adp.glitch.me Open in urlscan Pro
52.5.221.248  Malicious Activity! Public Scan

4 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response adp.glitch.me/	23 KB 23 KB	3266ms 117ms	Document text/html	52.5.221.248 Amazon.com
General Check archive.org Show headers Download Go to Full URL http://adp.glitch.me/ Protocol HTTP/1.1 Server 52.5.221.248 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US), Reverse DNS ec2-52-5-221-248.compute-1.amazonaws.com Software / Express Resource Hash a537a5b360277fd74b85bf039bf616d3c0e438b2b587f93e71d19100bcf04b59 Request headers Host adp.glitch.me Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Accept-Encoding gzip, deflate Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Wed, 10 Jul 2019 01:14:47 GMT Content-Type text/html; charset=UTF-8 Content-Length 23503 Connection keep-alive x-powered-by Express accept-ranges bytes cache-control public, max-age=0 last-modified Wed, 10 Jul 2019 01:13:56 GMT etag W/"5bcf-16bd971b420"
GET H2	200	Converged_v21033.css logincdn.msauth.net/16.000.28230.1/	98 KB 19 KB	325ms 20ms	Stylesheet text/css	192.229.221.185 MCI Communication...
General Check archive.org Show headers Download Go to Full URL https://logincdn.msauth.net/16.000.28230.1/Converged_v21033.css Requested by Host: adp.glitch.me URL: http://adp.glitch.me/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.229.221.185 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US), Reverse DNS Software ECAcc (ama/8AB2) / Resource Hash 1c87372ebae47bf26d36ab71e87f596f4e0b3c98472873bbfa7dcbbd48e9e7bb Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://adp.glitch.me/ Origin http://adp.glitch.me Response headers x-ms-blob-type BlockBlob date Wed, 10 Jul 2019 01:14:47 GMT content-encoding gzip content-md5 mcP+f/Z74VQ2+3GYFtwrYg== x-cache HIT status 200 content-length 18545 x-ms-lease-status unlocked last-modified Fri, 21 Jun 2019 06:07:43 GMT server ECAcc (ama/8AB2) etag 0x8D6F60EC67C7D7C vary Accept-Encoding content-type text/css access-control-allow-origin * x-ms-request-id 3812ebc7-901e-0004-6b22-2b3529000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	ConvergedLoginPaginatedStrings.en.js Show response logincdn.msauth.net/16.000.28230.1/	24 KB 7 KB	19ms 18ms	Script application/x-javascript	192.229.221.185 MCI Communication...
General Check archive.org Show headers Download Go to Full URL https://logincdn.msauth.net/16.000.28230.1/ConvergedLoginPaginatedStrings.en.js Requested by Host: adp.glitch.me URL: http://adp.glitch.me/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.229.221.185 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US), Reverse DNS Software ECAcc (ama/8B1D) / Resource Hash 5793b0c2358dfacdbcd3f5c05405bbbc9d78ef5b4e4dcbe24bf781d80b491a5b Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://adp.glitch.me/ Origin http://adp.glitch.me Response headers x-ms-blob-type BlockBlob date Wed, 10 Jul 2019 01:14:47 GMT content-encoding gzip content-md5 1lI4HNZdvXJm3w2TjaJ0hw== x-cache HIT status 200 content-length 6744 x-ms-lease-status unlocked last-modified Fri, 21 Jun 2019 06:07:07 GMT server ECAcc (ama/8B1D) etag 0x8D6F60EB07F6B91 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 6c4f4d05-e01e-0094-2ff8-2e7244000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET		ConvergedLogin_PCore.js logincdn.msauth.net/16.000.28230.1/	0 0
GET H2	200	ConvergedLogin_PCore.js Show response logincdn.msauth.net/16.000.28230.1/	531 KB 139 KB	17ms 16ms	Script application/x-javascript	192.229.221.185 MCI Communication...
General Check archive.org Show headers Download Go to Full URL https://logincdn.msauth.net/16.000.28230.1/ConvergedLogin_PCore.js Requested by Host: adp.glitch.me URL: http://adp.glitch.me/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.229.221.185 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US), Reverse DNS Software ECAcc (ama/8B1A) / Resource Hash e1271758e40d6d9c0826b2f9901a806eb9d6d8e38c6e28581d6b2e3b3b2b7c59 Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://adp.glitch.me/ Origin http://adp.glitch.me Response headers x-ms-blob-type BlockBlob date Wed, 10 Jul 2019 01:14:47 GMT content-encoding gzip content-md5 Tv1YuyivicIcwb0DJzGUHQ== x-cache HIT status 200 content-length 142347 x-ms-lease-status unlocked last-modified Fri, 21 Jun 2019 06:07:17 GMT server ECAcc (ama/8B1A) etag 0x8D6F60EB6A6FF68 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 720ba2a2-e01e-003f-2122-2b201f000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H/1.1	200 OK	Me.htm login.live.com/ Frame 7B20	0 0	566ms 156ms	Document text/html	2a01:111:2010:7::ff14 Microsoft Corpora...
General Check archive.org Show headers Download Go to Full URL https://login.live.com/Me.htm?v=1&uaid=fa97f4c881e243f92ffcdf5987870872&client_flight=ReservedFlight33,ReservedFligh&nw=4G Requested by Host: logincdn.msauth.net URL: https://logincdn.msauth.net/16.000.28230.1/ConvergedLogin_PCore.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_CBC Server 2a01:111:2010:7::ff14 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US), Reverse DNS Software Microsoft-IIS/8.5 / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Host login.live.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Referer http://adp.glitch.me/ Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Referer http://adp.glitch.me/ Response headers Content-Type text/html Content-Encoding gzip Last-Modified Tue, 09 Jul 2019 18:32:21 GMT Accept-Ranges bytes ETag "8068da58436d51:0" Vary Accept-Encoding Server Microsoft-IIS/8.5 PPServer PPV: 30 H: BL2IDSLGN2A006 V: 0 X-Content-Type-Options nosniff Strict-Transport-Security max-age=31536000 X-XSS-Protection 1; mode=block Date Wed, 10 Jul 2019 01:14:48 GMT Content-Length 951
