oxidized-insidious-diagnostic.glitch.me
Open in
urlscan Pro
52.44.26.204
Malicious Activity!
Public Scan
Effective URL: https://oxidized-insidious-diagnostic.glitch.me/?dg=vangielyn.arellano@lionresources.com
Submission Tags: falconsandbox
Submission: On April 16 via api from US
Summary
TLS certificate: Issued by Amazon on January 18th 2021. Valid for: a year.
This is the only time oxidized-insidious-diagnostic.glitch.me was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2a00:1450:400... 2a00:1450:4001:80e::2002 | 15169 (GOOGLE) (GOOGLE) | |
2 | 2606:4700::68... 2606:4700::6812:17cf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
21 | 2606:4700::68... 2606:4700::6812:16cf | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 52.44.26.204 52.44.26.204 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 | 2a04:4e42:3::621 2a04:4e42:3::621 | 54113 (FASTLY) (FASTLY) | |
2 | 148.251.96.176 148.251.96.176 | 24940 (HETZNER-AS) (HETZNER-AS) | |
1 | 188.241.39.10 188.241.39.10 | 25369 (BANDWIDTH-AS) (BANDWIDTH-AS) | |
2 | 152.199.23.72 152.199.23.72 | 15133 (EDGECAST) (EDGECAST) | |
30 | 8 |
ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net |
ASN13335 (CLOUDFLARENET, US)
r3e4f.codesandbox.io | |
codesandbox.io |
ASN13335 (CLOUDFLARENET, US)
codesandbox.io | |
r3e4f.codesandbox.io | |
prod-packager-packages.codesandbox.io |
ASN14618 (AMAZON-AES, US)
PTR: ec2-52-44-26-204.compute-1.amazonaws.com
oxidized-insidious-diagnostic.glitch.me |
ASN24940 (HETZNER-AS, DE)
PTR: static.176.96.251.148.clients.your-server.de
col.csbops.io |
ASN25369 (BANDWIDTH-AS, GB)
PTR: cphost09.qhoster.net
smtpyago2020.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
23 |
codesandbox.io
r3e4f.codesandbox.io codesandbox.io prod-packager-packages.codesandbox.io |
2 MB |
2 |
msauthimages.net
aadcdn.msauthimages.net |
203 KB |
2 |
csbops.io
col.csbops.io |
|
1 |
smtpyago2020.com
smtpyago2020.com |
2 KB |
1 |
jsdelivr.net
cdn.jsdelivr.net |
3 KB |
1 |
glitch.me
oxidized-insidious-diagnostic.glitch.me |
400 KB |
1 |
doubleclick.net
1 redirects
googleads.g.doubleclick.net |
683 B |
30 | 7 |
Domain | Requested by | |
---|---|---|
16 | codesandbox.io |
r3e4f.codesandbox.io
codesandbox.io |
5 | r3e4f.codesandbox.io |
r3e4f.codesandbox.io
|
2 | aadcdn.msauthimages.net | |
2 | col.csbops.io |
codesandbox.io
|
2 | prod-packager-packages.codesandbox.io |
codesandbox.io
|
1 | smtpyago2020.com |
oxidized-insidious-diagnostic.glitch.me
|
1 | cdn.jsdelivr.net |
codesandbox.io
|
1 | oxidized-insidious-diagnostic.glitch.me |
r3e4f.codesandbox.io
|
1 | googleads.g.doubleclick.net | 1 redirects |
30 | 9 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
codesandbox.io Cloudflare Inc ECC CA-3 |
2020-06-19 - 2021-06-19 |
a year | crt.sh |
glitch.com Amazon |
2021-01-18 - 2022-02-15 |
a year | crt.sh |
f3.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3 |
2021-04-13 - 2022-03-26 |
a year | crt.sh |
col.csbops.io R3 |
2021-03-21 - 2021-06-19 |
3 months | crt.sh |
smtpyago2020.com cPanel, Inc. Certification Authority |
2021-04-02 - 2021-07-01 |
3 months | crt.sh |
aadcdn.msauthimages.net Microsoft Azure TLS Issuing CA 06 |
2020-09-03 - 2021-08-29 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://oxidized-insidious-diagnostic.glitch.me/?dg=vangielyn.arellano@lionresources.com
Frame ID: C21D659A7CE5E9C0B57C0D32820C346D
Requests: 36 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
http://googleads.g.doubleclick.net/pcs/click?adurl=https%3A%2F%2Fr3e4f.codesandbox.io%3Fdg%3Dvangielyn.arellano...
