Submitted URL: http://redirexccel.pages.dev/?e=e.d*****@k***********.de
Effective URL: https://slender-dashing-ping.glitch.me/idiv3/view/download/files.html?e=e.d*****@k***********.de
Submission: On May 18 via api from US — Scanned from DE

Summary

This website contacted 5 IPs in 3 countries across 5 domains to perform 9 HTTP transactions. The main IP is 34.226.10.36, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is slender-dashing-ping.glitch.me.
TLS certificate: Issued by Amazon RSA 2048 M03 on December 4th 2023. Valid for: a year.
This is the only time slender-dashing-ping.glitch.me was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 172.66.44.215 13335 (CLOUDFLAR...)
2 34.226.10.36 14618 (AMAZON-AES)
3 2a04:4e42:200... 54113 (FASTLY)
1 104.17.25.14 13335 (CLOUDFLAR...)
2 162.19.58.158 16276 (OVH)
9 5
Apex Domain
Subdomains
Transfer
3 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 310
73 KB
2 ibb.co
i.ibb.co — Cisco Umbrella Rank: 10971
105 KB
2 glitch.me
slender-dashing-ping.glitch.me
14 KB
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 237
11 KB
1 pages.dev
redirexccel.pages.dev
704 B
9 5
Domain Requested by
3 cdn.jsdelivr.net slender-dashing-ping.glitch.me
2 i.ibb.co slender-dashing-ping.glitch.me
2 slender-dashing-ping.glitch.me redirexccel.pages.dev
slender-dashing-ping.glitch.me
1 cdnjs.cloudflare.com slender-dashing-ping.glitch.me
1 redirexccel.pages.dev
9 5

This site contains no links.

Subject Issuer Validity Valid
redirexccel.pages.dev
GTS CA 1P5
2024-04-29 -
2024-07-28
3 months crt.sh
glitch.com
Amazon RSA 2048 M03
2023-12-04 -
2025-01-01
a year crt.sh
jsdelivr.net
GlobalSign Atlas R3 DV TLS CA 2023 Q3
2023-09-27 -
2024-10-28
a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2023-07-03 -
2024-07-02
a year crt.sh
ibb.co
R3
2024-04-22 -
2024-07-21
3 months crt.sh

This page contains 1 frames:

Primary Page: https://slender-dashing-ping.glitch.me/idiv3/view/download/files.html?e=e.d*****@k***********.de
Frame ID: 70F617DB2CDE944142061718ECEAF140
Requests: 9 HTTP requests in this frame

Screenshot

Page Title

Secure XLSX Portal

Page URL History Show full URLs

  1. http://redirexccel.pages.dev/?e=e.d*****@k***********.de HTTP 307
    https://redirexccel.pages.dev/?e=e.d*****@k***********.de Page URL
  2. https://slender-dashing-ping.glitch.me/idiv3/view/download/files.html?e=e.d*****@k***********.de Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns
  • <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
  • //cdn\.jsdelivr\.net/

Page Statistics

9
Requests

100 %
HTTPS

20 %
IPv6

5
Domains

5
Subdomains

5
IPs

3
Countries

204 kB
Transfer

590 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://redirexccel.pages.dev/?e=e.d*****@k***********.de HTTP 307
    https://redirexccel.pages.dev/?e=e.d*****@k***********.de Page URL
  2. https://slender-dashing-ping.glitch.me/idiv3/view/download/files.html?e=e.d*****@k***********.de Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://redirexccel.pages.dev/?e=e.d*****@k***********.de HTTP 307
  • https://redirexccel.pages.dev/?e=e.d*****@k***********.de

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
redirexccel.pages.dev/
Redirect Chain
  • http://redirexccel.pages.dev/?e=e.d*****@k***********.de
  • https://redirexccel.pages.dev/?e=e.d*****@k***********.de
262 B
704 B
Document
General
Full URL
https://redirexccel.pages.dev/?e=e.d*****@k***********.de
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.44.215 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
cache-control
public, max-age=0, must-revalidate
cf-ray
885ed4093e0e349e-WAW
content-encoding
br
content-type
text/html; charset=utf-8
date
Sat, 18 May 2024 21:09:26 GMT
etag
W/"f664adc4a602c7ac2ed5fff3c521892c"
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=joRjMbSN8BR6%2FlEKetrN5sTDXQtvX2qrdZBXBrQFHXs%2B7Pxr2EDzJGZ0leFbmc0EqTcOPdvV0gnUZzFzITribeor7Kz1MaxuWE%2FLJNDgGCUKJlBTm7z%2BKwzxKZwJ8jLCWo%2BEi%2BuPSTE%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-content-type-options
nosniff

