hurricane-graceful-shirt.glitch.me Open in urlscan Pro
52.204.230.185  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response hurricane-graceful-shirt.glitch.me/	123 B 595 B	245ms 231ms	Document text/html	52.204.230.185 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL http://hurricane-graceful-shirt.glitch.me/ Protocol HTTP/1.1 Server 52.204.230.185 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-204-230-185.compute-1.amazonaws.com Software AmazonS3 / Resource Hash 295ff0a73b7ae11a2d4a4af9cc774a73b398e9a07790bf71df9d8a4af9d23f92 Request headers Host hurricane-graceful-shirt.glitch.me Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Accept-Encoding gzip, deflate Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Sat, 01 May 2021 13:24:33 GMT Content-Type text/html; charset=utf-8 Content-Length 123 Connection keep-alive x-amz-id-2 lUY861pNR8i4iOhq+klQWynOT+6j/OQDqexpQsag3ibwrQ8m3zxoD/Dj1d/PMQ7fhMcQ+jSLyR8= x-amz-request-id C2GBY4N18DS64BNS last-modified Fri, 30 Apr 2021 19:53:41 GMT etag "ed269e9318a9adb132fcd6e3e1a9f6c4" cache-control no-cache x-amz-version-id HSMXXgLdmKtxFfwdCNkuIoew5z60282H accept-ranges bytes server AmazonS3
GET H2	200	/ Show response mega-scripts.biz/	295 KB 133 KB	1094ms 593ms	Script text/html	64.90.42.230 DREAMHOST-AS
General Check archive.org Show headers Download Go to Full URL https://mega-scripts.biz/?token=08d830ef9c196f67924a25ecf7a102a9 Requested by Host: hurricane-graceful-shirt.glitch.me URL: http://hurricane-graceful-shirt.glitch.me/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 64.90.42.230 , United States, ASN26347 (DREAMHOST-AS, US), Reverse DNS apache2-quack.sthelens.dreamhost.com Software Apache / Resource Hash b397c8f80ffaef9fb64ad5d4e646aba2010b3e996cce6a2955e741cafb751b68 Request headers Referer http://hurricane-graceful-shirt.glitch.me/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Sat, 01 May 2021 13:24:34 GMT content-encoding gzip server Apache vary Accept-Encoding,User-Agent content-type text/html; charset=UTF-8 cache-control no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0, max-age=600 expires Sat, 01 May 2021 13:34:34 GMT
GET H2	200	/ whos.amung.us/pingjs/	29 B 29 B	328ms 110ms	Image text/javascript	67.202.114.212 STEADFAST
General Check archive.org Show headers Download Go to Show image Full URL https://whos.amung.us/pingjs/?k=directo100&t=Blacksar%20Inc.&x=https://whos.amung.us/&y=https://whos.amung.us/&a=-1&d=0&v=27&r=1148 Requested by Host: hurricane-graceful-shirt.glitch.me URL: http://hurricane-graceful-shirt.glitch.me/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 67.202.114.212 , United States, ASN32748 (STEADFAST, US), Reverse DNS amung.us Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer http://hurricane-graceful-shirt.glitch.me/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sat, 01 May 2021 13:24:35 GMT content-encoding gzip content-type text/javascript;charset=UTF-8
GET DATA	200 OK	truncated /	103 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 634d838fecff20190c0240c70c5b316fef0de1333282707b4bc22ffa3f943ea3 Request headers Referer http://hurricane-graceful-shirt.glitch.me/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png
GET H2	200	cvj8rfO8RgU.png static.xx.fbcdn.net/rsrc.php/v3/y3/r/	3 KB 4 KB	9ms 9ms	Image image/png	2a03:2880:f03f:1c:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://static.xx.fbcdn.net/rsrc.php/v3/y3/r/cvj8rfO8RgU.png Requested by Host: hurricane-graceful-shirt.glitch.me URL: http://hurricane-graceful-shirt.glitch.me/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f03f:1c:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash a58b811b01139f699ada37a6a9bcdb5d3767790d6acc66a709750891a20fc6ba Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer http://hurricane-graceful-shirt.glitch.me/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers x-fb-debug mM7bI/OkYZJRfTAkBldyXK/2XcIZNa5zY3YNl7XB50xan8uk6cmegURyb9/Nkh1bQxcAaGGVJPDETkS+7vDABQ== x-fb-trip-id 664085054 x-content-type-options nosniff last-modified Mon, 01 Jan 2001 08:00:00 GMT content-md5 Pb0/E/1+Z4AC+9LUZbnB1A== date Sat, 01 May 2021 13:24:35 GMT content-type image/png access-control-allow-origin * cache-control public,max-age=31536000,immutable cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 3404 x-fb-rlafr 0 expires Sat, 23 Apr 2022 18:19:02 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Facebook (Social Network)

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated string| d object| dom string| back boolean| ignoreHistoryChange boolean| ignoreHashChange string| kon object| _$_f395 string| head string| bod

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

hurricane-graceful-shirt.glitch.me
mega-scripts.biz
static.xx.fbcdn.net
whos.amung.us
2a03:2880:f03f:1c:face:b00c:0:3
52.204.230.185
64.90.42.230
67.202.114.212
295ff0a73b7ae11a2d4a4af9cc774a73b398e9a07790bf71df9d8a4af9d23f92
634d838fecff20190c0240c70c5b316fef0de1333282707b4bc22ffa3f943ea3
a58b811b01139f699ada37a6a9bcdb5d3767790d6acc66a709750891a20fc6ba
b397c8f80ffaef9fb64ad5d4e646aba2010b3e996cce6a2955e741cafb751b68
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855