urlscan.io logo urlscan.io
SecurityTrails logo

tranquil-valley-memory.glitch.me Open in urlscan Pro
34.197.3.188  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://tranquil-valley-memory.glitch.me/nenat06.html
Submission: On August 12 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 7 IPs in 4 countries across 6 domains to perform 32 HTTP transactions. The main IP is 34.197.3.188, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is tranquil-valley-memory.glitch.me.
TLS certificate: Issued by Amazon on January 18th 2021. Valid for: a year.
This is the only time tranquil-valley-memory.glitch.me was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: NatWest (Banking)

Domain & IP information

IP Address AS Autonomous System
2 34.197.3.188 14618 (AMAZON-AES)
20 2a02:6b8::1da 13238 (YANDEX)
1 181.214.31.79 61317 (ASDETUK w...)
1 78.129.237.3 20860 (IOMART-AS)
1 146.59.152.166 16276 (OVH)
1 195.80.159.133 29152 (DECKNET-AS)
32 7
2    34.197.3.188 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-197-3-188.compute-1.amazonaws.com
tranquil-valley-memory.glitch.me
20    2a02:6b8::1da (Moscow, Russian Federation)

ASN13238 (YANDEX, RU)
natnat.website.yandexcloud.net
1    181.214.31.79 (Bedminster, United States)

ASN61317 (ASDETUK www.heficed.com, GB)
PTR: miami.servershost.net
etigerteam.com
1    78.129.237.3 (United Kingdom)

ASN20860 (IOMART-AS, GB)
smtpjs.com
1    146.59.152.166 (France)

ASN16276 (OVH, FR)
PTR: i.ibb.co
i.ibb.co
1    195.80.159.133 (Paris, France)

ASN29152 (DECKNET-AS, FR)
l2.io
Domain Requested by
20 natnat.website.yandexcloud.net tranquil-valley-memory.glitch.me
natnat.website.yandexcloud.net
2 tranquil-valley-memory.glitch.me tranquil-valley-memory.glitch.me
1 l2.io tranquil-valley-memory.glitch.me
1 i.ibb.co tranquil-valley-memory.glitch.me
1 smtpjs.com tranquil-valley-memory.glitch.me
1 etigerteam.com tranquil-valley-memory.glitch.me
32 6

This site contains no links.

Subject Issuer Validity Valid
glitch.com
Amazon		 2021-01-18 -
2022-02-15		 a year crt.sh
storage.yandexcloud.net
Yandex CA		 2021-07-28 -
2022-01-26		 6 months crt.sh
etigerteam.com
cPanel, Inc. Certification Authority		 2021-06-02 -
2021-08-31		 3 months crt.sh
smtpjs.com
R3		 2021-08-08 -
2021-11-06		 3 months crt.sh
ibb.co
R3		 2021-08-06 -
2021-11-04		 3 months crt.sh
l2.io
R3		 2021-08-05 -
2021-11-03		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://tranquil-valley-memory.glitch.me/nenat06.html
Frame ID: 1C0E5AC92F243D2C015C22C85D9F8889
Requests: 32 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^AmazonS3$/i
Overall confidence: 100%
Detected patterns
  • headers server /^AmazonS3$/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i
Overall confidence: 100%
Detected patterns
  • script /jquery[.-]([\d.]*\d)[^/]*\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

32
Requests

81 %
HTTPS

17 %
IPv6

6
Domains

6
Subdomains

7
IPs

4
Countries

153 kB
Transfer

416 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

32 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request nenat06.html
tranquil-valley-memory.glitch.me/ 		40 KB
40 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tranquil-valley-memory.glitch.me/nenat06.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.197.3.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-197-3-188.compute-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
2eacefd416c79b212a43b90703989196386b703337b821b07e9e21403288b556