Redirect headers

Cross-Origin-Resource-Policy
Cross-Origin
Location
https://redirexccel.pages.dev/?e=e.d*****@k***********.de
Non-Authoritative-Reason
HSTS
Primary Request files.html
slender-dashing-ping.glitch.me/idiv3/view/download/
10 KB
11 KB
Document
General
Full URL
https://slender-dashing-ping.glitch.me/idiv3/view/download/files.html?e=e.d*****@k***********.de
Requested by
Host: redirexccel.pages.dev
URL: https://redirexccel.pages.dev/?e=e.d*****@k***********.de
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.226.10.36 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-226-10-36.compute-1.amazonaws.com
Software
AmazonS3 /
Resource Hash
d94eee1d1ee8b9b7141f61be9d6cbbe626bb61c8b80c63dadc6ed68d4c816694

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://redirexccel.pages.dev/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

accept-ranges
bytes
cache-control
no-cache
content-length
10423
content-type
text/html; charset=utf-8
date
Sat, 18 May 2024 21:09:27 GMT
etag
"32b0ed471dd02e7bcb27d8c667fa125c"
last-modified
Sat, 27 Apr 2024 13:40:19 GMT
server
AmazonS3
x-amz-id-2
W8/IgVwgAMOjjAyKpKgr3iFF2COu1kpK0iilnVsjZ5+o9f8lhosSX9PZ9n0nmby35NFMf0bJzXQ=
x-amz-request-id
VAQ709355AMS9BZE
x-amz-server-side-encryption
AES256
x-amz-version-id
60hUqAN.IV4fBVF5t4Xy5EiHEtpCu0G.
bootstrap.min.css
cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/
227 KB
34 KB
Stylesheet
General
Full URL
https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css
Requested by
Host: slender-dashing-ping.glitch.me
URL: https://slender-dashing-ping.glitch.me/idiv3/view/download/files.html?e=e.d*****@k***********.de
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
7f1d37f0d90b6385354c2ac10e2bb91563c46bd7a266ed351222ebcac8496c2a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://slender-dashing-ping.glitch.me/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Sat, 18 May 2024 21:09:27 GMT
x-content-type-options
nosniff
content-encoding
br
age
3698125
x-jsd-version
5.3.0
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
34860
x-served-by
cache-fra-eddf8230088-FRA, cache-cph2320041-CPH
x-jsd-version-type
version
etag
W/"38dd2-sjFlHg/Wi72HWBifvTZCxGLTT6Y"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
remixicon.css
cdn.jsdelivr.net/npm/remixicon@2.5.0/fonts/
108 KB
14 KB
Stylesheet
General
Full URL
https://cdn.jsdelivr.net/npm/remixicon@2.5.0/fonts/remixicon.css
Requested by
Host: slender-dashing-ping.glitch.me
URL: https://slender-dashing-ping.glitch.me/idiv3/view/download/files.html?e=e.d*****@k***********.de
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
13e29a29baade86f4e7a88d8e076d6a6f3ac8950757b50a0f8bbea1c33658d5c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://slender-dashing-ping.glitch.me/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Sat, 18 May 2024 21:09:27 GMT
x-content-type-options
nosniff
content-encoding
br
age
6365923
x-jsd-version
2.5.0
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
13745
x-served-by
cache-fra-eddf8230041-FRA, cache-cph2320041-CPH
x-jsd-version-type
version
etag
W/"1af66-MA7aTWKCoG0FYjklj9PTw0TfSFM"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/
58 KB
11 KB
Stylesheet
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.15.3/css/all.min.css
Requested by
Host: slender-dashing-ping.glitch.me
URL: https://slender-dashing-ping.glitch.me/idiv3/view/download/files.html?e=e.d*****@k***********.de
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d87ddf917b7a1449ab45e2b8e3c98354629bdd65b6659c37e6023bbea1ce1386
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://slender-dashing-ping.glitch.me/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 18 May 2024 21:09:27 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security
max-age=15780000
age
73631
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
10482
last-modified
Sat, 06 Jan 2024 21:52:53 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"6599bda5-28f2"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=17BWowuRj4GDqZKuGSsMU89%2BkKC4TKWEqgzRWgiMBDmNet3ljE%2FYg%2FM4MdoV9hfWoX5B8Y5Un3H6y%2BtvY6mPKgkaeKCshfczTQDs9hdoJWC6SNVycYRB6Cij2lEG3aJ6W20l6V1i"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
timing-allow-origin
*
cf-ray
885ed40eeab52bf1-FRA
expires
Thu, 08 May 2025 21:09:27 GMT
test2.png
slender-dashing-ping.glitch.me/idiv3/view/download/
4 KB
4 KB
Image
General
Full URL
https://slender-dashing-ping.glitch.me/idiv3/view/download/test2.png
Requested by
Host: slender-dashing-ping.glitch.me
URL: https://slender-dashing-ping.glitch.me/idiv3/view/download/files.html?e=e.d*****@k***********.de
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.226.10.36 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-226-10-36.compute-1.amazonaws.com
Software
/
Resource Hash
2784f6ffefbd5fcae302d112e1629907deed1e36f9c2050ea6d7038eec3f649c

