medusa-stealer.cc Open in urlscan Pro
172.67.197.202 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://medusa-stealer.cc/
Submission: On February 10 via api (February 10th 2023, 6:07:46 am UTC) from GB — Scanned from AU

Summary HTTP 18 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 4 domains to perform 18 HTTP transactions. The main IP is 172.67.197.202, located in United States and belongs to CLOUDFLARENET, US. The main domain is medusa-stealer.cc.
TLS certificate: Issued by E1 on December 29th 2022. Valid for: 3 months.

This is the only time medusa-stealer.cc was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
15	172.67.197.202 172.67.197.202	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.16.57.101 104.16.57.101	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	142.250.4.95 142.250.4.95	15169 (GOOGLE) (GOOGLE)
1	142.251.10.94 142.251.10.94	15169 (GOOGLE) (GOOGLE)
18	5

15 172.67.197.202 (United States)

ASN13335 (CLOUDFLARENET, US)

medusa-stealer.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.57.101 (None, )

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.4.95 (United States)

ASN15169 (GOOGLE, US)
PTR: sm-in-f95.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.10.94 (United States)

ASN15169 (GOOGLE, US)
PTR: sd-in-f94.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	medusa-stealer.cc medusa-stealer.cc	101 KB
1	gstatic.com fonts.gstatic.com	38 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 32	1 KB
1	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 925	6 KB
18	4

	Domain	Requested by
15	medusa-stealer.cc	medusa-stealer.cc static.cloudflareinsights.com
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	medusa-stealer.cc
1	static.cloudflareinsights.com	medusa-stealer.cc
18	4

This site contains no links.

Subject Issuer	Validity	Valid
*.medusa-stealer.cc E1	`2022-12-29` - `2023-03-29`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-05-11` - `2023-05-10`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-01-09` - `2023-04-03`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-01-31` - `2023-04-25`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://medusa-stealer.cc/
Frame ID: E0844A6A8104D439159E3561EEFFA65C
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Medusa Stealer's - HTTP C2 Security Experts

Detected technologies

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Page Statistics

18
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

146 kB
Transfer

480 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
medusa-stealer.cc/ 19 KB
6 KB 970ms
749ms Document
text/html 172.67.197.202
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://medusa-stealer.cc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.197.202 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9a54ef0129f971389a27244fff6ece84faca003184b9762c0902122db9a6aa56

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
accept-language: en-AU,en;q=0.9

Response headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7972aa741a1ca8bf-SYD
content-encoding: br
content-type: text/html; charset=utf-8
date: Fri, 10 Feb 2023 06:07:40 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0livn3YKVtlTMkHxk52D1spihX04AeM9qhYl8LYvDW6dxuZFkArTj0fR2xxIeZ36VQjMqh2IG8hOvQgjawhiqRutkFLeZ%2BdKUvs9qtZuIspTkAUWShA4TfMt2VaJfBk1VPu7fQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-served-by: medusa-stealer.cc

GET
H2 200 styles.css
medusa-stealer.cc/auth/resources/cada/index/medusa-public/css/ 37 KB
9 KB 365ms
365ms Stylesheet
text/css 172.67.197.202
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://medusa-stealer.cc/auth/resources/cada/index/medusa-public/css/styles.css
Requested by: Host: medusa-stealer.cc
URL: https://medusa-stealer.cc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.197.202 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d93ff4b0023b9a08c1c1d2bf37be640fc5c0f34de716df87deb400cec06350c0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://medusa-stealer.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 06:07:41 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: medusa-stealer.cc
cf-bgj: minify
server: cloudflare
etag: W/"95a7-183fae88530"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=C%2BAF7K92qCOrtm%2FQ3%2BBAo%2BPOYtbwDZNrQU2gPzWDLmwhCn7e7l4phmsjCj2AQk%2BsNdSbGSK2dZmVan0lB7xeO%2FlYDpCkgtPqqfbzoPAfMXuuqrk3wtyqNiQVmphagfl5y7gXYg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=11882
cf-ray: 7972aa78dd91a8bf-SYD
expires: Sat, 11 Feb 2023 00:30:00 GMT

GET
H2 200 favicon.svg
medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/ 4 KB
2 KB 380ms
380ms Image
image/svg+xml 172.67.197.202
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/favicon.svg
Requested by: Host: medusa-stealer.cc
URL: https://medusa-stealer.cc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.197.202 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2691ff2f9a92fc06a252e16b8b397c2ab5e7356e5003044069bff384ed6bea4e