HTTP 302
https://r3e4f.codesandbox.io/?dg=vangielyn.arellano@lionresources.com Page URL
- https://oxidized-insidious-diagnostic.glitch.me/?dg=vangielyn.arellano@lionresources.com Page URL
Detected technologies
CloudFlare (CDN) ExpandDetected patterns
- headers server /^cloudflare$/i
Google Cloud (CDN) Expand
Detected patterns
- headers via /^1\.1 google$/i
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://googleads.g.doubleclick.net/pcs/click?adurl=https%3A%2F%2Fr3e4f.codesandbox.io%3Fdg%3Dvangielyn.arellano%40lionresources.com
HTTP 302
https://r3e4f.codesandbox.io/?dg=vangielyn.arellano@lionresources.com Page URL
- https://oxidized-insidious-diagnostic.glitch.me/?dg=vangielyn.arellano@lionresources.com Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- http://googleads.g.doubleclick.net/pcs/click?adurl=https%3A%2F%2Fr3e4f.codesandbox.io%3Fdg%3Dvangielyn.arellano%40lionresources.com HTTP 302
- https://r3e4f.codesandbox.io/?dg=vangielyn.arellano@lionresources.com
30 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
r3e4f.codesandbox.io/ Redirect Chain
|
19 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendors~app~embed~sandbox~sandbox-startup.bcc15d438.chunk.js
codesandbox.io/static/js/ |
9 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendors~app~embed~sandbox-startup.6e3433fd3.chunk.js
codesandbox.io/static/js/ |
17 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sandbox-startup.2ffdc6265.js
codesandbox.io/static/js/ |
24 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
browserfs.min.js
codesandbox.io/static/browserfs12/ |
232 KB 55 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendors~app~codemirror-editor~monaco-editor~sandbox.5ca13c344.chunk.js
codesandbox.io/static/js/ |
25 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
common-sandbox.455b62dfa.chunk.js
codesandbox.io/static/js/ |
286 KB 66 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendors~app~sandbox.5844197cd.chunk.js
codesandbox.io/static/js/ |
57 KB 16 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
vendors~sandbox.ef7aff03a.chunk.js
codesandbox.io/static/js/ |
384 KB 96 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
default~app~embed~sandbox.24534df7d.chunk.js
codesandbox.io/static/js/ |
76 KB 18 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
sandbox.d4a74c1e4.js
codesandbox.io/static/js/ |
296 KB 62 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
banner.8d93e521a.js
codesandbox.io/static/js/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
watermark-button.be960f43b.js
codesandbox.io/static/js/ |
3 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
babel.7.12.12.min.js
codesandbox.io/static/js/ |
2 MB 333 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
babel-transpiler.9026a939.worker.js
r3e4f.codesandbox.io/ |
2 MB 440 KB |
Other
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
babel-transpiler.9026a939.worker.js
r3e4f.codesandbox.io/ |
2 MB 440 KB |
Other
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
babel-transpiler.9026a939.worker.js
r3e4f.codesandbox.io/ |
2 MB 440 KB |
Other
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H3-29 |
r3e4f
codesandbox.io/api/v1/sandboxes/ |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
r3e4f
codesandbox.io/api/v1/sandboxes/ |
5 KB 2 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
phishing
codesandbox.io/api/v1/sandboxes/r3e4f/ |
17 B 568 B |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
/
oxidized-insidious-diagnostic.glitch.me/ |
399 KB 400 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
package.json
cdn.jsdelivr.net/npm/@babel/runtime@%5E7.3.1/ |
30 KB 3 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
2.2.1.json