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://slender-dashing-ping.glitch.me/idiv3/view/download/files.html?e=e.d*****@k***********.de
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 18 May 2024 21:09:27 GMT
cache-control
max-age=0
content-length
3674
bootstrap.bundle.min.js
cdn.jsdelivr.net/npm/bootstrap@5.3.2/dist/js/
79 KB
25 KB
Script
General
Full URL
https://cdn.jsdelivr.net/npm/bootstrap@5.3.2/dist/js/bootstrap.bundle.min.js
Requested by
Host: slender-dashing-ping.glitch.me
URL: https://slender-dashing-ping.glitch.me/idiv3/view/download/files.html?e=e.d*****@k***********.de
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:200::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
82f64f62bb03c1bc1824b0f9c9e05f70dba33e146818e63cdf5c306c8cf3dedd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://slender-dashing-ping.glitch.me/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Sat, 18 May 2024 21:09:27 GMT
x-content-type-options
nosniff
content-encoding
br
age
3536700
x-jsd-version
5.3.2
x-cache
HIT, HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
25109
x-served-by
cache-fra-etou8220085-FRA, cache-cph2320041-CPH
x-jsd-version-type
version
etag
W/"13b17-9/0PPchLLPk7+B6DJQWmc/NU4KM"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
excelbg2.png
i.ibb.co/S7zzdKk/
103 KB
104 KB
Image
General
Full URL
https://i.ibb.co/S7zzdKk/excelbg2.png
Requested by
Host: slender-dashing-ping.glitch.me
URL: https://slender-dashing-ping.glitch.me/idiv3/view/download/files.html?e=e.d*****@k***********.de
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.19.58.158 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3096590.ip-162-19-58.eu
Software
nginx /
Resource Hash
d61a73620c16246d64fee2a20c06cd693870dcf2988c6031e2a475c2a5b8b693

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://slender-dashing-ping.glitch.me/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 18 May 2024 21:09:27 GMT
last-modified
Sun, 18 Feb 2024 15:58:33 GMT
server
nginx
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
105653
expires
Thu, 31 Dec 2037 23:55:55 GMT
favicon.png
i.ibb.co/C6jbTMK/
1 KB
1 KB
Other
General
Full URL
https://i.ibb.co/C6jbTMK/favicon.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.19.58.158 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3096590.ip-162-19-58.eu
Software
nginx /
Resource Hash
547e4aacd847ed33fa70ce0aecfff58f89eade3bdc380a1be88ab972f81d3a44

Request headers

sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
https://slender-dashing-ping.glitch.me/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Sat, 18 May 2024 21:09:28 GMT
last-modified
Sun, 18 Feb 2024 16:11:24 GMT
server
nginx
access-control-allow-methods
GET, OPTIONS
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
1260
expires
Thu, 31 Dec 2037 23:55:55 GMT

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

number| uidEvent object| bootstrap function| emailIsValid function| displayError

0 Cookies

2 Console Messages

Source Level URL
Text
network error URL: https://slender-dashing-ping.glitch.me/idiv3/view/download/test2.png
Message:
Failed to load resource: the server responded with a status of 404 ()
recommendation verbose URL: https://slender-dashing-ping.glitch.me/idiv3/view/download/files.html?e=e.d*****@k***********.de
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff