Report - polarized-nutritious-snickerdoodle.glitch.me/public/reel.htm

Report Overview

Submitted URL
polarized-nutritious-snickerdoodle.glitch.me/public/reel.htm
IP
54.83.64.233
ASN
#14618 AMAZON-AES
Submitted
2024-05-10 14:28:37
Access
public
Website Title
Navy Federal Credit Union - Our Members are the Mission®
Final URL
polarized-nutritious-snickerdoodle.glitch.me/public/reel.htm
Tags
phishing suspicious
urlquery detections
Phishing - Generic phishing
Suspicious - Suspicious Javascript code

Detections

urlquery
15
Network Intrusion Detection
6
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
cdnjs.cloudflare.com	235	2009-02-17	2015-04-17	2024-05-09	491 B	6.6 kB	104.17.24.14
l2.io	163527	2012-05-12	2015-06-25	2024-04-08	425 B	226 B	195.80.159.133
ocsp.r2m03.amazontrust.com	unknown	2007-05-11	2023-02-21	2024-05-09	338 B	942 B	143.204.53.97
polarized-nutritious-snickerdoodle.glitch.me	unknown	unknown	No data	No data	514 B	2.8 MB	54.83.64.233

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2024-05-10 14:28:11	medium	Client IP	54.83.64.233	ET HUNTING Suspicious Glitch Hosted TLS SNI Request - Possible Phishing Landing
2024-05-10 14:28:11	medium	Client IP	54.83.64.233	ET HUNTING Suspicious Glitch Hosted TLS SNI Request - Possible Phishing Landing
2024-05-10 14:28:11	low	Client IP	54.83.64.233	ET INFO Observed Online Application Hosting Domain (glitch .me in TLS SNI)
2024-05-10 14:28:11	low	Client IP	54.83.64.233	ET INFO Observed Online Application Hosting Domain (glitch .me in TLS SNI)
2024-05-10 14:28:13	medium	Client IP	195.80.159.133	ET POLICY Observed IP Lookup Domain (l2 .io in TLS SNI)
2024-05-10 14:28:13	medium	Client IP	195.80.159.133	ET POLICY Observed IP Lookup Domain (l2 .io in TLS SNI)

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-05-10	medium	polarized-nutritious-snickerdoodle.glitch.me/public/reel.htm	Navy Federal Credit Union

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (17)

	URL	Size	First Seen	Last Seen
	polarized-nutritious-snickerdoodle.glitch.me/public/reel.htm	2.8 MB	2024-05-10	2024-05-10
Pretty URL polarized-nutritious-snickerdoodle.glitch.me/public/reel.htm IP 54.83.64.233 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML true Observations First Seen2024-05-10 16:28:45 Last Seen2024-05-10 16:28:45 Times Seen1 Hash 7913c5045128071036b57bf1ee58bbac 31e8dd71ecd5861dfe173303de2a6bac1cc89728 6515b3fedd1e6fb9be6cc0eb3f067d02f6726f7e2f0f4647a78b82e4d5d1a9b1 Loading...

	unknown	857 B	2023-04-14	2024-05-18
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-14 06:56:18 Last Seen2024-05-18 07:55:22 Times Seen25 Hash edae6bb6edbacb054fa5fee60bbb9759 f170aa85f7697e9427e27bf72c352060c650862a 0841a57d9b65dbb2f5e499facca39020cc8a03a681292a607bc945b507de5ed4 Loading...

	unknown	1.3 kB	2024-05-10	2024-05-10
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-05-10 16:28:45 Last Seen2024-05-10 16:28:45 Times Seen1 Hash 5542f3b1292e0741068c1b4b63171cb7 ada647011621ba7dcdf1d0002160845b7b688697 912e54a7cbf568c588a9da97a80cf94812ef89102c5cee8094f528d482e1558b Loading...

	unknown	3.1 kB	2024-05-10	2024-05-10
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-05-10 16:28:45 Last Seen2024-05-10 16:28:45 Times Seen1 Hash 2925e5465f2dff2cacc8c6662eca36e9 2d06269afb88d8c4c78226569d82c31fa081d2d9 5c67bc8fdc6d4e2fa4c1b29565b11a6ff5372c6d2a4cc0658ad4be30b49779a2 Loading...

	unknown	7.8 kB	2023-05-13	2024-05-18
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-13 01:41:57 Last Seen2024-05-18 07:55:22 Times Seen15 Hash 3a3e53d603ac41757c879688b722a481 30858bef0584b4113f853a3a07563557e3f3da0a f59a5104472259257ee88c2f74384243c6c3125a41acf8cc3980c2e4fdafe8b6 Loading...

	unknown	1.0 kB	2024-05-10	2024-05-10
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-05-10 16:28:45 Last Seen2024-05-10 16:28:45 Times Seen1 Hash 1705476a0055c11258a6985d34b5b8c5 f145448d16f6a5924e24b59ecf73a0099e567ae0 21a49d34d2b0bd81ff5bd12b5e683f834a532743814fb7627b4d753ac5726cbc Loading...

