Report - hip-standing-house.glitch.me/public/digitalapps.navyfederal.org.html

Report Overview

Visited public
2024-06-08 10:19:09
Tags
URL
hip-standing-house.glitch.me/public/digitalapps.navyfederal.org.html
Finishing URL
hip-standing-house.glitch.me/public/digitalapps.navyfederal.org.html
IP / ASN
50.17.178.183
#14618 AMAZON-AES
Title
Navy Federal Credit Union - Our Members are the Mission®

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
l2.io	163527	2012-05-12	2015-06-25 03:31:26	2024-05-30 19:32:56	409 B	226 B	195.80.159.133
ocsp.r2m03.amazontrust.com	unknown	2007-05-11	2023-02-21 01:06:24	2024-06-07 10:19:56	338 B	942 B	143.204.245.189
hip-standing-house.glitch.me	unknown	unknown	No data	No data	522 B	948 kB	35.172.247.126
i.ibb.co	13485	2010-07-20	2018-11-25 11:13:48	2024-06-07 10:07:10	440 B	3.6 kB	162.19.58.161

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2024-06-08 10:18:43	medium	Client IP	35.172.247.126	ET HUNTING Suspicious Glitch Hosted TLS SNI Request - Possible Phishing Landing
2024-06-08 10:18:43	medium	Client IP	35.172.247.126	ET HUNTING Suspicious Glitch Hosted TLS SNI Request - Possible Phishing Landing
2024-06-08 10:18:43	low	Client IP	35.172.247.126	ET INFO Observed Online Application Hosting Domain (glitch .me in TLS SNI)
2024-06-08 10:18:43	low	Client IP	35.172.247.126	ET INFO Observed Online Application Hosting Domain (glitch .me in TLS SNI)
2024-06-08 10:18:44	medium	Client IP	195.80.159.133	ET POLICY Observed IP Lookup Domain (l2 .io in TLS SNI)
2024-06-08 10:18:44	medium	Client IP	195.80.159.133	ET POLICY Observed IP Lookup Domain (l2 .io in TLS SNI)

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2024-06-07	medium	hip-standing-house.glitch.me/public/digitalapps.navyfederal.org.html	Navy Federal Credit Union

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-06-08	medium	hip-standing-house.glitch.me	Sinkholed

ThreatFox

No alerts detected

JavaScript (12)

	URL	From	Size	First Seen	Last Seen
	hip-standing-house.glitch.me/public/digitalapps.navyfederal.org.html	ScriptElement	2.1 kB	2023-03-07	2025-04-12
Pretty URL hip-standing-house.glitch.me/public/digitalapps.navyfederal.org.html IP 35.172.247.126 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 12:03 Last Seen2025-04-12 17:47 Times Seen163 Hash f614f20afbf576b484daff8f1cd754e9 1638b3a4fd33b596e4f2c0b34fb4dfda7ea5b419 b706e7f259717a7f26145ad3877f817c14b281f2fb6698998dd967cfe45304ef Loading...

	hip-standing-house.glitch.me/public/digitalapps.navyfederal.org.html	ScriptElement	1.4 kB	2024-06-08	2024-08-29
Pretty URL hip-standing-house.glitch.me/public/digitalapps.navyfederal.org.html IP 35.172.247.126 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML true Observations First Seen2024-06-08 12:19 Last Seen2024-08-29 17:57 Times Seen4 Hash a16ec4e40ad84fc37eec52102e1448e4 c6fbbeb869767fa72240514a9be71376a88137b2 f075ac420d6e8d8e4858cf0b0fe310a8811a05ef4072b2b0048434d21d17a7e3 Loading...

	hip-standing-house.glitch.me/public/digitalapps.navyfederal.org.html	ScriptElement	2.0 kB	2024-06-08	2024-08-29
Pretty URL hip-standing-house.glitch.me/public/digitalapps.navyfederal.org.html IP 35.172.247.126 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML true Observations First Seen2024-06-08 12:19 Last Seen2024-08-29 17:57 Times Seen4 Hash 407b63e90cac3cda001e8fd12b7053eb a4451061bc054b5768dc588fce3224babca6020a bbbd46979675635b0f003733994ebc9727e8bf2775041e6edc15ac5be09ac853 Loading...

	hip-standing-house.glitch.me/public/digitalapps.navyfederal.org.html	ScriptElement	1.5 kB	2024-03-27	2024-12-07
Pretty URL hip-standing-house.glitch.me/public/digitalapps.navyfederal.org.html IP 35.172.247.126 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML true Observations First Seen2024-03-27 02:52 Last Seen2024-12-07 19:07 Times Seen9 Hash 73d30c65ed42a1d4c584329a36c16af9 0d3110ea20647cd787ca9f425d870a06580df5ee 15aeb6b319f300374035acc9d1bdf1c475abcece6386a7e5d26a9b0c6a6f68dd Loading...

