URL: http://medusa-stealer.cc/
Submission: On February 13 via manual from ZA — Scanned from DE

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 18 HTTP transactions. The main IP is 2606:4700:3030::6815:3c95, located in United States and belongs to CLOUDFLARENET, US. The main domain is medusa-stealer.cc.
This is the only time medusa-stealer.cc was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
15 2606:4700:303... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
18 5
Apex Domain
Subdomains
Transfer
15 medusa-stealer.cc
medusa-stealer.cc
114 KB
1 gstatic.com
fonts.gstatic.com
38 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 34
1 KB
1 cloudflareinsights.com
static.cloudflareinsights.com — Cisco Umbrella Rank: 917
6 KB
18 4
Domain Requested by
15 medusa-stealer.cc medusa-stealer.cc
static.cloudflareinsights.com
1 fonts.gstatic.com fonts.googleapis.com
1 fonts.googleapis.com medusa-stealer.cc
1 static.cloudflareinsights.com medusa-stealer.cc
18 4

This site contains no links.

Subject Issuer Validity Valid
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2022-05-11 -
2023-05-10
a year crt.sh
upload.video.google.com
GTS CA 1C3
2023-01-31 -
2023-04-25
3 months crt.sh
*.gstatic.com
GTS CA 1C3
2023-01-31 -
2023-04-25
3 months crt.sh

This page contains 1 frames:

Primary Page: http://medusa-stealer.cc/
Frame ID: DD818C836BB9F3BF645661A0E77A3DFC
Requests: 19 HTTP requests in this frame

Screenshot

Page Title

Medusa Stealer's - HTTP C2 Security Experts

Detected technologies

Overall confidence: 100%
Detected patterns
  • static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Page Statistics

18
Requests

17 %
HTTPS

100 %
IPv6

4
Domains

4
Subdomains

5
IPs

3
Countries

159 kB
Transfer

480 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
medusa-stealer.cc/
19 KB
6 KB
Document
General
Full URL
http://medusa-stealer.cc/
Protocol
HTTP/1.1
Server
2606:4700:3030::6815:3c95 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b21c1a21f795108b239c1b48027cdc54ad65e7830c04fb662246506585daea36

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Access-Control-Allow-Origin
*
CF-Cache-Status
DYNAMIC
CF-RAY
798ba849d9ed9193-FRA
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=utf-8
Date
Mon, 13 Feb 2023 06:55:15 GMT
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hVnY4cmnEuRjwBoVidFkTJUhFyudpXb9S%2BnGBSwJzAZDf%2FZ5hUHuSL%2F9pVgL5yvSnGdBGRO%2BIdGWz84u1a92JBDxzjw5AbrjMlOsDp8BM4NwdWWZycHUgd3UyW9z55AaZ%2FZVn6i6%2F7sm%2B0wpsD5WmQ%3D%3D"}],"group":"cf-nel","max_age":604800}
Server
cloudflare
Server-Timing
cf-q-config;dur=6.0000020312145e-06
Transfer-Encoding
chunked
X-Served-By
medusa-stealer.cc
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
styles.css
medusa-stealer.cc/auth/resources/cada/index/medusa-public/css/
37 KB
9 KB
Stylesheet
General
Full URL
http://medusa-stealer.cc/auth/resources/cada/index/medusa-public/css/styles.css
Requested by
Host: medusa-stealer.cc
URL: http://medusa-stealer.cc/
Protocol
HTTP/1.1
Server
2606:4700:3030::6815:3c95 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d93ff4b0023b9a08c1c1d2bf37be640fc5c0f34de716df87deb400cec06350c0

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://medusa-stealer.cc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date
Mon, 13 Feb 2023 06:55:15 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Transfer-Encoding
chunked
Connection
keep-alive
Server-Timing
cf-q-config;dur=5.0000016926788e-06
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Served-By
medusa-stealer.cc
Cf-Bgj
minify
Server
cloudflare
ETag
W/"95a7-183fae88530"
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0WVBh%2FpTYgV9bb8a5dVllJQY%2B3pxGZzoX7mRS7sVgYk3XLOK00WbN5U6CWPxnR9DO3NZNmzpfxEQ6QpKnDsfOUtui1NpmLCWAvnIDDmEzU0BpeWNZKE8xLiLjxgfv1oVzd8miD562JezyzUXzF%2BB0w%3D%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
text/css; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=308
CF-RAY
798ba84a5a7d9193-FRA
Expires
Tue, 14 Feb 2023 00:30:00 GMT
favicon.svg
medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/
4 KB
3 KB
Image
General
Full URL
http://medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/favicon.svg
Requested by
Host: medusa-stealer.cc
URL: http://medusa-stealer.cc/
Protocol
HTTP/1.1
Server
2606:4700:3030::6815:3c95 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2691ff2f9a92fc06a252e16b8b397c2ab5e7356e5003044069bff384ed6bea4e