Request headers

:method
GET
:authority
tranquil-valley-memory.glitch.me
:scheme
https
:path
/nenat06.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 12 Aug 2021 12:58:40 GMT
content-type
text/html; charset=utf-8
content-length
40619
x-amz-id-2
1h6iu7B75vRxc/Oo3DIbre1+QxqLIqmx/ZoSQQ0pSm6Ng8AJTeMjYR3naxWTJdDLE7M31+I2m/4=
x-amz-request-id
4RWVY9AMFGAVNN7C
last-modified
Thu, 12 Aug 2021 06:06:38 GMT
etag
"d799fb050a1f1672a7e64578791224ef"
cache-control
no-cache
x-amz-version-id
oOe0r4xyzLVlzJKB0nTk6Od8_2fI5RdY
accept-ranges
bytes
server
AmazonS3
master.css
natnat.website.yandexcloud.net/ 		223 KB
54 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://natnat.website.yandexcloud.net/master.css
Requested by
Host: tranquil-valley-memory.glitch.me
URL: https://tranquil-valley-memory.glitch.me/nenat06.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx /
Resource Hash
7960e821069d9da7073b2f14ee920bb25084cd2ab79ccad46f735772ae3d0f3b

Request headers

Referer
https://tranquil-valley-memory.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 12 Aug 2021 12:58:40 GMT
content-encoding
gzip
last-modified
Tue, 10 Aug 2021 18:34:28 UTC
server
nginx
x-amz-request-id
1ad9c2ede7821ee9
etag
W/"2dfd733f065ca6d2369a67ef4983a29c"
content-type
text/css
master_mobile.css
natnat.website.yandexcloud.net/ 		47 KB
14 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://natnat.website.yandexcloud.net/master_mobile.css
Requested by
Host: tranquil-valley-memory.glitch.me
URL: https://tranquil-valley-memory.glitch.me/nenat06.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx /
Resource Hash
762a7161fafb519ada43534e1e4aa7fd8f5ae402d21cdbb3aff8ff569b29ad6a

Request headers

Referer
https://tranquil-valley-memory.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 12 Aug 2021 12:58:40 GMT
content-encoding
gzip
last-modified
Tue, 10 Aug 2021 18:34:28 UTC
server
nginx
x-amz-request-id
9fafb63c5c013bf4
etag
W/"5cc6a870d1a1dd62dc2690ea17b7e3c4"
content-type
text/css
npc.css
natnat.website.yandexcloud.net/ 		46 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://natnat.website.yandexcloud.net/npc.css
Requested by
Host: tranquil-valley-memory.glitch.me
URL: https://tranquil-valley-memory.glitch.me/nenat06.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx /
Resource Hash
b618b1630fe11a6fee0232601cc91ac7e7cd56ec8d4ab7353846e493d8764778

Request headers

Referer
https://tranquil-valley-memory.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 12 Aug 2021 12:58:40 GMT
content-encoding
gzip
last-modified
Tue, 10 Aug 2021 18:34:28 UTC
server
nginx
x-amz-request-id
4cf392d315d211f7
etag
W/"d3f76cb5e9a68a590459b54b35e2ac59"
content-type
text/css
overlayPromptMaster.css
natnat.website.yandexcloud.net/ 		1 KB
743 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://natnat.website.yandexcloud.net/overlayPromptMaster.css
Requested by
Host: tranquil-valley-memory.glitch.me
URL: https://tranquil-valley-memory.glitch.me/nenat06.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx /
Resource Hash
42e70c32efffee33a1d8bddf152d6b754fa8abb83c6166444b8d41b217d9dae6

Request headers

Referer
https://tranquil-valley-memory.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 12 Aug 2021 12:58:40 GMT
content-encoding
gzip
last-modified
Tue, 10 Aug 2021 18:34:28 UTC
server
nginx
x-amz-request-id
58383755d6bf49de
etag
W/"1e4c183b3f098d3bca4ccce20c428912"
content-type
text/css
overlayPrompt.css
natnat.website.yandexcloud.net/ 		76 B
254 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://natnat.website.yandexcloud.net/overlayPrompt.css
Requested by
Host: tranquil-valley-memory.glitch.me
URL: https://tranquil-valley-memory.glitch.me/nenat06.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx /
Resource Hash
ef7db794b4a6b5c42d2535919d91fb11da1e5cd1147f35196db382197b35fdee

