Report - marshy-innate-trawler.glitch.me/public/n4chaetdj.HTM

Report Overview

Submitted URL
marshy-innate-trawler.glitch.me/public/n4chaetdj.HTM
IP
35.170.12.36
ASN
#14618 AMAZON-AES
Submitted
2024-04-20 05:31:10
Access
public
Website Title
Navy Federal Credit Union - Our Members are the Mission®
Final URL
marshy-innate-trawler.glitch.me/public/n4chaetdj.HTM
Tags
phishing suspicious
urlquery detections
Phishing - Generic phishing
Suspicious - Suspicious Javascript code

Detections

urlquery
15
Network Intrusion Detection
3
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
cdnjs.cloudflare.com	235	2009-02-17	2015-04-17	2024-04-19	478 B	6.6 kB	104.17.25.14
l2.io	163527	2012-05-12	2015-06-25	2024-04-18	412 B	226 B	195.80.159.133
marshy-innate-trawler.glitch.me	unknown	unknown	No data	No data	506 B	2.7 MB	3.209.194.124

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2024-04-20 05:30:44	medium	Client IP	3.209.194.124	ET HUNTING Suspicious Glitch Hosted TLS SNI Request - Possible Phishing Landing
2024-04-20 05:30:44	low	Client IP	3.209.194.124	ET INFO Observed Online Application Hosting Domain (glitch .me in TLS SNI)
2024-04-20 05:30:45	medium	Client IP	195.80.159.133	ET POLICY Observed IP Lookup Domain (l2 .io in TLS SNI)

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-04-19	medium	marshy-innate-trawler.glitch.me/public/n4chaetdj.HTM	Navy Federal Credit Union

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (17)

	URL	Size	First Seen	Last Seen
	unknown	1.4 kB	2024-04-20	2024-04-20
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-20 07:31:17 Last Seen2024-04-20 07:31:17 Times Seen1 Hash f54dbe2c0b0b742e3c968acecdf36084 46d98b474b964387146ee2977d7a9ca58533d97b 1668ff0e485d1652799aca9a7dd28a54f36f984507c7a2b55a1b0a825e2cd20e Loading...

	unknown	1.6 kB	2024-04-20	2024-04-20
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-20 07:31:17 Last Seen2024-04-20 07:31:17 Times Seen1 Hash 039651f36030e56633613fb89d813364 1b5609879ff6ed24ad5823cd5b25b321937986c0 5814f4cff616b0f6ea752a3fcee0b85da449919926c59ebf22cc9acaa92bb990 Loading...

	unknown	2.5 kB	2024-04-20	2024-04-20
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-20 07:31:17 Last Seen2024-04-20 07:31:17 Times Seen1 Hash 5976a4023f4df23fa73968bac924bead 4f145a6cfce0ba26b1da4efbc5705831900113c0 37b6880b9cf22b0de6274fda05e538f14d6b8f27b1c088f5c03fc584bf4e6c4a Loading...

	marshy-innate-trawler.glitch.me/public/n4chaetdj.HTM	2.7 MB	2024-04-20	2024-04-20
Pretty URL marshy-innate-trawler.glitch.me/public/n4chaetdj.HTM IP 3.209.194.124 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML true Observations First Seen2024-04-20 07:31:18 Last Seen2024-04-20 07:31:18 Times Seen1 Hash 41a26cc2befcc7c133b65e2139f98095 c525363a3c8ae602accf19b3486dfbd1e77fe9b7 49da5fa8eab8f4329dc336dccd16e571a97c626ef5bfbc85ecb51ef0fa63cb93 Loading...

	unknown	291 B	2023-05-13	2024-04-20
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-13 01:41:57 Last Seen2024-04-20 07:31:18 Times Seen13 Hash 7f0543420d56443f2da2cc798c77375b e150659c30534a433e619b955c4226d8d0f9eeb9 da20b42c4408f9b2ca620d21c002601d7304f6f51b1f1de339f00d2e419e7872 Loading...

	l2.io/ip.js?var=userip	24 B	2023-03-07	2024-05-02
Pretty URL l2.io/ip.js?var=userip IP 195.80.159.133 ASN #29152 Decknet S.a.r.l. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02:55 Last Seen2024-05-02 18:13:30 Times Seen1577 Hash f9dc91b3feea65bd389a2f5b57306c32 147d1c9ae79ae948a34c5f1254bdcbf7af9caf8e d88923af30873abcf4cde709062c3d2e9ded181f9e2552c7fbcc983b3796ff77 Loading...

	unknown	3.1 kB	2024-04-20	2024-04-20
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-20 07:31:18 Last Seen2024-04-20 07:31:18 Times Seen1 Hash a7700830ed1d538ef2472bc412f5e3ed 2936e85bd83c70af5a429d7a83e5ed2ba1eaa11e 1587641bda82bbed327ecb22a411f7a495aea12ee4df404465f3660e6419a644 Loading...

	unknown	19 B	2023-04-14	2024-04-20
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-14 06:56:18 Last Seen2024-04-20 07:31:18 Times Seen32 Hash 4808dba29c91d7fb50ad3c74f208970b fe2a2395fc9367b980aeb71e077fcb19d9171756 122447db490f641aa53c32c2c8b5f1044815783f2d230f0e82fad0960b3d8275 Loading...

	unknown	2.8 kB	2024-04-20	2024-04-20
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-20 07:31:18 Last Seen2024-04-20 07:31:18 Times Seen1 Hash 3b4a85816bfdba9ad386b85841ca034c 568d341b059ac1790a8a2a0c840e73f526c5892b 816914efbbbae79f8feb671f1f1eac72e60f74001188c0ae53834ebfeb5c95d6 Loading...

	unknown	1.0 kB	2024-04-20	2024-04-20
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-20 07:31:18 Last Seen2024-04-20 07:31:18 Times Seen1 Hash 5c349fa94fc29f4eb8623ebf6e449406 f9bf55c1bff4b8c9c28c243caec8ef562d496c04 60cb9f1e104ce331e31609a83d669434ac330daa6c470fb085334fbed046ff38 Loading...

	unknown	1.3 kB	2024-04-20	2024-04-20
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-20 07:31:18 Last Seen2024-04-20 07:31:18 Times Seen1 Hash 173729477970dca5c1ff604fe421e591 cbaf52be7d48c5e174674edc64242198c36dd130 1e13ffda549649dd12385871b42e8d570cf8d3828ceaf1efa96b7c891003bc6c Loading...

	unknown	7.8 kB	2023-05-13	2024-04-20
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-13 01:41:57 Last Seen2024-04-20 07:31:18 Times Seen11 Hash 3a3e53d603ac41757c879688b722a481 30858bef0584b4113f853a3a07563557e3f3da0a f59a5104472259257ee88c2f74384243c6c3125a41acf8cc3980c2e4fdafe8b6 Loading...

	unknown	2.8 kB	2023-05-13	2024-04-20
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-13 01:41:57 Last Seen2024-04-20 07:31:18 Times Seen11 Hash 37e63396529ccdeda4a62d386582b20d a4dd50c7122053a96cd4ec8dad45b15a59bce8be 37a10b3c1d4517dd6db6fc585801b12e6788a4e87dff46424627bc00941add20 Loading...

	unknown	857 B	2023-04-14	2024-04-20
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-14 06:56:18 Last Seen2024-04-20 07:31:18 Times Seen21 Hash edae6bb6edbacb054fa5fee60bbb9759 f170aa85f7697e9427e27bf72c352060c650862a 0841a57d9b65dbb2f5e499facca39020cc8a03a681292a607bc945b507de5ed4 Loading...

	unknown	76 B	2023-04-14	2024-04-20
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-14 06:56:18 Last Seen2024-04-20 07:31:18 Times Seen32 Hash 32740b119783fee71ee767cd4cfbb312 7b06d9e9845b30085db3a810171d52e3fca3fafc 94f71ba017a2e490591b1d61eba5aea13645da9ac6ad383f1f985e529d7835a9 Loading...

		Size	First Seen	Last Seen
	#1 Write - 991f3dbdc8e48236857620d104a53e50	910 kB	2024-04-20	2024-04-20
Pretty Observations First Seen2024-04-20 07:31:18 Last Seen2024-04-20 07:31:19 Times Seen1 Hash 991f3dbdc8e48236857620d104a53e50 e0ea19d08876e2faf22a274629e6bd765c4992e1 1832d35a58f482159d1b7009c5aad2dbbfbf5106fda47da84c21e7e4870211d8 Loading...

	#2 Write - bf032f61a73d2a8ca48627a33908da48	2.4 kB	2023-03-07	2024-04-20
Pretty Observations First Seen2023-03-07 12:09:26 Last Seen2024-04-20 07:31:19 Times Seen91 Hash bf032f61a73d2a8ca48627a33908da48 38b4b237d602fb229cd309315b0ce65fc47d5477 1f3f925220fd8734d386059dfdf4e3f19109432bed4dfa31ac6f0ea7c1a5ada3 Loading...

