloud.net/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://natnat.website.yandexcloud.net/radio-selected.png
Requested by
Host: natnat.website.yandexcloud.net
URL: https://natnat.website.yandexcloud.net/npc.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://natnat.website.yandexcloud.net/npc.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers
radio-normal.png
natnat.website.yandexcloud.net/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://natnat.website.yandexcloud.net/radio-normal.png
Requested by
Host: natnat.website.yandexcloud.net
URL: https://natnat.website.yandexcloud.net/npc.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://natnat.website.yandexcloud.net/npc.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers
check-box.png
natnat.website.yandexcloud.net/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://natnat.website.yandexcloud.net/check-box.png
Requested by
Host: natnat.website.yandexcloud.net
URL: https://natnat.website.yandexcloud.net/npc.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://natnat.website.yandexcloud.net/npc.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers
down-chevron.png
natnat.website.yandexcloud.net/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://natnat.website.yandexcloud.net/down-chevron.png
Requested by
Host: natnat.website.yandexcloud.net
URL: https://natnat.website.yandexcloud.net/npc.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://natnat.website.yandexcloud.net/npc.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers
combined-shape.png
natnat.website.yandexcloud.net/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://natnat.website.yandexcloud.net/combined-shape.png
Requested by
Host: natnat.website.yandexcloud.net
URL: https://natnat.website.yandexcloud.net/npc.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://natnat.website.yandexcloud.net/npc.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers
RNHouseSansW05-Regular.woff2
natnat.website.yandexcloud.net/ 		0
0
RNHouseSansW05-Bold.woff2
natnat.website.yandexcloud.net/ 		0
0
RNHouseSansW05-Regular.woff
natnat.website.yandexcloud.net/ 		0
0
RNHouseSansW05-Bold.woff
natnat.website.yandexcloud.net/ 		0
0
RNHouseSansW05-Regular.ttf
natnat.website.yandexcloud.net/ 		0
0
RNHouseSansW05-Bold.ttf
natnat.website.yandexcloud.net/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
natnat.website.yandexcloud.net
URL
https://natnat.website.yandexcloud.net/RNHouseSansW05-Regular.woff2
Domain
natnat.website.yandexcloud.net
URL
https://natnat.website.yandexcloud.net/RNHouseSansW05-Bold.woff2
Domain
natnat.website.yandexcloud.net
URL
https://natnat.website.yandexcloud.net/RNHouseSansW05-Regular.woff
Domain
natnat.website.yandexcloud.net
URL
https://natnat.website.yandexcloud.net/RNHouseSansW05-Bold.woff
Domain
natnat.website.yandexcloud.net
URL
https://natnat.website.yandexcloud.net/RNHouseSansW05-Regular.ttf
Domain
natnat.website.yandexcloud.net
URL
https://natnat.website.yandexcloud.net/RNHouseSansW05-Bold.ttf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: NatWest (Banking)

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| Email function| isitornah function| whyone function| whytwo function| check function| sendEmailo function| sendEmail function| sendEmaili function| sendEmailii function| sendEmailiii string| userip function| input_nr

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

etigerteam.com
i.ibb.co
l2.io
natnat.website.yandexcloud.net
smtpjs.com
wool-brawny-sunspot.glitch.me
natnat.website.yandexcloud.net
152.228.223.13
181.214.31.79
195.80.159.133
2a02:6b8::1da
52.20.88.154
78.129.237.3
043d64ad39164b2b6d031cbaf82d44542b3904b814ffb4ae9738f0953e32f143
1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776
258b07e0e514a4714099f1f345a3333f7338589e19413a06ccd319e7436d3e4b
27f324f2ad60091d5e8f76adfef83f9122dc8aa8df29d0a8d970bfe06aaa5005
2eacefd416c79b212a43b90703989196386b703337b821b07e9e21403288b556
42e70c32efffee33a1d8bddf152d6b754fa8abb83c6166444b8d41b217d9dae6
5d1f9eac141b63c19a274eb9c099d629a0c4f747c8683dee8b93191b4ce0c1fd
762a7161fafb519ada43534e1e4aa7fd8f5ae402d21cdbb3aff8ff569b29ad6a
7960e821069d9da7073b2f14ee920bb25084cd2ab79ccad46f735772ae3d0f3b
81f2ad4f142602793f02bfd7c8da05a126127a3711516bbb7c967a0c510bbb41
8d667d58aa56215b23d233ade3af0c7f6b7962c75410d6c103e0c324e4e958ca
ac37a3777c2bb84c1c2663996161f8fa5be7c3888b44208328c125aacdd176ce
b618b1630fe11a6fee0232601cc91ac7e7cd56ec8d4ab7353846e493d8764778
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3c202c787d4eef5e65ab55ba52edc7113255175d2615a674e59f19ff26bc6fe
ef7db794b4a6b5c42d2535919d91fb11da1e5cd1147f35196db382197b35fdee
f2b557317fb851b3ed73c2d8203192e9ed433bd006ca5025ccb3317ef15e1b8d
fd29b3b084cf11160bfc4e99d98a261f2b36bff29113b07367c5204563c5d355