	l2.io/ip.js?var=userip	ScriptElement	24 B	2023-03-07	2025-04-25
Pretty URL l2.io/ip.js?var=userip IP 195.80.159.133 ASN #29152 Decknet S.a.r.l. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-04-25 18:46 Times Seen1059 Hash f9dc91b3feea65bd389a2f5b57306c32 147d1c9ae79ae948a34c5f1254bdcbf7af9caf8e d88923af30873abcf4cde709062c3d2e9ded181f9e2552c7fbcc983b3796ff77 Loading...

	hip-standing-house.glitch.me/public/digitalapps.navyfederal.org.html	ScriptElement	1.6 kB	2024-03-27	2024-12-07
Pretty URL hip-standing-house.glitch.me/public/digitalapps.navyfederal.org.html IP 35.172.247.126 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML true Observations First Seen2024-03-27 02:52 Last Seen2024-12-07 19:07 Times Seen9 Hash 9c5e94d703ddfde3eeefea9f45404e44 bcc1bd4bc3d072e831a98bd8d966af6d8156b69d f32ca669a2739b3047bb060ab2151dab260263543291b7ad21d96fe504cd60de Loading...

	hip-standing-house.glitch.me/public/digitalapps.navyfederal.org.html	ScriptElement	398 B	2023-03-07	2025-04-12
Pretty URL hip-standing-house.glitch.me/public/digitalapps.navyfederal.org.html IP 35.172.247.126 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 12:03 Last Seen2025-04-12 17:31 Times Seen162 Hash 50a892b9a1594bbdffb3091e0c4c290a f764e97d3742b9ae4be7471d4c89998f83425f3f d1615b4612803995f82464f714e82ba84a7471fb6607b68080401140ceda4eb2 Loading...

	hip-standing-house.glitch.me/public/digitalapps.navyfederal.org.html	ScriptElement	1.7 kB	2024-03-27	2024-12-07
Pretty URL hip-standing-house.glitch.me/public/digitalapps.navyfederal.org.html IP 35.172.247.126 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML true Observations First Seen2024-03-27 02:52 Last Seen2024-12-07 19:07 Times Seen9 Hash 770b2e6ee145357db27e0a96387293ad f3202fbf68b1afaaa12643aeacb9605eec57441d 2e4a86653966062c1901cb2d5e965b583da0c5300a40832405755b3b955d8b8b Loading...

	hip-standing-house.glitch.me/public/digitalapps.navyfederal.org.html	ScriptElement	1.8 kB	2024-03-27	2024-12-07
Pretty URL hip-standing-house.glitch.me/public/digitalapps.navyfederal.org.html IP 35.172.247.126 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML true Observations First Seen2024-03-27 02:52 Last Seen2024-12-07 19:07 Times Seen9 Hash eb98c761f8223550e45c2d5272a2aa05 d473e571ddfffa4c16939afc54b8075c6504ac9b ce9cf07cfb22e2385fbfc64431ccb645f8c0d98a3bdde7f191566e9bf354b14a Loading...

	hip-standing-house.glitch.me/public/digitalapps.navyfederal.org.html	ScriptElement	15 B	2023-03-07	2025-04-25
Pretty URL hip-standing-house.glitch.me/public/digitalapps.navyfederal.org.html IP 35.172.247.126 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:06 Last Seen2025-04-25 08:57 Times Seen291 Hash a6334981a8bbe29aa5c1dc2edd2640b2 4c0fb8f501dfb048b93102fccc8976cd1ce14f34 5dedb26ee87d110b89e97198b67b2a79dc14359cfda2d56ff91af5f460b6a4a0 Loading...

	hip-standing-house.glitch.me/public/digitalapps.navyfederal.org.html	ScriptElement	65 B	2023-03-07	2025-04-25
Pretty URL hip-standing-house.glitch.me/public/digitalapps.navyfederal.org.html IP 35.172.247.126 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:06 Last Seen2025-04-25 08:57 Times Seen288 Hash 2bd60c5b14d66a418d7acfdb28bbbdce d2281051c147d3ba68c9cdf1048cf1d49408aa39 7ebe893f5ae6a45f490e5b51841c7ba938425832b0326aad21a13106b52d8675 Loading...

	hip-standing-house.glitch.me/public/digitalapps.navyfederal.org.html	ScriptElement	0 B	0001-01-01	2025-04-26
Pretty URL hip-standing-house.glitch.me/public/digitalapps.navyfederal.org.html IP 35.172.247.126 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML true Observations First Seen0001-01-01 00:00 Last Seen2025-04-26 01:19 Times Seen4535490 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

HTTP Transactions (4)

URL IP Response Size

ocsp.r2m03.amazontrust.com/

143.204.245.189

471 B

URL
ocsp.r2m03.amazontrust.com/
IP
143.204.245.189:0
ASN
#16509 AMAZON-02

File type
data
Size
471 B (471 bytes)
Hash
f1631c6ffd0b2ecfef611d7b0772c39f
c07a9b4f01bdbc19288d4cb709b774f614135b1d
eaa0d18fb32ac82d65c6fd9b3d22c8bf9bf307fcc214a7e73b68aba0abde095e

