Report - obsidian-aback-spring.glitch.me/public/NaaaffffffNeeeeeeeeeewLinnnnnnnnnk101.htm

Report Overview

Visited public
2025-05-13 16:39:27
Tags
phishing suspicious
URL
obsidian-aback-spring.glitch.me/public/NaaaffffffNeeeeeeeeeewLinnnnnnnnnk101.htm
Finishing URL
obsidian-aback-spring.glitch.me/public/NaaaffffffNeeeeeeeeeewLinnnnnnnnnk101.htm
IP / ASN
151.101.2.59
#54113 FASTLY
Title
Navy Federal Credit Union - Our Members are the Mission®
Phishing - Generic phishing
Suspicious - Suspicious Javascript code

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
i.ibb.co	13485	2010-07-20	2018-11-25	2025-05-11	457 B	3.6 kB	91.134.10.127
l2.io	163527	2012-05-12	2015-06-25	2025-05-10	426 B	228 B	195.80.159.133
obsidian-aback-spring.glitch.me	unknown	unknown	No data	No data	548 B	2.9 MB	151.101.130.59

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2025-05-13 16:38:55	medium	Client IP	151.101.130.59	ET HUNTING Suspicious Glitch Hosted TLS SNI Request - Possible Phishing Landing
2025-05-13 16:38:55	low	Client IP	151.101.130.59	ET INFO Observed Online Application Hosting Domain (glitch .me in TLS SNI)
2025-05-13 16:38:56	medium	Client IP	195.80.159.133	ET POLICY Observed IP Lookup Domain (l2 .io in TLS SNI)

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (14)

	URL	From	Size	First Seen	Last Seen
	obsidian-aback-spring.glitch.me/public/NaaaffffffNeeeeeeeeeewLinnnnnnnnnk101.htm	ScriptElement	1.2 kB	2023-05-01	2025-05-13
Pretty URL obsidian-aback-spring.glitch.me/public/NaaaffffffNeeeeeeeeeewLinnnnnnnnnk101.htm IP 151.101.130.59 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-01 11:14 Last Seen2025-05-13 16:39 Times Seen7 Hash 3eb06c6efbdcc3c5747dc0edaadc5dbd bed4fc0b6565d70992484c347e97edbfc0e8a3c8 ed7f06cc29d83e0362f95ecc68cfe5cf82ad54c3f435dc926737ec3af2ce8cc9 Loading...

	obsidian-aback-spring.glitch.me/public/NaaaffffffNeeeeeeeeeewLinnnnnnnnnk101.htm	ScriptElement	403 B	2023-04-12	2025-05-19
Pretty URL obsidian-aback-spring.glitch.me/public/NaaaffffffNeeeeeeeeeewLinnnnnnnnnk101.htm IP 151.101.130.59 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-12 19:11 Last Seen2025-05-19 17:24 Times Seen131 Hash 5d2648ad74b193d98207a4e83d9a1f94 b38359f3dbf1144fb8ffeb52beec983e05c7f3f4 f0688816dc29b83540a757623970914cd111d5cf62a13b952a19e0b7e0abef5c Loading...

	obsidian-aback-spring.glitch.me/public/NaaaffffffNeeeeeeeeeewLinnnnnnnnnk101.htm	ScriptElement	81 B	2023-04-14	2025-05-19
Pretty URL obsidian-aback-spring.glitch.me/public/NaaaffffffNeeeeeeeeeewLinnnnnnnnnk101.htm IP 151.101.130.59 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-14 09:29 Last Seen2025-05-19 17:24 Times Seen116 Hash f1986f6e942b9fd4d8e5f427725aaedd db4e78df8e28bf7e35b5c0806da193bf0c1b90b3 af1b5f1a1313c08c5037a63f9a6748a32ee7309378345d7d509dc5ae907dbf8a Loading...

