wzxynxcwmn1vlnkuzznhjmk3pcm2jyl2pqzftk14sxbybwdtwt.glitch.me
Open in
urlscan Pro
18.235.101.71
Malicious Activity!
Public Scan
Submission: On April 15 via manual from IN
Summary
TLS certificate: Issued by Amazon on January 18th 2021. Valid for: a year.
This is the only time wzxynxcwmn1vlnkuzznhjmk3pcm2jyl2pqzftk14sxbybwdtwt.glitch.me was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Adobe (Consumer) OneDrive (Online) Generic (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 18.235.101.71 18.235.101.71 | 14618 (AMAZON-AES) (AMAZON-AES) | |
2 | 173.231.203.174 173.231.203.174 | 22611 (INMOTION) (INMOTION) | |
1 8 | 132.148.215.8 132.148.215.8 | 398101 (GO-DADDY-...) (GO-DADDY-COM-LLC) | |
1 | 2a00:1450:400... 2a00:1450:4001:827::200a | 15169 (GOOGLE) (GOOGLE) | |
2 | 2001:4de0:ac1... 2001:4de0:ac18::1:a:3a | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
2 | 2606:4700::68... 2606:4700::6812:bcf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2a00:1450:400... 2a00:1450:4001:801::200a | 15169 (GOOGLE) (GOOGLE) | |
1 | 2606:4700::68... 2606:4700::6812:1634 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 2606:4700::68... 2606:4700::6810:135e | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2606:4700:e6:... 2606:4700:e6::ac40:ca1c | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
20 | 10 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-18-235-101-71.compute-1.amazonaws.com
wzxynxcwmn1vlnkuzznhjmk3pcm2jyl2pqzftk14sxbybwdtwt.glitch.me |
ASN22611 (INMOTION, US)
PTR: server.webnetws.com
onlinedentists.net |
ASN398101 (GO-DADDY-COM-LLC, US)
PTR: ip-132-148-215-8.ip.secureserver.net
cpanel.erealtymedia.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
8 |
erealtymedia.com
1 redirects
cpanel.erealtymedia.com |
306 KB |
3 |
fontawesome.com
kit.fontawesome.com ka-f.fontawesome.com |
21 KB |
2 |
bootstrapcdn.com
maxcdn.bootstrapcdn.com |
31 KB |
2 |
jquery.com
code.jquery.com |
53 KB |
2 |
googleapis.com
ajax.googleapis.com fonts.googleapis.com |
30 KB |
2 |
onlinedentists.net
onlinedentists.net |
804 B |
1 |
cloudflare.com
cdnjs.cloudflare.com |
7 KB |
1 |
glitch.me
wzxynxcwmn1vlnkuzznhjmk3pcm2jyl2pqzftk14sxbybwdtwt.glitch.me |
486 B |
20 | 8 |
Domain | Requested by | |
---|---|---|
8 | cpanel.erealtymedia.com |
1 redirects
onlinedentists.net
cpanel.erealtymedia.com |
2 | ka-f.fontawesome.com |
kit.fontawesome.com
|
2 | maxcdn.bootstrapcdn.com |
cpanel.erealtymedia.com
|
2 | code.jquery.com |
cpanel.erealtymedia.com
|
2 | onlinedentists.net |
wzxynxcwmn1vlnkuzznhjmk3pcm2jyl2pqzftk14sxbybwdtwt.glitch.me
onlinedentists.net |
1 | cdnjs.cloudflare.com |
cpanel.erealtymedia.com
|
1 | kit.fontawesome.com |
cpanel.erealtymedia.com
|
1 | fonts.googleapis.com |
cpanel.erealtymedia.com
|
1 | ajax.googleapis.com |
cpanel.erealtymedia.com
|
1 | wzxynxcwmn1vlnkuzznhjmk3pcm2jyl2pqzftk14sxbybwdtwt.glitch.me | |
20 | 10 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
glitch.com Amazon |
2021-01-18 - 2022-02-15 |
a year | crt.sh |
onlinedentists.net cPanel, Inc. Certification Authority |
2021-03-16 - 2021-06-14 |
3 months | crt.sh |
cpanel.erealtymedia.com Go Daddy Secure Certificate Authority - G2 |
2020-03-28 - 2022-03-28 |
2 years | crt.sh |
upload.video.google.com GTS CA 1O1 |
2021-03-23 - 2021-06-15 |
3 months | crt.sh |
jquery.org Sectigo RSA Domain Validation Secure Server CA |
2020-10-06 - 2021-10-16 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2021-03-01 - 2022-02-28 |
a year | crt.sh |
*.fontawesome.com DigiCert TLS RSA SHA256 2020 CA1 |
2020-11-13 - 2021-12-14 |
a year | crt.sh |
This page contains 4 frames:
Primary Page:
https://wzxynxcwmn1vlnkuzznhjmk3pcm2jyl2pqzftk14sxbybwdtwt.glitch.me/
Frame ID: EB6FEE802FF144717BDC5ADF96F01B80
Requests: 1 HTTP requests in this frame
Frame:
https://onlinedentists.net/wp-content/upgrade/upgrade/upgrade.html
Frame ID: 7D0B9F0DFE653D6003B36958BC14F909
Requests: 1 HTTP requests in this frame
Frame:
https://onlinedentists.net/wp-content/themes/themes/themes.html
Frame ID: 439400B7B5902AB8AAAA367085116748
Requests: 1 HTTP requests in this frame
Frame:
https://cpanel.erealtymedia.com/wp.erealtymedia.com/wp-media/media/forum/forum/
Frame ID: 79F8F90C46CE2F6AA37246150C757B73
Requests: 17 HTTP requests in this frame
Screenshot
Detected technologies
Amazon Web Services (PaaS) ExpandDetected patterns
- headers server /^AmazonS3$/i
Amazon S3 (Miscellaneous) Expand
Detected patterns
- headers server /^AmazonS3$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 2- https://cpanel.erealtymedia.com/wp.erealtymedia.com/wp-media/media/forum/forum HTTP 301
- https://cpanel.erealtymedia.com/wp.erealtymedia.com/wp-media/media/forum/forum/
20 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
wzxynxcwmn1vlnkuzznhjmk3pcm2jyl2pqzftk14sxbybwdtwt.glitch.me/ |
155 B 486 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
upgrade.html
onlinedentists.net/wp-content/upgrade/upgrade/ Frame 7D0B |
153 B 395 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
themes.html
onlinedentists.net/wp-content/themes/themes/ Frame 4394 |
168 B 409 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
cpanel.erealtymedia.com/wp.erealtymedia.com/wp-media/media/forum/forum/ Frame 79F8 Redirect Chain
|
12 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ Frame 79F8 |
84 KB 29 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.1.1.min.js
code.jquery.com/ Frame 79F8 |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.css
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/ Frame 79F8 |
141 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
css
fonts.googleapis.com/ Frame 79F8 |
398 B 408 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
585b051251.js
kit.fontawesome.com/ Frame 79F8 |
11 KB 4 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hover.css
cpanel.erealtymedia.com/wp.erealtymedia.com/wp-media/media/forum/forum/css/ Frame 79F8 |
112 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
adobe.jpg
cpanel.erealtymedia.com/wp.erealtymedia.com/wp-media/media/forum/forum/images/ Frame 79F8 |
30 KB 30 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
office3651.png
cpanel.erealtymedia.com/wp.erealtymedia.com/wp-media/media/forum/forum/images/ Frame 79F8 |
18 KB 18 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
other1.png
cpanel.erealtymedia.com/wp.erealtymedia.com/wp-media/media/forum/forum/images/ Frame 79F8 |
21 KB 22 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
gmail.png
cpanel.erealtymedia.com/wp.erealtymedia.com/wp-media/media/forum/forum/images/ Frame 79F8 |
65 KB 66 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.2.1.slim.min.js
code.jquery.com/ Frame 79F8 |
68 KB 24 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ Frame 79F8 |
19 KB 7 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bootstrap.min.js
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ Frame 79F8 |
48 KB 12 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
free.min.css
ka-f.fontawesome.com/releases/v5.15.3/css/ Frame 79F8 |
59 KB 13 KB |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
free-v4-shims.min.css
ka-f.fontawesome.com/releases/v5.15.3/css/ Frame 79F8 |
26 KB 5 KB |
Fetch
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
8.jpg
cpanel.erealtymedia.com/wp.erealtymedia.com/wp-media/media/forum/forum/images/ Frame 79F8 |
157 KB 159 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Adobe (Consumer) OneDrive (Online) Generic (Online)10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.googleapis.com
cdnjs.cloudflare.com
code.jquery.com
cpanel.erealtymedia.com
fonts.googleapis.com
ka-f.fontawesome.com
kit.fontawesome.com
maxcdn.bootstrapcdn.com
onlinedentists.net
wzxynxcwmn1vlnkuzznhjmk3pcm2jyl2pqzftk14sxbybwdtwt.glitch.me
132.148.215.8
173.231.203.174
18.235.101.71
2001:4de0:ac18::1:a:3a
2606:4700::6810:135e
2606:4700::6812:1634
2606:4700::6812:bcf
2606:4700:e6::ac40:ca1c
2a00:1450:4001:801::200a
2a00:1450:4001:827::200a
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
26c62dbdf527b8dcbf378ea62f129cbbba3b244730687909ba21ecd729c9d2e6
2c0f3dcfe93d7e380c290fe4ab838ed8cadff1596d62697f5444be460d1f876d
362daeaf1f7e05fee9a609e549f148aacbe518c166fbd96ead69057e295742af
3a9b144d6482b78afc4e0a940a1d3c22240f14fa535b808cf4dab9635339569f
4d0bbed07512253522aa51f12436c37ee9ebfa3c9860574b871018719797cb63
565b0e2180aad3ecb64b4614a0294239cb9dfa6ef067944740b84668151f4c11
67e22f39cb174e6f26f8aa7f1025ff67d5e02310948a7b0f0a9b7d73643bed13
6b778aeaed64f46b5615c7df59f1fb222b1a1e92b32b676daf05691b1aeabfd0
7829f065e0e10c8466f3d57766e0719421b7b652f6a1082f21b98702f1b28a30
7d840153f02ad6d91d652354e35b590721916d16c33956631eef0e7d3b5613ee
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
a2f26b68a6c8810c1aeb4048c938f835a86ba83756a7a440f989b967e78f3ba8
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
a80b724e0f6b6097a716bc15469b30590c96a6738e213eaec21f68e11d61f0d3
acf087c1757f08b0cfd53d59066544d7ef0bfcc50999e77c5813739cd9dc1479
bb88454962767eb6f2ddb1aabaaf844d8a57de7e8f848d7f6928f81b54998452
c2819ca1f7ad1af7ba53c4edfdfd395c547bcb16d29892a234d7860c689ed929
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b