urlscan.io logo urlscan.io
SecurityTrails logo

bad.download Open in urlscan Pro
2607:ff18:80::5fad  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda.hyd.me/
Effective URL: https://bad.download/?utm_campaign=hydme&utm_medium=0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda&utm...
Submission: On December 18 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 3 countries across 2 domains to perform 13 HTTP transactions. The main IP is 2607:ff18:80::5fad, located in United States and belongs to GRIDFURY-AS, US. The main domain is bad.download.
TLS certificate: Issued by E5 on November 11th 2024. Valid for: 3 months.
This is the only time bad.download was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 2 111.90.144.112 45839 (SHINJIRU-...)
9 2607:ff18:80:... 40630 (GRIDFURY-AS)
4 46.137.101.118 16509 (AMAZON-02)
13 2
Domain Requested by
9 bad.download bad.download
4 lavenderhaze.bad.download bad.download
lavenderhaze.bad.download
2 0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda.hyd.me 2 redirects
13 3
Subject Issuer Validity Valid
bad.download
E5		 2024-11-11 -
2025-02-09		 3 months crt.sh
lavenderhaze.bad.download
E6		 2024-10-29 -
2025-01-27		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://bad.download/?utm_campaign=hydme&utm_medium=0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda&utm_source=http://0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda.hyd.me/
Frame ID: 9247D9B52429C77B571104E1758742B6
Requests: 13 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

bad.download

Page URL History Show full URLs

  1. http://0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda.hyd.me/ HTTP 307
    https://0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda.hyd.me/ HTTP 302
    https://bad.download/?utm_campaign=hydme&utm_medium=0.security-confirmation.fb24ba7c9131791131671... HTTP 307
    http://0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda.hyd.me/ HTTP 302
    https://bad.download/?utm_campaign=hydme&utm_medium=0.security-confirmation.fb24ba7c9131791131671... Page URL

Page Statistics

13
Requests

100 %
HTTPS

33 %
IPv6

2
Domains

3
Subdomains

2
IPs

3
Countries

43 kB
Transfer

51 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda.hyd.me/ HTTP 307
    https://0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda.hyd.me/ HTTP 302
    https://bad.download/?utm_campaign=hydme&utm_medium=0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda&utm_source=https://0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda.hyd.me/ HTTP 307
    http://0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda.hyd.me/ HTTP 302
    https://bad.download/?utm_campaign=hydme&utm_medium=0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda&utm_source=http://0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda.hyd.me/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
bad.download/
Redirect Chain
  • http://0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda.hyd.me/
  • https://0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda.hyd.me/
  • https://bad.download/?utm_campaign=hydme&utm_medium=0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda&utm_source=https://0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda.hy...
  • http://0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda.hyd.me/
  • https://bad.download/?utm_campaign=hydme&utm_medium=0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda&utm_source=http://0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda.hyd...
13 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://bad.download/?utm_campaign=hydme&utm_medium=0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda&utm_source=http://0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda.hyd.me/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2607:ff18:80::5fad , United States, ASN40630 (GRIDFURY-AS, US),
Reverse DNS
Software
Apache /
Resource Hash
94147d534fe99dc681a4522ceb57bc97540595b30a8c4a26b903d8dc6e135a77

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
content-encoding
gzip
content-length
4017
content-type
text/html; charset=UTF-8
date
Wed, 18 Dec 2024 15:59:35 GMT
etag
"33d1-6198d4e4a7a7e"
last-modified
Wed, 29 May 2024 01:02:34 GMT
server
Apache
vary
Accept-Encoding
via
e7s

Redirect headers

Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
cache-control
no-cache, no-store, must-revalidate, max-age=0
content-length
771
content-type
text/html
date
Wed, 18 Dec 2024 15:59:35 GMT
location
https://bad.download/?utm_campaign=hydme&utm_medium=0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda&utm_source=http://0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda.hyd.me/
server
LiteSpeed
sidebar-firefox.gif
bad.download/images/ 		9 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bad.download/images/sidebar-firefox.gif
Requested by
Host: bad.download
URL: https://bad.download/?utm_campaign=hydme&utm_medium=0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda&utm_source=http://0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda.hyd.me/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2607:ff18:80::5fad , United States, ASN40630 (GRIDFURY-AS, US),
Reverse DNS
Software
Apache /
Resource Hash
7314af11cafb8cca143391063d3c902cd50f6654599326f94d1c37478fafd039

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://bad.download/?utm_campaign=hydme&utm_medium=0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda&utm_source=http://0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda.hyd.me/

Response headers

etag
"244f-5f4771c4cefed"
via
e7s
accept-ranges
bytes
content-length
9295
date
Wed, 18 Dec 2024 15:59:35 GMT
last-modified
Sun, 12 Feb 2023 02:01:36 GMT
content-type
image/gif
server
Apache
sidebar-aol-instant-messenger-aim.gif
bad.download/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bad.download/images/sidebar-aol-instant-messenger-aim.gif
Requested by
Host: bad.download
URL: https://bad.download/?utm_campaign=hydme&utm_medium=0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda&utm_source=http://0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda.hyd.me/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2607:ff18:80::5fad , United States, ASN40630 (GRIDFURY-AS, US),
Reverse DNS
Software
Apache /
Resource Hash
c1ad76c98ee93aca2ff82e319ed2126f95486cc80abb1856b62e902f1c5218b4

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://bad.download/?utm_campaign=hydme&utm_medium=0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda&utm_source=http://0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda.hyd.me/

Response headers

etag
"6e1-5f4771a99062d"
via
e7s
accept-ranges
bytes
content-length
1761
date
Wed, 18 Dec 2024 15:59:35 GMT
last-modified
Sun, 12 Feb 2023 02:01:08 GMT
content-type
image/gif
server
Apache
sidebar-macromedia-flashplayer.gif
bad.download/images/ 		938 B
996 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bad.download/images/sidebar-macromedia-flashplayer.gif
Requested by
Host: bad.download
URL: https://bad.download/?utm_campaign=hydme&utm_medium=0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda&utm_source=http://0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda.hyd.me/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2607:ff18:80::5fad , United States, ASN40630 (GRIDFURY-AS, US),
Reverse DNS
Software
Apache /
Resource Hash
3d6afaaf480f65d8479a5ac01471704ebbf6217ea10072f2e0ef0849a4a96cf3

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://bad.download/?utm_campaign=hydme&utm_medium=0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda&utm_source=http://0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda.hyd.me/

Response headers

etag
"3aa-5f4771a99832d"
via
e7s
accept-ranges
bytes
content-length
938
date
Wed, 18 Dec 2024 15:59:35 GMT
last-modified
Sun, 12 Feb 2023 02:01:08 GMT
content-type
image/gif
server
Apache
sidebar-macos.gif
bad.download/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bad.download/images/sidebar-macos.gif
Requested by
Host: bad.download
URL: https://bad.download/?utm_campaign=hydme&utm_medium=0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda&utm_source=http://0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda.hyd.me/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2607:ff18:80::5fad , United States, ASN40630 (GRIDFURY-AS, US),
Reverse DNS
Software
Apache /
Resource Hash
766c5986e6fc4dc69553d27d02b74714e73cfcb1ab0e1548a7662f19d3052a94

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://bad.download/?utm_campaign=hydme&utm_medium=0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda&utm_source=http://0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda.hyd.me/

Response headers

etag
"669-5f4771a93b6cd"
via
e7s
accept-ranges
bytes
content-length
1641
date
Wed, 18 Dec 2024 15:59:35 GMT
last-modified
Sun, 12 Feb 2023 02:01:07 GMT
content-type
image/gif
server
Apache
sidebar-openoffice.gif
bad.download/images/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bad.download/images/sidebar-openoffice.gif
Requested by
Host: bad.download
URL: https://bad.download/?utm_campaign=hydme&utm_medium=0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda&utm_source=http://0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda.hyd.me/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2607:ff18:80::5fad , United States, ASN40630 (GRIDFURY-AS, US),
Reverse DNS
Software
Apache /
Resource Hash
8f83f77a7c6e279c5d282859382174aba946ae2d27bf03f8c370023023dbd258