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://medusa-stealer.cc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date
Mon, 13 Feb 2023 06:55:15 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Transfer-Encoding
chunked
Connection
keep-alive
Server-Timing
cf-q-config;dur=7.0000023697503e-06
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Served-By
medusa-stealer.cc
Server
cloudflare
ETag
W/"1067-183fae87d60"
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eREhy2vcAuQnpobAdl6HwSYgkkI2EvH4MdxtkipGz81X8PfAK18qdPewyBhCBQUJlpupct5NlLvwexuHnlo0I4sEFdFDhwKHCCg05wJGdlgXpKrBKPnccbQz%2FMmoqtMMoOkDVZNhZqcEUdN4GvmwbQ%3D%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Cache-Control
max-age=307
CF-RAY
798ba84a6bbe2c6f-FRA
Expires
Tue, 14 Feb 2023 00:30:00 GMT
feature-tile-icon-01.0f9928d7.svg
medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/
312 B
1 KB
Image
General
Full URL
http://medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/feature-tile-icon-01.0f9928d7.svg
Requested by
Host: medusa-stealer.cc
URL: http://medusa-stealer.cc/
Protocol
HTTP/1.1
Server
2606:4700:3030::6815:3c95 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0fd13ff3f1f5d94b6b1bb9040a4c6ce0e3bd9b11b49a92ee55c199499f91ab78

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://medusa-stealer.cc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date
Mon, 13 Feb 2023 06:55:15 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Transfer-Encoding
chunked
Connection
keep-alive
Server-Timing
cf-q-config;dur=4.9999944167212e-06
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Served-By
medusa-stealer.cc
Server
cloudflare
ETag
W/"138-183fae87d60"
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RKm5Ln97mFC7bmP1muML2azUn2SWmTUir8jWfAzQEMp0eazX4RRIkHYsSCv%2F%2B4r2kJS1liblF%2F8jzmdxvKMUd156DG1uVZ8jbywzwnPWJRrLZRypaKlOYu%2B3%2BymSYZYb5pPOTh9SsT6zD%2BEPOYwlmg%3D%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Cache-Control
max-age=300
CF-RAY
798ba84a7a853a7e-FRA
Expires
Tue, 14 Feb 2023 00:30:00 GMT
feature-tile-icon-02.bd39f304.svg
medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/
246 B
1 KB
Image
General
Full URL
http://medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/feature-tile-icon-02.bd39f304.svg
Requested by
Host: medusa-stealer.cc
URL: http://medusa-stealer.cc/
Protocol
HTTP/1.1
Server
2606:4700:3030::6815:3c95 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cb9b36f808fb1e9fa4c6d84af46dfedc92b53850990ff95d10cb3e834b4441a2

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://medusa-stealer.cc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date
Mon, 13 Feb 2023 06:55:15 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Transfer-Encoding
chunked
Connection
keep-alive
Server-Timing
cf-q-config;dur=6.0000020312145e-06
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Served-By
medusa-stealer.cc
Server
cloudflare
ETag
W/"f6-183fae87d60"
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZN5NPmmIv1x1j6mRLyzrwOMJE0y5HwNID7EAoKClv6wYxOGOpeLPp1L5OCLfyhOOQjEREzk1bYVLN3bQp5RsNfiFFf38ah9ldLtLqaMU3LjI60usyax5O%2BYMYxOoArlqjl41VDKTJpDcsNmzYxG%2Fzw%3D%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Cache-Control
max-age=307
CF-RAY
798ba84a8a4839be-FRA
Expires
Tue, 14 Feb 2023 00:30:00 GMT
feature-tile-icon-03.66f37ba5.svg
medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/
323 B
1 KB
Image
General
Full URL
http://medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/feature-tile-icon-03.66f37ba5.svg
Requested by
Host: medusa-stealer.cc
URL: http://medusa-stealer.cc/
Protocol
HTTP/1.1
Server
2606:4700:3030::6815:3c95 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e794117c2698be46cad955263c9148181e452a6d7a070fdb362dc7afd86d151b

