thatwitchremains.com Open in urlscan Pro
172.67.129.135 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://thatwitchremains.com/
Submission Tags: phishingrod
Submission: On May 16 via api (May 16th 2024, 4:30:37 am UTC) from DE — Scanned from DE

Summary HTTP 16 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 16 HTTP transactions. The main IP is 172.67.129.135, located in United States and belongs to CLOUDFLARENET, US. The main domain is thatwitchremains.com.
TLS certificate: Issued by E1 on April 30th 2024. Valid for: 3 months.

This is the only time thatwitchremains.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
10	172.67.129.135 172.67.129.135	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2606:4700::68... 2606:4700::6810:5049	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:81c::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82f::2003	15169 (GOOGLE) (GOOGLE)
16	4

10 172.67.129.135 (United States)

ASN13335 (CLOUDFLARENET, US)

thatwitchremains.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6810:5049 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81c::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	thatwitchremains.com thatwitchremains.com	454 KB
3	cloudflareinsights.com static.cloudflareinsights.com — Cisco Umbrella Rank: 804 cloudflareinsights.com — Cisco Umbrella Rank: 791	7 KB
2	gstatic.com fonts.gstatic.com	81 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 33	2 KB
16	4

	Domain	Requested by
10	thatwitchremains.com	thatwitchremains.com
2	cloudflareinsights.com	static.cloudflareinsights.com
2	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	thatwitchremains.com
1	static.cloudflareinsights.com	thatwitchremains.com
16	5

This site contains links to these domains. Also see Links.

Domain
www.instagram.com
twitter.com
www.reddit.com
html5up.net

Subject Issuer	Validity	Valid
thatwitchremains.com E1	`2024-04-30` - `2024-07-29`	3 months	crt.sh
cloudflareinsights.com GTS CA 1P5	`2024-05-08` - `2024-08-06`	3 months	crt.sh
upload.video.google.com WR2	`2024-05-06` - `2024-07-29`	3 months	crt.sh
*.gstatic.com WR2	`2024-05-06` - `2024-07-29`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://thatwitchremains.com/
Frame ID: 3D77F22A31DA7D4C470EBFDD049E7A5E
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

that witch remains

Detected technologies

Cloudflare Browser Insights (Analytics) Expand

Overall confidence: 100%
Detected patterns

static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

googleapis\.com/.+webfont

Page Statistics

16
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

5
Subdomains

4
IPs

2
Countries

544 kB
Transfer

608 kB
Size

0
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://www.instagram.com/that_witch_remains
Title: Instagram

Search URL Search Domain Scan URL

URL: https://twitter.com/that_witch_rmns
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.reddit.com/user/that_witch_remains
Title: Reddit

Search URL Search Domain Scan URL

URL: https://html5up.net/
Title: HTML5 UP

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 Primary Request / Show response
thatwitchremains.com/ 7 KB
2 KB 84ms
41ms Document
text/html 172.67.129.135
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://thatwitchremains.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.129.135 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

10485d59d19e91ad8ce51f5a1c4e4604ddedf950c59c5ded816aa3f024438b0f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=0, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 8848a20e4bf2901c-FRA
content-encoding: br
content-type: text/html; charset=utf-8
date: Thu, 16 May 2024 04:30:32 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=80aKbfYkTVVeOAgrc1XtUqt6ZJjb%2FDG%2BA4R6l4zK4YRMaFVskyjpbzMvl3KDRr7OklB7QkDo75T3iHzRJucYQkjusv%2FVnv33EJdAEjZ2VYegRjtgYsEGwCe3DMtD5JJ9PDjER3wmCw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-content-type-options: nosniff

GET
H3 200 _slug_.pzX6X_ga.css
thatwitchremains.com/_astro/ 18 KB
5 KB 98ms
98ms Stylesheet
text/css 172.67.129.135
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://thatwitchremains.com/_astro/_slug_.pzX6X_ga.css

Requested by

Host: thatwitchremains.com
URL: https://thatwitchremains.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.129.135 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d7fb27041fb19d1448dc40326b7c7ff6a7fba70127d4e28e33e88a1efc38678a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://thatwitchremains.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 16 May 2024 04:30:32 GMT
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-cache-status: MISS
etag: W/"6a6dd2ab1462b66ea5df4c3809627d25"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7bQRsBY1C3PNqmx847ypNLY2gAu1nWxoKqdQZ%2BqIpMdWuSgwVKaaLGfOmD9GABkA6lo7kPu6NkbaiL7AGPowMfFFug50JduubNlvvIHJjbkao9Ne0wu8OWGFKfQLTi3xaxbK0XEoEQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=14400, must-revalidate
cf-ray: 8848a20e9c20901c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 index.pU7Z7CtE.css
thatwitchremains.com/_astro/ 9 KB
3 KB 85ms
84ms Stylesheet
text/css 172.67.129.135
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://thatwitchremains.com/_astro/index.pU7Z7CtE.css