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://bad.download/?utm_campaign=hydme&utm_medium=0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda&utm_source=http://0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda.hyd.me/

Response headers

etag
"bf9-60ad8b96b6587"
via
e7s
accept-ranges
bytes
content-length
3065
date
Wed, 18 Dec 2024 15:59:35 GMT
last-modified
Thu, 23 Nov 2023 21:43:20 GMT
content-type
image/gif
server
Apache
sidebar-winrar.gif
bad.download/images/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bad.download/images/sidebar-winrar.gif
Requested by
Host: bad.download
URL: https://bad.download/?utm_campaign=hydme&utm_medium=0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda&utm_source=http://0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda.hyd.me/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2607:ff18:80::5fad , United States, ASN40630 (GRIDFURY-AS, US),
Reverse DNS
Software
Apache /
Resource Hash
0045ac32fbc9c9f7c0d032ec35169bd7dde337272cd2bbf126ad6dcddb839282

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://bad.download/?utm_campaign=hydme&utm_medium=0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda&utm_source=http://0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda.hyd.me/

Response headers

etag
"e00-60ad8b088876b"
via
e7s
accept-ranges
bytes
content-length
3584
date
Wed, 18 Dec 2024 15:59:35 GMT
last-modified
Thu, 23 Nov 2023 21:40:51 GMT
content-type
image/gif
server
Apache
kopimi.png
bad.download/images/ 		15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bad.download/images/kopimi.png
Requested by
Host: bad.download
URL: https://bad.download/?utm_campaign=hydme&utm_medium=0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda&utm_source=http://0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda.hyd.me/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2607:ff18:80::5fad , United States, ASN40630 (GRIDFURY-AS, US),
Reverse DNS
Software
Apache /
Resource Hash
e9b570a154988c4931745d748cf4e28b8d8e79e729f762400185c6ae85ea8c80

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://bad.download/?utm_campaign=hydme&utm_medium=0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda&utm_source=http://0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda.hyd.me/

Response headers

etag
"3b94-60a8e197bde02"
via
e7s
accept-ranges
bytes
content-length
15252
date
Wed, 18 Dec 2024 15:59:35 GMT
last-modified
Mon, 20 Nov 2023 04:41:29 GMT
content-type
image/png
server
Apache
hello.js
lavenderhaze.bad.download/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://lavenderhaze.bad.download/hello.js
Requested by
Host: bad.download
URL: https://bad.download/?utm_campaign=hydme&utm_medium=0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda&utm_source=http://0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda.hyd.me/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
46.137.101.118 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-46-137-101-118.eu-west-1.compute.amazonaws.com
Software
Caddy /
Resource Hash
5f959945f5aab404690f2c44c17916346ea1218a36298b76a492fc70f430478a
Security Headers
Name Value
Content-Security-Policy default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://bad.download/

Response headers

content-encoding
gzip
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff
date
Wed, 18 Dec 2024 15:59:36 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=15552000; includeSubDomains
content-security-policy
default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
x-dns-prefetch-control
off
cross-origin-opener-policy
same-origin
cross-origin-resource-policy
cross-origin
x-ratelimit-reset
1734537622
referrer-policy
no-referrer
x-download-options
noopen
x-ratelimit-remaining
2999
cross-origin-embedder-policy
require-corp
access-control-allow-origin
*
content-length
1209
x-xss-protection
0
x-ratelimit-limit
3000
origin-agent-cluster
?1
server
Caddy
cache
lavenderhaze.bad.download/ 		1 B
704 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://lavenderhaze.bad.download/cache?bad.download
Requested by
Host: lavenderhaze.bad.download
URL: https://lavenderhaze.bad.download/hello.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
46.137.101.118 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-46-137-101-118.eu-west-1.compute.amazonaws.com
Software
Caddy /
Resource Hash
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
Security Headers
Name Value
Content-Security-Policy default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://bad.download/

Response headers

etag
false
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff
date
Wed, 18 Dec 2024 15:59:36 GMT
content-type
text/html; charset=utf-8
last-modified
Wed, 18 Dec 2024 00:00:01 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=15552000; includeSubDomains
content-security-policy
default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
cache-control
public, max-age=28824, no-cache
x-dns-prefetch-control
off
cross-origin-opener-policy
same-origin
cross-origin-resource-policy
cross-origin
x-ratelimit-reset
1734537622
referrer-policy
no-referrer
x-download-options
noopen
x-ratelimit-remaining
2998
cross-origin-embedder-policy
require-corp
access-control-allow-origin
*
content-length
1
x-xss-protection
0
x-ratelimit-limit
3000
origin-agent-cluster
?1
server
Caddy
cache
lavenderhaze.bad.download/ 		1 B
49 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://lavenderhaze.bad.download/cache?bad.download/
Requested by
Host: lavenderhaze.bad.download
URL: https://lavenderhaze.bad.download/hello.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
46.137.101.118 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-46-137-101-118.eu-west-1.compute.amazonaws.com
Software
Caddy /
Resource Hash
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
Security Headers
Name Value
Content-Security-Policy default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://bad.download/

Response headers

etag
false
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff
date
Wed, 18 Dec 2024 15:59:36 GMT
content-type
text/html; charset=utf-8
last-modified
Wed, 18 Dec 2024 00:00:01 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=15552000; includeSubDomains
content-security-policy
default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
cache-control
public, max-age=28824, no-cache
x-dns-prefetch-control
off
cross-origin-opener-policy
same-origin
cross-origin-resource-policy
cross-origin
x-ratelimit-reset
1734537622
referrer-policy
no-referrer
x-download-options
noopen
x-ratelimit-remaining
2997
cross-origin-embedder-policy
require-corp
access-control-allow-origin
*
content-length
1
x-xss-protection
0
x-ratelimit-limit
3000
origin-agent-cluster
?1
server
Caddy
hello
lavenderhaze.bad.download/ 		0
68 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://lavenderhaze.bad.download/hello?r=&w=1600&s=0&t=3700&p=https%3A%2F%2Fbad.download%2F%3Futm_campaign%3Dhydme%26utm_medium%3D0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda%26utm_source%3Dhttp%3A%2F%2F0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda.hyd.me%2F&u=0&up=0
Requested by
Host: lavenderhaze.bad.download
URL: https://lavenderhaze.bad.download/hello.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
46.137.101.118 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-46-137-101-118.eu-west-1.compute.amazonaws.com
Software
Caddy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://bad.download/

Response headers

etag
W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff
date
Wed, 18 Dec 2024 15:59:36 GMT
content-type
text/html; charset=utf-8
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=15552000; includeSubDomains
content-security-policy
default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
x-dns-prefetch-control
off
cross-origin-opener-policy
same-origin
cross-origin-resource-policy
cross-origin
x-ratelimit-reset
1734537622
referrer-policy
no-referrer
x-download-options
noopen
x-ratelimit-remaining
2996
cross-origin-embedder-policy
require-corp
access-control-allow-origin
*
content-length
0
x-xss-protection
0
x-ratelimit-limit
3000
origin-agent-cluster
?1
server
Caddy
favicon-32x32.png
bad.download/ 		956 B
1 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://bad.download/favicon-32x32.png
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2607:ff18:80::5fad , United States, ASN40630 (GRIDFURY-AS, US),
Reverse DNS
Software
Apache /
Resource Hash
08d08587b39615760e2ecba2a8205f04fd236c3d2aa2c079bb39ddc307f4985a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://bad.download/?utm_campaign=hydme&utm_medium=0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda&utm_source=http://0.security-confirmation.fb24ba7c91317911316716b23c72e912.awda.hyd.me/

Response headers

etag
"3bc-60aa0e1092a0a"
via
e7s
accept-ranges
bytes
content-length
956
date
Wed, 18 Dec 2024 15:59:36 GMT
last-modified
Tue, 21 Nov 2023 03:05:46 GMT
content-type
image/png
server
Apache

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| cabin

0 Cookies