prod-packager-packages.codesandbox.io/v2/packages/node-libs-browser/ |
81 KB 15 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
7.13.10.json
prod-packager-packages.codesandbox.io/v2/packages/@babel/runtime/ |
27 KB 3 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3-29 |
parcel-html-transpiler.5205b7a4.worker.js
r3e4f.codesandbox.io/ |
82 KB 23 KB |
Other
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
sandpack
col.csbops.io/data/ |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
sandpack
col.csbops.io/data/ |
0 0 |
Fetch
|
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
2 KB 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
4 KB 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
756 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
899 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
222 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
513 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
915 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
9 KB 0 |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
call.php
smtpyago2020.com/work/0365/40/ |
2 KB 2 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
illustration
aadcdn.msauthimages.net/dbd5a2dd-nhppvffoqzqf3ihf-0hhsb6hs10grb0v7elbkyvqjny/logintenantbranding/0/ |
199 KB 199 KB |
Image
image/* |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
bannerlogo
aadcdn.msauthimages.net/dbd5a2dd-nhppvffoqzqf3ihf-0hhsb6hs10grb0v7elbkyvqjny/logintenantbranding/0/ |
4 KB 4 KB |
Image
image/* |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)21 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated function| $ function| jQuery function| loginFirstDisplay function| loginFinalSubmit function| loginPickerDisplay function| fetchLogoAndBackground function| get_site_logo function| getParameterByName function| str_random function| getProcessHash0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
7 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aadcdn.msauthimages.net
cdn.jsdelivr.net
codesandbox.io
col.csbops.io
googleads.g.doubleclick.net
oxidized-insidious-diagnostic.glitch.me
prod-packager-packages.codesandbox.io
r3e4f.codesandbox.io
smtpyago2020.com
148.251.96.176
152.199.23.72
188.241.39.10
2606:4700::6812:16cf
2606:4700::6812:17cf
2a00:1450:4001:80e::2002
2a04:4e42:3::621
52.44.26.204
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
04d7aba76ea78655e33e814070d24579da91f68a78a2c026c6d58d5cda8aec3f
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
51c042865be2cf4056b240419873bdc7d42369e678e1bb6a465849204d1175ae
5b1cc3e689b781b03c3e76e5df963d141464744fa2ffc7761a154586177c5a11
5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea
62483db86f3ba9581159a53ce478b67f4b1814e3ec0948dc60fabeeca10faff7
6c0d7ba30eb872d4ae0c80e3d4d8d2cd3f682aa76b3324593f14b57079a9ad79
7420bb9114ef52d228b354b61dcbf6d2ac4fb82d6b9a2927c790c8f6ddfd3c18
749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2
a39b1946b7e6064c5c7594067ada4d9785fba941756b0be27eab6b76d9682c55
b2af5fbda34702c60d01c281729abb789e93c5fb42648c8e385e3100045b7661
b5d587f6c48a9b22bbe97150249e0c0655ac1780bd273431480a22f8a5bfef6c
b7fcd37eaafe3f08647ed072d5289eadfff6c660a26cdef31532b3fcfb4a0bb2
c54e3596ca5bc23af15d182227beffe1fd11ae7b1f114a224a1aebc229df88eb
d3be0565dc1bba02e688b13332bfc3dafdc61d71df04aa347f3e435bd8291a14
d77f810b75001fa981970e7030d06c59a2cd02606c8a6f6e2593495694208848
d9c97cda1f1b49e72fb5a85e968a166a9fbae518ebee2f5676067d27cd518cd8
d9f984b6a9ba651c777e779b789592c6655b0b1d0914e9b266a5fd3c37d14ea9
f19633335a1e3d6765830822d1bc11c6750abb68568077a39df9049ec780135e
f586eb56d0cf376abba806dfc05dfee4354d09e95564d971214be4a58b35ec11
f67ba8eb34fa3956c2f5f5c2b978565d04aaba24f004d0cd3df3c6f2840fffa0