Report - shrouded-half-prune.glitch.me/xfdt.html

Report Overview

Visited public
2025-03-31 13:37:34
Tags
suspicious
URL
shrouded-half-prune.glitch.me/xfdt.html
Finishing URL
shrouded-half-prune.glitch.me/xfdt.html
IP / ASN
151.101.2.59
#54113 FASTLY
Title
Sign in - Professional Email
Suspicious - Suspicious Javascript code

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
shrouded-half-prune.glitch.me	unknown	2008-07-18	2025-03-31	2025-03-31	495 B	122 kB	151.101.130.59
waxmedx.com	unknown	2024-12-20	2025-01-21	2025-03-27	2.3 kB	370 kB	145.223.77.127
webmail-oxcs.networksolutionsemail.com	unknown	2003-01-09	2021-11-09	2025-03-26	489 B	484 B	198.251.71.220

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2025-03-31 13:37:09	medium	Client IP	151.101.130.59	ET HUNTING Suspicious Glitch Hosted TLS SNI Request - Possible Phishing Landing
2025-03-31 13:37:09	low	Client IP	151.101.130.59	ET INFO Observed Online Application Hosting Domain (glitch .me in TLS SNI)

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2025-03-26	medium	shrouded-half-prune.glitch.me/xfdt.html	Webmail Providers

PhishTank

Scan Date	Severity	Indicator	Alert
2025-03-30	medium	shrouded-half-prune.glitch.me/xfdt.html	Other

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (5)

	URL	From	Size	First Seen	Last Seen
	shrouded-half-prune.glitch.me/xfdt.html	ScriptElement	315 B	2024-04-11	2025-05-17
Pretty URL shrouded-half-prune.glitch.me/xfdt.html IP 151.101.130.59 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-11 06:29 Last Seen2025-05-17 16:17 Times Seen51 Hash 960515ee571f1c27fc839b596e2fc266 3382ab14e9b1cd18d02a89a762de4fdc592760e7 10f7e851e5cf8f1db58e8559d72a84915e576c05cede8c995efdcd23e0341d3c Loading...

	shrouded-half-prune.glitch.me/xfdt.html	ScriptElement	121 kB	2025-03-31	2025-04-03
Pretty URL shrouded-half-prune.glitch.me/xfdt.html IP 151.101.130.59 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML true Observations First Seen2025-03-31 13:37 Last Seen2025-04-03 11:58 Times Seen3 Hash 97f1adbc1e8d346207129492a5c5e50d e0993462a41ed1f855d0f7dd102cd2b73ce8203f 6c420da6253f201b31f6ff826efec6066cb4c2cc0a21b53e469e3a52b098fe3a Loading...

	shrouded-half-prune.glitch.me/xfdt.html	ScriptElement	4.4 kB	2025-03-31	2025-05-04
Pretty URL shrouded-half-prune.glitch.me/xfdt.html IP 151.101.130.59 ASN #54113 FASTLY Introduced by scriptElement Embedded in HTML false Observations First Seen2025-03-31 13:37 Last Seen2025-05-04 14:40 Times Seen6 Hash d5d1ec515f85151a529624fcc7929723 3917d52f6e55a8d86235d92bac2f14d59625a51f c894e385ccf1d9abc16daeae006a09b47feb6cb747484c44e498cb17a01088ee Loading...

	about:blank	JavascriptURL	5 B	2023-03-07	2025-05-24
Pretty URL about:blank IP 0.0.0.0 ASN #0 Introduced by javascriptURL Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-05-24 01:01 Times Seen26146 Hash 68934a3e9455fa72420237eb05902327 7cb6efb98ba5972a9b5090dc2e517fe14d12cb04 fcbcf165908dd18a9e49f7ff27810176db8e9f63b4352213741664245224f8aa Loading...