Request headers

Referer
https://tranquil-valley-memory.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 12 Aug 2021 12:58:40 GMT
content-encoding
gzip
last-modified
Tue, 10 Aug 2021 18:34:28 UTC
server
nginx
x-amz-request-id
9daaeb995d3bb7c5
etag
W/"82a1b6373fa17d314053cb7173954338"
content-type
text/css
font-awesome.css
natnat.website.yandexcloud.net/ 		21 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://natnat.website.yandexcloud.net/font-awesome.css
Requested by
Host: tranquil-valley-memory.glitch.me
URL: https://tranquil-valley-memory.glitch.me/nenat06.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx /
Resource Hash
043d64ad39164b2b6d031cbaf82d44542b3904b814ffb4ae9738f0953e32f143

Request headers

Referer
https://tranquil-valley-memory.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 12 Aug 2021 12:58:40 GMT
content-encoding
gzip
last-modified
Tue, 10 Aug 2021 18:34:28 UTC
server
nginx
x-amz-request-id
578dd1a550381698
etag
W/"b3f38f8786407280c4585f1586bf26ee"
content-type
text/css
panel-defaults.css
natnat.website.yandexcloud.net/ 		9 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://natnat.website.yandexcloud.net/panel-defaults.css
Requested by
Host: tranquil-valley-memory.glitch.me
URL: https://tranquil-valley-memory.glitch.me/nenat06.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx /
Resource Hash
258b07e0e514a4714099f1f345a3333f7338589e19413a06ccd319e7436d3e4b

Request headers

Referer
https://tranquil-valley-memory.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 12 Aug 2021 12:58:40 GMT
content-encoding
gzip
last-modified
Tue, 10 Aug 2021 18:34:28 UTC
server
nginx
x-amz-request-id
54e601f3508b2f63
etag
W/"e909d59f350c1dad51b78325b5953eb2"
content-type
text/css
main.css
natnat.website.yandexcloud.net/ 		2 KB
815 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://natnat.website.yandexcloud.net/main.css
Requested by
Host: tranquil-valley-memory.glitch.me
URL: https://tranquil-valley-memory.glitch.me/nenat06.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx /
Resource Hash
81f2ad4f142602793f02bfd7c8da05a126127a3711516bbb7c967a0c510bbb41

Request headers

Referer
https://tranquil-valley-memory.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 12 Aug 2021 12:58:40 GMT
content-encoding
gzip
last-modified
Tue, 10 Aug 2021 18:34:28 UTC
server
nginx
x-amz-request-id
5d7757c3b51a1ab3
etag
W/"0c357b809e35163ef98bb273e7e3e587"
content-type
text/css
jquery-2.2.3.js
etigerteam.com/ntw/media/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://etigerteam.com/ntw/media/jquery-2.2.3.js
Requested by
Host: tranquil-valley-memory.glitch.me
URL: https://tranquil-valley-memory.glitch.me/nenat06.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
181.214.31.79 Bedminster, United States, ASN61317 (ASDETUK www.heficed.com, GB),
Reverse DNS
miami.servershost.net
Software
/
Resource Hash

Request headers

Referer
https://tranquil-valley-memory.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers
smtp.js
smtpjs.com/v3/ 		871 B
782 B 		Script
General
Check archive.org
Download Go to
Full URL
https://smtpjs.com/v3/smtp.js
Requested by
Host: tranquil-valley-memory.glitch.me
URL: https://tranquil-valley-memory.glitch.me/nenat06.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
78.129.237.3 , United Kingdom, ASN20860 (IOMART-AS, GB),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776

Request headers

Referer
https://tranquil-valley-memory.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 12 Aug 2021 12:58:39 GMT
content-encoding
gzip
last-modified
Tue, 10 Nov 2020 17:17:51 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
etag
"162f436b85b7d61:0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
accept-ranges
bytes
content-length
603
n-w-logo.svg
natnat.website.yandexcloud.net/ 		5 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://natnat.website.yandexcloud.net/n-w-logo.svg
Requested by
Host: tranquil-valley-memory.glitch.me
URL: https://tranquil-valley-memory.glitch.me/nenat06.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx /
Resource Hash
8d667d58aa56215b23d233ade3af0c7f6b7962c75410d6c103e0c324e4e958ca

Request headers

Referer
https://tranquil-valley-memory.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 12 Aug 2021 12:58:40 GMT
content-encoding
gzip
last-modified
Tue, 10 Aug 2021 18:34:28 UTC
server
nginx
x-amz-request-id
6003c03e342c9199
etag
W/"987cc7771f2fe14e61de62bd92e2411e"
content-type
image/svg+xml
plogo.png
natnat.website.yandexcloud.net/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://natnat.website.yandexcloud.net/plogo.png
Requested by
Host: tranquil-valley-memory.glitch.me
URL: https://tranquil-valley-memory.glitch.me/nenat06.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx /
Resource Hash
f2b557317fb851b3ed73c2d8203192e9ed433bd006ca5025ccb3317ef15e1b8d

Request headers

Referer
https://tranquil-valley-memory.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 12 Aug 2021 12:58:40 GMT
last-modified
Tue, 10 Aug 2021 18:34:28 UTC
server
nginx
x-amz-request-id
0e453c7f6cf497ba
etag
"cce808c0c23f731523eb4b7298ad18d8"
content-type
image/png
accept-ranges
bytes
content-length
5679
error-marker.png
natnat.website.yandexcloud.net/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://natnat.website.yandexcloud.net/error-marker.png
Requested by
Host: tranquil-valley-memory.glitch.me
URL: https://tranquil-valley-memory.glitch.me/nenat06.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx /
Resource Hash
27f324f2ad60091d5e8f76adfef83f9122dc8aa8df29d0a8d970bfe06aaa5005

Request headers

Referer
https://tranquil-valley-memory.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 12 Aug 2021 12:58:40 GMT
last-modified
Tue, 10 Aug 2021 18:34:28 UTC
server
nginx
x-amz-request-id
8f3b1900b8f2ce11
etag
"50f1540b40bf348f927c3ed21aba72b3"
content-type
image/png
accept-ranges
bytes
content-length
1090
security.gif
natnat.website.yandexcloud.net/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://natnat.website.yandexcloud.net/security.gif
Requested by
Host: tranquil-valley-memory.glitch.me
URL: https://tranquil-valley-memory.glitch.me/nenat06.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
nginx /
Resource Hash
e3c202c787d4eef5e65ab55ba52edc7113255175d2615a674e59f19ff26bc6fe

Request headers

Referer
https://tranquil-valley-memory.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 12 Aug 2021 12:58:40 GMT
last-modified
Tue, 10 Aug 2021 18:34:28 UTC
server
nginx
x-amz-request-id
c2dc764bf29ca1d0
etag
"98c7b877a2c1dd40ba0b2b78277342b1"
content-type
image/gif
accept-ranges
bytes
content-length
6122
ajax-loader.gif
i.ibb.co/RpLNy4f/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i.ibb.co/RpLNy4f/ajax-loader.gif
Requested by
Host: tranquil-valley-memory.glitch.me
URL: https://tranquil-valley-memory.glitch.me/nenat06.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
146.59.152.166 , France, ASN16276 (OVH, FR),
Reverse DNS
i.ibb.co
Software
nginx /
Resource Hash
fd29b3b084cf11160bfc4e99d98a261f2b36bff29113b07367c5204563c5d355