	unknown	2.5 kB	2024-05-10	2024-05-10
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-05-10 16:28:45 Last Seen2024-05-10 16:28:45 Times Seen1 Hash ceee9231d5054038fc67f295aa8ec57c 31350ca5cd1f5d82f7804a2e61acacf5aa8abd55 3a9ade0709b34a0c0c65637d6891162dce72afdb3a41303b6d97e5f6633712fe Loading...

	unknown	2.8 kB	2023-05-13	2024-05-18
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-13 01:41:57 Last Seen2024-05-18 07:55:22 Times Seen15 Hash 37e63396529ccdeda4a62d386582b20d a4dd50c7122053a96cd4ec8dad45b15a59bce8be 37a10b3c1d4517dd6db6fc585801b12e6788a4e87dff46424627bc00941add20 Loading...

	unknown	291 B	2023-05-13	2024-05-18
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-13 01:41:57 Last Seen2024-05-18 07:55:22 Times Seen17 Hash 7f0543420d56443f2da2cc798c77375b e150659c30534a433e619b955c4226d8d0f9eeb9 da20b42c4408f9b2ca620d21c002601d7304f6f51b1f1de339f00d2e419e7872 Loading...

	l2.io/ip.js?var=userip	24 B	2023-03-07	2024-05-20
Pretty URL l2.io/ip.js?var=userip IP 195.80.159.133 ASN #29152 Decknet S.a.r.l. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:55 Last Seen2024-05-20 08:29:40 Times Seen1630 Hash f9dc91b3feea65bd389a2f5b57306c32 147d1c9ae79ae948a34c5f1254bdcbf7af9caf8e d88923af30873abcf4cde709062c3d2e9ded181f9e2552c7fbcc983b3796ff77 Loading...

	unknown	76 B	2023-04-14	2024-05-18
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-14 06:56:18 Last Seen2024-05-18 07:55:22 Times Seen36 Hash 32740b119783fee71ee767cd4cfbb312 7b06d9e9845b30085db3a810171d52e3fca3fafc 94f71ba017a2e490591b1d61eba5aea13645da9ac6ad383f1f985e529d7835a9 Loading...

	unknown	1.4 kB	2024-05-10	2024-05-10
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-05-10 16:28:45 Last Seen2024-05-10 16:28:45 Times Seen1 Hash 6edad646b28ea95951061951c9179444 ae080b7f2bc17f869bae8d830d9500bc55811228 d3bb3fbc2160d96bc8d80665fdf901c52878f7fc7b72f876b8317b29d2fcb3d4 Loading...

	unknown	1.6 kB	2024-05-10	2024-05-10
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-05-10 16:28:45 Last Seen2024-05-10 16:28:45 Times Seen1 Hash 9df7a5f17dae5344c6c09f60b815eb71 5a44a631bfa53d512e6116aedf9398e04ec85434 508fb4ec2ee39e5dabd99db51e0024630919014985a2c06ff717a91c7d6e3b96 Loading...

	unknown	2.8 kB	2024-05-10	2024-05-10
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-05-10 16:28:45 Last Seen2024-05-10 16:28:45 Times Seen1 Hash 22518ed5764de8d4a68e37a2416a03ac 66a35f583059320841005f1b75118df64efecd75 fd3de28deb1540b59a7ca3293b04d513417f2078e5064dae5c2548d1f53e2386 Loading...

	unknown	19 B	2023-04-14	2024-05-18
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-14 06:56:18 Last Seen2024-05-18 07:55:22 Times Seen36 Hash 4808dba29c91d7fb50ad3c74f208970b fe2a2395fc9367b980aeb71e077fcb19d9171756 122447db490f641aa53c32c2c8b5f1044815783f2d230f0e82fad0960b3d8275 Loading...

		Size	First Seen	Last Seen
	#1 Write - 495e3a987608cfd4025ae4e9d40605c1	919 kB	2024-05-10	2024-05-10
Pretty Observations First Seen2024-05-10 16:28:46 Last Seen2024-05-10 16:28:46 Times Seen1 Hash 495e3a987608cfd4025ae4e9d40605c1 d7b47e175aae3cd30d093e44489aef1f3dc1bb96 d9405561be2dd2bff0a1cdbe85be515b47482654d003729f4396ae27baed232d Loading...

	#2 Write - bf032f61a73d2a8ca48627a33908da48	2.4 kB	2023-03-07	2024-05-18
Pretty Observations First Seen2023-03-07 12:09:26 Last Seen2024-05-18 07:55:22 Times Seen95 Hash bf032f61a73d2a8ca48627a33908da48 38b4b237d602fb229cd309315b0ce65fc47d5477 1f3f925220fd8734d386059dfdf4e3f19109432bed4dfa31ac6f0ea7c1a5ada3 Loading...