HTTP Headers

POST / HTTP/1.1
Host: ocsp.r2m03.amazontrust.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=7200
Date: Sat, 08 Jun 2024 10:18:43 GMT
Last-Modified: Sat, 08 Jun 2024 09:21:32 GMT
Server: ECAcc (ska/F756)
X-Cache: Miss from cloudfront
Via: 1.1 c0f81b73b25f5689e5357fd24a5fcb0c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: CPH50-C1
X-Amz-Cf-Id: fAwya7wrM-YsUVlOv7Wgep4oPwzyvr0tvfaz-KB81L3tgCFtP59C9w==
Age: 3431

hip-standing-house.glitch.me/public/digitalapps.navyfederal.org.html

35.172.247.126

200 OK

948 kB

URL User Request GET HTTP/2
hip-standing-house.glitch.me/public/digitalapps.navyfederal.org.html
IP
35.172.247.126:443
ASN
#14618 AMAZON-AES

Certificate
IssuerAmazon
Subjectglitch.com
Fingerprint57:4F:13:8A:33:42:32:7C:F7:C9:C5:1F:DF:C1:35:65:F0:E9:70:EE
ValidityMon, 04 Dec 2023 00:00:00 GMT - Wed, 01 Jan 2025 23:59:59 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (13069)
Size
948 kB (947492 bytes)
Hash
d842d740f04719265e85a8d6bc5df001
46507c4397eb611bc746f17f68bf8b6e9e7bf131
283c5f5778c14b8a925b8303a6b5f501341854de6cc9392bd1b964d07a7384a9

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Navy Federal Credit Union
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /public/digitalapps.navyfederal.org.html HTTP/1.1
Host: hip-standing-house.glitch.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sat, 08 Jun 2024 10:18:43 GMT
content-type: text/html; charset=utf-8
content-length: 947492
x-amz-id-2: D8l+SBRAiuDKiy+A6FZ5GCNjoQU91jYNlBtazlexLEeDnIWBx2fANpYr8/gvHlrsu4DtuHWO9Rc=
x-amz-request-id: 4S3SB8MGVVP64ZS7
last-modified: Sat, 25 May 2024 07:18:59 GMT
etag: "d842d740f04719265e85a8d6bc5df001"
x-amz-server-side-encryption: AES256
cache-control: no-cache
x-amz-version-id: null
accept-ranges: bytes
server: AmazonS3
X-Firefox-Spdy: h2

i.ibb.co/RpLNy4f/ajax-loader.gif

162.19.58.161

200 OK

3.2 kB

URL GET HTTP/2
i.ibb.co/RpLNy4f/ajax-loader.gif
IP
162.19.58.161:443
ASN
#16276 OVH SAS

Requested by
https://hip-standing-house.glitch.me/public/digitalapps.navyfederal.org.html
Certificate
IssuerLet's Encrypt
Subjectibb.co
Fingerprint0C:8B:6F:2F:B8:9F:91:1E:3A:DD:B1:1B:45:47:B4:65:FD:56:73:3D
ValidityMon, 22 Apr 2024 06:29:44 GMT - Sun, 21 Jul 2024 06:29:43 GMT

File type
GIF image data, version 89a, 32 x 32
Size
3.2 kB (3208 bytes)
Hash
be1cede97289c13920048f238fd37b85
313b867d11fc0dd6bc6ca47c334bbcf18956ca76
fd29b3b084cf11160bfc4e99d98a261f2b36bff29113b07367c5204563c5d355

HTTP Headers

GET /RpLNy4f/ajax-loader.gif HTTP/1.1
Host: i.ibb.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://hip-standing-house.glitch.me/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Sat, 08 Jun 2024 10:18:44 GMT
content-type: image/gif
content-length: 3208
last-modified: Tue, 02 Mar 2021 22:27:30 GMT
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000, public
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
X-Firefox-Spdy: h2

l2.io/ip.js?var=userip

195.80.159.133

200 OK

24 B

URL GET HTTP/1.1
l2.io/ip.js?var=userip
IP
195.80.159.133:443
ASN
#29152 Decknet S.a.r.l.

Requested by
https://hip-standing-house.glitch.me/public/digitalapps.navyfederal.org.html
Certificate
IssuerLet's Encrypt
Subjectl2.io
FingerprintBC:DB:2B:74:04:D1:E7:ED:9F:6C:5B:B1:7D:00:74:82:0C:E2:DE:C8
ValiditySat, 04 May 2024 14:42:18 GMT - Fri, 02 Aug 2024 14:42:17 GMT

File type
ASCII text, with no line terminators
Size
24 B (24 bytes)
Hash
f9dc91b3feea65bd389a2f5b57306c32
147d1c9ae79ae948a34c5f1254bdcbf7af9caf8e
d88923af30873abcf4cde709062c3d2e9ded181f9e2552c7fbcc983b3796ff77

HTTP Headers

GET /ip.js?var=userip HTTP/1.1
Host: l2.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://hip-standing-house.glitch.me/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sat, 08 Jun 2024 10:18:44 GMT
Server: Apache/2.4.38 (Debian)
Content-Length: 24
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (12)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by