Requested by

Host: thatwitchremains.com
URL: https://thatwitchremains.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.129.135 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2dbbf73bee47878d65c437d5a1d5e55667ca539ac35ca9f23d2fc21124f6b759

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://thatwitchremains.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 16 May 2024 04:30:32 GMT
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-cache-status: MISS
etag: W/"06546fcd61c774001896599241d031ed"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GezYRjIkVtIyYen6l%2BrYgZRDBCDfDu4K5i8nmBh0ybTInFpK2WHedBwYHSHwPQ4vQ0kvWF1avy9gH%2BYy%2Fw9oZtaEWxDWUv9bSJtWK85zUHaIf9yC1qGEfAjJZIxEy92WTZJdL3TtOw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=14400, must-revalidate
cf-ray: 8848a20e9c22901c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 index.B2FgkhE3.css
thatwitchremains.com/_astro/ 10 KB
3 KB 98ms
98ms Stylesheet
text/css 172.67.129.135
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://thatwitchremains.com/_astro/index.B2FgkhE3.css

Requested by

Host: thatwitchremains.com
URL: https://thatwitchremains.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.129.135 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4f05ba025db87e3631808ad27cd4a27d1fe52037819ca78d468e6f38c86e2db8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://thatwitchremains.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 16 May 2024 04:30:32 GMT
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-cache-status: MISS
etag: W/"4945d5e2627687597e71d818814f657d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ic0ZYdfrG670U7ELj14%2BmD0A2f3h7jYtQOz7HcTPuV0YABR8fssrHdL9%2F0mbhoD0fTeWYk%2BzpE%2FhJPrQM7HW5E%2FW1lZEkCgA3lapStNVfra396H4uhWi9B4OZavGX9cPy6miHJvqRg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=14400, must-revalidate
cf-ray: 8848a20e9c23901c-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 sun-halo-sm.webp
thatwitchremains.com/images/ 126 KB
127 KB 89ms
88ms Image
image/webp 172.67.129.135
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://thatwitchremains.com/images/sun-halo-sm.webp

Requested by

Host: thatwitchremains.com
URL: https://thatwitchremains.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.129.135 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9c7c4bf23e27d0fb294604cf2b10dc908b8c3cb25e5a693befcaeee45cd48000

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://thatwitchremains.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 16 May 2024 04:30:32 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 129140
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: "be2818df150bf0169dcd2eab0668e5d2"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P5x%2BfcdvLgyA65hIEF%2FFvZYjOGg4kNgu%2BU7ypnTvjQZXqNzicrkRTlM9XBYkoKVF%2BsRtsbxiJLAOqdwPRKDtcdOdmH877jpcdcK54iMzd%2FSN5U5DCNbk%2Fc9uF0QpwV64Ib%2F4DxRRoQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=14400, must-revalidate
accept-ranges: bytes
cf-ray: 8848a20e9c26901c-FRA

GET
H3 200 the-fool-sm.webp
thatwitchremains.com/images/ 10 KB
10 KB 79ms
78ms Image
image/webp 172.67.129.135
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://thatwitchremains.com/images/the-fool-sm.webp

Requested by

Host: thatwitchremains.com
URL: https://thatwitchremains.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.129.135 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

55dee11f5b196a10900f3136dcb2d6cb6aa0b79f4b3946711e141c94e05b5284

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://thatwitchremains.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 16 May 2024 04:30:32 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 9828
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: "349552c5c57200121dd5a5798f3622b9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3R00Cpw9ci5d3oVAfBFDfxw7fwrzlUjUyHYZLrUUIHs3qmxJAnm7frHtoqYBk7SsYS63Ck31cBRkI7ol41ykTSWMcoJ2H1%2Ffhi%2BRhxzU%2FLn6GL3H7BX6jIst8nxfZrEQaVojRLtgrw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=14400, must-revalidate
accept-ranges: bytes
cf-ray: 8848a20e9c27901c-FRA

GET
H3 200 models-sm.webp
thatwitchremains.com/images/ 33 KB
34 KB 89ms
88ms Image
image/webp 172.67.129.135
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://thatwitchremains.com/images/models-sm.webp

Requested by

Host: thatwitchremains.com
URL: https://thatwitchremains.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.129.135 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f98b9ee0ebb0e038548ffb21ada0457c8f2f4c9862b3dba5eb9dade62fd61619

