subdued-harvest-yumberry.glitch.me Open in urlscan Pro
44.210.232.137 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://subdued-harvest-yumberry.glitch.me/
Effective URL:
https://subdued-harvest-yumberry.glitch.me/
Submission: On June 18 via api (June 18th 2024, 9:05:49 am UTC) from BY — Scanned from DE

Summary HTTP 10 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 7 IPs in 3 countries across 7 domains to perform 10 HTTP transactions. The main IP is 44.210.232.137, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is subdued-harvest-yumberry.glitch.me.
TLS certificate: Issued by Amazon RSA 2048 M03 on December 4th 2023. Valid for: a year.

This is the only time subdued-harvest-yumberry.glitch.me was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Rackspace (Online)

Domain & IP information

	IP Address	AS Autonomous System
2	44.210.232.137 44.210.232.137	14618 (AMAZON-AES) (AMAZON-AES)
1	2a00:1450:400... 2a00:1450:4001:828::200a	15169 (GOOGLE) (GOOGLE)
1	2a04:4e42:200... 2a04:4e42:200::649	54113 (FASTLY) (FASTLY)
2	2606:2800:233... 2606:2800:233:1cb7:261b:1f9c:2074:3c	15133 (EDGECAST) (EDGECAST)
2	2a00:1450:400... 2a00:1450:4001:827::2003	15169 (GOOGLE) (GOOGLE)
1	41.222.32.12 41.222.32.12	327979 (DIAMATRIX) (DIAMATRIX)
10	7

2 44.210.232.137 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-210-232-137.compute-1.amazonaws.com

subdued-harvest-yumberry.glitch.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:200::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:2800:233:1cb7:261b:1f9c:2074:3c (United States)

ASN15133 (EDGECAST, US)

static.emailsrvr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:827::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 41.222.32.12 (South Africa)

ASN327979 (DIAMATRIX, ZA)
PTR: wp12.domains.co.za

lochnerimmigration.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
2	gstatic.com fonts.gstatic.com	31 KB
2	emailsrvr.com static.emailsrvr.com — Cisco Umbrella Rank: 161052	39 KB
2	glitch.me subdued-harvest-yumberry.glitch.me	19 KB
1	lochnerimmigration.com lochnerimmigration.com	324 B
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 814	30 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 77	1 KB
0	jsdelivr.net Failed cdn.jsdelivr.net Failed
10	7

	Domain	Requested by
2	fonts.gstatic.com	fonts.googleapis.com
2	static.emailsrvr.com	subdued-harvest-yumberry.glitch.me
2	subdued-harvest-yumberry.glitch.me
1	lochnerimmigration.com	code.jquery.com
1	code.jquery.com	subdued-harvest-yumberry.glitch.me
1	fonts.googleapis.com	subdued-harvest-yumberry.glitch.me
0	cdn.jsdelivr.net Failed	subdued-harvest-yumberry.glitch.me
10	7

This site contains links to these domains. Also see Links.

Domain
emailhelp.rackspace.com
www.rackspace.com

Subject Issuer	Validity	Valid
glitch.com Amazon RSA 2048 M03	`2023-12-04` - `2025-01-01`	a year	crt.sh
upload.video.google.com WR2	`2024-05-27` - `2024-08-19`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh
sni9278gl.wpc.edgecastcdn.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-03-27` - `2025-04-27`	a year	crt.sh
*.gstatic.com WR2	`2024-05-27` - `2024-08-19`	3 months	crt.sh
lochnerimmigration.com cPanel, Inc. Certification Authority	`2024-05-02` - `2024-07-31`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://subdued-harvest-yumberry.glitch.me/
Frame ID: 3A26524EF289038B99D489B7DA4D94A0
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://subdued-harvest-yumberry.glitch.me/ HTTP 307
https://subdued-harvest-yumberry.glitch.me/ Page URL

Detected technologies

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

10
Requests

90 %
HTTPS

67 %
IPv6

7
Domains

7
Subdomains

7
IPs

3
Countries

122 kB
Transfer

184 kB
Size

0
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://emailhelp.rackspace.com/l/identify-suspicious-email

Search URL Search Domain Scan URL

URL: http://www.rackspace.com/information/legal/privacystatement
Title: Privacy Statement

Search URL Search Domain Scan URL

URL: http://www.rackspace.com/information/legal/websiteterms
Title: Website Terms

Search URL Search Domain Scan URL

URL: https://www.rackspace.com/email-hosting/webmail
Title: Hosted Email

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://subdued-harvest-yumberry.glitch.me/ HTTP 307
https://subdued-harvest-yumberry.glitch.me/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
subdued-harvest-yumberry.glitch.me/
Redirect Chain

http://subdued-harvest-yumberry.glitch.me/
https://subdued-harvest-yumberry.glitch.me/