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://medusa-stealer.cc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date
Mon, 13 Feb 2023 06:55:15 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Transfer-Encoding
chunked
Connection
keep-alive
Server-Timing
cf-q-config;dur=5.9999947552569e-06
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Served-By
medusa-stealer.cc
Server
cloudflare
ETag
W/"143-183fae87d60"
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cTjfMp8AoMPoy4vSntlE3Lm9R7nGSkUHilnhdmm20TB7NqxBrOMOL1MkCtl2ahWWHC9mc5tWvlZi%2F0G3O2IgJ%2FwRE5TPeLhbKeL6sG0m4UjS7oVOMhtOF9O7DTRTuTI6xxSnRXyH4W10IDDcc9gSLQ%3D%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Cache-Control
max-age=306
CF-RAY
798ba84a8b239bfa-FRA
Expires
Tue, 14 Feb 2023 00:30:00 GMT
feature-tile-icon-04.836acd10.svg
medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/
334 B
1 KB
Image
General
Full URL
http://medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/feature-tile-icon-04.836acd10.svg
Requested by
Host: medusa-stealer.cc
URL: http://medusa-stealer.cc/
Protocol
HTTP/1.1
Server
2606:4700:3030::6815:3c95 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6dbf2c4d555fb52612831ceb9acd39b38270cd16bc52547e3a492867466e06f7

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://medusa-stealer.cc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date
Mon, 13 Feb 2023 06:55:15 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Transfer-Encoding
chunked
Connection
keep-alive
Server-Timing
cf-q-config;dur=5.9999947552569e-06
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Served-By
medusa-stealer.cc
Server
cloudflare
ETag
W/"14e-183fae87d60"
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1DazUNRViGxUQR4AK8lohrTynEqn%2FTTwkwxFQ4M3CSZFxBkNnH42vgccMUSIEcpxvpq2LrB8LToSzJ56QWpscNzGLGQpD7rsygzWJnHYX8E%2BVyoXhbtdK62yWM87lyeAd680uLJPckflRjT7oPOlBQ%3D%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Cache-Control
max-age=307
CF-RAY
798ba84a8864910d-FRA
Expires
Tue, 14 Feb 2023 00:30:00 GMT
feature-tile-icon-05.fa9ba00b.svg
medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/
346 B
1 KB
Image
General
Full URL
http://medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/feature-tile-icon-05.fa9ba00b.svg
Requested by
Host: medusa-stealer.cc
URL: http://medusa-stealer.cc/
Protocol
HTTP/1.1
Server
2606:4700:3030::6815:3c95 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
edc9fe5e3a9a422401074bb576ef12edc2a1ca5198617572307323b1507ac364

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://medusa-stealer.cc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date
Mon, 13 Feb 2023 06:55:15 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Transfer-Encoding
chunked
Connection
keep-alive
Server-Timing
cf-q-config;dur=6.0000020312145e-06
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Served-By
medusa-stealer.cc
Server
cloudflare
ETag
W/"15a-183fae87d60"
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=03kg%2BIWkuWqMHFS%2B6WCcm5YYsA6DFLgc0YF9pGWEts3RLtXLguqB88mjFIjNVjcYL8%2B7QHdq%2FjHoe6ZEpLk2IfCCGzl5Dmoxktxs29mQweFiaphSz9ymULqll4u7h8UStGVJirU9JeC%2Fm7U%2BU%2BVWog%3D%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Cache-Control
max-age=300
CF-RAY
798ba84a9ac39193-FRA
Expires
Tue, 14 Feb 2023 00:30:00 GMT
feature-tile-icon-06.6a177696.svg
medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/
510 B
1 KB
Image
General
Full URL
http://medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/feature-tile-icon-06.6a177696.svg
Requested by
Host: medusa-stealer.cc
URL: http://medusa-stealer.cc/
Protocol
HTTP/1.1
Server
2606:4700:3030::6815:3c95 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9f57e99b3714955250e44ecf354097b98885d704c63809e6dad3856826b4b1ef