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://thatwitchremains.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 16 May 2024 04:30:32 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 33788
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: "b7f1f563d1dbd3286e5116a3038c1f49"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m4teSZewhpcbHo03%2Bzn3AWPU33C%2ByOowwahrQfHtb6URGE9YTytJ16Eqt8KZVJJR0Yau8sB8myx61Spo351MPfoh83xGrsnqydVUGRSYAFASImL%2BMqpFG%2FCvSV3bnQf5RoXS2ustAQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=14400, must-revalidate
accept-ranges: bytes
cf-ray: 8848a20ebc36901c-FRA

GET
H2 200 beacon.min.js Show response
static.cloudflareinsights.com/ 19 KB
7 KB 57ms
38ms Script
text/javascript 2606:4700::6810:5049
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js
Requested by: Host: thatwitchremains.com
URL: https://thatwitchremains.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5049 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f9eb189676a78d42d7a8487eef683702ada6c5c866399eefbc0df319d5f7c6d7

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://thatwitchremains.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 16 May 2024 04:30:32 GMT
content-encoding: gzip
last-modified: Mon, 06 May 2024 19:01:13 GMT
server: cloudflare
etag: W/"2024.5.0"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 8848a20ec897693d-FRA

GET
H2 200 css
fonts.googleapis.com/ 26 KB
2 KB 38ms
16ms Stylesheet
text/css 2a00:1450:4001:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:400,600,400italic,600italic|Roboto+Slab:400,700

Requested by

Host: thatwitchremains.com
URL: https://thatwitchremains.com/_astro/index.pU7Z7CtE.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ddd92d3982369d8e28712bd0a2cb09d961f915db768d794f58fafe2e54026e4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://thatwitchremains.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Thu, 16 May 2024 04:30:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 16 May 2024 04:06:02 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 16 May 2024 04:30:32 GMT

GET
H2 200 BngMUXZYTXPIvIBgJJSb6ufN5qU.woff2
fonts.gstatic.com/s/robotoslab/v34/ 34 KB
34 KB 38ms
15ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/robotoslab/v34/BngMUXZYTXPIvIBgJJSb6ufN5qU.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400,600,400italic,600italic|Roboto+Slab:400,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a8e429611131e3fdc2018ec943a36100dbabb4aaa788c8dead6bdcf927917293

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://fonts.googleapis.com/
Origin: https://thatwitchremains.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 14 May 2024 02:18:32 GMT
x-content-type-options: nosniff
age: 180720
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34328
x-xss-protection: 0
last-modified: Tue, 24 Oct 2023 01:54:50 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 14 May 2025 02:18:32 GMT

GET
H3 200 fa-brands-400.woff2
thatwitchremains.com/webfonts/ 115 KB
115 KB 96ms
95ms Font
font/woff2 172.67.129.135
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://thatwitchremains.com/webfonts/fa-brands-400.woff2

Requested by

Host: thatwitchremains.com
URL: https://thatwitchremains.com/_astro/_slug_.pzX6X_ga.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.129.135 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3a8924cd5203a28628716aedb5cef0943da4c3b44e3ffcee90ab06387b41c490

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://thatwitchremains.com/_astro/_slug_.pzX6X_ga.css
Origin: https://thatwitchremains.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 16 May 2024 04:30:32 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 117372
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: "ad3469c79417f091df7a4edb62632afb"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9DxsHjxt%2FeQR50V6BR%2BwXmc2zdWYjMSoMp3I6%2BdWOKXyL7%2Bw8bH%2FOpZtYu2cOnk78hMChmzk9LbxX3nEmxN1hBsOIMvmsayHxzTn1N%2BrQ%2BZJxZQO%2Bt9AoXCy4rHvkdDQXj01u5DMww%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=14400, must-revalidate
accept-ranges: bytes
cf-ray: 8848a20f9cbf901c-FRA

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ 47 KB
48 KB 30ms
7ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400,600,400italic,600italic|Roboto+Slab:400,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://fonts.googleapis.com/
Origin: https://thatwitchremains.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 10 May 2024 22:45:56 GMT
x-content-type-options: nosniff
age: 452676
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48236
x-xss-protection: 0
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 10 May 2025 22:45:56 GMT

GET
H3 200 fa-solid-900.woff2
thatwitchremains.com/webfonts/ 153 KB
153 KB 89ms
88ms Font
font/woff2 172.67.129.135
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://thatwitchremains.com/webfonts/fa-solid-900.woff2

Requested by

Host: thatwitchremains.com
URL: https://thatwitchremains.com/_astro/_slug_.pzX6X_ga.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.129.135 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9fc85f3a4544ab0d570c7f8f9bbb88db8d92c359b2707580ea8b07c75673eae2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://thatwitchremains.com/_astro/_slug_.pzX6X_ga.css
Origin: https://thatwitchremains.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 16 May 2024 04:30:32 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 156496
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: "3575caffe06465d0e78a37f4957e77ef"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9kunJiX7atdS%2BdBPerb3e4MkC0GCsa6oeTi3EUGkkTWe4C5OQN51QboRssNfflB2hsXSHwGGMrg8FgDoy0%2FbiK%2FOkE%2B3jhhzcbMgSGSiNSop5gXvX3lej42PHHqSAEI1Otg6VWeFow%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=14400, must-revalidate
accept-ranges: bytes
cf-ray: 8848a20f9cc0901c-FRA