15 KB
15 KB

655ms
416ms

Document
text/html

44.210.232.137
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://subdued-harvest-yumberry.glitch.me/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.210.232.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-210-232-137.compute-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 32c2952c671f7d91f4ba6d1f5bba4679f340621878bbe2856553b1ae6e77536a

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: no-cache
content-length: 15427
content-type: text/html; charset=utf-8
date: Tue, 18 Jun 2024 09:05:44 GMT
etag: "6eb70b58600cbfc8db540a3e9541e0c5"
last-modified: Thu, 08 Sep 2022 13:28:50 GMT
server: AmazonS3
x-amz-id-2: Sd6FNgMaEboavqETKa+DC3v3QO+9sNWj7IjDh0KAg04/ur4nF/PuE1K4oEZKZqx0AbitNDBL6Zw=
x-amz-request-id: JZCEG031VMFJFTVP
x-amz-version-id: G4hFIYMsX1f7W8cCjdsHgYf1t3TPnqUr

Redirect headers

Location: https://subdued-harvest-yumberry.glitch.me/
Non-Authoritative-Reason: HttpsUpgrades

GET main.min.js
cdn.jsdelivr.net/gh/killbot-org/Killbot-JS@latest/dist/ 0
0

GET
H2 200 css
fonts.googleapis.com/ 9 KB
1 KB 87ms
32ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:100,400,500,700

Requested by

Host: subdued-harvest-yumberry.glitch.me
URL: https://subdued-harvest-yumberry.glitch.me/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

54421efb548eb2edbf6a252fd296afdd850a5ab2d0a56b5046dbad39d6826365

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://subdued-harvest-yumberry.glitch.me/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Tue, 18 Jun 2024 09:05:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 18 Jun 2024 08:29:02 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 18 Jun 2024 09:05:45 GMT

GET
H2 200 jquery-3.6.0.min.js Show response
code.jquery.com/ 87 KB
30 KB 73ms
23ms Script
application/javascript 2a04:4e42:200::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.6.0.min.js
Requested by: Host: subdued-harvest-yumberry.glitch.me
URL: https://subdued-harvest-yumberry.glitch.me/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:200::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Origin: https://subdued-harvest-yumberry.glitch.me
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer: https://subdued-harvest-yumberry.glitch.me/
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 18 Jun 2024 09:05:45 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 106117
x-cache: HIT, HIT
content-length: 30875
x-served-by: cache-lga21931-LGA, cache-fra-etou8220084-FRA
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1718701545.486478,VS0,VE0
etag: W/"28feccc0-15d9d"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 17, 52727

GET
H2 200 Rackspace_Technology_Logo_RGB_WHT.png
static.emailsrvr.com/beta_apps_rackspace_com/images/ 8 KB
8 KB 137ms
22ms Image
image/png 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.emailsrvr.com/beta_apps_rackspace_com/images/Rackspace_Technology_Logo_RGB_WHT.png
Requested by: Host: subdued-harvest-yumberry.glitch.me
URL: https://subdued-harvest-yumberry.glitch.me/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4CA4) / ASP.NET
Resource Hash: 97669a98a4d13725fbefcfd567ea8adf12fc3c06eef40e71d824bb47267ccb18

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://subdued-harvest-yumberry.glitch.me/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 18 Jun 2024 09:05:45 GMT
last-modified: Mon, 13 Jul 2020 19:51:24 GMT
server: ECAcc (frc/4CA4)
age: 103952
etag: "ffe73fd4e59d61:0"
x-powered-by: ASP.NET
x-cache: HIT
content-type: image/png
cache-control: max-age=300
accept-ranges: bytes
content-length: 8173
expires: Tue, 18 Jun 2024 09:10:45 GMT

GET
H2 200 Suspicious-Email-Banner.jpg
static.emailsrvr.com/apps_rackspace_com/images/ 31 KB
31 KB 138ms
23ms Image
image/jpeg 2606:2800:233:1cb7:261b:1f9c:2074:3c
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.emailsrvr.com/apps_rackspace_com/images/Suspicious-Email-Banner.jpg
Requested by: Host: subdued-harvest-yumberry.glitch.me
URL: https://subdued-harvest-yumberry.glitch.me/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4CE1) / ASP.NET
Resource Hash: ee608b4a41a47f8df45dd1d505afb39cb7293e7a33c094b756764a85d67fca47

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://subdued-harvest-yumberry.glitch.me/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 18 Jun 2024 09:05:45 GMT
last-modified: Fri, 28 Sep 2018 18:18:39 GMT
server: ECAcc (frc/4CE1)
age: 103952
etag: "5b1d4cae5757d41:0"
x-powered-by: ASP.NET
x-cache: HIT
content-type: image/jpeg
cache-control: max-age=300
accept-ranges: bytes
content-length: 31715
expires: Tue, 18 Jun 2024 09:10:45 GMT