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://medusa-stealer.cc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date
Mon, 13 Feb 2023 06:55:15 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Transfer-Encoding
chunked
Connection
keep-alive
Server-Timing
cf-q-config;dur=7.9999954323284e-06
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Served-By
medusa-stealer.cc
Server
cloudflare
ETag
W/"1fe-183fae87d60"
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3Cz6XMSITJpsbyPUEpZbNxmNAqPGew05eDqjSZq3V%2F4DItNfGN7MjU57%2BpuAeCG1zazsY1cGZ7%2BapThPAL2b8j3ElxXobQAPHOq%2FEmctPmL98uhiUy7EmTrp6q%2FwlOBC6SjsNxOFWfcrlbSoi7KDkA%3D%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Cache-Control
max-age=306
CF-RAY
798ba84abc152c6f-FRA
Expires
Tue, 14 Feb 2023 00:30:00 GMT
d1.eb23152d.svg
medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/
215 KB
49 KB
Image
General
Full URL
http://medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/d1.eb23152d.svg
Requested by
Host: medusa-stealer.cc
URL: http://medusa-stealer.cc/
Protocol
HTTP/1.1
Server
2606:4700:3030::6815:3c95 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bb2975184d7208506f7c3534bc7252bf3d6e267b9ab1d9a45e79eeed15b9f8b0

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://medusa-stealer.cc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date
Mon, 13 Feb 2023 06:55:15 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Transfer-Encoding
chunked
Connection
keep-alive
Server-Timing
cf-q-config;dur=5.9999947552569e-06
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Served-By
medusa-stealer.cc
Server
cloudflare
ETag
W/"35a96-183fae88530"
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m8gUOzmfDgEkLqx3onN3C5z9%2BzFNyqhgmCoPMzxRIX707LcmQDUJvDt0S5ru7RoTmOsZ8amPQWSzZmGEjuOetKRCVu8YCOicJhSQzLv266BQrgKPzPgTOPtniirX90j1Fc33i5NRkCgDJDDlyt9WSQ%3D%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Cache-Control
max-age=307
CF-RAY
798ba84abad33a7e-FRA
Expires
Tue, 14 Feb 2023 00:30:00 GMT
d3.7e28f7f2.svg
medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/
51 KB
13 KB
Image
General
Full URL
http://medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/d3.7e28f7f2.svg
Requested by
Host: medusa-stealer.cc
URL: http://medusa-stealer.cc/
Protocol
HTTP/1.1
Server
2606:4700:3030::6815:3c95 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
376c4e61b6c16e307f0617994e72884a149b2cb75d4e0392127be90f328ec7af

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://medusa-stealer.cc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date
Mon, 13 Feb 2023 06:55:15 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Transfer-Encoding
chunked
Connection
keep-alive
Server-Timing
cf-q-config;dur=6.0000020312145e-06
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Served-By
medusa-stealer.cc
Server
cloudflare
ETag
W/"cc60-183fae87d60"
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=btZ4DgJeOKwz6uBOTcuntyCQwAvrSziCqThllVOIl9R3R%2BPwqX7rBR0Q98Zg182RXwJMeyKle7fc2BaHb2xtGsTuo%2FlB85wJShPslLBYFRo0KkD65U9AWogXhR83g4oMchMP1mcTpjEGLVxrH8RnEw%3D%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Cache-Control
max-age=307
CF-RAY
798ba84acb7e9bfa-FRA
Expires
Tue, 14 Feb 2023 00:30:00 GMT
d2.20eaa006.svg
medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/
73 KB
20 KB
Image
General
Full URL
http://medusa-stealer.cc/auth/resources/cada/index/medusa-public/img/d2.20eaa006.svg
Requested by
Host: medusa-stealer.cc
URL: http://medusa-stealer.cc/
Protocol
HTTP/1.1
Server
2606:4700:3030::6815:3c95 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e97af518911a71d47591c932246a9f29d5281d0331ef2a7fd00747d7ccfd750c

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://medusa-stealer.cc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date
Mon, 13 Feb 2023 06:55:15 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Transfer-Encoding
chunked
Connection
keep-alive
Server-Timing
cf-q-config;dur=7.0000023697503e-06
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Served-By
medusa-stealer.cc
Server
cloudflare
ETag
W/"1247f-183fae87d60"
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AaOiWbCJrPyMPIb%2FxNLbayYQmRPPeCDoFCOpzRvGOdl4KTj61Kx9btTv7gpdYy60qmkNJ3tGSLOsHgK3rEl8qrwDCVc50NEa4O5caC4xIKpr%2F5LJ3Wz%2BRzx%2Fc3Aoyjq3Af3rD7xdZURTJUXh%2B33mcw%3D%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
image/svg+xml
Access-Control-Allow-Origin
*
Cache-Control
max-age=307
CF-RAY
798ba84adaa739be-FRA
Expires
Tue, 14 Feb 2023 00:30:00 GMT
rocket-loader.min.js
medusa-stealer.cc/cdn-cgi/scripts/7d0fa10a/cloudflare-static/
12 KB
5 KB
Script
General
Full URL
http://medusa-stealer.cc/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Requested by
Host: medusa-stealer.cc
URL: http://medusa-stealer.cc/
Protocol
HTTP/1.1
Server
2606:4700:3030::6815:3c95 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://medusa-stealer.cc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date
Mon, 13 Feb 2023 06:55:15 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Transfer-Encoding
chunked
Connection
keep-alive
Last-Modified
Thu, 09 Feb 2023 12:46:50 GMT
Server
cloudflare
ETag
W/"63e4eb3a-302c"
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gD33wFu8%2FYxNE481CoQbZBN3b8yAmQGp9cDrr5NIPj%2FhNpsn8VwgtwGjDNtH802fNiVVudLcIw09cpa8pUIUrnXGCEdRJm8IXlnBbPo%2FIza3LgKVKo3rk4JqAzfGFKtUgzz0ktiMk4uWR2nl41BMjQ%3D%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
application/javascript
X-Frame-Options
DENY
Cache-Control
max-age=172800, public
CF-RAY
798ba84adb289193-FRA
Expires
Wed, 15 Feb 2023 06:55:15 GMT
vaafb692b2aea4879b33c060e79fe94621666317369993
static.cloudflareinsights.com/beacon.min.js/
17 KB
6 KB
Script
General
Full URL
https://static.cloudflareinsights.com/beacon.min.js/vaafb692b2aea4879b33c060e79fe94621666317369993
Requested by
Host: medusa-stealer.cc
URL: http://medusa-stealer.cc/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:3965 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0f48c5678ce459a596423b0e55344e7ad8eb3d3b1b27c54cd76a9d4cee7dd6c3

Request headers

Referer
http://medusa-stealer.cc/
Origin
http://medusa-stealer.cc
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date
Mon, 13 Feb 2023 06:55:15 GMT
content-encoding
gzip
last-modified
Fri, 21 Oct 2022 01:56:09 GMT
server
cloudflare
etag
W/2022.10.1
vary
Accept-Encoding
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
cf-ray
798ba84a8d7e9226-FRA
css
fonts.googleapis.com/
11 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Inter:400,500,600,700,800&display=swap
Requested by
Host: medusa-stealer.cc
URL: http://medusa-stealer.cc/auth/resources/cada/index/medusa-public/css/styles.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:80c::200a , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
ebef77f2ad2f39d3f06fd1cd2f56d5dd68658429106965fab20477b6a27616d3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://medusa-stealer.cc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Mon, 13 Feb 2023 06:55:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Mon, 13 Feb 2023 06:55:15 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 13 Feb 2023 06:55:15 GMT
snow.js
medusa-stealer.cc/auth/resources/cada/dashboard/medusa-public/js/
2 KB
2 KB
Script
General
Full URL
http://medusa-stealer.cc/auth/resources/cada/dashboard/medusa-public/js/snow.js
Requested by
Host: medusa-stealer.cc
URL: http://medusa-stealer.cc/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol
HTTP/1.1
Server
2606:4700:3030::6815:3c95 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
85905377d85ca95845fa6e5c446ed75c4c939b1d02015a354f01dbbd37088a4d

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://medusa-stealer.cc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Date
Mon, 13 Feb 2023 06:55:15 GMT
Content-Encoding
gzip
CF-Cache-Status
HIT
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Cf-Polished
origSize=2236
Transfer-Encoding
chunked
Connection
keep-alive
Server-Timing
cf-q-config;dur=4.9999944167212e-06
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Served-By
medusa-stealer.cc
Cf-Bgj
minify
Server
cloudflare
ETag
W/"8bc-18508ae68f0"
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y9qSCqEHctgqYM4zLk1B%2BdEuhGKVqd2OlGZ2qJK03M0CPjd9V4LnheV8UxxcYZ5%2BDnl8yXPEC2jzOiC0YetJiXI%2BhCn32ayNzOLH6BL0yyUPFO%2B6lObA2Ir%2BYDnhVbB3t0KtPLBpTPECK%2FUH3fG6Tg%3D%3D"}],"group":"cf-nel","max_age":604800}
Content-Type
application/javascript; charset=UTF-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=307
CF-RAY
798ba84bdbcf39be-FRA
Expires
Tue, 14 Feb 2023 00:30:00 GMT
truncated
/
437 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
44c6245e17f8681854e88041bb00c4165e7efb8cb00fca7c8d21538cc7f87da1

