Report - zany-pouncing-pair.glitch.me/public/nfculogon.html

Report Overview

Visited public
2023-11-24 02:47:29
Tags
suspicious
URL
zany-pouncing-pair.glitch.me/public/nfculogon.html
Finishing URL
zany-pouncing-pair.glitch.me/public/nfculogon.html
IP / ASN
34.199.59.238
#14618 AMAZON-AES
Title
Navy Federal Credit Union - Our Members are the Mission®
Suspicious - Suspicious Javascript code

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
l2.io	163527	2012-05-12	2015-06-25 03:31:26	2023-11-21 03:22:21	411 B	226 B	195.80.159.133
cdnjs.cloudflare.com	235	2009-02-17	2015-04-17 22:46:33	2023-11-23 05:09:19	477 B	6.6 kB	104.17.25.14
zany-pouncing-pair.glitch.me	unknown	unknown	No data	No data	506 B	910 kB	34.196.51.7

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-11-24 02:47:13	medium	Client IP	Internal IP	ET HUNTING Suspicious Glitch Hosted DNS Request - Possible Phishing Landing
2023-11-24 02:47:13	medium	Client IP	Internal IP	ET HUNTING Suspicious Glitch Hosted DNS Request - Possible Phishing Landing
2023-11-24 02:47:14	medium	Client IP	Internal IP	ET HUNTING Suspicious Glitch Hosted DNS Request - Possible Phishing Landing
2023-11-24 02:47:14	medium	Client IP	34.196.51.7	ET HUNTING Suspicious Glitch Hosted TLS SNI Request - Possible Phishing Landing
2023-11-24 02:47:16	medium	Client IP	Internal IP	ET POLICY Observed IP Lookup Domain (l2 .io in DNS Lookup)
2023-11-24 02:47:16	medium	Client IP	Internal IP	ET POLICY Observed IP Lookup Domain (l2 .io in DNS Lookup)
2023-11-24 02:47:16	medium	Client IP	195.80.159.133	ET POLICY Observed IP Lookup Domain (l2 .io in TLS SNI)

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2023-11-23	medium	zany-pouncing-pair.glitch.me/public/nfculogon.html	Navy Federal Credit Union

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (15)

	URL	From	Size	First Seen	Last Seen
	zany-pouncing-pair.glitch.me/public/nfculogon.html	ScriptElement	258 B	2023-03-07	2025-05-07
Pretty URL zany-pouncing-pair.glitch.me/public/nfculogon.html IP 34.196.51.7 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 12:09 Last Seen2025-05-07 16:02 Times Seen73 Hash c93bfd6df957b0e513001d034271d53e 86dabc69994dd97e75556a5f172d16b96d204093 41a08952e21af8f17814cdc69394a20e255e4f828741c85f61bdb50b5b513d36 Loading...

	zany-pouncing-pair.glitch.me/public/nfculogon.html	ScriptElement	15 B	2023-03-07	2025-05-07
Pretty URL zany-pouncing-pair.glitch.me/public/nfculogon.html IP 34.196.51.7 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:06 Last Seen2025-05-07 16:02 Times Seen319 Hash a6334981a8bbe29aa5c1dc2edd2640b2 4c0fb8f501dfb048b93102fccc8976cd1ce14f34 5dedb26ee87d110b89e97198b67b2a79dc14359cfda2d56ff91af5f460b6a4a0 Loading...

	zany-pouncing-pair.glitch.me/public/nfculogon.html	ScriptElement	65 B	2023-03-07	2025-05-07
Pretty URL zany-pouncing-pair.glitch.me/public/nfculogon.html IP 34.196.51.7 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:06 Last Seen2025-05-07 16:02 Times Seen316 Hash 2bd60c5b14d66a418d7acfdb28bbbdce d2281051c147d3ba68c9cdf1048cf1d49408aa39 7ebe893f5ae6a45f490e5b51841c7ba938425832b0326aad21a13106b52d8675 Loading...

	zany-pouncing-pair.glitch.me/public/nfculogon.html	ScriptElement	1.0 kB	2023-11-03	2024-08-20
Pretty URL zany-pouncing-pair.glitch.me/public/nfculogon.html IP 34.196.51.7 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML true Observations First Seen2023-11-03 13:14 Last Seen2024-08-20 21:17 Times Seen11 Hash 0631322299b3e6b916410995a574fa95 603ad9e5cd82dda2ed79cd37cbb4c0dac4c35810 9d78b2aeb556db9c6e37905d947ac439c53e14e8db2764ef110c06331131d3e9 Loading...

	zany-pouncing-pair.glitch.me/public/nfculogon.html	ScriptElement	1.2 kB	2023-11-03	2024-08-20
Pretty URL zany-pouncing-pair.glitch.me/public/nfculogon.html IP 34.196.51.7 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML true Observations First Seen2023-11-03 13:14 Last Seen2024-08-20 21:17 Times Seen11 Hash 74567e304c51af6b61f13e35db964639 3d5a4a03481c53ee4d57662a3d04d167ed2747bd 4ca7831e2452360addfa3287b7e19060b1224644f6077a03f3d6fa7c3cd20d94 Loading...