		Size	First Seen	Last Seen
	#1 Write - d41d8cd98f00b204e9800998ecf8427e	0 B	0001-01-01 00:00	2025-05-24 02:27
Pretty Observations First Seen0001-01-01 00:00 Last Seen2025-05-24 02:27 Times Seen4753717 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

HTTP Transactions (7)

URL IP Response Size

webmail-oxcs.networksolutionsemail.com/appsuite/favicon.svg?version=3999779421

198.251.71.220

403 Forbidden

0 B

URL GET
webmail-oxcs.networksolutionsemail.com/appsuite/favicon.svg?version=3999779421
IP
198.251.71.220:443
ASN
#8560 IONOS SE

Requested by
https://shrouded-half-prune.glitch.me/xfdt.html
Certificate
IssuerSectigo Limited
Subject*.networksolutionsemail.com
FingerprintD5:E1:96:FA:EA:36:36:92:F6:7E:11:6C:88:AF:DE:42:F6:56:BE:54
ValidityThu, 09 Jan 2025 00:00:00 GMT - Fri, 09 Jan 2026 23:59:59 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /appsuite/favicon.svg?version=3999779421 HTTP/1.1
Host: webmail-oxcs.networksolutionsemail.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://shrouded-half-prune.glitch.me/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 403 Forbidden
date: Mon, 31 Mar 2025 13:37:17 GMT
content-type: application/xml
x-amz-request-id: tx00000e0c6efdc4642a24a-0067ea9a8d-177766ff4-msc1
accept-ranges: bytes
x-app-server: rgw14ham1
content-encoding: gzip
vary: Accept-Encoding
strict-transport-security: max-age=15552000; includeSubDomains; preload;
x-content-type-options: nosniff
x-download-options: noopen
x-permitted-cross-domain-policies: none
x-xss-protection: 1; mode=block
X-Firefox-Spdy: h2

shrouded-half-prune.glitch.me/xfdt.html

151.101.130.59

200 OK

121 kB

URL User Request GET
shrouded-half-prune.glitch.me/xfdt.html
IP
151.101.130.59:443
ASN
#54113 FASTLY

Certificate
IssuerCertainly
Subject*.glitch.me
Fingerprint97:AE:38:66:3D:A4:DF:39:E3:02:0E:99:02:5B:C4:DD:7A:E0:6D:60
ValiditySat, 22 Mar 2025 21:21:47 GMT - Mon, 21 Apr 2025 21:21:46 GMT

File type
HTML document, ASCII text, with very long lines (65536), with no line terminators
Size
121 kB (121445 bytes)
Hash
892a573f95dc11dcf6a0a02c475b2199
eb6fa90d6ce43d7ee0897919d127e74175db9d62
51ef60c345c7a19288fc89b4120ee2a6142b1f53c049b6afa512f8e88ec19139

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - Suspicious Javascript code
OpenPhish	phishing	Webmail Providers
PhishTank	phishing	Other

HTTP Headers

GET /xfdt.html HTTP/1.1
Host: shrouded-half-prune.glitch.me
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
x-amz-server-side-encryption: AES256
etag: "892a573f95dc11dcf6a0a02c475b2199"
cache-control: no-cache
server: AmazonS3
last-modified: Tue, 25 Mar 2025 19:42:55 GMT
x-amz-id-2: Gi8r7CoMGa99CvKfr6xp7Ypp9EBTzJxrTDCok2zhbp+Xeqi9NcXfcFapz932324HeqKxvhTCqxiF+WNcQVse4T0PhpbqjNJorJI2Sa95irU=
x-amz-request-id: 1432ZJH0SV8C5EGA
content-type: text/html; charset=utf-8
x-amz-version-id: JEvgpcEPf5sexmUAzwX29puSDj5AOx80
accept-ranges: bytes
date: Mon, 31 Mar 2025 13:37:10 GMT
via: 1.1 varnish
x-served-by: cache-hel1410027-HEL, cache-hel1410027-HEL
x-cache: MISS, MISS
x-cache-hits: 0, 0
x-timer: S1743428230.635493,VS0,VE374
content-length: 121445
X-Firefox-Spdy: h2

waxmedx.com/app/network/media/index.html.js.download

145.223.77.127

200 OK

0 B

URL GET
waxmedx.com/app/network/media/index.html.js.download
IP
145.223.77.127:443
ASN
#47583 Hostinger International Limited

Requested by
https://shrouded-half-prune.glitch.me/xfdt.html
Certificate
IssuerLet's Encrypt
Subjectwaxmedx.com
Fingerprint36:2C:6A:97:8E:70:96:B4:E7:3B:34:90:09:EA:ED:AD:02:03:42:94
ValidityTue, 18 Feb 2025 08:49:29 GMT - Mon, 19 May 2025 08:49:28 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /app/network/media/index.html.js.download HTTP/1.1
Host: waxmedx.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://shrouded-half-prune.glitch.me
DNT: 1
Connection: keep-alive
Referer: https://shrouded-half-prune.glitch.me/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/plain
last-modified: Mon, 23 Dec 2024 10:43:42 GMT
etag: "116b-67693ede-1a5aad2763c23a34;br"
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding
content-length: 2086
date: Mon, 31 Mar 2025 13:37:10 GMT
server: LiteSpeed
platform: hostinger
panel: hpanel
content-security-policy: upgrade-insecure-requests
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
X-Firefox-Spdy: h2

waxmedx.com/app/network/media/main-781bf877.css

145.223.77.127

200 OK

343 kB

URL GET
waxmedx.com/app/network/media/main-781bf877.css
IP
145.223.77.127:443
ASN
#47583 Hostinger International Limited

Requested by
https://shrouded-half-prune.glitch.me/xfdt.html
Certificate
IssuerLet's Encrypt
Subjectwaxmedx.com
Fingerprint36:2C:6A:97:8E:70:96:B4:E7:3B:34:90:09:EA:ED:AD:02:03:42:94
ValidityTue, 18 Feb 2025 08:49:29 GMT - Mon, 19 May 2025 08:49:28 GMT

File type

Size
343 kB (342558 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /app/network/media/main-781bf877.css HTTP/1.1
Host: waxmedx.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://shrouded-half-prune.glitch.me/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
cache-control: public, max-age=604800
expires: Mon, 07 Apr 2025 13:37:10 GMT
content-type: text/css
last-modified: Mon, 23 Dec 2024 10:43:42 GMT
etag: "53a1e-67693ede-98912753e194db0a;br"
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding
content-length: 49272
date: Mon, 31 Mar 2025 13:37:10 GMT
server: LiteSpeed
platform: hostinger
panel: hpanel
content-security-policy: upgrade-insecure-requests
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
X-Firefox-Spdy: h2

waxmedx.com/app/network/media/logo

145.223.77.127

200 OK

4.3 kB

URL GET
waxmedx.com/app/network/media/logo
IP
145.223.77.127:443
ASN
#47583 Hostinger International Limited

Requested by
https://shrouded-half-prune.glitch.me/xfdt.html
Certificate
IssuerLet's Encrypt
Subjectwaxmedx.com
Fingerprint36:2C:6A:97:8E:70:96:B4:E7:3B:34:90:09:EA:ED:AD:02:03:42:94
ValidityTue, 18 Feb 2025 08:49:29 GMT - Mon, 19 May 2025 08:49:28 GMT

File type
PNG image data, 154 x 62, 8-bit/color RGBA, non-interlaced
Size
4.3 kB (4342 bytes)
Hash
8d74d147618554291f8cb17959e22450
4602c88a77f1ae4832e5943a9f31e6dc46c4019c
38f4cd5c0c12b0655856bb8470b15392154ebad70467d63a577ff730e8f248df

HTTP Headers

GET /app/network/media/logo HTTP/1.1
Host: waxmedx.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://shrouded-half-prune.glitch.me/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
last-modified: Mon, 23 Dec 2024 10:43:42 GMT
etag: "10f6-67693ede-20cd7a78fb9fecb7;;;"
accept-ranges: bytes
content-length: 4342
date: Mon, 31 Mar 2025 13:37:10 GMT
server: LiteSpeed
platform: hostinger
panel: hpanel
content-security-policy: upgrade-insecure-requests
X-Firefox-Spdy: h2

waxmedx.com/app/network/media/error-generic.svg

145.223.77.127

200 OK

5.1 kB

URL GET
waxmedx.com/app/network/media/error-generic.svg
IP
145.223.77.127:443
ASN
#47583 Hostinger International Limited

Requested by
https://shrouded-half-prune.glitch.me/xfdt.html
Certificate
IssuerLet's Encrypt
Subjectwaxmedx.com
Fingerprint36:2C:6A:97:8E:70:96:B4:E7:3B:34:90:09:EA:ED:AD:02:03:42:94
ValidityTue, 18 Feb 2025 08:49:29 GMT - Mon, 19 May 2025 08:49:28 GMT

File type
SVG Scalable Vector Graphics image
Size
5.1 kB (5081 bytes)
Hash
94f4b2097b323d5776bac1d91e8c8745
6e9df6ba575da23594331bdec6ad578622d21aa3
3412fd66dfcaf0e4e4ce55aad1842cfad80330f384e8a4a7c92eeed9bf85bc32

HTTP Headers

GET /app/network/media/error-generic.svg HTTP/1.1
Host: waxmedx.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://shrouded-half-prune.glitch.me/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
cache-control: public, max-age=604800
expires: Mon, 07 Apr 2025 13:37:10 GMT
content-type: image/svg+xml
last-modified: Mon, 23 Dec 2024 10:43:42 GMT
etag: "13d9-67693ede-6550b0a01945d9dd;br"
accept-ranges: bytes
content-encoding: br
vary: Accept-Encoding
content-length: 1688
date: Mon, 31 Mar 2025 13:37:10 GMT
server: LiteSpeed
platform: hostinger
panel: hpanel
content-security-policy: upgrade-insecure-requests
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
X-Firefox-Spdy: h2

waxmedx.com/app/network/media/logo_180.png

145.223.77.127

200 OK

16 kB

URL GET
waxmedx.com/app/network/media/logo_180.png
IP
145.223.77.127:443
ASN
#47583 Hostinger International Limited

Requested by
https://shrouded-half-prune.glitch.me/xfdt.html
Certificate
IssuerLet's Encrypt
Subjectwaxmedx.com
Fingerprint36:2C:6A:97:8E:70:96:B4:E7:3B:34:90:09:EA:ED:AD:02:03:42:94
ValidityTue, 18 Feb 2025 08:49:29 GMT - Mon, 19 May 2025 08:49:28 GMT

File type
RIFF (little-endian) data, Web/P image
Size
16 kB (15754 bytes)
Hash
e06af44c8daf198f8f7347c19d16b6fb
5f19c6b1810c23b4c00c47ab9ab69ac2fe616954
bf4d6827f36f12aaf4e420da28f3ee7b6335be06a13aa3b54bc67eaa4f6465ae

HTTP Headers

GET /app/network/media/logo_180.png HTTP/1.1
Host: waxmedx.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://shrouded-half-prune.glitch.me/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
cache-control: public, max-age=604800
expires: Mon, 07 Apr 2025 13:37:11 GMT
content-type: image/png
last-modified: Mon, 23 Dec 2024 10:43:42 GMT
etag: "3d8a-67693ede-1e143a29c8deb500;;;"
accept-ranges: bytes
content-length: 15754
date: Mon, 31 Mar 2025 13:37:11 GMT
server: LiteSpeed
platform: hostinger
panel: hpanel
content-security-policy: upgrade-insecure-requests
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

JavaScript (5)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Observations

Hash

HTTP Transactions (7)

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET

IP

ASN

Certificate

File type

Size

Hash

Detections

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET

IP

ASN

Requested by

Certificate

File type

Size

Hash

HTTP Headers

URL GET