HTTP Transactions (3)

URL IP Response Size

marshy-innate-trawler.glitch.me/public/n4chaetdj.HTM

3.209.194.124

200 OK

2.7 MB

URL User Request GET HTTP/2
marshy-innate-trawler.glitch.me/public/n4chaetdj.HTM
IP
3.209.194.124:443
ASN
#14618 AMAZON-AES

Certificate
IssuerAmazon
Subjectglitch.com
Fingerprint57:4F:13:8A:33:42:32:7C:F7:C9:C5:1F:DF:C1:35:65:F0:E9:70:EE
ValidityMon, 04 Dec 2023 00:00:00 GMT - Wed, 01 Jan 2025 23:59:59 GMT

File type
HTML document, ASCII text, with very long lines (65536), with no line terminators
Size
2.7 MB (2728612 bytes)
Hash
068a8b85d380f15ae1d4090adb2ed650
5200ce56c81b66e4454bc3e83d065223654487fc
7332f80b55e72ac71b32ee01d024751ad8ff00a4f28b2c3557e8cd57a8c7ec89

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - Suspicious Javascript code
OpenPhish	phishing	Navy Federal Credit Union

HTTP Headers

GET /public/n4chaetdj.HTM HTTP/1.1
Host: marshy-innate-trawler.glitch.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 20 Apr 2024 05:30:44 GMT
content-type: text/html; charset=utf-8
content-length: 2728612
x-amz-id-2: eO3pOilbES45QB4Wz/We0Xt8VKoGQZNLk/tfDoKzj+//sdbedTbFP6uY7fSWll1ixl4CMk9UDDQ=
x-amz-request-id: JS1DM08YR7BA39TM
last-modified: Thu, 18 Apr 2024 13:21:27 GMT
etag: "068a8b85d380f15ae1d4090adb2ed650"
x-amz-server-side-encryption: AES256
cache-control: no-cache
x-amz-version-id: null
accept-ranges: bytes
server: AmazonS3
X-Firefox-Spdy: h2

cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css

104.17.25.14

200 OK

5.6 kB

URL GET HTTP/2
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
IP
104.17.25.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://marshy-innate-trawler.glitch.me/public/n4chaetdj.HTM
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D
ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT

File type
ASCII text, with very long lines (30837)
Size
5.6 kB (5631 bytes)
Hash
269550530cc127b6aa5a35925a7de6ce
512c7d79033e3028a9be61b540cf1a6870c896f8
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

HTTP Headers

GET /ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://marshy-innate-trawler.glitch.me/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 20 Apr 2024 05:30:45 GMT
content-type: text/css; charset=utf-8
content-length: 5631
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03e5f-7918"
last-modified: Mon, 04 May 2020 16:10:07 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 384530
expires: Thu, 10 Apr 2025 05:30:45 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c3MOfjXXSQ7dRPbJlfhxlOC5D9Ry8xELgOhtUgfoJXe18eMg1caZwJ9PG27waJzPpxjtF%2FZW5Xc5qpTbri8P9QyHCua8evNkzSCx5HgIbzX0wj%2FOGSQnjrvu12HGhRFYxp93Zmkj"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 8772be836e7e56c6-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

l2.io/ip.js?var=userip

195.80.159.133

200 OK

24 B

URL GET HTTP/1.1
l2.io/ip.js?var=userip
IP
195.80.159.133:443
ASN
#29152 Decknet S.a.r.l.

Requested by
https://marshy-innate-trawler.glitch.me/public/n4chaetdj.HTM
Certificate
IssuerLet's Encrypt
Subjectl2.io
Fingerprint1D:F0:67:A9:3B:A0:37:E5:4C:88:AD:B8:EA:EE:A3:BB:A1:84:53:A7
ValidityTue, 05 Mar 2024 09:52:38 GMT - Mon, 03 Jun 2024 09:52:37 GMT

File type
ASCII text, with no line terminators
Size
24 B (24 bytes)
Hash
f9dc91b3feea65bd389a2f5b57306c32
147d1c9ae79ae948a34c5f1254bdcbf7af9caf8e
d88923af30873abcf4cde709062c3d2e9ded181f9e2552c7fbcc983b3796ff77

HTTP Headers

GET /ip.js?var=userip HTTP/1.1
Host: l2.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://marshy-innate-trawler.glitch.me/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 20 Apr 2024 05:30:45 GMT
Server: Apache/2.4.38 (Debian)
Content-Length: 24
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (17)

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash