Report - buttery-slash-tuberose.glitch.me/public/ONLINEW54390AUSSOAU.htm

Report Overview

Visited public
2023-11-20 03:36:07
Tags
navy_federal_credit_union financial phishing
URL
buttery-slash-tuberose.glitch.me/public/ONLINEW54390AUSSOAU.htm
Finishing URL
buttery-slash-tuberose.glitch.me/public/ONLINEW54390AUSSOAU.htm
IP / ASN
54.84.157.136
#14618 AMAZON-AES
Title
Navy Federal Credit Union - Our Members are the Mission®
Phishing - Navy Federal Credit Union

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
buttery-slash-tuberose.glitch.me	unknown	2008-07-18	2023-11-19 17:40:38	2023-11-20 01:08:05	519 B	1.1 MB	34.237.3.83
i.ibb.co	13485	2010-07-20	2018-11-25 11:13:48	2023-11-20 02:50:05	446 B	3.6 kB	162.19.58.158
l2.io	163527	2012-05-12	2015-06-25 03:31:26	2023-11-19 02:58:10	415 B	226 B	195.80.159.133

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-11-20 03:35:50	high	Client IP	Internal IP	ET PHISHING Possible Glitch.me Phishing Domain
2023-11-20 03:35:50	high	Client IP	Internal IP	ET PHISHING Possible Glitch.me Phishing Domain
2023-11-20 03:35:50	medium	Client IP	Internal IP	ET HUNTING Suspicious Glitch Hosted DNS Request - Possible Phishing Landing
2023-11-20 03:35:50	medium	Client IP	Internal IP	ET HUNTING Suspicious Glitch Hosted DNS Request - Possible Phishing Landing
2023-11-20 03:35:50	high	Client IP	Internal IP	ET PHISHING Possible Glitch.me Phishing Domain
2023-11-20 03:35:50	medium	Client IP	Internal IP	ET HUNTING Suspicious Glitch Hosted DNS Request - Possible Phishing Landing
2023-11-20 03:35:50	medium	Client IP	34.237.3.83	ET HUNTING Suspicious Glitch Hosted TLS SNI Request - Possible Phishing Landing
2023-11-20 03:35:51	medium	Client IP	Internal IP	ET POLICY Observed IP Lookup Domain (l2 .io in DNS Lookup)
2023-11-20 03:35:51	medium	Client IP	Internal IP	ET POLICY Observed IP Lookup Domain (l2 .io in DNS Lookup)
2023-11-20 03:35:52	medium	Client IP	195.80.159.133	ET POLICY Observed IP Lookup Domain (l2 .io in TLS SNI)

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2023-11-19	medium	buttery-slash-tuberose.glitch.me/public/ONLINEW54390AUSSOAU.htm	Navy Federal Credit Union

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (14)

	URL	From	Size	First Seen	Last Seen
	unknown	ScriptElement	1.9 kB	2023-08-11	2024-08-21
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-08-11 04:45 Last Seen2024-08-21 09:31 Times Seen50 Hash 9ae8c6e2021bee064ad1ff8561c3fc70 64ed166c7404f3e0ac6785bec76b77e3750b23dd 81f1dd009e550a7861f2aa8c9fd4ae50dbead863c78c4e0e3f7a40573979bf37 Loading...

	unknown	ScriptElement	1.1 kB	2023-08-11	2025-05-06
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-08-11 04:45 Last Seen2025-05-06 12:16 Times Seen96 Hash f9d6f3dcf03ffa3cd03dad7de82f1ef5 2bf02ea6ce066e9a7252e5521f8982c1df23a4b2 bee7af6ebff9d8015d2f98cdd77118f53ae6d6eaf3698d55e06fd553144bbbb1 Loading...

	unknown	ScriptElement	2.1 kB	2023-08-11	2025-05-07
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-08-11 04:45 Last Seen2025-05-07 17:44 Times Seen122 Hash cf3731b72115f6d65cdb0221decb7bac df8d4d257ad3636bb337782aa48907c4ffaf1583 27eda76114912a6697a33b25b587d946bbb75b042846ec23382611e004116346 Loading...

	unknown	ScriptElement	1.4 kB	2023-09-17	2024-08-21
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-09-17 02:26 Last Seen2024-08-21 06:38 Times Seen29 Hash a496344236a0ebe6ef9595072608d6b1 bb88aea7a8802aa218c2b5435e10828ba2c63dc7 e82fe0563c63f973f1a9853cd651733250d6db2f6d494604a4fa683f15958dc9 Loading...

	unknown	ScriptElement	404 B	2023-08-11	2025-05-07
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-08-11 04:45 Last Seen2025-05-07 17:44 Times Seen122 Hash 91afdf060127912d805e13a2ecc507a1 2926efc7b46678bf939c93cd257b47833ea5e4cb 45e55e7df48a3fc4d67d42d69f072c247e63ff1d047ebceb99fc42e5c8c01bc1 Loading...

	unknown	ScriptElement	1.4 kB	2023-08-11	2025-05-06
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-08-11 04:45 Last Seen2025-05-06 12:16 Times Seen96 Hash 14f6a41c4b561592deda7b697b3dd920 607d9823828412a5ed58dfc0e907ce09bf5aaaff 562627d6d9c41cd2b36443dad4ff99f41b5b34d7d1cbe167637f59467fbff4e4 Loading...

	l2.io/ip.js?var=userip	ScriptElement	24 B	2023-03-07	2025-05-09
Pretty URL l2.io/ip.js?var=userip IP 195.80.159.133 ASN #29152 Decknet S.a.r.l. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-05-09 07:36 Times Seen1137 Hash f9dc91b3feea65bd389a2f5b57306c32 147d1c9ae79ae948a34c5f1254bdcbf7af9caf8e d88923af30873abcf4cde709062c3d2e9ded181f9e2552c7fbcc983b3796ff77 Loading...

	unknown	ScriptElement	80 B	2023-04-17	2025-05-07
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-17 07:53 Last Seen2025-05-07 17:44 Times Seen172 Hash ae20ce6047b374cdb6b4ed5a2fff9dd2 78044e79d31970c24cfb093c84b46bedbc1514eb 4ae158d12e85ef975077cdd7fb3422da87336f2a84ab777113974d704b60a6ca Loading...

	buttery-slash-tuberose.glitch.me/public/ONLINEW54390AUSSOAU.htm	ScriptElement	1.1 MB	2023-09-17	2024-08-21
Pretty URL buttery-slash-tuberose.glitch.me/public/ONLINEW54390AUSSOAU.htm IP 34.237.3.83 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML true Observations First Seen2023-09-17 02:26 Last Seen2024-08-21 06:38 Times Seen29 Hash 35e0d82001e50419cc96322e0e27c32a 887211529aacf39b2050aff2ae71b38c63beea1e f54ea94e23057fc5ef3a35b660a9617c37d2182803bfa8371206121f77261206 Loading...

	unknown	ScriptElement	1.2 kB	2023-08-11	2025-05-06
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-08-11 04:45 Last Seen2025-05-06 12:16 Times Seen96 Hash 7903349a30cb3fe1cc011c68673f9d59 9bbe74b64a3eb8a9f1f743768c004668eb01a980 3111ab4b8fe0462a340b8645b6f02cc18a640ce0b1ca63275654feafe734738b Loading...

	unknown	ScriptElement	1.3 kB	2023-08-11	2025-05-06
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-08-11 04:45 Last Seen2025-05-06 12:16 Times Seen96 Hash 4929f147b923377f32ed818085d4a83b 35bcada2186ee9d198cf80e753181794c54f6bde 1963b7320b1ac56bde4458f5b4f3d56193ff3d6e28f512de8f37fdde4d79769b Loading...

	unknown	ScriptElement	23 B	2023-04-17	2025-05-07
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-17 07:53 Last Seen2025-05-07 17:44 Times Seen172 Hash 7daf22e412582bd955abec238c735f24 6eea0cdb1040194e77d455024bb9cbfb5378016a 1263a3e1e1c19b2064d03506aba02ffc04f0d5747675d9e6404506a2a77da7a9 Loading...

	unknown	ScriptElement	860 B	2023-07-03	2025-05-07
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-07-03 17:19 Last Seen2025-05-07 17:44 Times Seen136 Hash 8fe0201e9c33e36f49f52d2b371a27f9 3bb2ed60fc5b434fcf1481b478d1b1f75fd70c66 bd5978aa8345ffb032720036c0754a5c0b1f759f81f6abb0129baefcd3104606 Loading...

		Size	First Seen	Last Seen
	#1 Write - 4aec96e66a948af4d5d3ce419fd1226d	943 kB	2023-09-17 02:26	2024-08-21 06:38
Pretty Observations First Seen2023-09-17 02:26 Last Seen2024-08-21 06:38 Times Seen29 Hash 4aec96e66a948af4d5d3ce419fd1226d 0985b3be6710d7caecf44cbebc6227ab4deaf441 18a423ac4276efdafbbc045a269022bc3c7a1c911d415ce5b0fc355d6416c6e7 Loading...

HTTP Transactions (3)

URL IP Response Size

buttery-slash-tuberose.glitch.me/public/ONLINEW54390AUSSOAU.htm

34.237.3.83

200 OK

1.1 MB

URL User Request GET HTTP/2
buttery-slash-tuberose.glitch.me/public/ONLINEW54390AUSSOAU.htm
IP
34.237.3.83:443
ASN
#14618 AMAZON-AES

Certificate
IssuerAmazon
Subjectglitch.com
Fingerprint13:93:2D:E4:50:7E:CE:BA:BC:F9:6D:7E:86:7F:43:5D:8E:63:45:3E
ValidityWed, 22 Feb 2023 00:00:00 GMT - Thu, 01 Feb 2024 23:59:59 GMT

File type
HTML document text\012- exported SGML document, ASCII text, with very long lines (65522)
Size
1.1 MB (1086744 bytes)
Hash
4c5c72b17753079de112d8ac0752cc8b
185952e3370e9c3d62ecea67356873f2a2e7f17d
4ea626c39f81286843457acea9b5c5fbe3da9ba724d69b426946405d41c3a01f

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Navy Federal Credit Union

HTTP Headers

GET /public/ONLINEW54390AUSSOAU.htm HTTP/1.1
Host: buttery-slash-tuberose.glitch.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Mon, 20 Nov 2023 03:35:49 GMT
content-type: text/html; charset=utf-8
content-length: 1086744
x-amz-id-2: 0jVGJ0A4UEag1aHNpuCDh7xQvjEX/vCUuvMcwvPA9Jp9adiQ/jUPNBG6dTz5iPENhltZDsm/NYM=
x-amz-request-id: D9G8JHQKBF2X048X
last-modified: Sat, 18 Nov 2023 14:23:14 GMT
etag: "4c5c72b17753079de112d8ac0752cc8b"
x-amz-server-side-encryption: AES256
cache-control: no-cache
x-amz-version-id: null
accept-ranges: bytes
server: AmazonS3
X-Firefox-Spdy: h2

i.ibb.co/RpLNy4f/ajax-loader.gif

162.19.58.158

200 OK

3.2 kB

URL GET HTTP/2
i.ibb.co/RpLNy4f/ajax-loader.gif
IP
162.19.58.158:443
ASN
#16276 OVH SAS

Requested by
https://buttery-slash-tuberose.glitch.me/public/ONLINEW54390AUSSOAU.htm
Certificate
IssuerLet's Encrypt
Subjectibb.co
FingerprintCC:72:96:95:90:7F:15:8E:AC:C5:40:3A:D2:6F:83:A3:DF:5E:72:56
ValidityMon, 09 Oct 2023 14:39:49 GMT - Sun, 07 Jan 2024 14:39:48 GMT

File type
GIF image data, version 89a, 32 x 32\012- data
Size
3.2 kB (3208 bytes)
Hash
be1cede97289c13920048f238fd37b85
313b867d11fc0dd6bc6ca47c334bbcf18956ca76
fd29b3b084cf11160bfc4e99d98a261f2b36bff29113b07367c5204563c5d355

HTTP Headers

GET /RpLNy4f/ajax-loader.gif HTTP/1.1
Host: i.ibb.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://buttery-slash-tuberose.glitch.me/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Mon, 20 Nov 2023 03:35:50 GMT
content-type: image/gif
content-length: 3208
last-modified: Tue, 02 Mar 2021 22:27:30 GMT
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000, public
access-control-allow-origin: *
access-control-allow-methods: GET, OPTIONS
accept-ranges: bytes
X-Firefox-Spdy: h2

l2.io/ip.js?var=userip

195.80.159.133

200 OK

24 B

URL GET HTTP/1.1
l2.io/ip.js?var=userip
IP
195.80.159.133:443
ASN
#29152 Decknet S.a.r.l.

Requested by
https://buttery-slash-tuberose.glitch.me/public/ONLINEW54390AUSSOAU.htm
Certificate
IssuerLet's Encrypt
Subjectl2.io
Fingerprint65:49:ED:2D:E9:35:D9:26:3D:70:87:2B:4F:20:FF:14:56:55:52:B4
ValidityTue, 17 Oct 2023 07:33:55 GMT - Mon, 15 Jan 2024 07:33:54 GMT

File type
ASCII text, with no line terminators
Size
24 B (24 bytes)
Hash
f9dc91b3feea65bd389a2f5b57306c32
147d1c9ae79ae948a34c5f1254bdcbf7af9caf8e
d88923af30873abcf4cde709062c3d2e9ded181f9e2552c7fbcc983b3796ff77

HTTP Headers

GET /ip.js?var=userip HTTP/1.1
Host: l2.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://buttery-slash-tuberose.glitch.me/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Mon, 20 Nov 2023 03:35:51 GMT
Server: Apache/2.4.38 (Debian)
Content-Length: 24
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (14)

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

HTTP Transactions (3)

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size