Request headers

Referer
https://tranquil-valley-memory.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 12 Aug 2021 12:58:40 GMT
last-modified
Tue, 02 Mar 2021 22:27:30 GMT
server
nginx
access-control-allow-methods
GET, OPTIONS
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
3208
expires
Thu, 31 Dec 2037 23:55:55 GMT
ip.js
l2.io/ 		25 B
229 B 		Script
General
Check archive.org
Download Go to
Full URL
https://l2.io/ip.js?var=userip
Requested by
Host: tranquil-valley-memory.glitch.me
URL: https://tranquil-valley-memory.glitch.me/nenat06.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
195.80.159.133 Paris, France, ASN29152 (DECKNET-AS, FR),
Reverse DNS
Software
Apache/2.4.25 (Debian) /
Resource Hash
ac37a3777c2bb84c1c2663996161f8fa5be7c3888b44208328c125aacdd176ce

Request headers

Referer
https://tranquil-valley-memory.glitch.me/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Thu, 12 Aug 2021 12:58:40 GMT
Server
Apache/2.4.25 (Debian)
Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
Content-Length
25
Content-Type
text/html; charset=UTF-8
plogo.png
tranquil-valley-memory.glitch.me/media/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tranquil-valley-memory.glitch.me/media/plogo.png
Requested by
Host: tranquil-valley-memory.glitch.me
URL: https://tranquil-valley-memory.glitch.me/nenat06.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.197.3.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-197-3-188.compute-1.amazonaws.com
Software
/
Resource Hash
5d1f9eac141b63c19a274eb9c099d629a0c4f747c8683dee8b93191b4ce0c1fd

Request headers

:path
/media/plogo.png
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control
no-cache
sec-fetch-dest
image
:authority
tranquil-valley-memory.glitch.me
referer
https://tranquil-valley-memory.glitch.me/nenat06.html
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://tranquil-valley-memory.glitch.me/nenat06.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 12 Aug 2021 12:58:40 GMT
cache-control
max-age=0
content-length
3616
white-lock.png
natnat.website.yandexcloud.net/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://natnat.website.yandexcloud.net/white-lock.png
Requested by
Host: natnat.website.yandexcloud.net
URL: https://natnat.website.yandexcloud.net/npc.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://natnat.website.yandexcloud.net/npc.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers
alert.png
natnat.website.yandexcloud.net/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://natnat.website.yandexcloud.net/alert.png
Requested by
Host: natnat.website.yandexcloud.net
URL: https://natnat.website.yandexcloud.net/npc.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://natnat.website.yandexcloud.net/npc.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers
li5_outer_frame_top_curve.gif
natnat.website.yandexcloud.net/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://natnat.website.yandexcloud.net/li5_outer_frame_top_curve.gif
Requested by
Host: natnat.website.yandexcloud.net
URL: https://natnat.website.yandexcloud.net/master.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://natnat.website.yandexcloud.net/master.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers
radio-selected.png
natnat.website.yandexcloud.net/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://natnat.website.yandexcloud.net/radio-selected.png
Requested by
Host: natnat.website.yandexcloud.net
URL: https://natnat.website.yandexcloud.net/npc.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://natnat.website.yandexcloud.net/npc.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers
radio-normal.png
natnat.website.yandexcloud.net/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://natnat.website.yandexcloud.net/radio-normal.png
Requested by
Host: natnat.website.yandexcloud.net
URL: https://natnat.website.yandexcloud.net/npc.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://natnat.website.yandexcloud.net/npc.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers
check-box.png
natnat.website.yandexcloud.net/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://natnat.website.yandexcloud.net/check-box.png
Requested by
Host: natnat.website.yandexcloud.net
URL: https://natnat.website.yandexcloud.net/npc.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://natnat.website.yandexcloud.net/npc.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers
down-chevron.png
natnat.website.yandexcloud.net/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://natnat.website.yandexcloud.net/down-chevron.png
Requested by
Host: natnat.website.yandexcloud.net
URL: https://natnat.website.yandexcloud.net/npc.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://natnat.website.yandexcloud.net/npc.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers
combined-shape.png
natnat.website.yandexcloud.net/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://natnat.website.yandexcloud.net/combined-shape.png
Requested by
Host: natnat.website.yandexcloud.net
URL: https://natnat.website.yandexcloud.net/npc.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a02:6b8::1da Moscow, Russian Federation, ASN13238 (YANDEX, RU),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://natnat.website.yandexcloud.net/npc.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers
RNHouseSansW05-Regular.woff2
natnat.website.yandexcloud.net/ 		0
0
RNHouseSansW05-Bold.woff2
natnat.website.yandexcloud.net/ 		0
0
RNHouseSansW05-Regular.woff
natnat.website.yandexcloud.net/ 		0
0
RNHouseSansW05-Bold.woff
natnat.website.yandexcloud.net/ 		0
0
RNHouseSansW05-Regular.ttf
natnat.website.yandexcloud.net/ 		0
0
RNHouseSansW05-Bold.ttf
natnat.website.yandexcloud.net/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
natnat.website.yandexcloud.net
URL
https://natnat.website.yandexcloud.net/RNHouseSansW05-Regular.woff2
Domain
natnat.website.yandexcloud.net
URL
https://natnat.website.yandexcloud.net/RNHouseSansW05-Bold.woff2
Domain
natnat.website.yandexcloud.net
URL
https://natnat.website.yandexcloud.net/RNHouseSansW05-Regular.woff
Domain
natnat.website.yandexcloud.net
URL
https://natnat.website.yandexcloud.net/RNHouseSansW05-Bold.woff
Domain
natnat.website.yandexcloud.net
URL
https://natnat.website.yandexcloud.net/RNHouseSansW05-Regular.ttf
Domain
natnat.website.yandexcloud.net
URL
https://natnat.website.yandexcloud.net/RNHouseSansW05-Bold.ttf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: NatWest (Banking)

23 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| Email function| isitornah function| whyone function| whytwo function| check function| sendEmailo function| sendEmail function| sendEmaili function| sendEmailii function| sendEmailiii string| userip function| input_nr

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

etigerteam.com
i.ibb.co
l2.io
natnat.website.yandexcloud.net
smtpjs.com
tranquil-valley-memory.glitch.me
natnat.website.yandexcloud.net
146.59.152.166
181.214.31.79
195.80.159.133
2a02:6b8::1da
34.197.3.188
78.129.237.3
043d64ad39164b2b6d031cbaf82d44542b3904b814ffb4ae9738f0953e32f143
1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776
258b07e0e514a4714099f1f345a3333f7338589e19413a06ccd319e7436d3e4b
27f324f2ad60091d5e8f76adfef83f9122dc8aa8df29d0a8d970bfe06aaa5005
2eacefd416c79b212a43b90703989196386b703337b821b07e9e21403288b556
42e70c32efffee33a1d8bddf152d6b754fa8abb83c6166444b8d41b217d9dae6
5d1f9eac141b63c19a274eb9c099d629a0c4f747c8683dee8b93191b4ce0c1fd
762a7161fafb519ada43534e1e4aa7fd8f5ae402d21cdbb3aff8ff569b29ad6a
7960e821069d9da7073b2f14ee920bb25084cd2ab79ccad46f735772ae3d0f3b
81f2ad4f142602793f02bfd7c8da05a126127a3711516bbb7c967a0c510bbb41
8d667d58aa56215b23d233ade3af0c7f6b7962c75410d6c103e0c324e4e958ca
ac37a3777c2bb84c1c2663996161f8fa5be7c3888b44208328c125aacdd176ce
b618b1630fe11a6fee0232601cc91ac7e7cd56ec8d4ab7353846e493d8764778
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3c202c787d4eef5e65ab55ba52edc7113255175d2615a674e59f19ff26bc6fe
ef7db794b4a6b5c42d2535919d91fb11da1e5cd1147f35196db382197b35fdee
f2b557317fb851b3ed73c2d8203192e9ed433bd006ca5025ccb3317ef15e1b8d
fd29b3b084cf11160bfc4e99d98a261f2b36bff29113b07367c5204563c5d355