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://medusa-stealer.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

expires: Sat, 11 Feb 2023 00:30:00 GMT
date: Fri, 10 Feb 2023 06:07:41 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"1067-183fae87d60"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ivrc4QmTM5NgQuNHDzcHNr5bIUhtXbd51eH4JP%2BVGVPN69cgIR8JMJQL5aa8%2FzAgGBc%2BU7BKoyYq81O1Mw8hyS2W7qvxY7JhF3DI9wgmUxs1Z8n5eRdEd8gUd91BDQEwW%2BKAGA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=11882
cf-ray: 7972aa78dd92a8bf-SYD
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: medusa-stealer.cc

GET
H2 200 feature-tile-icon-01.0f9928d7.svg
medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/ 312 B
667 B 374ms
370ms Image
image/svg+xml 172.67.197.202
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/feature-tile-icon-01.0f9928d7.svg
Requested by: Host: medusa-stealer.cc
URL: https://medusa-stealer.cc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.197.202 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0fd13ff3f1f5d94b6b1bb9040a4c6ce0e3bd9b11b49a92ee55c199499f91ab78

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://medusa-stealer.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

expires: Sat, 11 Feb 2023 00:30:00 GMT
date: Fri, 10 Feb 2023 06:07:41 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"138-183fae87d60"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R7WVk%2Fwq6OsilsocDjzUv7HzHhKWVtBsgUnPRAiEpTYvK2pFrbXoa%2ButMWzUK%2B2tChg4k49Z1jPDO7EhSJHYF9ggGL39BwS5hzDOXIu7y2RrgVtk70inEkUT0LSyH38KMAXTQg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=17124
cf-ray: 7972aa78fd9fa8bf-SYD
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: medusa-stealer.cc

GET
H2 200 feature-tile-icon-02.bd39f304.svg
medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/ 246 B
469 B 370ms
366ms Image
image/svg+xml 172.67.197.202
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/feature-tile-icon-02.bd39f304.svg
Requested by: Host: medusa-stealer.cc
URL: https://medusa-stealer.cc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.197.202 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cb9b36f808fb1e9fa4c6d84af46dfedc92b53850990ff95d10cb3e834b4441a2

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://medusa-stealer.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

expires: Sat, 11 Feb 2023 00:30:00 GMT
date: Fri, 10 Feb 2023 06:07:41 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"f6-183fae87d60"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mi0RocRd9awbXOT8YU2Zky4kfkOKAg5AxKeoDSV856GSkIegBuul%2Fh7DtBKVA9zgRAOSOvqKC2VwuzSPwQMqO9uSyzeb803OUU1MTLzecyqEEYY1wPu2Lu0efX2qAmPNPryBDQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=11882
cf-ray: 7972aa78fda2a8bf-SYD
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: medusa-stealer.cc

GET
H2 200 feature-tile-icon-03.66f37ba5.svg
medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/ 323 B
497 B 373ms
370ms Image
image/svg+xml 172.67.197.202
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/feature-tile-icon-03.66f37ba5.svg
Requested by: Host: medusa-stealer.cc
URL: https://medusa-stealer.cc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.197.202 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e794117c2698be46cad955263c9148181e452a6d7a070fdb362dc7afd86d151b

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://medusa-stealer.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

expires: Sat, 11 Feb 2023 00:30:00 GMT
date: Fri, 10 Feb 2023 06:07:41 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"143-183fae87d60"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Fpg5hqk0iu2fKPR%2FyjY%2BEOMUCOBOKgBIMXZHUwJOs57V%2Fywm0Ot8wQPvc7j7s4IaokZdbfKtJsk%2FXlBaXietlLQsHVCkJ8%2FtzbBCUb6m8p9ZlnO1lYtTxp262liSv3BT6xrx8w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=11882
cf-ray: 7972aa78fda4a8bf-SYD
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: medusa-stealer.cc

GET
H2 200 feature-tile-icon-04.836acd10.svg
medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/ 334 B
563 B 374ms
372ms Image
image/svg+xml 172.67.197.202
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/feature-tile-icon-04.836acd10.svg
Requested by: Host: medusa-stealer.cc
URL: https://medusa-stealer.cc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.197.202 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6dbf2c4d555fb52612831ceb9acd39b38270cd16bc52547e3a492867466e06f7

