Report - splendid-awake-bun.glitch.me/public/vghshja.HTM

Report Overview

Visited public
2023-11-22 03:00:49
Tags
navy_federal_credit_union financial phishing suspicious
URL
splendid-awake-bun.glitch.me/public/vghshja.HTM
Finishing URL
splendid-awake-bun.glitch.me/public/vghshja.HTM
IP / ASN
44.217.233.228
#14618 AMAZON-AES
Title
Navy Federal Credit Union - Our Members are the Mission®
Phishing - Navy Federal Credit Union
Suspicious - Suspicious Javascript code

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
splendid-awake-bun.glitch.me	unknown	unknown	No data	No data	503 B	2.9 MB	34.225.219.45
i.ibb.co	13485	2010-07-20	2018-11-25 11:13:48	2023-11-21 06:20:23	442 B	3.6 kB	162.19.58.161
l2.io	163527	2012-05-12	2015-06-25 03:31:26	2023-11-20 04:35:50	411 B	226 B	195.80.159.133

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-11-22 03:00:33	medium	Client IP	Internal IP	ET HUNTING Suspicious Glitch Hosted DNS Request - Possible Phishing Landing
2023-11-22 03:00:33	medium	Client IP	Internal IP	ET HUNTING Suspicious Glitch Hosted DNS Request - Possible Phishing Landing
2023-11-22 03:00:33	medium	Client IP	Internal IP	ET HUNTING Suspicious Glitch Hosted DNS Request - Possible Phishing Landing
2023-11-22 03:00:33	medium	Client IP	34.225.219.45	ET HUNTING Suspicious Glitch Hosted TLS SNI Request - Possible Phishing Landing
2023-11-22 03:00:34	medium	Client IP	Internal IP	ET POLICY Observed IP Lookup Domain (l2 .io in DNS Lookup)
2023-11-22 03:00:34	medium	Client IP	Internal IP	ET POLICY Observed IP Lookup Domain (l2 .io in DNS Lookup)
2023-11-22 03:00:35	medium	Client IP	195.80.159.133	ET POLICY Observed IP Lookup Domain (l2 .io in TLS SNI)
2023-11-22 03:00:38	medium	Client IP	195.80.159.133	ET POLICY Observed IP Lookup Domain (l2 .io in TLS SNI)

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2023-11-21	medium	splendid-awake-bun.glitch.me/public/vghshja.HTM	Navy Federal Credit Union

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (14)

	URL	From	Size	First Seen	Last Seen
	unknown	ScriptElement	2.1 kB	2023-04-14	2025-05-08
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-14 09:29 Last Seen2025-05-08 14:10 Times Seen95 Hash c86ca5c0ee0957abc3ecf1ac2c16a7e4 acca8e74f96b6f4bf54d53150e73e79afa646aec 540b2d3244db065c3a48a0c20500211cb43fa366e49ba32de6b91972956a832d Loading...

	unknown	ScriptElement	1.3 kB	2023-04-12	2025-05-06
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-12 19:11 Last Seen2025-05-06 14:06 Times Seen62 Hash 7c019014fef43b5f4417056535a30d31 32f40351374ee91e1adeb1921d2f2acbb467c02f b4269160576c450214b445c8ff835fb26921d4f6a4120eb04c9157ddac6b853f Loading...

	unknown	ScriptElement	403 B	2023-04-12	2025-05-08
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-12 19:11 Last Seen2025-05-08 14:10 Times Seen111 Hash 5d2648ad74b193d98207a4e83d9a1f94 b38359f3dbf1144fb8ffeb52beec983e05c7f3f4 f0688816dc29b83540a757623970914cd111d5cf62a13b952a19e0b7e0abef5c Loading...

	unknown	ScriptElement	24 B	2023-04-14	2025-05-08
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-14 09:29 Last Seen2025-05-08 14:10 Times Seen99 Hash 91bd33e881a6688ae7da8750397dac52 6d0c0de1f8d985079283072f9513090acb05a8c1 5e3309457053ce2503865aba4d1ee7be808e44ba94032174834e53f4d34222b3 Loading...

	unknown	ScriptElement	1.9 kB	2023-04-12	2025-05-06
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-12 19:11 Last Seen2025-05-06 14:06 Times Seen65 Hash ee9e4a822f8b85bc8906362bbe98a8b3 5b9688ae6f30d94277474f02609b92f5341a54d3 b2e820470a68e0089be9d8a0d2c2d791bf72c4a6b6077d765e4b51fe417c8da0 Loading...

	unknown	ScriptElement	1.2 kB	2023-04-14	2025-05-06
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-14 09:29 Last Seen2025-05-06 14:06 Times Seen31 Hash 982a7a809e74f20e0f21939763aa2681 e2da2e627fca4da8d2c8c1afaa5a7703b13b8291 5aff3f7cb0a49da2081b51067315bdbae6ee8bf86546d7525756d80ad034d211 Loading...

	unknown	ScriptElement	1.4 kB	2023-04-12	2025-05-06
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-12 19:11 Last Seen2025-05-06 14:06 Times Seen65 Hash 81c97ebd890afc77ff82d7c79beca854 cdf9e82fc2c184210c55dbdd09572ebfbb08667f b5f98fc6510547589808b6cc70d2ab8bf766369f84b01a9a9ded49682c5b9a64 Loading...

	unknown	ScriptElement	852 B	2023-04-14	2025-05-08
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-14 09:29 Last Seen2025-05-08 14:10 Times Seen97 Hash 9dceb192be2a6a42f1c8cb970822a65a 080e262a6354da1b65f5323c29fb8631274d54d6 0163580798d4f0e81b04f46aa5f0834b2d77160c58b3f77b29764bd51a1ccc14 Loading...

	unknown	ScriptElement	1.4 kB	2023-05-07	2024-08-29
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-07 21:52 Last Seen2024-08-29 18:00 Times Seen8 Hash a18be7c31384431483dc4e3b96671011 d61dda0125b5990d8f8b73f9ff3b30019d010441 94b4ff2e3b9cf342545017451a35e05090bb28a3dd405151ed5b68590748fa40 Loading...

	unknown	ScriptElement	1.1 kB	2023-04-12	2025-05-06
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-12 19:11 Last Seen2025-05-06 14:06 Times Seen64 Hash 9f982fda3140f4c73c12676d7058ace6 ed11bc6b7f5186835b756793fa858945f342f65d 5a711c57c47a9bb18c5a97a48209489a5b36ccb51ce7b561c1a566ef819c99e6 Loading...

	l2.io/ip.js?var=userip	ScriptElement	24 B	2023-03-07	2025-05-09
Pretty URL l2.io/ip.js?var=userip IP 195.80.159.133 ASN #29152 Decknet S.a.r.l. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-05-09 07:36 Times Seen1137 Hash f9dc91b3feea65bd389a2f5b57306c32 147d1c9ae79ae948a34c5f1254bdcbf7af9caf8e d88923af30873abcf4cde709062c3d2e9ded181f9e2552c7fbcc983b3796ff77 Loading...

	splendid-awake-bun.glitch.me/public/vghshja.HTM	ScriptElement	2.9 MB	2023-03-08	2024-08-29
Pretty URL splendid-awake-bun.glitch.me/public/vghshja.HTM IP 34.225.219.45 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-08 11:55 Last Seen2024-08-29 18:00 Times Seen8 Hash eb5a844abf5c8c7103b17998cd75e83e f5909e0e745e87c2fd3577d075b22765adae562b cbe62498bb3efe7ffbb122c32c58eae32d5b700c531a007c976d395270636f41 Loading...

	unknown	ScriptElement	81 B	2023-04-14	2025-05-08
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-14 09:29 Last Seen2025-05-08 14:10 Times Seen96 Hash f1986f6e942b9fd4d8e5f427725aaedd db4e78df8e28bf7e35b5c0806da193bf0c1b90b3 af1b5f1a1313c08c5037a63f9a6748a32ee7309378345d7d509dc5ae907dbf8a Loading...

		Size	First Seen	Last Seen
	#1 Write - b24e3b4ad9d5bace5317ed7eda88f960	953 kB	2023-03-08 11:55	2024-08-29 18:00
Pretty Observations First Seen2023-03-08 11:55 Last Seen2024-08-29 18:00 Times Seen8 Hash b24e3b4ad9d5bace5317ed7eda88f960 937c965a966068bbb2d8bbd8900329757fbe44dd d155a9e6f66498c507fc8ac2674c0aa55ea3cf02abe3c5e3a3102b35a778d9ca Loading...

HTTP Transactions (3)

URL IP Response Size

splendid-awake-bun.glitch.me/public/vghshja.HTM

34.225.219.45

200 OK

2.9 MB

URL User Request GET HTTP/2
splendid-awake-bun.glitch.me/public/vghshja.HTM
IP
34.225.219.45:443
ASN
#14618 AMAZON-AES

Certificate
IssuerAmazon
Subjectglitch.com
Fingerprint13:93:2D:E4:50:7E:CE:BA:BC:F9:6D:7E:86:7F:43:5D:8E:63:45:3E
ValidityWed, 22 Feb 2023 00:00:00 GMT - Thu, 01 Feb 2024 23:59:59 GMT

File type
HTML document text\012- exported SGML document, ASCII text, with very long lines (65489)
Size
2.9 MB (2858072 bytes)
Hash
aa21faadd9890747c3656b6ded716f1d
7b80cbe0319153f79feba2968b81e61cb402c7f7
6042eda2ff974a88522e238c64c70a0da1d0bdae4df3ece8108ca698aeb24083

Detections

Analyzer	Verdict	Alert
urlquery	phishing	Phishing - Navy Federal Credit Union
OpenPhish	phishing	Navy Federal Credit Union

HTTP Headers

GET /public/vghshja.HTM HTTP/1.1
Host: splendid-awake-bun.glitch.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Wed, 22 Nov 2023 03:00:31 GMT
content-type: text/html; charset=utf-8
content-length: 2858072
x-amz-id-2: p4RdqxKTk/chiOyr1i/7/trSPupvmuiieJonZazH5wtzu38yLXhGSYjqim+majwVv4Vz9Zhwz6g=
x-amz-request-id: 0E7401KHNWE7N7W1
last-modified: Mon, 25 Sep 2023 17:31:27 GMT
etag: "aa21faadd9890747c3656b6ded716f1d"
x-amz-server-side-encryption: AES256
cache-control: no-cache
x-amz-version-id: null
accept-ranges: bytes
server: AmazonS3
X-Firefox-Spdy: h2

i.ibb.co/RpLNy4f/ajax-loader.gif

162.19.58.161

200 OK

3.2 kB

URL GET HTTP/2
i.ibb.co/RpLNy4f/ajax-loader.gif
IP
162.19.58.161:443
ASN
#16276 OVH SAS

Requested by
https://splendid-awake-bun.glitch.me/public/vghshja.HTM
Certificate
IssuerLet's Encrypt
Subjectibb.co
FingerprintCC:72:96:95:90:7F:15:8E:AC:C5:40:3A:D2:6F:83:A3:DF:5E:72:56
ValidityMon, 09 Oct 2023 14:39:49 GMT - Sun, 07 Jan 2024 14:39:48 GMT

File type
GIF image data, version 89a, 32 x 32\012- data
Size
3.2 kB (3208 bytes)
Hash
be1cede97289c13920048f238fd37b85
313b867d11fc0dd6bc6ca47c334bbcf18956ca76
fd29b3b084cf11160bfc4e99d98a261f2b36bff29113b07367c5204563c5d355

HTTP Headers

GET /RpLNy4f/ajax-loader.gif HTTP/1.1
Host: i.ibb.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://splendid-awake-bun.glitch.me/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 22 Nov 2023 03:00:32 GMT
content-type: image/gif
content-length: 3208
last-modified: Tue, 02 Mar 2021 22:27:30 GMT
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000, public
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
X-Firefox-Spdy: h2

l2.io/ip.js?var=userip

195.80.159.133

200 OK

24 B

URL GET HTTP/1.1
l2.io/ip.js?var=userip
IP
195.80.159.133:443
ASN
#29152 Decknet S.a.r.l.

Requested by
https://splendid-awake-bun.glitch.me/public/vghshja.HTM
Certificate
IssuerLet's Encrypt
Subjectl2.io
Fingerprint65:49:ED:2D:E9:35:D9:26:3D:70:87:2B:4F:20:FF:14:56:55:52:B4
ValidityTue, 17 Oct 2023 07:33:55 GMT - Mon, 15 Jan 2024 07:33:54 GMT

File type
ASCII text, with no line terminators
Size
24 B (24 bytes)
Hash
f9dc91b3feea65bd389a2f5b57306c32
147d1c9ae79ae948a34c5f1254bdcbf7af9caf8e
d88923af30873abcf4cde709062c3d2e9ded181f9e2552c7fbcc983b3796ff77

HTTP Headers

GET /ip.js?var=userip HTTP/1.1
Host: l2.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://splendid-awake-bun.glitch.me/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 22 Nov 2023 03:00:34 GMT
Server: Apache/2.4.38 (Debian)
Content-Length: 24
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (14)

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

HTTP Transactions (3)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size