Report - mammoth-sandy-durian.glitch.me/

Report Overview

Submitted URL
mammoth-sandy-durian.glitch.me/
IP
52.5.48.123
ASN
#14618 AMAZON-AES
Submitted
2023-06-02 04:40:50
Access
public
Website Title
Final URL
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
19
Threat Detection Systems
0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
i.imgyukle.com	925856	2016-08-27	2017-05-13	2023-05-13	900 B	0 B	0.0.0.0
ocsp.r2m01.amazontrust.com	unknown	2007-05-11	2022-10-12	2023-06-02	340 B	942 B	54.230.80.227
mammoth-sandy-durian.glitch.me	unknown	2008-07-18	2022-12-28	2023-04-26	1.9 kB	25 kB	75.101.194.106

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-06-02 04:40:32	medium	Client IP	Internal IP	ET HUNTING Suspicious Glitch Hosted DNS Request - Possible Phishing Landing
2023-06-02 04:40:32	medium	Client IP	Internal IP	ET HUNTING Suspicious Glitch Hosted DNS Request - Possible Phishing Landing
2023-06-02 04:40:32	medium	Client IP	Internal IP	ET HUNTING Suspicious Glitch Hosted DNS Request - Possible Phishing Landing
2023-06-02 04:40:33	medium	Client IP	75.101.194.106	ET HUNTING Suspicious Glitch Hosted TLS SNI Request - Possible Phishing Landing
2023-06-02 04:40:33	medium	Client IP	Internal IP	ET HUNTING Suspicious Glitch Hosted DNS Request - Possible Phishing Landing
2023-06-02 04:40:33	low	Client IP	Internal IP	ET INFO Image Hosting Domain in DNS Lookup (imgyukle .com)
2023-06-02 04:40:33	low	Client IP	Internal IP	ET INFO Image Hosting Domain in DNS Lookup (imgyukle .com)
2023-06-02 04:40:33	low	Client IP	Internal IP	ET INFO Image Hosting Domain in DNS Lookup (imgyukle .com)
2023-06-02 04:40:33	low	Client IP	Internal IP	ET INFO Image Hosting Domain in DNS Lookup (imgyukle .com)
2023-06-02 04:40:33	low	Client IP	Internal IP	ET INFO Image Hosting Domain in DNS Lookup (imgyukle .com)
2023-06-02 04:40:33	low	Client IP	Internal IP	ET INFO Image Hosting Domain in DNS Lookup (imgyukle .com)
2023-06-02 04:40:33	low	Client IP	Internal IP	ET INFO Image Hosting Domain in DNS Lookup (imgyukle .com)
2023-06-02 04:40:33	low	Client IP	Internal IP	ET INFO Image Hosting Domain in DNS Lookup (imgyukle .com)
2023-06-02 04:40:33	low	Client IP	Internal IP	ET INFO Image Hosting Domain in DNS Lookup (imgyukle .com)
2023-06-02 04:40:33	low	Client IP	Internal IP	ET INFO Image Hosting Domain in DNS Lookup (imgyukle .com)
2023-06-02 04:40:33	low	Client IP	Internal IP	ET INFO Image Hosting Domain in DNS Lookup (imgyukle .com)
2023-06-02 04:40:33	low	Client IP	Internal IP	ET INFO Image Hosting Domain in DNS Lookup (imgyukle .com)
2023-06-02 04:40:33	medium	Client IP	Internal IP	ET HUNTING Suspicious Glitch Hosted DNS Request - Possible Phishing Landing
2023-06-02 04:40:34	medium	Client IP	Internal IP	ET HUNTING Suspicious Glitch Hosted DNS Request - Possible Phishing Landing

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (0)

HTTP Transactions (7)