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://medusa-stealer.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

expires: Sat, 11 Feb 2023 00:30:00 GMT
date: Fri, 10 Feb 2023 06:07:41 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"14e-183fae87d60"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ivq2lSMtAuAPpq%2FD%2B8ucGUUrbjzvFvdj6t6KR9LagasCE2z3EYrJ9oPvw5Wi72WttVeRm0Bs%2BktOMkrYQvkK5WJnpZXqGdugJj7sd3bBnu1Zzq5QRzjcs8j9qmInL%2FTonfCUSw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=17124
cf-ray: 7972aa78fda5a8bf-SYD
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: medusa-stealer.cc

GET
H2 200 feature-tile-icon-05.fa9ba00b.svg
medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/ 346 B
547 B 387ms
384ms Image
image/svg+xml 172.67.197.202
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/feature-tile-icon-05.fa9ba00b.svg
Requested by: Host: medusa-stealer.cc
URL: https://medusa-stealer.cc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.197.202 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: edc9fe5e3a9a422401074bb576ef12edc2a1ca5198617572307323b1507ac364

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://medusa-stealer.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

expires: Sat, 11 Feb 2023 00:30:00 GMT
date: Fri, 10 Feb 2023 06:07:41 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"15a-183fae87d60"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LanOtF02nh7VvohIzC0xgeubwZu76Tj3m12yIS2%2F0qNPdS6R7FklAQtvcuFHhjfjCuajutBuS9KtC4o3xyqQu7n7idn92%2FBdaPfPVzSHpPee0xWLlehl6dXLuz1kDC%2FUC0McYQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=11882
cf-ray: 7972aa78fda6a8bf-SYD
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: medusa-stealer.cc

GET
H2 200 feature-tile-icon-06.6a177696.svg
medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/ 510 B
599 B 371ms
369ms Image
image/svg+xml 172.67.197.202
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/feature-tile-icon-06.6a177696.svg
Requested by: Host: medusa-stealer.cc
URL: https://medusa-stealer.cc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.197.202 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9f57e99b3714955250e44ecf354097b98885d704c63809e6dad3856826b4b1ef

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://medusa-stealer.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

expires: Sat, 11 Feb 2023 00:30:00 GMT
date: Fri, 10 Feb 2023 06:07:41 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"1fe-183fae87d60"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L3ZSIzpQa2cyCb3pCZ5BqMP7Dq5uMnOpIqhKEwc1K5yhg6bmwtVs5%2BAhReEVhTIXpowx3x30P4DElaNT0fwq4naLFHtOQG9kD4M7R6uowm3e7YfovIOAyt5VlCUGVCSKuQ2tbA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=11882
cf-ray: 7972aa78fda7a8bf-SYD
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: medusa-stealer.cc

GET
H2 200 d1.eb23152d.svg
medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/ 215 KB
45 KB 441ms
439ms Image
image/svg+xml 172.67.197.202
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/d1.eb23152d.svg
Requested by: Host: medusa-stealer.cc
URL: https://medusa-stealer.cc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.197.202 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bb2975184d7208506f7c3534bc7252bf3d6e267b9ab1d9a45e79eeed15b9f8b0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://medusa-stealer.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

expires: Sat, 11 Feb 2023 00:30:00 GMT
date: Fri, 10 Feb 2023 06:07:41 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"35a96-183fae88530"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QFfbix8REHwwRAvucJF%2BgP%2FywPs%2BKwVK56RlAc3W5eDR5EOXh14eGwZrJ2qMFYD0lhWIiTUk%2BocijM04YADRHSfj4CTpkOriOXKaS1ILBGz8I3vGxE2de%2BolE%2FUG7%2ByJiPrCYQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=11882
cf-ray: 7972aa78fda8a8bf-SYD
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: medusa-stealer.cc

GET
H2 200 d3.7e28f7f2.svg
medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/ 51 KB
12 KB 376ms
374ms Image
image/svg+xml 172.67.197.202
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/d3.7e28f7f2.svg
Requested by: Host: medusa-stealer.cc
URL: https://medusa-stealer.cc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.197.202 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 376c4e61b6c16e307f0617994e72884a149b2cb75d4e0392127be90f328ec7af

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://medusa-stealer.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

expires: Sat, 11 Feb 2023 00:30:00 GMT
date: Fri, 10 Feb 2023 06:07:41 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"cc60-183fae87d60"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Okqrd%2FRrZ3IjYC4rEDxgFVqqrAb04jdMRVx5utfCjHjvMWQniECv0XZYG7MEuTsyG4j8lLuWScMnyblygqWj4BA5MeUWzTsHoJpKduDuGiUzUlWAlmN6sSZ7QVKbm74Epjpyww%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=27249
cf-ray: 7972aa78fda9a8bf-SYD
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: medusa-stealer.cc

GET
H2 200 d2.20eaa006.svg
medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/ 73 KB
18 KB 484ms
482ms Image
image/svg+xml 172.67.197.202
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/d2.20eaa006.svg
Requested by: Host: medusa-stealer.cc
URL: https://medusa-stealer.cc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.197.202 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e97af518911a71d47591c932246a9f29d5281d0331ef2a7fd00747d7ccfd750c

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://medusa-stealer.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

expires: Sat, 11 Feb 2023 00:30:00 GMT
date: Fri, 10 Feb 2023 06:07:41 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"1247f-183fae87d60"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0VLauKw%2BpPiVZ7Mm5xv2xP1ewd%2B%2FUcEXep2Ii1vMRrTYNTCtY7LkfDk8om%2FL8ypRHrcvRr1RdZQpzHO1t%2FPe9dlT%2B9yU6rNKl7hOCVEon5dYvCe%2BGCPxQHGARcM5oI8G3y1shA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=11882
cf-ray: 7972aa797de9a8bf-SYD
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: medusa-stealer.cc

GET
H2 200 rocket-loader.min.js Show response
medusa-stealer.cc/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ 12 KB
4 KB 177ms
175ms Script
application/javascript 172.67.197.202
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://medusa-stealer.cc/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Requested by

Host: medusa-stealer.cc
URL: https://medusa-stealer.cc/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.197.202 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://medusa-stealer.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 06:07:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 06 Feb 2023 18:52:43 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"63e14c7b-302c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G9zHcBznpEQvsBq1znFw4xOInGBlIzAfNzniR5LCygV6LzzU5EBd%2BjcvTtRHtiaxHTCmCARCRtui2uo8JTAphkdHmdyt8Cqa0f8Cj8NwgyoG9W7L0MRREOyPr4VtmKsWtUdR4g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-frame-options: DENY
cache-control: max-age=172800, public
cf-ray: 7972aa797deba8bf-SYD
expires: Sun, 12 Feb 2023 06:07:41 GMT

GET
H2 200 vaafb692b2aea4879b33c060e79fe94621666317369993 Show response
static.cloudflareinsights.com/beacon.min.js/ 17 KB
6 KB 339ms
133ms Script
text/javascript 104.16.57.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/vaafb692b2aea4879b33c060e79fe94621666317369993
Requested by: Host: medusa-stealer.cc
URL: https://medusa-stealer.cc/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.16.57.101 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0f48c5678ce459a596423b0e55344e7ad8eb3d3b1b27c54cd76a9d4cee7dd6c3

Request headers

Referer: https://medusa-stealer.cc/
Origin: https://medusa-stealer.cc
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 06:07:41 GMT
content-encoding: gzip
last-modified: Fri, 21 Oct 2022 01:56:09 GMT
server: cloudflare
etag: W/2022.10.1
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 7972aa7a4d66a967-SYD

GET
H2 200 css
fonts.googleapis.com/ 11 KB
1 KB 579ms
196ms Stylesheet
text/css 142.250.4.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Inter:400,500,600,700,800&display=swap

Requested by

Host: medusa-stealer.cc
URL: https://medusa-stealer.cc/auth/resources/cada/index/medusa-public/css/styles.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.4.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sm-in-f95.1e100.net

Software

ESF /

Resource Hash

ebef77f2ad2f39d3f06fd1cd2f56d5dd68658429106965fab20477b6a27616d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://medusa-stealer.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Fri, 10 Feb 2023 06:07:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 10 Feb 2023 06:07:41 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 10 Feb 2023 06:07:41 GMT

GET
H3 200 snow.js Show response
medusa-stealer.cc/auth/resources/cada/dashboard/medusa-public/js/ 2 KB
1 KB 372ms
371ms Script
application/javascript 172.67.197.202
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://medusa-stealer.cc/auth/resources/cada/dashboard/medusa-public/js/snow.js
Requested by: Host: medusa-stealer.cc
URL: https://medusa-stealer.cc/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.197.202 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 85905377d85ca95845fa6e5c446ed75c4c939b1d02015a354f01dbbd37088a4d

Request headers

accept-language: en-AU,en;q=0.9
Referer: https://medusa-stealer.cc/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Fri, 10 Feb 2023 06:07:42 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-polished: origSize=2236
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: medusa-stealer.cc
cf-bgj: minify
server: cloudflare
etag: W/"8bc-18508ae68f0"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2iKbvrNMHW7kpv9aq0m1vbyvd1Lfp9PqG7WRzUAYdeveOoZPgSI8wAFJuT1YgbFVqLk%2BvNoWjLlkywSRwAdMdrf9C5OqpMqXpxZCruWwaE8Sh7FZXEqI28hVxTIFxupKqM7nJA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=17124
cf-ray: 7972aa7ede21a932-SYD
priority: u=1,i=?0
expires: Sat, 11 Feb 2023 00:30:00 GMT

GET
DATA 200
OK truncated
/ 437 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 44c6245e17f8681854e88041bb00c4165e7efb8cb00fca7c8d21538cc7f87da1

Request headers

accept-language: en-AU,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
fonts.gstatic.com/s/inter/v12/ 37 KB
38 KB 578ms
191ms Font
font/woff2 142.251.10.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/inter/v12/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Inter:400,500,600,700,800&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.10.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

sd-in-f94.1e100.net

Software

sffe /

Resource Hash

450f3ba4e47ee174bd9692b396f264b907d37d2528f53911760f3d0edb785f7e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://medusa-stealer.cc
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date: Mon, 06 Feb 2023 06:55:48 GMT
x-content-type-options: nosniff
age: 342714
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37924
x-xss-protection: 0
last-modified: Mon, 11 Jul 2022 20:54:46 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 06 Feb 2024 06:55:48 GMT

POST
H3 204 rum Show response
medusa-stealer.cc/cdn-cgi/ 0
142 B 102ms
102ms XHR
text/plain 172.67.197.202
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://medusa-stealer.cc/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/vaafb692b2aea4879b33c060e79fe94621666317369993

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.197.202 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://medusa-stealer.cc/
accept-language: en-AU,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
content-type: application/json

Response headers

date: Fri, 10 Feb 2023 06:07:42 GMT
x-content-type-options: nosniff
server: cloudflare
vary: Origin
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://medusa-stealer.cc
x-frame-options: DENY
access-control-allow-credentials: true
cf-ray: 7972aa841c1da932-SYD

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
medusa-stealer.cc
static.cloudflareinsights.com
104.16.57.101
142.250.4.95
142.251.10.94
172.67.197.202
0f48c5678ce459a596423b0e55344e7ad8eb3d3b1b27c54cd76a9d4cee7dd6c3
0fd13ff3f1f5d94b6b1bb9040a4c6ce0e3bd9b11b49a92ee55c199499f91ab78
2691ff2f9a92fc06a252e16b8b397c2ab5e7356e5003044069bff384ed6bea4e
376c4e61b6c16e307f0617994e72884a149b2cb75d4e0392127be90f328ec7af
44c6245e17f8681854e88041bb00c4165e7efb8cb00fca7c8d21538cc7f87da1
450f3ba4e47ee174bd9692b396f264b907d37d2528f53911760f3d0edb785f7e
6dbf2c4d555fb52612831ceb9acd39b38270cd16bc52547e3a492867466e06f7
85905377d85ca95845fa6e5c446ed75c4c939b1d02015a354f01dbbd37088a4d
9a54ef0129f971389a27244fff6ece84faca003184b9762c0902122db9a6aa56
9f57e99b3714955250e44ecf354097b98885d704c63809e6dad3856826b4b1ef
bb2975184d7208506f7c3534bc7252bf3d6e267b9ab1d9a45e79eeed15b9f8b0
cb9b36f808fb1e9fa4c6d84af46dfedc92b53850990ff95d10cb3e834b4441a2
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
d93ff4b0023b9a08c1c1d2bf37be640fc5c0f34de716df87deb400cec06350c0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e794117c2698be46cad955263c9148181e452a6d7a070fdb362dc7afd86d151b
e97af518911a71d47591c932246a9f29d5281d0331ef2a7fd00747d7ccfd750c
ebef77f2ad2f39d3f06fd1cd2f56d5dd68658429106965fab20477b6a27616d3
edc9fe5e3a9a422401074bb576ef12edc2a1ca5198617572307323b1507ac364

medusa-stealer.cc Open in urlscan Pro 172.67.197.202 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

18 Requests

100 %HTTPS

0 %IPv6

4 Domains

4 Subdomains

5 IPs

2 Countries

146 kBTransfer

480 kBSize

0 Cookies

0 Outgoing links

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

0 Cookies

Indicators

medusa-stealer.cc Open in urlscan Pro
172.67.197.202 Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

4
Subdomains

5
IPs

2
Countries

146 kB
Transfer

480 kB
Size

0
Cookies

18 HTTP transactions
1 data transactions