POST
H2 204 rum Show response
cloudflareinsights.com/cdn-cgi/ 0
37 B 12ms
11ms XHR
text/plain 2606:4700::6810:5049
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cloudflareinsights.com/cdn-cgi/rum

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5049 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-platform: "Win32"
Referer: https://thatwitchremains.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
content-type: application/json

Response headers

date: Thu, 16 May 2024 04:30:33 GMT
x-content-type-options: nosniff
server: cloudflare
vary: Origin
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://thatwitchremains.com
x-frame-options: DENY
access-control-allow-credentials: true
cf-ray: 8848a2107c6e37cb-FRA

OPTIONS
H2 200 rum
cloudflareinsights.com/cdn-cgi/ 0
0 35ms
9ms Preflight
text/plain 2606:4700::6810:5049
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cloudflareinsights.com/cdn-cgi/rum

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5049 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://thatwitchremains.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://thatwitchremains.com
access-control-max-age: 86400
cf-ray: 8848a2106c6137cb-FRA
content-encoding: gzip
content-type: text/plain
date: Thu, 16 May 2024 04:30:33 GMT
server: cloudflare
vary: Origin
x-content-type-options: nosniff
x-frame-options: DENY

GET
H3 200 favicon-32x32.png
thatwitchremains.com/ 880 B
1 KB 80ms
79ms Other
image/png 172.67.129.135
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://thatwitchremains.com/favicon-32x32.png

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.129.135 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ea31e6b9b10b7debac887d563406393074f92163165ff0c324d660578eeda452

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://thatwitchremains.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 16 May 2024 04:30:33 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 880
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: "b08aafed8f080f7e0212c4b9860a5ac3"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FRnYSGJ9b7GUDoLxRQHu527pZ2NzgNd%2BOuNGc5egs1SR%2B8Dm4cbs8fYDLWJvUre4D%2FuTQMXVrBSSkIHeSfyyB5cJ1VDtTE8q%2F9v28tQuN7tJ2wP1%2Bo6QcS7l%2Bmp%2FNuzffW2u%2FBOROA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=14400, must-revalidate
accept-ranges: bytes
cf-ray: 8848a2104d30901c-FRA

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| __cfBeacon

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cloudflareinsights.com
fonts.googleapis.com
fonts.gstatic.com
static.cloudflareinsights.com
thatwitchremains.com
172.67.129.135
2606:4700::6810:5049
2a00:1450:4001:81c::200a
2a00:1450:4001:82f::2003
10485d59d19e91ad8ce51f5a1c4e4604ddedf950c59c5ded816aa3f024438b0f
2dbbf73bee47878d65c437d5a1d5e55667ca539ac35ca9f23d2fc21124f6b759
3a8924cd5203a28628716aedb5cef0943da4c3b44e3ffcee90ab06387b41c490
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
4f05ba025db87e3631808ad27cd4a27d1fe52037819ca78d468e6f38c86e2db8
55dee11f5b196a10900f3136dcb2d6cb6aa0b79f4b3946711e141c94e05b5284
9c7c4bf23e27d0fb294604cf2b10dc908b8c3cb25e5a693befcaeee45cd48000
9fc85f3a4544ab0d570c7f8f9bbb88db8d92c359b2707580ea8b07c75673eae2
a8e429611131e3fdc2018ec943a36100dbabb4aaa788c8dead6bdcf927917293
d7fb27041fb19d1448dc40326b7c7ff6a7fba70127d4e28e33e88a1efc38678a
ddd92d3982369d8e28712bd0a2cb09d961f915db768d794f58fafe2e54026e4d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea31e6b9b10b7debac887d563406393074f92163165ff0c324d660578eeda452
f98b9ee0ebb0e038548ffb21ada0457c8f2f4c9862b3dba5eb9dade62fd61619
f9eb189676a78d42d7a8487eef683702ada6c5c866399eefbc0df319d5f7c6d7

thatwitchremains.com Open in urlscan Pro 172.67.129.135 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

16 Requests

100 %HTTPS

75 %IPv6

4 Domains

5 Subdomains

4 IPs

2 Countries

544 kBTransfer

608 kBSize

0 Cookies

4 Outgoing links

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

0 Cookies

Security Headers

Indicators

thatwitchremains.com Open in urlscan Pro
172.67.129.135 Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

5
Subdomains

4
IPs

2
Countries

544 kB
Transfer

608 kB
Size

0
Cookies

16 HTTP transactions
0 data transactions