	URL	IP	Response	Size
	ocsp.r2m01.amazontrust.com/	54.230.80.227		471 B
URL ocsp.r2m01.amazontrust.com/ IP 54.230.80.227:0 ASN #16509 AMAZON-02 File type data Size 471 B (471 bytes) Hash 8b1f4e5aefb9489f35b847657d0c3bcb d278d1e57197f9b6e2f1bb2f601385b650f8b8e3 20ce461c54410c70c0da9fc8f383a42f88fb38d51eade9a392e17a42fd864d97 HTTP Headers `POST / HTTP/1.1 Host: ocsp.r2m01.amazontrust.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 83 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 471 Connection: keep-alive Accept-Ranges: bytes Cache-Control: max-age=7200 Date: Fri, 02 Jun 2023 04:40:33 GMT Last-Modified: Fri, 02 Jun 2023 02:56:23 GMT Server: ECAcc (bsa/EA8F) X-Cache: Miss from cloudfront Via: 1.1 3bff78035f818b6a3185b0f5f4586410.cloudfront.net (CloudFront) X-Amz-Cf-Pop: OSL50-P1 X-Amz-Cf-Id: 8ZmqixIc9i3JZDzH1iAwuRU0SqDAcZUAcyS2ivG1ajwncQhaZBYPtA== Age: 6250`

	mammoth-sandy-durian.glitch.me/	75.101.194.106	200 OK	1.6 kB
URL User Request GET HTTP/2 mammoth-sandy-durian.glitch.me/ IP 75.101.194.106:443 ASN #14618 AMAZON-AES Certificate IssuerAmazon Subjectglitch.com Fingerprint13:93:2D:E4:50:7E:CE:BA:BC:F9:6D:7E:86:7F:43:5D:8E:63:45:3E ValidityWed, 22 Feb 2023 00:00:00 GMT - Thu, 01 Feb 2024 23:59:59 GMT File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, ASCII text, with CRLF line terminators Size 1.6 kB (1574 bytes) Hash 324ccfc08c37fe2e40e77f9acc29b103 d1b0af16c52e94bea2f45aaf6a63d9c98055012e 0c4bc77c3708c5164479c8c5355d8b9e7216e2fdefbd43663d5eb76f41051af3 HTTP Headers `GET / HTTP/1.1 Host: mammoth-sandy-durian.glitch.me User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache` `HTTP/2 200 OK date: Fri, 02 Jun 2023 04:40:33 GMT content-type: text/html; charset=utf-8 content-length: 1574 x-amz-id-2: Ig3dwdJ55v7WqSJMIR4M8TvuAmObycOhFZGEZNTG7Ag2V76aLoYVUIhN0xRGBY6JTvKpPET5uSE= x-amz-request-id: JW10RVW4WM7XX3TP last-modified: Wed, 28 Dec 2022 11:47:46 GMT etag: "324ccfc08c37fe2e40e77f9acc29b103" x-amz-server-side-encryption: AES256 cache-control: no-cache x-amz-version-id: 56Me9RjmJb2eAyv9yQ39W02f.3vlQ.SV accept-ranges: bytes server: AmazonS3 X-Firefox-Spdy: h2`

	mammoth-sandy-durian.glitch.me/style.css	75.101.194.106	404 Not Found	3.7 kB
URL GET HTTP/2 mammoth-sandy-durian.glitch.me/style.css IP 75.101.194.106:443 ASN #14618 AMAZON-AES Requested by https://mammoth-sandy-durian.glitch.me/ Certificate IssuerAmazon Subjectglitch.com Fingerprint13:93:2D:E4:50:7E:CE:BA:BC:F9:6D:7E:86:7F:43:5D:8E:63:45:3E ValidityWed, 22 Feb 2023 00:00:00 GMT - Thu, 01 Feb 2024 23:59:59 GMT File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text Size 3.7 kB (3672 bytes) Hash cb7041c1a55eafb11d1cd3803a1d6ece ca77adb188cc5841de7c4da8ea09d4f31e6b6210 39636ae7f7de3deacfe55d573d85d1bb5c349440065b16e573e5e3c62a0e3fb6 HTTP Headers `GET /style.css HTTP/1.1 Host: mammoth-sandy-durian.glitch.me User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: text/css,/;q=0.1 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Referer: https://mammoth-sandy-durian.glitch.me/ Sec-Fetch-Dest: style Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin Pragma: no-cache Cache-Control: no-cache TE: trailers` `HTTP/2 404 Not Found date: Fri, 02 Jun 2023 04:40:34 GMT content-length: 3672 cache-control: max-age=0 X-Firefox-Spdy: h2`