	unknown	ScriptElement	12 kB	2023-11-03	2024-08-20
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-03 13:14 Last Seen2024-08-20 21:17 Times Seen16 Hash e368ac362a3934c8d9730cc4e1f7fe1c a41446d62d471eadb0d74025f2de5ea94d09dcb7 62b273b947cea7ed1e4b0e25eb77f268d34974691ed8f0d3f608d73895e9f328 Loading...

	l2.io/ip.js?var=userip	ScriptElement	24 B	2023-03-07	2025-05-09
Pretty URL l2.io/ip.js?var=userip IP 195.80.159.133 ASN #29152 Decknet S.a.r.l. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-05-09 07:36 Times Seen1137 Hash f9dc91b3feea65bd389a2f5b57306c32 147d1c9ae79ae948a34c5f1254bdcbf7af9caf8e d88923af30873abcf4cde709062c3d2e9ded181f9e2552c7fbcc983b3796ff77 Loading...

	zany-pouncing-pair.glitch.me/public/nfculogon.html	ScriptElement	1.3 kB	2023-11-03	2024-08-20
Pretty URL zany-pouncing-pair.glitch.me/public/nfculogon.html IP 34.196.51.7 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML true Observations First Seen2023-11-03 13:14 Last Seen2024-08-20 21:17 Times Seen11 Hash 3a3858022b764ebdec769698c14f5222 b5716552c4a43cdbffd9daa678cf1ef1679e798e 15c87917b225f599f93b44539b9dfaef85c37def8cb72063bc4c952c2e126fff Loading...

	zany-pouncing-pair.glitch.me/public/nfculogon.html	ScriptElement	1.4 kB	2023-11-03	2024-08-20
Pretty URL zany-pouncing-pair.glitch.me/public/nfculogon.html IP 34.196.51.7 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML true Observations First Seen2023-11-03 13:14 Last Seen2024-08-20 21:17 Times Seen11 Hash bf9c95147eeaca3ba725721ba0fc9cbe d7d40bd545958a95e0187c102d56c75a04776bfd 578be71df9482ed840557d09f1962680bfe529e3c03f7776c671ae76f8a06d16 Loading...

	zany-pouncing-pair.glitch.me/public/nfculogon.html	ScriptElement	2.3 kB	2023-11-03	2024-08-20
Pretty URL zany-pouncing-pair.glitch.me/public/nfculogon.html IP 34.196.51.7 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML true Observations First Seen2023-11-03 13:14 Last Seen2024-08-20 21:17 Times Seen11 Hash 25adee0328f0d2868fe4ec15b6683426 2cfd022e774b9cdad923d7a52bd34a1415b5c6bf ab13b83a8980aa8a7e5494bf46a5b8daa1cd5ff0338c6db24ef7afd01b83bef3 Loading...

	zany-pouncing-pair.glitch.me/public/nfculogon.html	ScriptElement	2.5 kB	2023-11-03	2024-08-20
Pretty URL zany-pouncing-pair.glitch.me/public/nfculogon.html IP 34.196.51.7 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML true Observations First Seen2023-11-03 13:14 Last Seen2024-08-20 21:17 Times Seen11 Hash 76d0d97578b8d76998d3bb4c8c62af38 57a5ddabc09bd3aa9ea835d3b6341ad1754cc059 1d295fe78e7343c9010b974d4241ac2374a9f85df18888240dbc8230c16b6687 Loading...

	zany-pouncing-pair.glitch.me/public/nfculogon.html	ScriptElement	2.8 kB	2023-11-03	2024-08-20
Pretty URL zany-pouncing-pair.glitch.me/public/nfculogon.html IP 34.196.51.7 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML true Observations First Seen2023-11-03 13:14 Last Seen2024-08-20 21:17 Times Seen11 Hash bd53b3a4ccb6631736668b46a5eb3a23 25b46e845bcaa2772d622d20d1fea337dabfe5c4 9a90ba6644e6476b8c0292de8f794e6239431020e746a66ce9c54df298f9d1bb Loading...

	zany-pouncing-pair.glitch.me/public/nfculogon.html	ScriptElement	7.3 kB	2023-03-07	2025-05-07
Pretty URL zany-pouncing-pair.glitch.me/public/nfculogon.html IP 34.196.51.7 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 12:09 Last Seen2025-05-07 16:02 Times Seen72 Hash b9d6f1560ad183cb9fde5f597e405fad 38b60cb29859a431e8c38d616615eb893cff3391 9feebe08608ee9e17dd00041e29d3ee7dbab56f153cce83c942d09da420f5905 Loading...

	zany-pouncing-pair.glitch.me/public/nfculogon.html	ScriptElement	0 B	0001-01-01	2025-05-09
Pretty URL zany-pouncing-pair.glitch.me/public/nfculogon.html IP 34.196.51.7 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML true Observations First Seen0001-01-01 00:00 Last Seen2025-05-09 09:54 Times Seen4635182 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

		Size	First Seen	Last Seen
	#1 Write - bf032f61a73d2a8ca48627a33908da48	2.4 kB	2023-03-07 12:09	2025-05-07 16:02
Pretty Observations First Seen2023-03-07 12:09 Last Seen2025-05-07 16:02 Times Seen119 Hash bf032f61a73d2a8ca48627a33908da48 38b4b237d602fb229cd309315b0ce65fc47d5477 1f3f925220fd8734d386059dfdf4e3f19109432bed4dfa31ac6f0ea7c1a5ada3 Loading...

HTTP Transactions (3)

URL IP Response Size

cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css

104.17.25.14

200 OK

5.6 kB

URL GET HTTP/2
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
IP
104.17.25.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://zany-pouncing-pair.glitch.me/public/nfculogon.html
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D
ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT

File type
ASCII text, with very long lines (30837)
Size
5.6 kB (5631 bytes)
Hash
269550530cc127b6aa5a35925a7de6ce
512c7d79033e3028a9be61b540cf1a6870c896f8
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

HTTP Headers

GET /ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zany-pouncing-pair.glitch.me/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 24 Nov 2023 02:47:13 GMT
content-type: text/css; charset=utf-8
content-length: 5631
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03e5f-7918"
last-modified: Mon, 04 May 2020 16:10:07 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 2336588
expires: Wed, 13 Nov 2024 02:47:13 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7R3JdVLPP8p6EAOCiULxec7oeLAIX4f4KoTCuu4Bguw%2FA7LBJxMtLkku8Q2WZ2NENbQLU9MbDKH3wkEG0U56ha30bYMZiooFAv%2FMA2rkamL11VG3hNETl9OR9ZPCQBDk7H4JPpXO"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 82ae53766b825690-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

zany-pouncing-pair.glitch.me/public/nfculogon.html

34.196.51.7

200 OK

910 kB

URL User Request GET HTTP/2
zany-pouncing-pair.glitch.me/public/nfculogon.html
IP
34.196.51.7:443
ASN
#14618 AMAZON-AES

Certificate
IssuerAmazon
Subjectglitch.com
Fingerprint13:93:2D:E4:50:7E:CE:BA:BC:F9:6D:7E:86:7F:43:5D:8E:63:45:3E
ValidityWed, 22 Feb 2023 00:00:00 GMT - Thu, 01 Feb 2024 23:59:59 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (15881)
Size
910 kB (909694 bytes)
Hash
e9d93d403026af590c063ba693138e22
5097a4533d130e73eb9c77e2964eae1c00774943
d42ea012e927e611c232d00b49a585485733eb88a626e8cc44e69f959e1752c8

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	Navy Federal Credit Union

HTTP Headers

GET /public/nfculogon.html HTTP/1.1
Host: zany-pouncing-pair.glitch.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Fri, 24 Nov 2023 02:47:11 GMT
content-type: text/html; charset=utf-8
content-length: 909694
x-amz-id-2: w0OJTryJ6vFSDecLZnHA0NQ1zcHPN1R+sPovdo+4TMiSEKxmt/B5ayIWCCOgg1ReSZZ/VrmHS5M=
x-amz-request-id: MEKWPDACS5QE85R7
last-modified: Thu, 23 Nov 2023 14:30:30 GMT
etag: "e9d93d403026af590c063ba693138e22"
x-amz-server-side-encryption: AES256
cache-control: no-cache
x-amz-version-id: null
accept-ranges: bytes
server: AmazonS3
X-Firefox-Spdy: h2

l2.io/ip.js?var=userip

195.80.159.133

200 OK

24 B

URL GET HTTP/1.1
l2.io/ip.js?var=userip
IP
195.80.159.133:443
ASN
#29152 Decknet S.a.r.l.

Requested by
https://zany-pouncing-pair.glitch.me/public/nfculogon.html
Certificate
IssuerLet's Encrypt
Subjectl2.io
Fingerprint65:49:ED:2D:E9:35:D9:26:3D:70:87:2B:4F:20:FF:14:56:55:52:B4
ValidityTue, 17 Oct 2023 07:33:55 GMT - Mon, 15 Jan 2024 07:33:54 GMT

File type
ASCII text, with no line terminators
Size
24 B (24 bytes)
Hash
f9dc91b3feea65bd389a2f5b57306c32
147d1c9ae79ae948a34c5f1254bdcbf7af9caf8e
d88923af30873abcf4cde709062c3d2e9ded181f9e2552c7fbcc983b3796ff77

HTTP Headers

GET /ip.js?var=userip HTTP/1.1
Host: l2.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://zany-pouncing-pair.glitch.me/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Fri, 24 Nov 2023 02:47:14 GMT
Server: Apache/2.4.38 (Debian)
Content-Length: 24
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (15)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash