![](/screenshots/a5b1e10f-4eb1-4ec7-873f-480b461680b9.png)
jeweled-economic-bull.glitch.me
Open in
urlscan Pro
52.86.228.72
Malicious Activity!
Public Scan
Submission Tags: 7243353
Submission: On July 25 via api from NL
Summary
TLS certificate: Issued by Amazon on January 18th 2021. Valid for: a year.
This is the only time jeweled-economic-bull.glitch.me was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: NatWest (Banking)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 52.86.228.72 52.86.228.72 | 14618 (AMAZON-AES) (AMAZON-AES) | |
22 | 2a02:4780:dea... 2a02:4780:dead:c30d::1 | 204915 (AWEX) (AWEX) | |
1 | 181.214.31.79 181.214.31.79 | 61317 (ASDETUK w...) (ASDETUK www.heficed.com) | |
1 | 78.129.237.3 78.129.237.3 | 20860 (IOMART-AS) (IOMART-AS) | |
1 | 146.59.152.166 146.59.152.166 | 16276 (OVH) (OVH) | |
1 | 195.80.159.133 195.80.159.133 | 29152 (DECKNET-AS) (DECKNET-AS) | |
28 | 6 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-52-86-228-72.compute-1.amazonaws.com
jeweled-economic-bull.glitch.me |
ASN61317 (ASDETUK www.heficed.com, GB)
PTR: miami.servershost.net
etigerteam.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
22 |
000webhostapp.com
filprom.000webhostapp.com |
172 KB |
2 |
glitch.me
jeweled-economic-bull.glitch.me |
44 KB |
1 |
l2.io
l2.io |
230 B |
1 |
ibb.co
i.ibb.co |
3 KB |
1 |
smtpjs.com
smtpjs.com |
782 B |
1 |
etigerteam.com
etigerteam.com |
|
28 | 6 |
Domain | Requested by | |
---|---|---|
22 | filprom.000webhostapp.com |
jeweled-economic-bull.glitch.me
filprom.000webhostapp.com |
2 | jeweled-economic-bull.glitch.me |
jeweled-economic-bull.glitch.me
|
1 | l2.io |
jeweled-economic-bull.glitch.me
|
1 | i.ibb.co |
jeweled-economic-bull.glitch.me
|
1 | smtpjs.com |
jeweled-economic-bull.glitch.me
|
1 | etigerteam.com |
jeweled-economic-bull.glitch.me
|
28 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
glitch.com Amazon |
2021-01-18 - 2022-02-15 |
a year | crt.sh |
*.000webhostapp.com RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1 |
2021-07-10 - 2022-08-10 |
a year | crt.sh |
etigerteam.com cPanel, Inc. Certification Authority |
2021-06-02 - 2021-08-31 |
3 months | crt.sh |
smtpjs.com R3 |
2021-07-09 - 2021-10-07 |
3 months | crt.sh |
ibb.co R3 |
2021-06-07 - 2021-09-05 |
3 months | crt.sh |
l2.io R3 |
2021-06-05 - 2021-09-03 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://jeweled-economic-bull.glitch.me/nogoingback.html?/NAT_WEST_Customer.verification/error.html
Frame ID: E8E90114169CC5BEDEF42D938DB25BE3
Requests: 28 HTTP requests in this frame
Screenshot
![](/screenshots/a5b1e10f-4eb1-4ec7-873f-480b461680b9.png)
Detected technologies
Detected patterns
- headers server /^AmazonS3$/i
Detected patterns
- headers server /^AmazonS3$/i
![](/vendor/wappa/icons/Font Awesome.png)
Detected patterns
- html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i
Detected patterns
- script /jquery[.-]([\d.]*\d)[^/]*\.js/i
- script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
28 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
nogoingback.html
jeweled-economic-bull.glitch.me/ |
40 KB 40 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
master.css
filprom.000webhostapp.com/media/ |
223 KB 54 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
master_mobile.css
filprom.000webhostapp.com/media/ |
47 KB 14 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
npc.css
filprom.000webhostapp.com/media/ |
46 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
overlayPromptMaster.css
filprom.000webhostapp.com/media/ |
1 KB 786 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
overlayPrompt.css
filprom.000webhostapp.com/media/ |
76 B 285 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
font-awesome.css
filprom.000webhostapp.com/media/ |
21 KB 6 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
panel-defaults.css
filprom.000webhostapp.com/media/ |
9 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
main.css
filprom.000webhostapp.com/media/ |
2 KB 859 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-2.2.3.js
etigerteam.com/ntw/media/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
smtp.js
smtpjs.com/v3/ |
871 B 782 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
n-w-logo.svg
filprom.000webhostapp.com/media/ |
5 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
plogo.png
filprom.000webhostapp.com/media/ |
6 KB 6 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
error-marker.png
filprom.000webhostapp.com/media/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
security.gif
filprom.000webhostapp.com/media/ |
6 KB 6 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ajax-loader.gif
i.ibb.co/RpLNy4f/ |
3 KB 3 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
ip.js
l2.io/ |
26 B 230 B |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
plogo.png
jeweled-economic-bull.glitch.me/media/ |
4 KB 4 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
white-lock.png
filprom.000webhostapp.com/media/ |
285 B 496 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
alert.png
filprom.000webhostapp.com/media/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
li5_outer_frame_top_curve.gif
filprom.000webhostapp.com/media/ |
17 KB 17 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
radio-selected.png
filprom.000webhostapp.com/media/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
radio-normal.png
filprom.000webhostapp.com/media/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
check-box.png
filprom.000webhostapp.com/media/ |
157 B 367 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
down-chevron.png
filprom.000webhostapp.com/media/ |
295 B 506 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
combined-shape.png
filprom.000webhostapp.com/media/ |
359 B 570 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
RNHouseSansW05-Regular.woff2
filprom.000webhostapp.com/media/ |
21 KB 21 KB |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
RNHouseSansW05-Bold.woff2
filprom.000webhostapp.com/media/ |
22 KB 22 KB |
Font
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: NatWest (Banking)23 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| Email function| isitornah function| whyone function| whytwo function| check function| sendEmailo function| sendEmail function| sendEmaili function| sendEmailii function| sendEmailiii string| userip function| input_nr0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
etigerteam.com
filprom.000webhostapp.com
i.ibb.co
jeweled-economic-bull.glitch.me
l2.io
smtpjs.com
146.59.152.166
181.214.31.79
195.80.159.133
2a02:4780:dead:c30d::1
52.86.228.72
78.129.237.3
043d64ad39164b2b6d031cbaf82d44542b3904b814ffb4ae9738f0953e32f143
1203b68b6104dd656426fbf6e90745df26d7bfb91cf1163cff6baf0d3e458a5f
1ec277d20cb0b2b9d72322f3cc32d988435978a6a8f72b28e0f8ac8b1bf17a72
1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776
258b07e0e514a4714099f1f345a3333f7338589e19413a06ccd319e7436d3e4b
27f324f2ad60091d5e8f76adfef83f9122dc8aa8df29d0a8d970bfe06aaa5005
42e70c32efffee33a1d8bddf152d6b754fa8abb83c6166444b8d41b217d9dae6
4f5a022467e927b5b385cc335e58434a49bad0520ed018fc059075069d695c79
5d1f9eac141b63c19a274eb9c099d629a0c4f747c8683dee8b93191b4ce0c1fd
762a7161fafb519ada43534e1e4aa7fd8f5ae402d21cdbb3aff8ff569b29ad6a
7960e821069d9da7073b2f14ee920bb25084cd2ab79ccad46f735772ae3d0f3b
816128c403e882f6d31208fd95435f625564b5914dbea396754640760cfc612e
81f2ad4f142602793f02bfd7c8da05a126127a3711516bbb7c967a0c510bbb41
8d667d58aa56215b23d233ade3af0c7f6b7962c75410d6c103e0c324e4e958ca
9ccc02568ec79c3f073aadd04efdd9abe527681ba1d26d5b60d1bb52b668ac84
b465d00b89619e9899ec7d618559157db09f935d318466d67deb036157fadcf2
b618b1630fe11a6fee0232601cc91ac7e7cd56ec8d4ab7353846e493d8764778
d1c878b4e69d9da5292c53b1f46708de74c435144895bdfd697208406466a814
d2955b58d801a021737f025d1716a68fd2a143ddac3e0b749fcc053deba6e082
d6f01bdb67a342b50dacb894a4cc585dbe700da9dd373886ade1480113972cc1
d81db57832f4742b67755f90f8c3d37735cb9f58dbb10e312f931343d27552c6
d9a71c2084defb7ddca352c3c09aa7d0945f4a6c01cc478a84e90616935e127b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3c202c787d4eef5e65ab55ba52edc7113255175d2615a674e59f19ff26bc6fe
ef7db794b4a6b5c42d2535919d91fb11da1e5cd1147f35196db382197b35fdee
f2b557317fb851b3ed73c2d8203192e9ed433bd006ca5025ccb3317ef15e1b8d
fd29b3b084cf11160bfc4e99d98a261f2b36bff29113b07367c5204563c5d355