lucifer.sh - urlscan.io

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 4 HTTP transactions. The main IP is 172.67.167.240, located in United States and belongs to CLOUDFLARENET, US. The main domain is lucifer.sh.
TLS certificate: Issued by WE1 on June 12th 2024. Valid for: 3 months.

This is the only time lucifer.sh was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
4	172.67.167.240 172.67.167.240		13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	1

4 172.67.167.240 (United States)

ASN13335 (CLOUDFLARENET, US)

lucifer.sh	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	lucifer.sh lucifer.sh	102 KB
4	1

	Domain	Requested by
4	lucifer.sh	lucifer.sh
4	1

This site contains links to these domains. Also see Links.

Domain
t.me
twitter.com
darkforums.st

Subject Issuer	Validity	Valid
lucifer.sh WE1	`2024-06-12` - `2024-09-10`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://lucifer.sh/
Frame ID: E68341A9E2C3752A2F749D0AECA6BB76
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Lucifer

Page URL History Show full URLs

http://lucifer.sh/ HTTP 307
https://lucifer.sh/ Page URL

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

102 kB
Transfer

102 kB
Size

0
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://t.me/OwnerDF
Title: @OwnerDF

Search URL Search Domain Scan URL

URL: https://twitter.com/0x1ucif3r
Title: @0x1ucif3r

Search URL Search Domain Scan URL

URL: https://darkforums.st/User-Lucifer
Title: @Lucifer [UID:1]

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://lucifer.sh/ HTTP 307
https://lucifer.sh/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

200

Primary Request / Show response
lucifer.sh/
Redirect Chain

http://lucifer.sh/
https://lucifer.sh/

2 KB
1 KB

138ms
110ms

Document
text/html

172.67.167.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://lucifer.sh/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.167.240 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ce7c16e272fb47b9ef3173e0c87911d6192d6fa06a1dfab17bc775718b2e3633

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8a9eb8eccdce2c27-FRA
content-encoding: br
content-type: text/html
date: Sat, 27 Jul 2024 18:34:13 GMT
last-modified: Fri, 05 Jul 2024 07:42:24 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BTEbFv2JjMZDrnxideqn4XErh%2BGNGMgD%2BvaRsLBjCaQELI%2BMFCDWErIfF4tP0wqPgEzTKZ7m0Qzy1qOwm%2Bf3SdHOu52wDa6hqT83SB8mgH%2Bz7aRXJe1CFaOxapXR"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-cdn-cache-status: MISS
x-origin-cache-status: MISS
x-provided-by: StackCDN
x-via: FRA1

Redirect headers

Location: https://lucifer.sh/
Non-Authoritative-Reason: HttpsUpgrades

GET
H3 200 logo.png
lucifer.sh/images/ 98 KB
99 KB 167ms
167ms Image
image/png 172.67.167.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lucifer.sh/images/logo.png
Requested by: Host: lucifer.sh
URL: https://lucifer.sh/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.167.240 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3c7525842cd69ebe601412705977f76e9c4490bc848926f9665c8c07a16ebc7c

Request headers

Referer: https://lucifer.sh/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 18:34:14 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-cdn-cache-status: MISS
x-via: FRA1
alt-svc: h3=":443"; ma=86400
content-length: 100522
x-origin-cache-status: MISS
x-provided-by: StackCDN
last-modified: Wed, 18 Oct 2023 16:41:05 GMT
server: cloudflare
etag: "188aa-608004e38f586"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FChrB%2Bs2uxp5IVgPiVh04BUf%2FQEenv1ExVy9krbjWVqbRT4CnmaL78%2Br3zUjhDDn31w20a8ykJNyjUOdxzdPmzUB4XHq1X5RPiCtAD3AIrwL7joTkNF8YlZCI%2Bp8"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 8a9eb8ed8ebe2c27-FRA

GET
H3 200 email-decode.min.js Show response
lucifer.sh/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
1 KB 12ms
12ms Script
application/javascript 172.67.167.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://lucifer.sh/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: lucifer.sh
URL: https://lucifer.sh/

Protocol

H3

Security

QUIC, , AES_128_GCM

Server

172.67.167.240 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://lucifer.sh/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 18:34:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2024 16:35:10 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"669fdbbe-4d7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hn%2BpQm6D%2BnTjCMDLT8BHWZhj%2F3batV5%2FG5pV0Lo%2Bz6PSKgGU7j%2BHKUURRJuVfFVaHr%2B8k6cSHKeG%2FvMBqXrW1wG66ow8cQqNPmrwJNUVJN13XqLbynAPzjqWAnMd"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-frame-options: DENY
cache-control: max-age=172800, public
cf-ray: 8a9eb8ed8ec32c27-FRA
expires: Mon, 29 Jul 2024 18:34:14 GMT

GET
H3 404 favicon.ico
lucifer.sh/ 196 B
645 B 111ms
111ms Other
text/html 172.67.167.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://lucifer.sh/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.167.240 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880

Request headers

Referer: https://lucifer.sh/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Sat, 27 Jul 2024 18:34:14 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-cdn-cache-status: EXPIRED
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OogMhCSRPiCOYTXzwHLMak3oX74LSwr8S5AEu9mvncrjVKIv%2Bq0Rgk%2FB5CaIxnJX3qbpWkaA%2FvthGHCNicZ%2Fu2zOtjzh22QUtG%2B2u0CjjdHfqtN0FGsuX8XeNfzj"}],"group":"cf-nel","max_age":604800}
x-via: FRA1
content-type: text/html; charset=iso-8859-1
cache-control: max-age=14400
cf-ray: 8a9eb8eebfe72c27-FRA
alt-svc: h3=":443"; ma=86400
x-origin-cache-status: EXPIRED

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://lucifer.sh/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

lucifer.sh
172.67.167.240
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
3c7525842cd69ebe601412705977f76e9c4490bc848926f9665c8c07a16ebc7c
80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
ce7c16e272fb47b9ef3173e0c87911d6192d6fa06a1dfab17bc775718b2e3633

lucifer.sh Open in urlscan Pro 172.67.167.240 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

4 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

102 kBTransfer

102 kBSize

0 Cookies

3 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

lucifer.sh Open in urlscan Pro
172.67.167.240 Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

102 kB
Transfer

102 kB
Size

0
Cookies

4 HTTP transactions
0 data transactions