Report - pub-61a210c5a9b945c091d5601500d84171.r2.dev/index.html?email=yuri0247@slurpmail.net

Report Overview

Visited public
2025-03-21 09:51:55
Tags
URL
pub-61a210c5a9b945c091d5601500d84171.r2.dev/index.html?email=yuri0247@slurpmail.net
Finishing URL
pub-61a210c5a9b945c091d5601500d84171.r2.dev/index.html?email=yuri0247@slurpmail.net
IP / ASN
172.66.0.235
#13335 CLOUDFLARENET
Title
File Transfer

Detections

urlquery

0

Network Intrusion Detection

7

Threat Detection Systems

0

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
glaze-crimson-sloth.glitch.me	unknown	2008-07-18	2025-03-21	2025-03-21	969 B	10 kB	151.101.130.59
bafybeiand3y764kpmrbappwur3t3d67daui57xijgtja73yhejnjx7rghe.ipfs.dweb.link	unknown	2017-02-24	2025-03-21	2025-03-21	591 B	1.4 MB	209.94.90.3
pub-61a210c5a9b945c091d5601500d84171.r2.dev	unknown	2022-08-23	2025-03-21	2025-03-21	551 B	182 kB	172.66.0.235
bafybeihdyss6n37yhu7zlwsmocsbpwl4pnfdxhkujzhwph7yhlrgo5rzny.ipfs.dweb.link	unknown	2017-02-24	2025-03-21	2025-03-21	531 B	359 kB	209.94.90.3

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2025-03-21 09:51:33	low	Client IP	209.94.90.3	ET HUNTING Observed IPFS Gateway Domain (ipfs .dweb .link) in TLS SNI
2025-03-21 09:51:33	medium	Client IP	151.101.130.59	ET HUNTING Suspicious Glitch Hosted TLS SNI Request - Possible Phishing Landing
2025-03-21 09:51:33	low	Client IP	151.101.130.59	ET INFO Observed Online Application Hosting Domain (glitch .me in TLS SNI)
2025-03-21 09:51:33	medium	Client IP	151.101.130.59	ET HUNTING Suspicious Glitch Hosted TLS SNI Request - Possible Phishing Landing
2025-03-21 09:51:33	low	Client IP	151.101.130.59	ET INFO Observed Online Application Hosting Domain (glitch .me in TLS SNI)
2025-03-21 09:51:34	low	Client IP	209.94.90.3	ET HUNTING Observed IPFS Gateway Domain (ipfs .dweb .link) in TLS SNI
2025-03-21 09:51:34	low	Client IP	209.94.90.2	ET HUNTING Observed IPFS Gateway Domain (ipfs .dweb .link) in TLS SNI

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (1)

	URL	From	Size	First Seen	Last Seen
	glaze-crimson-sloth.glitch.me/js	ScriptElement	3.5 kB	2025-03-21	2025-03-28
Pretty URL glaze-crimson-sloth.glitch.me/js IP 151.101.130.59 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2025-03-21 09:17 Last Seen2025-03-28 04:28 Times Seen44 Hash 7f9c1c8493ee04bd4e4836906c90abd0 689d07eee321e0b4d69baa1da357fa11ac07581b 5cc2a51dec3f7b18c055072833c912e907eac17b10ab2d6bf3a461221ba85cec Loading...

HTTP Transactions (5)

	URL	IP	Response	Size
	bafybeiand3y764kpmrbappwur3t3d67daui57xijgtja73yhejnjx7rghe.ipfs.dweb.link/?filename=dp.mp4	209.94.90.3	206 Partial Content	1.4 MB
URL GET bafybeiand3y764kpmrbappwur3t3d67daui57xijgtja73yhejnjx7rghe.ipfs.dweb.link/?filename=dp.mp4 IP 209.94.90.3:443 ASN #40680 PROTOCOL Requested by https://pub-61a210c5a9b945c091d5601500d84171.r2.dev/index.html?email=yuri0247@slurpmail.net Certificate IssuerLet's Encrypt Subjectdweb.link Fingerprint40:09:E3:36:2C:19:99:FE:17:2E:56:5F:86:5D:BE:27:F7:38:19:87 ValidityWed, 05 Feb 2025 13:46:22 GMT - Tue, 06 May 2025 13:46:21 GMT File type ISO Media, MP4 v2 [ISO 14496-14] Size 1.4 MB (1426982 bytes) Hash 8229e709ffae8efcfd6a7a19821d1411 ce4916c27451d81455a4d0b2f2b31551b76393c7 405cd7a882bc711b34ba0dd875e8adcd7c1b099e38b250d7359cf6efda7c3b25 HTTP Headers GET /?filename=dp.mp4 HTTP/1.1 Host: bafybeiand3y764kpmrbappwur3t3d67daui57xijgtja73yhejnjx7rghe.ipfs.dweb.link User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: video/webm,video/ogg,video/;q=0.9,application/ogg;q=0.7,audio/;q=0.6,/;q=0.5 Accept-Language: en-US,en;q=0.5 Range: bytes=0- DNT: 1 Connection: keep-alive Referer: https://pub-61a210c5a9b945c091d5601500d84171.r2.dev/ Sec-Fetch-Dest: video Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site Accept-Encoding: identity Pragma: no-cache Cache-Control: no-cache HTTP/2 206 Partial Content date: Fri, 21 Mar 2025 09:51:34 GMT content-type: video/mp4 content-length: 1426982 access-control-allow-headers: Content-Type, Range, User-Agent, X-Requested-With access-control-allow-methods: GET, HEAD, OPTIONS access-control-allow-origin: * access-control-expose-headers: Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output cache-control: public, max-age=29030400, immutable content-disposition: inline; filename="dp.mp4"; filename*=UTF-8''dp.mp4 etag: "bafybeiand3y764kpmrbappwur3t3d67daui57xijgtja73yhejnjx7rghe" x-ipfs-path: /ipfs/bafybeiand3y764kpmrbappwur3t3d67daui57xijgtja73yhejnjx7rghe/ x-ipfs-roots: bafybeiand3y764kpmrbappwur3t3d67daui57xijgtja73yhejnjx7rghe x-ipfs-pop: rainbow-am6-06 cf-cache-status: HIT age: 21050 content-range: bytes 0-1426981/1426982 vary: Accept-Encoding server: cloudflare cf-ray: 923c8d2d895aebd8-ARN alt-svc: h3=":443"; ma=86400 X-Firefox-Spdy: h2

	pub-61a210c5a9b945c091d5601500d84171.r2.dev/index.html?email=yuri0247@slurpmail.net	172.66.0.235	200 OK	182 kB
URL User Request GET pub-61a210c5a9b945c091d5601500d84171.r2.dev/index.html?email=yuri0247@slurpmail.net IP 172.66.0.235:443 ASN #13335 CLOUDFLARENET Certificate IssuerLet's Encrypt Subject.r2.dev Fingerprint69:C8:8E:21:A3:C2:15:95:49:F4:A4:3C:C2:C8:D2:2F:2C:33:93:3A ValiditySat, 25 Jan 2025 12:16:42 GMT - Fri, 25 Apr 2025 12:16:41 GMT File type Size 182 kB (181502 bytes) Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP Headers GET /index.html?email=yuri0247@slurpmail.net HTTP/1.1 Host: pub-61a210c5a9b945c091d5601500d84171.r2.dev User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache `HTTP/1.1 200 OK Date: Fri, 21 Mar 2025 09:51:33 GMT Content-Type: text/html Content-Length: 181502 Connection: keep-alive Accept-Ranges: bytes ETag: "102c498f57cc6c441ba6a733e7029409" Last-Modified: Wed, 19 Mar 2025 15:30:20 GMT Vary: Accept-Encoding Server: cloudflare CF-RAY: 923c8d2acc1956cc-OSL`

	bafybeihdyss6n37yhu7zlwsmocsbpwl4pnfdxhkujzhwph7yhlrgo5rzny.ipfs.dweb.link/?filename=modal.gif	209.94.90.3	200 OK	358 kB
URL GET bafybeihdyss6n37yhu7zlwsmocsbpwl4pnfdxhkujzhwph7yhlrgo5rzny.ipfs.dweb.link/?filename=modal.gif IP 209.94.90.3:443 ASN #40680 PROTOCOL Requested by https://pub-61a210c5a9b945c091d5601500d84171.r2.dev/index.html?email=yuri0247@slurpmail.net Certificate IssuerLet's Encrypt Subjectdweb.link Fingerprint40:09:E3:36:2C:19:99:FE:17:2E:56:5F:86:5D:BE:27:F7:38:19:87 ValidityWed, 05 Feb 2025 13:46:22 GMT - Tue, 06 May 2025 13:46:21 GMT File type GIF image data, version 89a, 650 x 525 Size 358 kB (357935 bytes) Hash 651731b8467333289e3b44e569883a18 42600d5c20ddbe1eb3cea6b171f648619048aa5f 73257fb51b4e9c849a46820ae181173030b1a15d1c5a597f5840e353b438b33a HTTP Headers GET /?filename=modal.gif HTTP/1.1 Host: bafybeihdyss6n37yhu7zlwsmocsbpwl4pnfdxhkujzhwph7yhlrgo5rzny.ipfs.dweb.link User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: image/avif,image/webp,/ Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Referer: https://pub-61a210c5a9b945c091d5601500d84171.r2.dev/ Sec-Fetch-Dest: image Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache HTTP/2 200 OK date: Fri, 21 Mar 2025 09:51:33 GMT content-type: image/gif content-length: 357935 access-control-allow-headers: Content-Type, Range, User-Agent, X-Requested-With access-control-allow-methods: GET, HEAD, OPTIONS access-control-allow-origin: * access-control-expose-headers: Content-Length, Content-Range, X-Chunked-Output, X-Ipfs-Path, X-Ipfs-Roots, X-Stream-Output cache-control: public, max-age=29030400, immutable content-disposition: inline; filename="modal.gif"; filename*=UTF-8''modal.gif etag: "bafybeihdyss6n37yhu7zlwsmocsbpwl4pnfdxhkujzhwph7yhlrgo5rzny" x-ipfs-path: /ipfs/bafybeihdyss6n37yhu7zlwsmocsbpwl4pnfdxhkujzhwph7yhlrgo5rzny/ x-ipfs-roots: bafybeihdyss6n37yhu7zlwsmocsbpwl4pnfdxhkujzhwph7yhlrgo5rzny x-ipfs-pop: rainbow-am6-02 cf-cache-status: HIT age: 21049 accept-ranges: bytes vary: Accept-Encoding server: cloudflare cf-ray: 923c8d2d690eebd8-ARN alt-svc: h3=":443"; ma=86400 X-Firefox-Spdy: h2

	glaze-crimson-sloth.glitch.me/css	151.101.130.59	200 OK	5.5 kB
URL GET glaze-crimson-sloth.glitch.me/css IP 151.101.130.59:443 ASN #54113 FASTLY Requested by https://pub-61a210c5a9b945c091d5601500d84171.r2.dev/index.html?email=yuri0247@slurpmail.net Certificate IssuerCertainly Subject.glitch.me Fingerprint30:54:49:DE:33:25:7F:72:68:93:F3:47:0C:E6:64:EE:8A:F1:6B:F9 ValiditySun, 02 Mar 2025 22:17:53 GMT - Tue, 01 Apr 2025 22:17:52 GMT File type ASCII text, with very long lines (5855), with no line terminators Size 5.5 kB (5476 bytes) Hash 9c91c743b8d83aaf016529ae3ac6a858 56b7137c17ddee968972a36d581d13105b4cd59d ccecb457841ca918e3489bcd5e85b0741d3aea838f1c570a3f9f32e98498f17b HTTP Headers `GET /css HTTP/1.1 Host: glaze-crimson-sloth.glitch.me User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/css,/;q=0.1 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Referer: https://pub-61a210c5a9b945c091d5601500d84171.r2.dev/ Sec-Fetch-Dest: style Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache` `HTTP/2 200 OK x-powered-by: Express accept-ranges: bytes content-type: text/css; charset=UTF-8 cache-control: public, max-age=0 last-modified: Fri, 17 Jan 2025 23:56:56 GMT etag: W/"1564-19476b2c940" access-control-allow-origin: date: Fri, 21 Mar 2025 09:51:34 GMT via: 1.1 varnish x-served-by: cache-hel1410022-HEL, cache-hel1410022-HEL x-cache: MISS, MISS x-cache-hits: 0, 0 x-timer: S1742550694.027090,VS0,VE171 content-length: 5476 X-Firefox-Spdy: h2`

	glaze-crimson-sloth.glitch.me/js	151.101.130.59	200 OK	3.5 kB
URL GET glaze-crimson-sloth.glitch.me/js IP 151.101.130.59:443 ASN #54113 FASTLY Requested by https://pub-61a210c5a9b945c091d5601500d84171.r2.dev/index.html?email=yuri0247@slurpmail.net Certificate IssuerCertainly Subject.glitch.me Fingerprint30:54:49:DE:33:25:7F:72:68:93:F3:47:0C:E6:64:EE:8A:F1:6B:F9 ValiditySun, 02 Mar 2025 22:17:53 GMT - Tue, 01 Apr 2025 22:17:52 GMT File type ASCII text, with very long lines (3769), with no line terminators Size 3.5 kB (3539 bytes) Hash 00ba65d0457f7a071160ecc134f8cd5e fda059d986f3384de3f2c0b7e6908d85792cfd7d 6a9abae65729c745a18ce6c18f074da44ceb07d51bb990d37eb81b252a7adba7 HTTP Headers `GET /js HTTP/1.1 Host: glaze-crimson-sloth.glitch.me User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: /* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: https://pub-61a210c5a9b945c091d5601500d84171.r2.dev DNT: 1 Connection: keep-alive Referer: https://pub-61a210c5a9b945c091d5601500d84171.r2.dev/ Sec-Fetch-Dest: script Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache` `HTTP/2 200 OK x-powered-by: Express accept-ranges: bytes content-type: application/javascript; charset=UTF-8 cache-control: public, max-age=0 last-modified: Mon, 27 Jan 2025 13:39:17 GMT etag: W/"dd3-194a7fce788" access-control-allow-origin: * date: Fri, 21 Mar 2025 09:51:34 GMT via: 1.1 varnish x-served-by: cache-hel1410026-HEL, cache-hel1410026-HEL x-cache: MISS, MISS x-cache-hits: 0, 0 x-timer: S1742550694.022970,VS0,VE170 content-length: 3539 X-Firefox-Spdy: h2`