URL: https://llama.mu.nu/
Submission: On June 19 via api from US — Scanned from DE

Summary

This website contacted 3 IPs in 1 countries across 9 domains to perform 16 HTTP transactions. The main IP is 107.155.97.50, located in Dallas, United States and belongs to HVC-AS, US. The main domain is llama.mu.nu.
TLS certificate: Issued by cPanel, Inc. Certification Authority on June 16th 2024. Valid for: 3 months.
This is the only time llama.mu.nu was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
5 107.155.97.50 29802 (HVC-AS)
1 1 151.101.65.21 54113 (FASTLY)
1 151.101.2.133 54113 (FASTLY)
16 3
Apex Domain
Subdomains
Transfer
5 mu.nu
llama.mu.nu
llamabutchers.mu.nu
munuviana.mu.nu Failed
289 KB
1 paypalobjects.com
www.paypalobjects.com — Cisco Umbrella Rank: 2736
2 KB
1 paypal.com
www.paypal.com — Cisco Umbrella Rank: 3002
979 B
0 blogrolling.com Failed
rpc.blogrolling.com Failed
0 statcounter.com Failed
www.statcounter.com Failed
0 devinschumacher.com Failed
devinschumacher.com Failed
0 sitemeter.com Failed
s16.sitemeter.com Failed
0 truthlaidbear.com Failed
www.truthlaidbear.com Failed
0 blogads.com Failed
cache.blogads.com Failed
16 9
Domain Requested by
4 llamabutchers.mu.nu llama.mu.nu
1 www.paypalobjects.com llama.mu.nu
1 www.paypal.com 1 redirects
1 llama.mu.nu
0 rpc.blogrolling.com Failed llama.mu.nu
0 www.statcounter.com Failed llama.mu.nu
0 devinschumacher.com Failed llama.mu.nu
0 s16.sitemeter.com Failed llama.mu.nu
0 www.truthlaidbear.com Failed llama.mu.nu
0 munuviana.mu.nu Failed llama.mu.nu
0 cache.blogads.com Failed llama.mu.nu
16 11
Subject Issuer Validity Valid
llamabutchers.mu.nu
cPanel, Inc. Certification Authority
2024-06-16 -
2024-09-14
3 months crt.sh

This page contains 1 frames:

Primary Page: https://llama.mu.nu/
Frame ID: A9DA9355B0567F441B6057A12E53E44E
Requests: 16 HTTP requests in this frame

Screenshot

Page Title

The LLama Butchers:

Detected technologies

Overall confidence: 100%
Detected patterns
  • <input[^>]+_s-xclick
  • paypalobjects\.com

Page Statistics

16
Requests

31 %
HTTPS

0 %
IPv6

9
Domains

11
Subdomains

3
IPs

1
Countries

291 kB
Transfer

317 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 4
  • https://www.paypal.com/en_US/i/btn/x-click-but21.gif HTTP 301
  • https://www.paypalobjects.com/en_US/i/btn/x-click-but21.gif
Request Chain 11
  • https://www.blogpatrol.com/counter.php?i=5397&r=&n=Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/126.0.0.0%20Safari/537.36&p=Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/126.0.0.0%20Safari/537.36&sd=24&sw=1600x1200 HTTP 301
  • https://devinschumacher.com/

16 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
llama.mu.nu/
38 KB
11 KB
Document
General
Full URL
https://llama.mu.nu/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
107.155.97.50 Dallas, United States, ASN29802 (HVC-AS, US),
Reverse DNS
107-155-97-50-customer-incero.com
Software
Apache /
Resource Hash
17d93d53a603719e0be1177379a638e8ad6b86ef35f3407742aa1a9a4cc380b2

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

Connection
Keep-Alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Wed, 19 Jun 2024 02:30:51 GMT
Keep-Alive
timeout=5, max=100
Server
Apache
Transfer-Encoding
chunked
Vary
Accept-Encoding
apothegm.jpg
llamabutchers.mu.nu/images/
2 KB
3 KB
Image
General
Full URL
https://llamabutchers.mu.nu/images/apothegm.jpg
Requested by
Host: llama.mu.nu
URL: https://llama.mu.nu/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
107.155.97.50 Dallas, United States, ASN29802 (HVC-AS, US),
Reverse DNS
107-155-97-50-customer-incero.com
Software
Apache /
Resource Hash
e576bd5c410010b506cc6fcdeca701a13d0bec710870a10666ac0e13b14f70da