	obsidian-aback-spring.glitch.me/public/NaaaffffffNeeeeeeeeeewLinnnnnnnnnk101.htm	ScriptElement	852 B	2023-04-14	2025-05-19
Pretty URL obsidian-aback-spring.glitch.me/public/NaaaffffffNeeeeeeeeeewLinnnnnnnnnk101.htm IP 151.101.130.59 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-14 09:29 Last Seen2025-05-19 17:24 Times Seen119 Hash 9dceb192be2a6a42f1c8cb970822a65a 080e262a6354da1b65f5323c29fb8631274d54d6 0163580798d4f0e81b04f46aa5f0834b2d77160c58b3f77b29764bd51a1ccc14 Loading...

	obsidian-aback-spring.glitch.me/public/NaaaffffffNeeeeeeeeeewLinnnnnnnnnk101.htm	ScriptElement	2.1 kB	2023-04-14	2025-05-19
Pretty URL obsidian-aback-spring.glitch.me/public/NaaaffffffNeeeeeeeeeewLinnnnnnnnnk101.htm IP 151.101.130.59 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-14 09:29 Last Seen2025-05-19 17:24 Times Seen115 Hash c86ca5c0ee0957abc3ecf1ac2c16a7e4 acca8e74f96b6f4bf54d53150e73e79afa646aec 540b2d3244db065c3a48a0c20500211cb43fa366e49ba32de6b91972956a832d Loading...

	obsidian-aback-spring.glitch.me/public/NaaaffffffNeeeeeeeeeewLinnnnnnnnnk101.htm	ScriptElement	1.4 kB	2023-05-01	2025-05-13
Pretty URL obsidian-aback-spring.glitch.me/public/NaaaffffffNeeeeeeeeeewLinnnnnnnnnk101.htm IP 151.101.130.59 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-01 11:14 Last Seen2025-05-13 16:39 Times Seen7 Hash eabc494e60d36a542ec5106d651db275 348c2c8ee99729aeda326218ac00dc360cff8b62 0783ca75d92ba591476100b3ec51e1b5ad2c5f0b5fdeb71ae0bddbd8b3f139fc Loading...

	obsidian-aback-spring.glitch.me/public/NaaaffffffNeeeeeeeeeewLinnnnnnnnnk101.htm	ScriptElement	1.9 kB	2023-05-01	2025-05-13
Pretty URL obsidian-aback-spring.glitch.me/public/NaaaffffffNeeeeeeeeeewLinnnnnnnnnk101.htm IP 151.101.130.59 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-01 11:14 Last Seen2025-05-13 16:39 Times Seen7 Hash 3ee5ba23798563cbbfb1d8a3579ec72b 961ee0ade2416e953626544da71ba2b0ca0b8101 4753a201176893773e1e67f291e8c119bdb0443ea94ac7b131102b6bf4676cfd Loading...

	obsidian-aback-spring.glitch.me/public/NaaaffffffNeeeeeeeeeewLinnnnnnnnnk101.htm	ScriptElement	1.3 kB	2023-05-01	2025-05-13
Pretty URL obsidian-aback-spring.glitch.me/public/NaaaffffffNeeeeeeeeeewLinnnnnnnnnk101.htm IP 151.101.130.59 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-01 11:14 Last Seen2025-05-13 16:39 Times Seen7 Hash 5aa0e9d620f1207e950c5b375d7b4909 44e9ff6ef4e290de0348da3e65e5afb918e715f9 7a212fa7f3584c42c2942fca1cc63c91c09e158c065e65b7ec7f1016cdc98441 Loading...

	obsidian-aback-spring.glitch.me/public/NaaaffffffNeeeeeeeeeewLinnnnnnnnnk101.htm	ScriptElement	24 B	2023-04-14	2025-05-19
Pretty URL obsidian-aback-spring.glitch.me/public/NaaaffffffNeeeeeeeeeewLinnnnnnnnnk101.htm IP 151.101.130.59 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-14 09:29 Last Seen2025-05-19 17:24 Times Seen119 Hash 91bd33e881a6688ae7da8750397dac52 6d0c0de1f8d985079283072f9513090acb05a8c1 5e3309457053ce2503865aba4d1ee7be808e44ba94032174834e53f4d34222b3 Loading...

	obsidian-aback-spring.glitch.me/public/NaaaffffffNeeeeeeeeeewLinnnnnnnnnk101.htm	ScriptElement	1.4 kB	2023-05-01	2025-05-13
Pretty URL obsidian-aback-spring.glitch.me/public/NaaaffffffNeeeeeeeeeewLinnnnnnnnnk101.htm IP 151.101.130.59 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-01 11:14 Last Seen2025-05-13 16:39 Times Seen7 Hash bf59a5332f5c1016255437b8eb58f6a6 899c0d96d8d4dbf1ad5aac38770584febb7efa2d 4c4ffedb1423ea09345f1a5882a7bff8a7668f1a044c7bf1d43d030c3442ad6c Loading...

	obsidian-aback-spring.glitch.me/public/NaaaffffffNeeeeeeeeeewLinnnnnnnnnk101.htm	ScriptElement	1.1 kB	2023-05-01	2025-05-13
Pretty URL obsidian-aback-spring.glitch.me/public/NaaaffffffNeeeeeeeeeewLinnnnnnnnnk101.htm IP 151.101.130.59 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-01 11:14 Last Seen2025-05-13 16:39 Times Seen7 Hash 32c1157a7fd4c5a7edfefda808a3306b 260b47a21b6c3b9ad0c407065e7f808691211b62 2a523f5cbd651323f301413d820fbbc5e276e8c4b9b383a3d64462d254cf401a Loading...

	obsidian-aback-spring.glitch.me/public/NaaaffffffNeeeeeeeeeewLinnnnnnnnnk101.htm	ScriptElement	2.9 MB	2023-05-01	2025-05-13
Pretty URL obsidian-aback-spring.glitch.me/public/NaaaffffffNeeeeeeeeeewLinnnnnnnnnk101.htm IP 151.101.130.59 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML true Observations First Seen2023-05-01 11:14 Last Seen2025-05-13 16:39 Times Seen7 Hash 0b4b1d3fe146aec49bfdb252ef380e9c db34b3cecb70a7f987a6dbc4118d93ded542626e a3226776b4adc1b370ebc84e6f0257186cf51d4c9768de4dd6ed3537c21a7c1e Loading...

	l2.io/ip.js?var=userip	ScriptElement	24 B	2023-03-07	2025-05-19
Pretty URL l2.io/ip.js?var=userip IP 195.80.159.133 ASN #29152 Decknet SARL Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-05-19 19:30 Times Seen1192 Hash f9dc91b3feea65bd389a2f5b57306c32 147d1c9ae79ae948a34c5f1254bdcbf7af9caf8e d88923af30873abcf4cde709062c3d2e9ded181f9e2552c7fbcc983b3796ff77 Loading...

		Size	First Seen	Last Seen
	#1 Write - 4296c9878bac65fdd24008cf9f9b0a4a	953 kB	2023-05-01 11:14	2025-05-13 16:39
Pretty Observations First Seen2023-05-01 11:14 Last Seen2025-05-13 16:39 Times Seen7 Hash 4296c9878bac65fdd24008cf9f9b0a4a 1d5f8f4d8f30d8b8eb07e952482d1776ba42501b 16b57936e6b46e678ce749dc8505b7ae2e81d0e9261bf117f24d733078278663 Loading...

HTTP Transactions (3)

URL IP Response Size

obsidian-aback-spring.glitch.me/public/NaaaffffffNeeeeeeeeeewLinnnnnnnnnk101.htm

151.101.130.59

200 OK

2.9 MB

URL User Request GET
obsidian-aback-spring.glitch.me/public/NaaaffffffNeeeeeeeeeewLinnnnnnnnnk101.htm
IP
151.101.130.59:443
ASN
#54113 FASTLY

Certificate
IssuerCertainly
Subject*.glitch.me
FingerprintCA:E0:99:37:8D:1B:C9:5F:F3:2F:54:20:0A:23:83:E7:75:6C:F8:AC
ValidityThu, 01 May 2025 19:31:53 GMT - Sat, 31 May 2025 19:31:52 GMT

File type
HTML document, ASCII text, with very long lines (65498)
Size
2.9 MB (2858180 bytes)
Hash
4329b68749f49a2635976a6d35fb1551
6859b9d555c36038ab4cfb8ef6fd82cbf6262df6
89418fb929b8b85c9d626fdd46fc1caba1607d30517cbb45e5c1b52b68f97007

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - Suspicious Javascript code

HTTP Headers

GET /public/NaaaffffffNeeeeeeeeeewLinnnnnnnnnk101.htm HTTP/1.1
Host: obsidian-aback-spring.glitch.me
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-amz-id-2: v480JPkHW14kGZLvochBDkLf1twxWcs9l0oDtiBngef9JwN/rQy7ucsPQnF9e4Y9kOLX1rHowFg=
content-type: text/html; charset=utf-8
accept-ranges: bytes
cache-control: no-cache
server: AmazonS3
x-amz-request-id: 0G70N84697KPH8GW
x-amz-server-side-encryption: AES256
etag: "4329b68749f49a2635976a6d35fb1551"
last-modified: Wed, 17 Apr 2024 09:54:17 GMT
x-amz-version-id: null
date: Tue, 13 May 2025 16:38:55 GMT
via: 1.1 varnish
x-served-by: cache-hel1410033-HEL, cache-hel1410033-HEL
x-cache: MISS, MISS
x-cache-hits: 0, 0
x-timer: S1747154335.264290,VS0,VE169
content-length: 2858180
X-Firefox-Spdy: h2

i.ibb.co/RpLNy4f/ajax-loader.gif

91.134.10.127

200 OK

3.2 kB

URL GET
i.ibb.co/RpLNy4f/ajax-loader.gif
IP
91.134.10.127:443
ASN
#16276 OVH SAS

Requested by
https://obsidian-aback-spring.glitch.me/public/NaaaffffffNeeeeeeeeeewLinnnnnnnnnk101.htm
Certificate
IssuerLet's Encrypt
Subjectibb.co
Fingerprint0C:AA:F7:77:A3:D5:B6:E8:71:39:92:D2:3F:B9:BD:20:7C:B9:1E:14
ValiditySun, 20 Apr 2025 07:15:11 GMT - Sat, 19 Jul 2025 07:15:10 GMT

File type
GIF image data, version 89a, 32 x 32
Size
3.2 kB (3208 bytes)
Hash
be1cede97289c13920048f238fd37b85
313b867d11fc0dd6bc6ca47c334bbcf18956ca76
fd29b3b084cf11160bfc4e99d98a261f2b36bff29113b07367c5204563c5d355

HTTP Headers

GET /RpLNy4f/ajax-loader.gif HTTP/1.1
Host: i.ibb.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://obsidian-aback-spring.glitch.me/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Tue, 13 May 2025 16:38:56 GMT
content-type: image/gif
content-length: 3208
last-modified: Tue, 02 Mar 2021 22:27:30 GMT
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000, public
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
X-Firefox-Spdy: h2

l2.io/ip.js?var=userip

195.80.159.133

200 OK

24 B

URL GET
l2.io/ip.js?var=userip
IP
195.80.159.133:443
ASN
#29152 Decknet SARL

Requested by
https://obsidian-aback-spring.glitch.me/public/NaaaffffffNeeeeeeeeeewLinnnnnnnnnk101.htm
Certificate
IssuerLet's Encrypt
Subjectl2.io
Fingerprint9B:B1:47:B0:88:4D:F1:27:55:1E:23:34:23:EC:94:C1:0C:F9:ED:04
ValidityThu, 01 May 2025 16:54:55 GMT - Wed, 30 Jul 2025 16:54:54 GMT

File type
ASCII text, with no line terminators
Size
24 B (24 bytes)
Hash
f9dc91b3feea65bd389a2f5b57306c32
147d1c9ae79ae948a34c5f1254bdcbf7af9caf8e
d88923af30873abcf4cde709062c3d2e9ded181f9e2552c7fbcc983b3796ff77

HTTP Headers

GET /ip.js?var=userip HTTP/1.1
Host: l2.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://obsidian-aback-spring.glitch.me/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Tue, 13 May 2025 16:38:56 GMT
Server: Apache/2.4.59 (Debian)
Content-Length: 24
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

JavaScript (14)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML