shelled-automatic-dinghy.glitch.me
Open in
urlscan Pro
18.233.217.16
Malicious Activity!
Public Scan
URL:
http://shelled-automatic-dinghy.glitch.me/
Submission: On November 18 via manual from GB
Submission: On November 18 via manual from GB
Summary
This website contacted 4 IPs
in 2 countries
across 3 domains to perform 6 HTTP transactions.
The main IP is 18.233.217.16, located in
Ashburn, United States and
belongs to AMAZON-AES, US.
The main domain is shelled-automatic-dinghy.glitch.me.
This is the only time shelled-automatic-dinghy.glitch.me was scanned on urlscan.io!
This is the only time shelled-automatic-dinghy.glitch.me was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: WeTransfer (Online)Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 4 | 18.233.217.16 18.233.217.16 | 14618 (AMAZON-AES) (AMAZON-AES) | |
| 1 | 35.197.18.156 35.197.18.156 | 15169 (GOOGLE) (GOOGLE) | |
| 1 | 2001:4de0:ac1... 2001:4de0:ac19::1:b:2b | 20446 (HIGHWINDS3) (HIGHWINDS3) | |
| 6 | 4 |
4
18.233.217.16
(Ashburn, United States)
ASN14618 (AMAZON-AES, US)
PTR: ec2-18-233-217-16.compute-1.amazonaws.com
ASN14618 (AMAZON-AES, US)
PTR: ec2-18-233-217-16.compute-1.amazonaws.com
| shelled-automatic-dinghy.glitch.me |
1
35.197.18.156
(Mountain View, United States)
ASN15169 (GOOGLE, US)
PTR: 156.18.197.35.bc.googleusercontent.com
ASN15169 (GOOGLE, US)
PTR: 156.18.197.35.bc.googleusercontent.com
| blog.thunderbird.net |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 4 |
glitch.me
shelled-automatic-dinghy.glitch.me |
905 KB |
| 1 |
jquery.com
code.jquery.com |
30 KB |
| 1 |
thunderbird.net
blog.thunderbird.net |
4 KB |
| 6 | 3 |
| Domain | Requested by | |
|---|---|---|
| 4 | shelled-automatic-dinghy.glitch.me |
shelled-automatic-dinghy.glitch.me
|
| 1 | code.jquery.com |
shelled-automatic-dinghy.glitch.me
|
| 1 | blog.thunderbird.net |
shelled-automatic-dinghy.glitch.me
|
| 6 | 3 |
This site contains links to these domains. Also see Links.
| Domain |
|---|
| wetransfer.zendesk.com |
| wetransfer.com |
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| blog.thunderbird.net Let's Encrypt Authority X3 |
2020-10-12 - 2021-01-10 |
3 months | crt.sh |
| jquery.org Sectigo RSA Domain Validation Secure Server CA |
2020-10-06 - 2021-10-16 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
http://shelled-automatic-dinghy.glitch.me/
Frame ID: 08FBEF5247E31DEBBD0BD963FCA14121
Requests: 7 HTTP requests in this frame
Screenshot
Detected technologies
Ruby
(Programming Languages)
Expand
Overall confidence: 50%
Detected patterns
Detected patterns
- meta csrf-param /^authenticity_token$/i
Ruby on Rails
(Web Frameworks)
Expand
Overall confidence: 50%
Detected patterns
Detected patterns
- meta csrf-param /^authenticity_token$/i
Amazon Web Services
(PaaS)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /^AmazonS3$/i
Amazon S3
(Miscellaneous)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- headers server /^AmazonS3$/i
Page Statistics
7 Outgoing links
These are links going to different origins than the main page.
URL: https://wetransfer.zendesk.com/
Title: help center
Title: help center
Search URL Search Domain Scan URL
URL: https://wetransfer.com/help
Title: Help
Title: Help
Search URL Search Domain Scan URL
URL: https://wetransfer.com/about
Title: About
Title: About
Search URL Search Domain Scan URL
URL: https://wetransfer.com/products
Title: Products
Title: Products
Search URL Search Domain Scan URL
URL: https://wetransfer.com/plus?trk=WT201610_AboutPlus
Title: Plus
Title: Plus
Search URL Search Domain Scan URL
URL: https://wetransfer.com/advertise
Title: Advertise
Title: Advertise
Search URL Search Domain Scan URL
URL: https://wetransfer.com/sign-in
Title: Got Plus?
Title: Got Plus?
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
6 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
Primary Request
/
shelled-automatic-dinghy.glitch.me/ |
905 KB 905 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.min.js.download
shelled-automatic-dinghy.glitch.me/WeTransfer_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.min.js.download
shelled-automatic-dinghy.glitch.me/WeTransfer_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET DATA |
truncated
/ |
404 KB 0 |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
wetransfer-workmark-website.png
blog.thunderbird.net/files/2019/05/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
bootstrap.min.js.download
shelled-automatic-dinghy.glitch.me/WeTransfer_files/ |
0 0 |
Script
text/html |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-3.1.1.min.js
code.jquery.com/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: WeTransfer (Online)19 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| trustedTypes object| _preloaded_transfer_ function| validateForm undefined| ctx undefined| al undefined| start undefined| cw undefined| ch undefined| diff undefined| sim function| progressSim function| triggerError function| closeModal function| reset object| Wallpapers function| $ function| jQuery function| true_email0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
blog.thunderbird.net
code.jquery.com
shelled-automatic-dinghy.glitch.me
18.233.217.16
2001:4de0:ac19::1:b:2b
35.197.18.156
33068b31229eafcb20e2d8679d02ac8697f0b74fc659648591ceed3711a66bbf
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
ac31dce28251e2634e32d96434b2d6d1b32c27d47474bccea6ee216373088d4e
d427514a08d01168a2d132a8cc9ae70ec0a4e95f8e4f905fa50e2a70b34ef575