GET H2	200	microsoft_logo.svg logincdn.msauth.net/16.000.28230.1/images/	4 KB 2 KB	1080ms 21ms	Image image/svg+xml	192.229.221.185 MCI Communication...
General Check archive.org Show headers Download Go to Show image Full URL https://logincdn.msauth.net/16.000.28230.1/images/microsoft_logo.svg?x=ee5c8d9fb6248c938fd0dc19370e90bd Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.229.221.185 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US), Reverse DNS Software ECAcc (ama/8AB1) / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers Referer http://adp.glitch.me/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 10 Jul 2019 01:14:49 GMT content-encoding gzip content-md5 nzaLxFgP7ZB3dfMcaybWzw== x-cache HIT status 200 content-length 1435 x-ms-lease-status unlocked last-modified Fri, 21 Jun 2019 06:10:49 GMT server ECAcc (ama/8AB1) etag 0x8D6F60F35592140 vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id ecf3ffac-501e-008f-6722-2b1923000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	ellipsis_white.svg logincdn.msauth.net/16.000.28230.1/images/	915 B 383 B	1079ms 20ms	Image image/svg+xml	192.229.221.185 MCI Communication...
General Check archive.org Show headers Download Go to Show image Full URL https://logincdn.msauth.net/16.000.28230.1/images/ellipsis_white.svg?x=5ac590ee72bfe06a7cecfd75b588ad73 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.229.221.185 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US), Reverse DNS Software ECAcc (ama/8AD1) / Resource Hash 6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea Request headers Referer http://adp.glitch.me/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 10 Jul 2019 01:14:49 GMT content-encoding gzip content-md5 HMwsHhNXdtrfirQDkzcqMA== x-cache HIT status 200 content-length 263 x-ms-lease-status unlocked last-modified Fri, 21 Jun 2019 06:10:48 GMT server ECAcc (ama/8AD1) etag 0x8D6F60F346F2533 vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id 3dc4901f-101e-0044-261a-2fc98b000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	ellipsis_grey.svg logincdn.msauth.net/16.000.28230.1/images/	915 B 730 B	1076ms 17ms	Image image/svg+xml	192.229.221.185 MCI Communication...
General Check archive.org Show headers Download Go to Show image Full URL https://logincdn.msauth.net/16.000.28230.1/images/ellipsis_grey.svg?x=2b5d393db04a5e6e1f739cb266e65b4c Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.229.221.185 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US), Reverse DNS Software ECAcc (ama/8B4E) / Resource Hash 16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6 Request headers Referer http://adp.glitch.me/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 10 Jul 2019 01:14:49 GMT content-encoding gzip content-md5 /a3y/mpA+HRaVAiPACrsog== x-cache HIT status 200 content-length 263 x-ms-lease-status unlocked last-modified Fri, 21 Jun 2019 06:10:48 GMT server ECAcc (ama/8B4E) etag 0x8D6F60F344CEEF8 vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id af81814c-801e-0008-0e23-2bf9aa000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	0-small.jpg logincdn.msauth.net/16.000.28230.1/images/Backgrounds/	3 KB 3 KB	1069ms 20ms	Image image/jpeg	192.229.221.185 MCI Communication...
General Check archive.org Show headers Download Go to Show image Full URL https://logincdn.msauth.net/16.000.28230.1/images/Backgrounds/0-small.jpg?x=138bcee624fa04ef9b75e86211a9fe0d Requested by Host: logincdn.msauth.net URL: https://logincdn.msauth.net/16.000.28230.1/ConvergedLogin_PCore.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.229.221.185 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US), Reverse DNS Software ECAcc (ama/8AD6) / Resource Hash f89e908280791803bbf1f33b596ff4a2179b355a8e15ad02ebaa2b1da11127ea Request headers Referer https://login.live.com/pp1600/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 10 Jul 2019 01:14:49 GMT content-md5 E4vO5iT6BO+bdehiEan+DQ== x-cache HIT status 200 content-length 3006 x-ms-lease-status unlocked last-modified Fri, 21 Jun 2019 06:10:36 GMT server ECAcc (ama/8AD6) etag 0x8D6F60F2D8ACAB1 content-type image/jpeg access-control-allow-origin * x-ms-request-id de6ded8c-601e-003c-2123-2bd37f000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	0.jpg logincdn.msauth.net/16.000.28230.1/images/Backgrounds/	277 KB 277 KB	1071ms 22ms	Image image/jpeg	192.229.221.185 MCI Communication...
General Check archive.org Show headers Download Go to Show image Full URL https://logincdn.msauth.net/16.000.28230.1/images/Backgrounds/0.jpg?x=a5dbd4393ff6a725c7e62b61df7e72f0 Requested by Host: logincdn.msauth.net URL: https://logincdn.msauth.net/16.000.28230.1/ConvergedLogin_PCore.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 192.229.221.185 , United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US), Reverse DNS Software ECAcc (ama/8AEA) / Resource Hash 211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb Request headers Referer https://login.live.com/pp1600/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Wed, 10 Jul 2019 01:14:49 GMT content-md5 pdvUOT/2pyXH5ith335y8A== x-cache HIT status 200 content-length 283351 x-ms-lease-status unlocked last-modified Fri, 21 Jun 2019 06:10:36 GMT server ECAcc (ama/8AEA) etag 0x8D6F60F2D963F26 content-type image/jpeg access-control-allow-origin * x-ms-request-id eb9087b7-b01e-0037-3f26-2b0730000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

logincdn.msauth.net

URL

https://logincdn.msauth.net/16.000.28230.1/ConvergedLogin_PCore.js

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| PROOF function| $Loader object| $Do function| $DepLoader object| g_dtFirstByte object| g_objPageMode number| g_iSRSFailed string| g_sSRSSuccess function| SRSRetry object| ServerData object| UXResourceDependencies function| WhenAllLoaded object| StringRepository boolean| __ConvergedLoginPaginatedStrings function| webpackJsonp object| ko boolean| __ConvergedLogin_PCore

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			adp.glitch.me/	1969-12-31 23:59:59	Name: CkTst Value: G1562721288078

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adp.glitch.me
login.live.com
logincdn.msauth.net
logincdn.msauth.net
192.229.221.185
2a01:111:2010:7::ff14
52.5.221.248
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6
1c87372ebae47bf26d36ab71e87f596f4e0b3c98472873bbfa7dcbbd48e9e7bb
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb
5793b0c2358dfacdbcd3f5c05405bbbc9d78ef5b4e4dcbe24bf781d80b491a5b
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea
a537a5b360277fd74b85bf039bf616d3c0e438b2b587f93e71d19100bcf04b59
e1271758e40d6d9c0826b2f9901a806eb9d6d8e38c6e28581d6b2e3b3b2b7c59
f89e908280791803bbf1f33b596ff4a2179b355a8e15ad02ebaa2b1da11127ea