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://llama.mu.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Wed, 19 Jun 2024 02:30:52 GMT
Last-Modified
Sat, 09 Jul 2005 01:37:52 GMT
Server
Apache
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
2540
llama%20logo%20jan%2006.jpg
llamabutchers.mu.nu/archives/
20 KB
20 KB
Image
General
Full URL
https://llamabutchers.mu.nu/archives/llama%20logo%20jan%2006.jpg
Requested by
Host: llama.mu.nu
URL: https://llama.mu.nu/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
107.155.97.50 Dallas, United States, ASN29802 (HVC-AS, US),
Reverse DNS
107-155-97-50-customer-incero.com
Software
Apache /
Resource Hash
6fa2b6e9c1c2379bac9102d3ab62a4b6cd6e9404fbc02fb71e32199444cc2b4f

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://llama.mu.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Wed, 19 Jun 2024 02:30:52 GMT
Last-Modified
Fri, 13 Jan 2006 23:07:38 GMT
Server
Apache
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
19991
LlamaFour.jpg
llamabutchers.mu.nu/
250 KB
251 KB
Image
General
Full URL
https://llamabutchers.mu.nu/LlamaFour.jpg
Requested by
Host: llama.mu.nu
URL: https://llama.mu.nu/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
107.155.97.50 Dallas, United States, ASN29802 (HVC-AS, US),
Reverse DNS
107-155-97-50-customer-incero.com
Software
Apache /
Resource Hash
7b615608f5758f22eb69f0b645972898b6d1d8ab54c321fc0e4a184e348ab3be

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://llama.mu.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Wed, 19 Jun 2024 02:30:52 GMT
Last-Modified
Sun, 11 Jan 2009 18:16:04 GMT
Server
Apache
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
256266
Llama%20Cuppa.jpg
llamabutchers.mu.nu/
4 KB
5 KB
Image
General
Full URL
https://llamabutchers.mu.nu/Llama%20Cuppa.jpg
Requested by
Host: llama.mu.nu
URL: https://llama.mu.nu/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
107.155.97.50 Dallas, United States, ASN29802 (HVC-AS, US),
Reverse DNS
107-155-97-50-customer-incero.com
Software
Apache /
Resource Hash
a710a08656c6883b3ef5f168f34e9b26211e7468cfbe6a89cbbad2b87b17b3f4

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://llama.mu.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Wed, 19 Jun 2024 02:30:52 GMT
Last-Modified
Tue, 06 Dec 2005 18:42:52 GMT
Server
Apache
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
4546
x-click-but21.gif
www.paypalobjects.com/en_US/i/btn/
Redirect Chain
  • https://www.paypal.com/en_US/i/btn/x-click-but21.gif
  • https://www.paypalobjects.com/en_US/i/btn/x-click-but21.gif
2 KB
2 KB
Image
General
Full URL
https://www.paypalobjects.com/en_US/i/btn/x-click-but21.gif
Requested by
Host: llama.mu.nu
URL: https://llama.mu.nu/
Protocol
H2
Server
151.101.2.133 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
aa6b6a4988dec542b2931d1796733bed523970dafd701c440e5c3cf549111b7d
Security Headers
Name Value
Strict-Transport-Security max-age=31557600
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://llama.mu.nu/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Wed, 19 Jun 2024 02:30:52 GMT
via
1.1 varnish, 1.1 varnish
x-content-type-options
nosniff
strict-transport-security
max-age=31557600
fastly-io-served-by
vpop-haf2300712
x-cache
HIT, HIT
fastly-io-info
ifsz=1909 idim=110x23 ifmt=gif ofsz=1909 odim=110x23 ofmt=gif
paypal-debug-id
2944d5a2dcc56
fastly-stats
io=1
dc
ccg11-origin-www-1.paypal.com
content-length
1909
fastly-io-warning
Failed to shrink image
x-served-by
cache-sjc10043-SJC, cache-fra-etou8220044-FRA
traceparent
00-00000000000000000002944d5a2dcc56-9659257013427ef0-01
x-timer
S1718764252.392251,VS0,VE1
etag
"7wW+VrVdy7pRLnPRLrl35kU9Hgap9cx6PFyNLf1/FQU"
content-type
image/gif
cache-control
s-maxage=31536000, public,max-age=3600
accept-ranges
bytes
timing-allow-origin
https://www.paypal.com,https://www.sandbox.paypal.com
x-cache-hits
10307, 0

Redirect headers

date
Wed, 19 Jun 2024 02:30:52 GMT
via
1.1 varnish, 1.1 varnish
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-cache
MISS, MISS
paypal-debug-id
f23298224773f
server-timing
content-encoding;desc="",x-cdn;desc="fastly"
dc
ccg11-origin-www-1.paypal.com
content-length
0
x-served-by
cache-fra-etou8220042-FRA, cache-fra-etou8220042-FRA
accept-ch
Sec-CH-UA-Full
traceparent
00-0000000000000000000f23298224773f-27297c947a5de685-01
x-timer
S1718764252.122951,VS0,VE142
location
https://www.paypalobjects.com/en_US/i/btn/x-click-but21.gif
cache-control
max-age=0, no-cache, no-store, must-revalidate
origin-trial
AlIogV3KFtnbfVCyl9Z2NprE7FD8PYCt+TQiYdE3ppeJjJ0xJKcthYwOxXpRCNopxVWdOIENMcNSvQCGAmj0fw0AAAB2eyJvcmlnaW4iOiJodHRwczovL3BheXBhbC5jb206NDQzIiwiZmVhdHVyZSI6IlNlbmRGdWxsVXNlckFnZW50QWZ0ZXJSZWR1Y3Rpb24iLCJleHBpcnkiOjE2ODQ4ODYzOTksImlzU3ViZG9tYWluIjp0cnVlfQ==
accept-ranges
bytes
x-cache-hits
0, 0
styles-site1.css
llamabutchers.mu.nu/
0
0

feed.css
cache.blogads.com/675785224/
0
0

feed.js
cache.blogads.com/675785224/
0
0

mu.js
munuviana.mu.nu/
0
0

MyDetails.php
www.truthlaidbear.com/
0
0

counter.js
s16.sitemeter.com/js/
0
0

/
devinschumacher.com/
Redirect Chain
  • https://www.blogpatrol.com/counter.php?i=5397&r=&n=Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/126.0.0.0%20Safari/537.3...
  • https://devinschumacher.com/
0
0

counter.js
www.statcounter.com/counter/
0
0

display.php
rpc.blogrolling.com/
0
0

llamalogosmall.gif
llamabutchers.mu.nu/images/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
llamabutchers.mu.nu
URL
http://llamabutchers.mu.nu/styles-site1.css
Domain
cache.blogads.com
URL
http://cache.blogads.com/675785224/feed.css
Domain
cache.blogads.com
URL
http://cache.blogads.com/675785224/feed.js
Domain
munuviana.mu.nu
URL
http://munuviana.mu.nu/mu.js
Domain
www.truthlaidbear.com
URL
http://www.truthlaidbear.com/MyDetails.php?url=http://www.llamabutchers.mu.nu/&style=javascript
Domain
s16.sitemeter.com
URL
http://s16.sitemeter.com/js/counter.js?site=s16LLamaButchers
Domain
devinschumacher.com
URL
https://devinschumacher.com/
Domain
www.statcounter.com
URL
http://www.statcounter.com/counter/counter.js
Domain
rpc.blogrolling.com
URL
http://rpc.blogrolling.com/display.php?r=f5ed4b7eafb4667d34f2061bf4e47b6f
Domain
llamabutchers.mu.nu
URL
http://llamabutchers.mu.nu/images/llamalogosmall.gif

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage function| OpenComments function| OpenTrackback string| site string| data string| p string| agt number| sc_project number| sc_partition

2 Cookies

Domain/Path Name / Value
.paypal.com/ Name: ts
Value: vreXpYrS%3D1813372252%26vteXpYrS%3D1718766052%26vr%3D2e552c241900aa30549b1e1ffe989001%26vt%3D2e552c241900aa30549b1e1ffe989000%26vtyp%3Dnew
.paypal.com/ Name: ts_c
Value: vr%3D2e552c241900aa30549b1e1ffe989001%26vt%3D2e552c241900aa30549b1e1ffe989000

19 Console Messages

Source Level URL
Text
security warning URL: https://llama.mu.nu/
Message:
Mixed Content: The page at 'https://llama.mu.nu/' was loaded over HTTPS, but requested an insecure element 'http://llamabutchers.mu.nu/images/apothegm.jpg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://llama.mu.nu/
Message:
Mixed Content: The page at 'https://llama.mu.nu/' was loaded over HTTPS, but requested an insecure element 'http://llamabutchers.mu.nu/archives/llama%20logo%20jan%2006.jpg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://llama.mu.nu/
Message:
Mixed Content: The page at 'https://llama.mu.nu/' was loaded over HTTPS, but requested an insecure element 'http://llamabutchers.mu.nu/LlamaFour.jpg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://llama.mu.nu/
Message:
Mixed Content: The page at 'https://llama.mu.nu/' was loaded over HTTPS, but requested an insecure element 'http://llamabutchers.mu.nu/Llama%20Cuppa.jpg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security error URL: https://llama.mu.nu/(Line 8)
Message:
Mixed Content: The page at 'https://llama.mu.nu/' was loaded over HTTPS, but requested an insecure stylesheet 'http://llamabutchers.mu.nu/styles-site1.css'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://llama.mu.nu/(Line 80)
Message:
Mixed Content: The page at 'https://llama.mu.nu/' was loaded over HTTPS, but requested an insecure stylesheet 'http://cache.blogads.com/675785224/feed.css'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://llama.mu.nu/
Message:
Mixed Content: The page at 'https://llama.mu.nu/' was loaded over HTTPS, but requested an insecure script 'http://cache.blogads.com/675785224/feed.js'. This request has been blocked; the content must be served over HTTPS.
security warning URL: https://llama.mu.nu/(Line 95)
Message:
Mixed Content: The page at 'https://llama.mu.nu/' was loaded over a secure connection, but contains a form that targets an insecure endpoint 'http://blog2.mu.nu/cgi/mt-search.cgi'. This endpoint should be made available over a secure connection.
security warning URL: https://llama.mu.nu/(Line 207)
Message:
Mixed Content: The page at 'https://llama.mu.nu/' was loaded over HTTPS, but requested an insecure element 'http://llamabutchers.mu.nu/images/apothegm.jpg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security error URL: https://llama.mu.nu/
Message:
Mixed Content: The page at 'https://llama.mu.nu/' was loaded over HTTPS, but requested an insecure script 'http://munuviana.mu.nu/mu.js'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://llama.mu.nu/
Message:
Mixed Content: The page at 'https://llama.mu.nu/' was loaded over HTTPS, but requested an insecure script 'http://www.truthlaidbear.com/MyDetails.php?url=http://www.llamabutchers.mu.nu/&style=javascript'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://llama.mu.nu/
Message:
Mixed Content: The page at 'https://llama.mu.nu/' was loaded over HTTPS, but requested an insecure script 'http://s16.sitemeter.com/js/counter.js?site=s16LLamaButchers'. This request has been blocked; the content must be served over HTTPS.
security warning URL: https://llama.mu.nu/
Message:
Mixed Content: The page at 'https://llama.mu.nu/' was loaded over HTTPS, but requested an insecure element 'http://www.blogpatrol.com/counter.php?i=5397&r=&n=Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/126.0.0.0%20Safari/537.36&p=Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/126.0.0.0%20Safari/537.36&sd=24&sw=1600x1200'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security error URL: https://llama.mu.nu/
Message:
Mixed Content: The page at 'https://llama.mu.nu/' was loaded over HTTPS, but requested an insecure script 'http://www.statcounter.com/counter/counter.js'. This request has been blocked; the content must be served over HTTPS.
security warning URL: https://llama.mu.nu/(Line 669)
Message:
Mixed Content: The page at 'https://llama.mu.nu/' was loaded over HTTPS, but requested an insecure element 'http://llamabutchers.mu.nu/archives/llama%20logo%20jan%2006.jpg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://llama.mu.nu/(Line 669)
Message:
Mixed Content: The page at 'https://llama.mu.nu/' was loaded over HTTPS, but requested an insecure element 'http://llamabutchers.mu.nu/LlamaFour.jpg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://llama.mu.nu/(Line 669)
Message:
Mixed Content: The page at 'https://llama.mu.nu/' was loaded over HTTPS, but requested an insecure element 'http://llamabutchers.mu.nu/Llama%20Cuppa.jpg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security error URL: https://llama.mu.nu/
Message:
Mixed Content: The page at 'https://llama.mu.nu/' was loaded over HTTPS, but requested an insecure script 'http://rpc.blogrolling.com/display.php?r=f5ed4b7eafb4667d34f2061bf4e47b6f'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://llama.mu.nu/
Message:
Mixed Content: The page at 'https://llama.mu.nu/' was loaded over HTTPS, but requested an insecure favicon 'http://llamabutchers.mu.nu/images/llamalogosmall.gif'. This request has been blocked; the content must be served over HTTPS.