GET
H2 200 KFOkCnqEu92Fr1MmgVxIIzI.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 173ms
29ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOkCnqEu92Fr1MmgVxIIzI.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,400,500,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0f303f31706d39866cced9dcc17b61fb8423674278d7f6051d66b3a79ffbca18

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://fonts.googleapis.com/
Origin: https://subdued-harvest-yumberry.glitch.me
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 13 Jun 2024 18:11:44 GMT
x-content-type-options: nosniff
age: 399241
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15764
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:35 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 13 Jun 2025 18:11:44 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 171ms
27ms Font
font/woff2 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:100,400,500,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://fonts.googleapis.com/
Origin: https://subdued-harvest-yumberry.glitch.me
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 13 Jun 2024 05:20:49 GMT
x-content-type-options: nosniff
age: 445496
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 13 Jun 2025 05:20:49 GMT

POST
H2 200 hero.php Show response
lochnerimmigration.com/.hmm/ca/ 0
324 B 3425ms
2846ms XHR
text/html 41.222.32.12
DIAMATRIX

General

Check archive.org

Show headers Download Go to

Full URL

https://lochnerimmigration.com/.hmm/ca/hero.php

Requested by

Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.6.0.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

41.222.32.12 , South Africa, ASN327979 (DIAMATRIX, ZA),

Reverse DNS

wp12.domains.co.za

Software

LiteSpeed / PHP/7.4.33

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept: */*
Referer: https://subdued-harvest-yumberry.glitch.me/
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 18 Jun 2024 09:05:48 GMT
server: LiteSpeed
x-powered-by: PHP/7.4.33
vary: User-Agent,User-Agent
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
content-length: 0
x-xss-protection: 1; mode=block
expires: Wed, 19 Jun 2024 09:05:48 GMT

GET
H2 404 favicon.ico
subdued-harvest-yumberry.glitch.me/ 4 KB
4 KB 161ms
161ms Other
text/html 44.210.232.137
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://subdued-harvest-yumberry.glitch.me/favicon.ico
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.210.232.137 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-210-232-137.compute-1.amazonaws.com
Software: /
Resource Hash: 2784f6ffefbd5fcae302d112e1629907deed1e36f9c2050ea6d7038eec3f649c

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://subdued-harvest-yumberry.glitch.me/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 18 Jun 2024 09:05:45 GMT
cache-control: max-age=0
content-length: 3674

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/gh/killbot-org/Killbot-JS@latest/dist/main.min.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Rackspace (Online)

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://subdued-harvest-yumberry.glitch.me/(Line 4) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn.jsdelivr.net/gh/killbot-org/Killbot-JS@latest/dist/main.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://subdued-harvest-yumberry.glitch.me/(Line 4) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn.jsdelivr.net/gh/killbot-org/Killbot-JS@latest/dist/main.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://subdued-harvest-yumberry.glitch.me/(Line 4) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.6.0.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network	error	URL: https://subdued-harvest-yumberry.glitch.me/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.jsdelivr.net
code.jquery.com
fonts.googleapis.com
fonts.gstatic.com
lochnerimmigration.com
static.emailsrvr.com
subdued-harvest-yumberry.glitch.me
cdn.jsdelivr.net
2606:2800:233:1cb7:261b:1f9c:2074:3c
2a00:1450:4001:827::2003
2a00:1450:4001:828::200a
2a04:4e42:200::649
41.222.32.12
44.210.232.137
0f303f31706d39866cced9dcc17b61fb8423674278d7f6051d66b3a79ffbca18
2784f6ffefbd5fcae302d112e1629907deed1e36f9c2050ea6d7038eec3f649c
32c2952c671f7d91f4ba6d1f5bba4679f340621878bbe2856553b1ae6e77536a
54421efb548eb2edbf6a252fd296afdd850a5ab2d0a56b5046dbad39d6826365
97669a98a4d13725fbefcfd567ea8adf12fc3c06eef40e71d824bb47267ccb18
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ee608b4a41a47f8df45dd1d505afb39cb7293e7a33c094b756764a85d67fca47
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

subdued-harvest-yumberry.glitch.me Open in urlscan Pro 44.210.232.137 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

10 Requests

90 %HTTPS

67 %IPv6

7 Domains

7 Subdomains

7 IPs

3 Countries

122 kBTransfer

184 kBSize

0 Cookies

4 Outgoing links

Page URL History

Redirected requests

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

11 JavaScript Global Variables

0 Cookies

4 Console Messages

Indicators

subdued-harvest-yumberry.glitch.me Open in urlscan Pro
44.210.232.137 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

10
Requests

90 %
HTTPS

67 %
IPv6

7
Domains

7
Subdomains

7
IPs

3
Countries

122 kB
Transfer

184 kB
Size

0
Cookies

10 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!