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://medusa-stealer.cc/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

Content-Type
image/svg+xml
UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
fonts.gstatic.com/s/inter/v12/
37 KB
38 KB
Font
General
Full URL
https://fonts.gstatic.com/s/inter/v12/UcC73FwrK3iLTeHuS_fvQtMwCp50KnMa1ZL7.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Inter:400,500,600,700,800&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
450f3ba4e47ee174bd9692b396f264b907d37d2528f53911760f3d0edb785f7e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
http://medusa-stealer.cc
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36

Response headers

date
Tue, 07 Feb 2023 11:39:34 GMT
x-content-type-options
nosniff
age
501341
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
37924
x-xss-protection
0
last-modified
Mon, 11 Jul 2022 20:54:46 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 07 Feb 2024 11:39:34 GMT
rum
medusa-stealer.cc/cdn-cgi/
0
378 B
XHR
General
Full URL
http://medusa-stealer.cc/cdn-cgi/rum?
Requested by
Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/vaafb692b2aea4879b33c060e79fe94621666317369993
Protocol
HTTP/1.1
Server
2606:4700:3030::6815:3c95 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
http://medusa-stealer.cc/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.77 Safari/537.36
content-type
application/json

Response headers

Date
Mon, 13 Feb 2023 06:55:16 GMT
X-Content-Type-Options
nosniff
Server
cloudflare
vary
Origin
access-control-max-age
86400
access-control-allow-methods
POST,OPTIONS
access-control-allow-origin
http://medusa-stealer.cc
X-Frame-Options
DENY
access-control-allow-credentials
true
Connection
keep-alive
CF-RAY
798ba84d3d2639be-FRA

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| oncontentvisibilityautostatechange object| __cfQR object| __cfBeacon object| snow boolean| __cfRLUnblockHandlers

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
fonts.gstatic.com
medusa-stealer.cc
static.cloudflareinsights.com
2606:4700:3030::6815:3c95
2606:4700::6810:3965
2a00:1450:4001:82b::2003
2a00:1450:400d:80c::200a
0f48c5678ce459a596423b0e55344e7ad8eb3d3b1b27c54cd76a9d4cee7dd6c3
0fd13ff3f1f5d94b6b1bb9040a4c6ce0e3bd9b11b49a92ee55c199499f91ab78
2691ff2f9a92fc06a252e16b8b397c2ab5e7356e5003044069bff384ed6bea4e
376c4e61b6c16e307f0617994e72884a149b2cb75d4e0392127be90f328ec7af
44c6245e17f8681854e88041bb00c4165e7efb8cb00fca7c8d21538cc7f87da1
450f3ba4e47ee174bd9692b396f264b907d37d2528f53911760f3d0edb785f7e
6dbf2c4d555fb52612831ceb9acd39b38270cd16bc52547e3a492867466e06f7
85905377d85ca95845fa6e5c446ed75c4c939b1d02015a354f01dbbd37088a4d
9f57e99b3714955250e44ecf354097b98885d704c63809e6dad3856826b4b1ef
b21c1a21f795108b239c1b48027cdc54ad65e7830c04fb662246506585daea36
bb2975184d7208506f7c3534bc7252bf3d6e267b9ab1d9a45e79eeed15b9f8b0
cb9b36f808fb1e9fa4c6d84af46dfedc92b53850990ff95d10cb3e834b4441a2
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
d93ff4b0023b9a08c1c1d2bf37be640fc5c0f34de716df87deb400cec06350c0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e794117c2698be46cad955263c9148181e452a6d7a070fdb362dc7afd86d151b
e97af518911a71d47591c932246a9f29d5281d0331ef2a7fd00747d7ccfd750c
ebef77f2ad2f39d3f06fd1cd2f56d5dd68658429106965fab20477b6a27616d3
edc9fe5e3a9a422401074bb576ef12edc2a1ca5198617572307323b1507ac364