![](/screenshots/9ba30fc8-5ee4-418b-82cb-36b2a495c84f.png)
useful-closed-dogsled.glitch.me
Open in
urlscan Pro
34.225.219.45
Malicious Activity!
Public Scan
Submission: On November 26 via manual from HU — Scanned from CA
Summary
TLS certificate: Issued by Amazon RSA 2048 M01 on February 22nd 2023. Valid for: a year.
This is the only time useful-closed-dogsled.glitch.me was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 34.225.219.45 34.225.219.45 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 | 142.251.163.99 142.251.163.99 | 15169 (GOOGLE) (GOOGLE) | |
1 | 104.17.25.14 104.17.25.14 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 172.253.62.95 172.253.62.95 | 15169 (GOOGLE) (GOOGLE) | |
1 | 152.199.4.44 152.199.4.44 | 15133 (EDGECAST) (EDGECAST) | |
1 | 104.16.123.96 104.16.123.96 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
6 | 6 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-34-225-219-45.compute-1.amazonaws.com
useful-closed-dogsled.glitch.me |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 223 cf-assets.www.cloudflare.com — Cisco Umbrella Rank: 148271 |
276 KB |
1 |
msftauth.net
aadcdn.msftauth.net — Cisco Umbrella Rank: 1018 |
17 KB |
1 |
googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 31 |
1 KB |
1 |
google.com
www.google.com — Cisco Umbrella Rank: 2 |
|
1 |
glitch.me
useful-closed-dogsled.glitch.me |
105 KB |
6 | 5 |
Domain | Requested by | |
---|---|---|
1 | cf-assets.www.cloudflare.com |
useful-closed-dogsled.glitch.me
|
1 | aadcdn.msftauth.net |
useful-closed-dogsled.glitch.me
|
1 | fonts.googleapis.com |
useful-closed-dogsled.glitch.me
|
1 | cdnjs.cloudflare.com |
useful-closed-dogsled.glitch.me
|
1 | www.google.com |
useful-closed-dogsled.glitch.me
|
1 | useful-closed-dogsled.glitch.me | |
6 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.cloudflare.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
glitch.com Amazon RSA 2048 M01 |
2023-02-22 - 2024-02-01 |
a year | crt.sh |
www.google.com GTS CA 1C3 |
2023-10-23 - 2024-01-15 |
3 months | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-07-03 - 2024-07-02 |
a year | crt.sh |
upload.video.google.com GTS CA 1C3 |
2023-10-23 - 2024-01-15 |
3 months | crt.sh |
aadcdn.msftauth.net DigiCert SHA2 Secure Server CA |
2023-01-31 - 2024-01-31 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://useful-closed-dogsled.glitch.me/
Frame ID: 940C7236644F1592C647263C891DF7C3
Requests: 6 HTTP requests in this frame
1 Outgoing links
These are links going to different origins than the main page.
Title: Cloudflare
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
useful-closed-dogsled.glitch.me/ |
104 KB 105 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
www.google.com/ |
0 0 |
Stylesheet
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/ |
87 KB 28 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css2
fonts.googleapis.com/ |
21 KB 1 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon_a_eupayfgghqiai7k9sol6lg2.ico
aadcdn.msftauth.net/shared/1.0/content/images/ |
17 KB 17 KB |
Image
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
turnstile_gif.gif
cf-assets.www.cloudflare.com/slt3lc6tev37/2atsfrGgvgOc3DZ91qMlKN/0412afa63e5fac20964377c70c1a9a17/ |
247 KB 248 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)7 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| documentPictureInPicture function| _0x56697a function| _0x32e8 function| _0x3785 function| $ function| jQuery number| timer2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
.www.cloudflare.com/ | Name: __cf_bm Value: yhFthPxWCFlu4dcPrOA1e8CKnf5Wjy6DgryPQwm0l78-1700979247-0-Ae8b/OK3ggDLnMS+7L0j15PPpBS/lYe5NvE+WimAwsPzIBYtom6E9O5KBNHu+6BAacuv9xtSLyc7+UDWHzCYaBNDOxPaglzzVJzz2519/3jZ |
|
.google.com/ | Name: NID Value: 511=YuXRximXbwtzwdcpYIsfp21E9kmOqFH6SxNf7G6JGv8Jd7qRMq_7bmAfnitq25uvoKvJsak_mTQE_yV1SOVLiAq5LQxCzlxPHCobZO6y-3N-3jZAdrR4kGBwUJks5vdhmOdww0FJ644oM3ln5-FXa6A3wUFewU4N42UIo0jH0G0 |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aadcdn.msftauth.net
cdnjs.cloudflare.com
cf-assets.www.cloudflare.com
fonts.googleapis.com
useful-closed-dogsled.glitch.me
www.google.com
104.16.123.96
104.17.25.14
142.251.163.99
152.199.4.44
172.253.62.95
34.225.219.45
2074b871b5a0cf7a87e49f1e4af7080145ebebf4e674ffda31643747d223cb30
843b6abc2b1f183893fdfbfe30c53c3941737a905f833cb276356aa7cb228848
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
cd5bc7ebf261590bb58d125a2f0cf6314a91da047fc77ea898ab227dfa52454e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e