![](/screenshots/f89d6be7-ea1f-42b0-8339-1c1e9a790a68.png)
amber-chalk-raptor.glitch.me
Open in
urlscan Pro
52.73.203.41
Malicious Activity!
Public Scan
Submission Tags: falconsandbox
Submission: On January 27 via api from US — Scanned from DE
Summary
TLS certificate: Issued by Amazon on January 2nd 2023. Valid for: a year.
This is the only time amber-chalk-raptor.glitch.me was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Microsoft (Consumer)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 | 52.73.203.41 52.73.203.41 | 14618 (AMAZON-AES) (AMAZON-AES) | |
3 | 160.153.138.53 160.153.138.53 | 20773 (GODADDY) (GODADDY) | |
1 | 152.199.23.37 152.199.23.37 | 15133 (EDGECAST) (EDGECAST) | |
1 1 | 2a00:1450:400... 2a00:1450:400d:807::2004 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2a00:1450:400... 2a00:1450:4001:80f::2004 | 15169 (GOOGLE) (GOOGLE) | |
1 | 2600:3c01::f0... 2600:3c01::f03c:91ff:fe79:43b | 63949 (AKAMAI-AP...) (AKAMAI-AP Akamai Technologies) | |
8 | 5 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-52-73-203-41.compute-1.amazonaws.com
amber-chalk-raptor.glitch.me |
ASN20773 (GODADDY, DE)
PTR: 53.138.153.160.host.secureserver.net
loveyrmotor.com |
ASN63949 (AKAMAI-AP Akamai Technologies, Inc., SG)
jsonip.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
3 |
loveyrmotor.com
loveyrmotor.com |
55 KB |
2 |
glitch.me
amber-chalk-raptor.glitch.me |
26 KB |
1 |
jsonip.com
jsonip.com — Cisco Umbrella Rank: 21706 |
410 B |
1 |
gstatic.com
t3.gstatic.com |
917 B |
1 |
google.com
1 redirects
www.google.com — Cisco Umbrella Rank: 2 |
289 B |
1 |
msftauth.net
aadcdn.msftauth.net — Cisco Umbrella Rank: 1157 |
1 KB |
8 | 6 |
Domain | Requested by | |
---|---|---|
3 | loveyrmotor.com |
amber-chalk-raptor.glitch.me
|
2 | amber-chalk-raptor.glitch.me |
amber-chalk-raptor.glitch.me
|
1 | jsonip.com |
amber-chalk-raptor.glitch.me
|
1 | t3.gstatic.com |
amber-chalk-raptor.glitch.me
|
1 | www.google.com | 1 redirects |
1 | aadcdn.msftauth.net |
amber-chalk-raptor.glitch.me
|
8 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
login.microsoftonline.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
glitch.com Amazon |
2023-01-02 - 2024-02-01 |
a year | crt.sh |
loveyrmotor.com Go Daddy Secure Certificate Authority - G2 |
2022-12-23 - 2024-01-24 |
a year | crt.sh |
aadcdn.msftauth.net DigiCert SHA2 Secure Server CA |
2022-04-01 - 2023-04-01 |
a year | crt.sh |
jsonip.com R3 |
2023-01-26 - 2023-04-26 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://amber-chalk-raptor.glitch.me/?id=meg.guercio%40infovista.com
Frame ID: 62E11825EA94737AB9827A23B8810FF8
Requests: 8 HTTP requests in this frame
1 Outgoing links
These are links going to different origins than the main page.
Title: Cannot access your account?
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 5- https://www.google.com/s2/favicons?domain=infovista.com HTTP 301
- https://t3.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=http://infovista.com&size=16
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
/
amber-chalk-raptor.glitch.me/ |
22 KB 23 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
style.css
loveyrmotor.com/wahis/office/css/ |
179 KB 21 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
jquery-3.3.1.min.js
loveyrmotor.com/wahis/office/js/ |
85 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
microsoft_logo_7zyesnzhfxur7eprws2m2q2.png
aadcdn.msftauth.net/ests/2.1/content/images/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
microsoft_logo.svg
loveyrmotor.com/wahis/office/images/ |
4 KB 4 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
0.jpg
amber-chalk-raptor.glitch.me/https://loveyrmotor.com/wahis/office/images/ |
4 KB 4 KB |
Image
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
faviconV2
t3.gstatic.com/ Redirect Chain
|
726 B 917 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
/
jsonip.com/ |
109 B 410 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Microsoft (Consumer)22 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontentvisibilityautostatechange function| $ function| jQuery function| goNext function| closeBox function| checkSubmit function| isEmail function| createCORSRequest function| senddataPOST function| postdata object| input object| inputsec string| url_string object| url string| communid string| maindomain number| counterattempt object| nowdate object| imputs number| lastIndex string| OSName object| objs0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
3 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aadcdn.msftauth.net
amber-chalk-raptor.glitch.me
jsonip.com
loveyrmotor.com
t3.gstatic.com
www.google.com
152.199.23.37
160.153.138.53
2600:3c01::f03c:91ff:fe79:43b
2a00:1450:4001:80f::2004
2a00:1450:400d:807::2004
52.73.203.41
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef
200325480be6aca982583e88ee7cf45cb31cd489a95b01c698d7ea9f23045513
39636ae7f7de3deacfe55d573d85d1bb5c349440065b16e573e5e3c62a0e3fb6
59bfe9bc385ad69f50793ce4a53397316d7a875a7148a63c16df9b674c6cda64
91e4a878774d5583d3d7f6513cd953d874b137cbc5022109547b67695927e2e5
c18d2bdc2740df7a0ea84bde6b98891ea8eccb266f975a4ebd1e91b13a1098b1
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c