	mammoth-sandy-durian.glitch.me/favicon.ico	75.101.194.106	404 Not Found	3.7 kB
URL GET HTTP/2 mammoth-sandy-durian.glitch.me/favicon.ico IP 75.101.194.106:443 ASN #14618 AMAZON-AES Requested by https://mammoth-sandy-durian.glitch.me/ Certificate IssuerAmazon Subjectglitch.com Fingerprint13:93:2D:E4:50:7E:CE:BA:BC:F9:6D:7E:86:7F:43:5D:8E:63:45:3E ValidityWed, 22 Feb 2023 00:00:00 GMT - Thu, 01 Feb 2024 23:59:59 GMT File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text Size 3.7 kB (3672 bytes) Hash cb7041c1a55eafb11d1cd3803a1d6ece ca77adb188cc5841de7c4da8ea09d4f31e6b6210 39636ae7f7de3deacfe55d573d85d1bb5c349440065b16e573e5e3c62a0e3fb6 HTTP Headers `GET /favicon.ico HTTP/1.1 Host: mammoth-sandy-durian.glitch.me User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Referer: https://mammoth-sandy-durian.glitch.me/ Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: same-origin Pragma: no-cache Cache-Control: no-cache TE: trailers` `HTTP/2 404 Not Found date: Fri, 02 Jun 2023 04:40:34 GMT content-length: 3672 cache-control: max-age=0 X-Firefox-Spdy: h2`

	mammoth-sandy-durian.glitch.me/username.php	75.101.194.106	200 OK	15 kB
URL User Request GET HTTP/2 mammoth-sandy-durian.glitch.me/username.php IP 75.101.194.106:443 ASN #14618 AMAZON-AES Certificate IssuerAmazon Subjectglitch.com Fingerprint13:93:2D:E4:50:7E:CE:BA:BC:F9:6D:7E:86:7F:43:5D:8E:63:45:3E ValidityWed, 22 Feb 2023 00:00:00 GMT - Thu, 01 Feb 2024 23:59:59 GMT File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (6595), with CRLF line terminators Size 15 kB (15188 bytes) Hash 61a7bc927fb367776bfdd464cad0d7ab 4442e81fc2ffbfa12ef567d48ff0be855eb3a6a7 6fc94b16cf1f70ee03463cd444a6c29de4b9a2a6fc07377dc698427fbbe70f26 HTTP Headers `GET /username.php HTTP/1.1 Host: mammoth-sandy-durian.glitch.me User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin Pragma: no-cache Cache-Control: no-cache TE: trailers` HTTP/2 200 OK date: Fri, 02 Jun 2023 04:40:35 GMT content-type: application/x-httpd-php content-length: 15188 x-amz-id-2: GNl0uXs+//zsK7fRIDk23UQLG1AaMOaV25qEjqLno/5anKi6FNmQVzWvAIuQHNPEMqxk8BQ4XeHzft+Xp2uU3BjvtqXDwzSzHIKmWMULaA4= x-amz-request-id: FAGD7ZXC0B55CAJ1 last-modified: Wed, 28 Dec 2022 11:47:46 GMT etag: "61a7bc927fb367776bfdd464cad0d7ab" x-amz-server-side-encryption: AES256 cache-control: no-cache x-amz-version-id: 0KKKPfEA0F7EiG9TFg1kHOUvVv3Lf9b. accept-ranges: bytes server: AmazonS3 X-Firefox-Spdy: h2

	i.imgyukle.com/2020/07/17/SHN2fR.png	0.0.0.0		0 B
URL GET i.imgyukle.com/2020/07/17/SHN2fR.png IP 0.0.0.0:0 ASN #0 Requested by https://mammoth-sandy-durian.glitch.me/ File type Size 0 B (0 bytes) Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP Headers `GET /2020/07/17/SHN2fR.png HTTP/1.1 Host: i.imgyukle.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Referer: https://mammoth-sandy-durian.glitch.me/ Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache`

	i.imgyukle.com/2020/07/17/SHNOWo.png	0.0.0.0		0 B
URL GET i.imgyukle.com/2020/07/17/SHNOWo.png IP 0.0.0.0:0 ASN #0 Requested by https://mammoth-sandy-durian.glitch.me/ File type Size 0 B (0 bytes) Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP Headers `GET /2020/07/17/SHNOWo.png HTTP/1.1 Host: i.imgyukle.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Referer: https://mammoth-sandy-durian.glitch.me/ Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache`

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (0)

HTTP Transactions (7)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET HTTP/2

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL GET

IP

ASN

Requested by

File type

Size

Hash

HTTP Headers

URL GET

IP

ASN

Requested by