HTTP Transactions (4)

URL IP Response Size

ocsp.r2m03.amazontrust.com/

143.204.53.97

471 B

URL
ocsp.r2m03.amazontrust.com/
IP
143.204.53.97:0
ASN
#16509 AMAZON-02

File type
data
Size
471 B (471 bytes)
Hash
0adbdc74383c8b4b4ea0d2bc8d982639
823eb7ec53e4c9f4b986487c365748f2893ecaf0
31933a65d62f0ae87c723ba9f0264bf17872295df49f2dd7ea9f21746b683c34

HTTP Headers

POST / HTTP/1.1
Host: ocsp.r2m03.amazontrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=7200
Date: Fri, 10 May 2024 14:28:11 GMT
Last-Modified: Fri, 10 May 2024 13:45:18 GMT
Server: ECAcc (ska/F7B0)
X-Cache: Miss from cloudfront
Via: 1.1 6a757ab2991da716151f94ca00b38098.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: VVRngMCeMGFqQkIzq-O4LVLCNWj0qAjFzgmTL66c46ZCsHrRH1TOXQ==
Age: 2574

polarized-nutritious-snickerdoodle.glitch.me/public/reel.htm

54.83.64.233

200 OK

2.8 MB

URL User Request GET HTTP/2
polarized-nutritious-snickerdoodle.glitch.me/public/reel.htm
IP
54.83.64.233:443
ASN
#14618 AMAZON-AES

Certificate
IssuerAmazon
Subjectglitch.com
Fingerprint57:4F:13:8A:33:42:32:7C:F7:C9:C5:1F:DF:C1:35:65:F0:E9:70:EE
ValidityMon, 04 Dec 2023 00:00:00 GMT - Wed, 01 Jan 2025 23:59:59 GMT

File type
HTML document, ASCII text, with very long lines (65536), with no line terminators
Size
2.8 MB (2756262 bytes)
Hash
2077b66c6469f1331e4d96c6325b549c
0504e2e1e1dcf98cd24e5a98a02767b7c24c1ae0
fa3836c688d85d17264fbc4cb45528328b63d74700adcec2d3db4df1ff61123f

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - Suspicious Javascript code
OpenPhish	phishing	Navy Federal Credit Union

HTTP Headers

GET /public/reel.htm HTTP/1.1
Host: polarized-nutritious-snickerdoodle.glitch.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 10 May 2024 14:28:11 GMT
content-type: text/html; charset=utf-8
content-length: 2756262
x-amz-id-2: arXYVP2Q6IWcjGJcA1fG6SNdDVX18IQfDoA0vebumrTsfmOVJ73k4ITgbHecpmqcrIwS2OZ4Y9c=
x-amz-request-id: QMWSB63B54JKSZY1
last-modified: Thu, 09 May 2024 15:31:21 GMT
etag: "2077b66c6469f1331e4d96c6325b549c"
x-amz-server-side-encryption: AES256
cache-control: no-cache
x-amz-version-id: null
accept-ranges: bytes
server: AmazonS3
X-Firefox-Spdy: h2

cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css

104.17.24.14

200 OK

5.6 kB

URL GET HTTP/2
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
IP
104.17.24.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://polarized-nutritious-snickerdoodle.glitch.me/public/reel.htm
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D
ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT

File type
ASCII text, with very long lines (30837)
Size
5.6 kB (5631 bytes)
Hash
269550530cc127b6aa5a35925a7de6ce
512c7d79033e3028a9be61b540cf1a6870c896f8
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

HTTP Headers

GET /ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://polarized-nutritious-snickerdoodle.glitch.me/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 10 May 2024 14:28:13 GMT
content-type: text/css; charset=utf-8
content-length: 5631
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03e5f-7918"
last-modified: Mon, 04 May 2020 16:10:07 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 121373
expires: Wed, 30 Apr 2025 14:28:13 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SmplUwdXgmpgD2i1rjSj0gEDKPIU92sqmSxcMvZjcKFAqdu0USSK%2FQthFL4e%2FvE55nDIvBqFv9UG3y%2F3%2FXiEb5OHXhCiqMMgjOHbcS4%2FkTeccTCugLGRF2FPntG0oWD%2Fwzg0sAGp"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 881a9d4d7e035699-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

l2.io/ip.js?var=userip

195.80.159.133

200 OK

24 B

URL GET HTTP/1.1
l2.io/ip.js?var=userip
IP
195.80.159.133:443
ASN
#29152 Decknet S.a.r.l.

Requested by
https://polarized-nutritious-snickerdoodle.glitch.me/public/reel.htm
Certificate
IssuerLet's Encrypt
Subjectl2.io
FingerprintBC:DB:2B:74:04:D1:E7:ED:9F:6C:5B:B1:7D:00:74:82:0C:E2:DE:C8
ValiditySat, 04 May 2024 14:42:18 GMT - Fri, 02 Aug 2024 14:42:17 GMT

File type
ASCII text, with no line terminators
Size
24 B (24 bytes)
Hash
f9dc91b3feea65bd389a2f5b57306c32
147d1c9ae79ae948a34c5f1254bdcbf7af9caf8e
d88923af30873abcf4cde709062c3d2e9ded181f9e2552c7fbcc983b3796ff77

HTTP Headers

GET /ip.js?var=userip HTTP/1.1
Host: l2.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://polarized-nutritious-snickerdoodle.glitch.me/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 10 May 2024 14:28:13 GMT
Server: Apache/2.4.38 (Debian)
Content-Length: 24
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (17)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash