www.nih.gov
2606:4700:78::90:0:183  Public Scan Open in urlscan Pro

Internal
urlscan.io (IP) urlscan.io (Domain)
Effective Hostname
VirusTotal SecurityTrails crt.sh
Submitted URL
Google Safe Browsing Archive.org
Effective URL Pivot
Google Safe Browsing Archive.org
Effective IP
VirusTotal SecurityTrails Domaintools Censys
Go To Rescan
Add Verdict Report
Submitted URL:
http://www.nih.gov/ 11yr old
Effective URL:
https://www.nih.gov/ 11yr old
Submission: On June 15 via api (June 15th 2026, 6:36:09 pm UTC) from CA — Scanned from DE
Summary HTTP 19 Redirects Links 2  Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 19 HTTP transactions. The main IP is 2606:4700:78::90:0:183, located in and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is www.nih.gov. The Cisco Umbrella rank of the primary domain is 435780. 11yr old
TLS certificate: Issued by E8 on May 27th 2026. Valid for: 3mo.
This is the only time www.nih.gov was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
11 2606:4700:78:... 2606:4700:78::90:0:183 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
4 2606:4700::68... 2606:4700::6812:5f29 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
19 3
Apex Domain
Subdomains		 Transfer
11 nih.gov
www.nih.gov — Cisco Umbrella Rank: 435780 11yr old
194 KB
4 cloudflare.com
challenges.cloudflare.com — Cisco Umbrella Rank: 1225 5yr old
21 KB
19 2
Domain Requested by
11 www.nih.gov www.nih.gov
4 challenges.cloudflare.com www.nih.gov
challenges.cloudflare.com
19 2

This site contains links to these domains. Also see Links.

Domain
www.cloudflare.com
Subject Issuer Validity Valid
nih.gov
E8		 2026-05-27 -
2026-08-25		 3mo crt.sh
challenges.cloudflare.com
WE1		 2026-04-18 -
2026-07-17		 3mo crt.sh

This page contains 3 frames:

Primary Page: https://www.nih.gov/
Frame ID: D5FA7D0787CD70408CFBCCF9E347CDD1
Requests: 17 HTTP requests in this frame

Frame: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/f/ov2/av0/rch/kpq92/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal?lang=auto
Frame ID: 66A6E0468E9C729B38626A0588C7F0B1
Requests: 1 HTTP requests in this frame

Frame: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/f/ov2/av0/rch/trcc2/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal?lang=auto
Frame ID: E2F02A2566061C98479208C4D2B73E3F
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Nur einen Moment…

Page URL History Show full URLs

  1. http://www.nih.gov/ HTTP 307
    https://www.nih.gov/ HTTP 307
    https://www.nih.gov/ Page URL
  2. https://www.nih.gov/ Page URL

Detected technologies

(Security)
Overall confidence: 100%
Detected patterns

Page Statistics

19
Requests

79 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

215 kB
Transfer

584 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://www.nih.gov/ HTTP 307
    https://www.nih.gov/ HTTP 307
    https://www.nih.gov/ Page URL
  2. https://www.nih.gov/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://www.nih.gov/ HTTP 307
  • https://www.nih.gov/ HTTP 307
  • https://www.nih.gov/

19 HTTP transactions
0 data transactions

Method
Protocol		 Status Resource
Path		 Size
x-fer		 Time
Latency		 Type
MIME-Type		 IP
Location
GET
H2 		403
 / Show response
www.nih.gov/
Redirect Chain
  • http://www.nih.gov/
  • https://www.nih.gov/
  • https://www.nih.gov/
6 KB
4 KB 		113ms
113ms 		Document
text/html		 2606:4700:78::90:0:183
Cloudflare
General
Check archive.org
Download Go to
Full URL
https://www.nih.gov/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:78::90:0:183 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
40afff0a36ff2c55b713b8ca13c22f3c5abccacea91c7847eb2e5ae36a225d2d
Security Headers
Name Value
Content-Security-Policy default-src 'none'; script-src 'nonce-Fi0ALsyBkhHSGquwecjHzC' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36

Response headers

accept-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
alt-svc
h3=":443"; ma=86400
cf-mitigated
challenge
cf-ray
a0c3adc50cfcbcaa-ATL
content-encoding
gzip
content-security-policy
default-src 'none'; script-src 'nonce-Fi0ALsyBkhHSGquwecjHzC' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self'
content-type
text/html; charset=UTF-8
critical-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy
same-origin
cross-origin-resource-policy
same-origin
date
Mon, 15 Jun 2026 18:36:10 GMT
expect-ct
max-age=86400, enforce
origin-agent-cluster
?1
permissions-policy
accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=(),xr-spatial-tracking=*
referrer-policy
same-origin
server
cloudflare
server-timing
chlray;desc="a0c3adc50cfcbcaa"
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
accept-encoding
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block

Redirect headers

Location
https://www.nih.gov/
GET
H2 		200
 v1 Show response
www.nih.gov/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/ 		189 KB
66 KB 		124ms
123ms 		Script
application/javascript		 2606:4700:78::90:0:183
Cloudflare
General
Check archive.org
Download Go to
Full URL
https://www.nih.gov/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=a0c3adc50cfcbcaa
Requested by
Host: www.nih.gov
URL: https://www.nih.gov/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:78::90:0:183 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2f89437668408e6e99f8fd9c059ab79754662295eb8981038c622dca9556d294

Request headers

sec-ch-ua-full-version-list
"Chromium";v="149.0.0.0", "Google Chrome";v="149.0.0.0", "Not-A.Brand";v="24.0.0.0"
sec-ch-ua-platform
"Linux"
Referer
https://www.nih.gov/?__cf_chl_rt_tk=MlRblVH9f7ovRUUpqipQMS5EVETJ.WiyfAx4paF1DxM-1781548570-1.0.1.1-8zP94tXPHpEadgZ7A32TDd7kSv9_9uw7WJzpeKdiYCg
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-bitness
"64"
sec-ch-ua-model
""
sec-ch-ua-mobile
?0
sec-ch-ua-arch
"x86"
sec-ch-ua-full-version
"149.0.7827.114"
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua-platform-version
""

Response headers

cf-ray
a0c3adc5ed9dbcaa-ATL
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
alt-svc
h3=":443"; ma=86400
content-encoding
gzip
date
Mon, 15 Jun 2026 18:36:10 GMT
content-type
application/javascript; charset=UTF-8
server
cloudflare
GET

2b408115-3081-4f83-b021-96571b7a9f51
https://www.nih.gov/ 		0
0

GET
H2 		200
 api.js Show response
challenges.cloudflare.com/turnstile/v0/g/8fc8ed1d8752/ 		65 KB
21 KB 		35ms
17ms 		Script
application/javascript		 2606:4700::6812:5f29
Cloudflare
General
Check archive.org
Download Go to
Full URL
https://challenges.cloudflare.com/turnstile/v0/g/8fc8ed1d8752/api.js?onload=NoWu9&render=explicit
Requested by
Host: www.nih.gov
URL: https://www.nih.gov/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=a0c3adc50cfcbcaa
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:5f29 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
550ee5324f2c405d2e21206bd7099b9dcca18a052483b70695f2c7c971322d4e

Request headers

Origin
https://www.nih.gov
sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public
timing-allow-origin
https://www.nih.gov
content-encoding
br
cross-origin-resource-policy
cross-origin
cf-ray
a0c3adc6ca95d295-FRA
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
date
Mon, 15 Jun 2026 18:36:10 GMT
content-type
application/javascript; charset=UTF-8
last-modified
Thu, 28 May 2026 15:08:54 GMT
server
cloudflare
GET
H2 		403
 favicon.ico
www.nih.gov/ 		3 KB
3 KB 		114ms
114ms 		Image
text/html		 2606:4700:78::90:0:183
Cloudflare
General
Check archive.org
Download Go to Show image
Full URL
https://www.nih.gov/favicon.ico
Requested by
Host: www.nih.gov
URL: https://www.nih.gov/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:78::90:0:183 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc415fbabf99fbd3a0e3d714d18fcf9676ba20b41a2991fc14652f382b765400
Security Headers
Name Value
Content-Security-Policy default-src 'none'; script-src 'nonce-ApN0PiDxmnBZTw3yqe4BXZ' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua-full-version-list
"Chromium";v="149.0.0.0", "Google Chrome";v="149.0.0.0", "Not-A.Brand";v="24.0.0.0"
sec-ch-ua-platform
"Linux"
Referer
https://www.nih.gov/
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-bitness
"64"
sec-ch-ua-model
""
sec-ch-ua-mobile
?0
sec-ch-ua-arch
"x86"
sec-ch-ua-full-version
"149.0.7827.114"
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua-platform-version
""

Response headers

content-encoding
gzip
expect-ct
max-age=86400, enforce
critical-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
x-content-type-options
nosniff
server-timing
chlray;desc="a0c3adc71e87bcaa"
alt-svc
h3=":443"; ma=86400
date
Mon, 15 Jun 2026 18:36:10 GMT
content-type
text/html; charset=UTF-8
vary
accept-encoding
x-frame-options
SAMEORIGIN
cf-mitigated
challenge
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'none'; script-src 'nonce-ApN0PiDxmnBZTw3yqe4BXZ' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self'
cross-origin-opener-policy
same-origin
accept-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-resource-policy
same-origin
referrer-policy
same-origin
cf-ray
a0c3adc71e87bcaa-ATL
cross-origin-embedder-policy
require-corp
permissions-policy
accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=(),xr-spatial-tracking=*
x-xss-protection
1; mode=block
origin-agent-cluster
?1
server
cloudflare
POST
H2 		200
 oD32uYCh7tWJcdLeQkybnLouCL9sjivAMSmCf4AIR3w-1781548570-1.2.1.1-F63RyBC8bIwSvGjOFDC9LTw6l1TQb24IuHg2NjSbqQuevV5QFTVWW3sYQyrA5vMS Show response
www.nih.gov/cdn-cgi/challenge-platform/h/g/flow/ov1/563723632:1781547023:RGYj_px0d_LFjlV6cF9MOmqsWYnTvIY1IJmjr3GUfwU/a0c3adc50cfcbcaa/ 		21 KB
16 KB 		127ms
126ms 		XHR
text/plain		 2606:4700:78::90:0:183
Cloudflare
General
Check archive.org
Download Go to
Full URL
https://www.nih.gov/cdn-cgi/challenge-platform/h/g/flow/ov1/563723632:1781547023:RGYj_px0d_LFjlV6cF9MOmqsWYnTvIY1IJmjr3GUfwU/a0c3adc50cfcbcaa/oD32uYCh7tWJcdLeQkybnLouCL9sjivAMSmCf4AIR3w-1781548570-1.2.1.1-F63RyBC8bIwSvGjOFDC9LTw6l1TQb24IuHg2NjSbqQuevV5QFTVWW3sYQyrA5vMS
Requested by
Host: www.nih.gov
URL: https://www.nih.gov/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=a0c3adc50cfcbcaa
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:78::90:0:183 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e8ece76948081f0f4fdc2011dd8a2314c7ea90f1465df3c6f89bd96b42409dca

Request headers

sec-ch-ua-full-version-list
"Chromium";v="149.0.0.0", "Google Chrome";v="149.0.0.0", "Not-A.Brand";v="24.0.0.0"
sec-ch-ua-platform
"Linux"
Referer
https://www.nih.gov/
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-bitness
"64"
cf-chl-ra
0
sec-ch-ua-mobile
?0
sec-ch-ua-model
""
sec-ch-ua-arch
"x86"
sec-ch-ua-full-version
"149.0.7827.114"
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
cf-chl
oD32uYCh7tWJcdLeQkybnLouCL9sjivAMSmCf4AIR3w-1781548570-1.2.1.1-F63RyBC8bIwSvGjOFDC9LTw6l1TQb24IuHg2NjSbqQuevV5QFTVWW3sYQyrA5vMS
sec-ch-ua-platform-version
""

Response headers

timing-allow-origin
https://www.nih.gov
content-encoding
gzip
cf-ray
a0c3adc7cf06bcaa-ATL
alt-svc
h3=":443"; ma=86400
date
Mon, 15 Jun 2026 18:36:10 GMT
content-type
text/plain; charset=UTF-8
cf-chl-gen
HOSKrgwXixGBI8I9EzS3BnOuYqSLon+GKPSwmZT4dWQ=$ISOGFQv+vnw/YlmKKKVpJQ==
server
cloudflare
GET
H2 		403
 favicon.ico
www.nih.gov/ 		6 KB
4 KB 		112ms
112ms 		Other
text/html		 2606:4700:78::90:0:183
Cloudflare
General
Check archive.org
Download Go to
Full URL
https://www.nih.gov/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:78::90:0:183 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2abb35c2081068dd3cf05c3a8d6533ef1d874d63bf3dbc456e9ac4d0c0a9771a
Security Headers
Name Value
Content-Security-Policy default-src 'none'; script-src 'nonce-40jY9SYzEoPUwg6kjYI8iI' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua-full-version-list
"Chromium";v="149.0.0.0", "Google Chrome";v="149.0.0.0", "Not-A.Brand";v="24.0.0.0"
sec-ch-ua-platform
"Linux"
Referer
https://www.nih.gov/
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-bitness
"64"
sec-ch-ua-model
""
sec-ch-ua-mobile
?0
sec-ch-ua-arch
"x86"
sec-ch-ua-full-version
"149.0.7827.114"
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua-platform-version
""

Response headers

content-encoding
gzip
expect-ct
max-age=86400, enforce
critical-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
x-content-type-options
nosniff
server-timing
chlray;desc="a0c3adc7cf0bbcaa"
alt-svc
h3=":443"; ma=86400
date
Mon, 15 Jun 2026 18:36:10 GMT
content-type
text/html; charset=UTF-8
vary
accept-encoding
x-frame-options
SAMEORIGIN
cf-mitigated
challenge
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'none'; script-src 'nonce-40jY9SYzEoPUwg6kjYI8iI' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self'
cross-origin-opener-policy
same-origin
accept-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-resource-policy
same-origin
referrer-policy
same-origin
cf-ray
a0c3adc7cf0bbcaa-ATL
cross-origin-embedder-policy
require-corp
permissions-policy
accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=(),xr-spatial-tracking=*
x-xss-protection
1; mode=block
origin-agent-cluster
?1
server
cloudflare
GET

ccfd059b-10c3-4b90-9927-d27bb9f1c247
https://www.nih.gov/ 		0
0

GET
H2 		200
 normal
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/f/ov2/av0/rch/kpq92/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/ Frame 66A6 		0
0 		46ms
30ms 		Document
text/html		 2606:4700::6812:5f29
Cloudflare
General
Check archive.org
Download Go to
Full URL
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/f/ov2/av0/rch/kpq92/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal?lang=auto
Requested by
Host: challenges.cloudflare.com
URL: https://challenges.cloudflare.com/turnstile/v0/g/8fc8ed1d8752/api.js?onload=NoWu9&render=explicit
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:5f29 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'none'; script-src 'nonce-MgaPtOCTEiWcNWQs4tpX6X' 'unsafe-eval'; script-src-attr 'none'; worker-src blob:; style-src 'unsafe-inline'; img-src 'self'; connect-src 'self'; frame-src 'self' blob:; child-src 'self' blob:; form-action 'none'; base-uri 'self'; trusted-types twKxV6 default; require-trusted-types-for 'script'; sandbox allow-same-origin allow-scripts allow-popups allow-forms

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

accept-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
alt-svc
h3=":443"; ma=86400
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
a0c3adc87a63dbcd-FRA
content-encoding
br
content-security-policy
default-src 'none'; script-src 'nonce-MgaPtOCTEiWcNWQs4tpX6X' 'unsafe-eval'; script-src-attr 'none'; worker-src blob:; style-src 'unsafe-inline'; img-src 'self'; connect-src 'self'; frame-src 'self' blob:; child-src 'self' blob:; form-action 'none'; base-uri 'self'; trusted-types twKxV6 default; require-trusted-types-for 'script'; sandbox allow-same-origin allow-scripts allow-popups allow-forms
content-type
text/html; charset=UTF-8
critical-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy
same-origin
cross-origin-resource-policy
cross-origin
date
Mon, 15 Jun 2026 18:36:10 GMT
document-policy
js-profiling
origin-agent-cluster
?1
permissions-policy
accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=(),xr-spatial-tracking=*
referrer-policy
same-origin
server
cloudflare
server-timing
ap6f6eup;dur=232189
POST
H2 		200
 oD32uYCh7tWJcdLeQkybnLouCL9sjivAMSmCf4AIR3w-1781548570-1.2.1.1-F63RyBC8bIwSvGjOFDC9LTw6l1TQb24IuHg2NjSbqQuevV5QFTVWW3sYQyrA5vMS Show response
www.nih.gov/cdn-cgi/challenge-platform/h/g/flow/ov1/563723632:1781547023:RGYj_px0d_LFjlV6cF9MOmqsWYnTvIY1IJmjr3GUfwU/a0c3adc50cfcbcaa/ 		4 KB
5 KB 		119ms
117ms 		XHR
text/html		 2606:4700:78::90:0:183
Cloudflare
General
Check archive.org
Download Go to
Full URL
https://www.nih.gov/cdn-cgi/challenge-platform/h/g/flow/ov1/563723632:1781547023:RGYj_px0d_LFjlV6cF9MOmqsWYnTvIY1IJmjr3GUfwU/a0c3adc50cfcbcaa/oD32uYCh7tWJcdLeQkybnLouCL9sjivAMSmCf4AIR3w-1781548570-1.2.1.1-F63RyBC8bIwSvGjOFDC9LTw6l1TQb24IuHg2NjSbqQuevV5QFTVWW3sYQyrA5vMS
Requested by
Host: www.nih.gov
URL: https://www.nih.gov/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=a0c3adc50cfcbcaa
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:78::90:0:183 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0f6c96d28ec4fce3ab614699a5e1310dcd272c4d2651aaf053c6244d72165ea9

Request headers

sec-ch-ua-full-version-list
"Chromium";v="149.0.0.0", "Google Chrome";v="149.0.0.0", "Not-A.Brand";v="24.0.0.0"
sec-ch-ua-platform
"Linux"
Referer
https://www.nih.gov/
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-bitness
"64"
cf-chl-ra
0
sec-ch-ua-mobile
?0
sec-ch-ua-model
""
sec-ch-ua-arch
"x86"
sec-ch-ua-full-version
"149.0.7827.114"
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
cf-chl
oD32uYCh7tWJcdLeQkybnLouCL9sjivAMSmCf4AIR3w-1781548570-1.2.1.1-F63RyBC8bIwSvGjOFDC9LTw6l1TQb24IuHg2NjSbqQuevV5QFTVWW3sYQyrA5vMS
sec-ch-ua-platform-version
""

Response headers

cf-chl-out
RHROi5R4Hewj2jvYbpN1uhbSb5iYKziQ7fBEEGEK9Demoytrwpn0bmK1iYEjO5o+ih+BBW4MqVSHp0jETGODJvWnvQb2mOvOfvT9ocpfXyw=$rLGl49PISdehPPeNRjlPJg==
timing-allow-origin
https://www.nih.gov
content-encoding
gzip
cf-ray
a0c3ade3b8a6bcaa-ATL
alt-svc
h3=":443"; ma=86400
cf-chl-out-s
t+x03k29B0+VFCRTqG2T6yoR/PTsqg66Belo5ROdFsrb2gxySgy29BlfUHOVKLt331Ek87MBBIdImcl+eoyJKgrd0y/IH2N/hx1tUTQp4L3y1pmYuBnkxqOobR6z634f2YvKUTYHpOOQt2xPjq25w06xLDFWaM/BpNTvey/NIffnXuPliY1yeKzLZeRR/NGkF9Kv8INwyJ7fAjG8ki3mnJDN8EJpYQO9zbNQeAm5G3hAb14tUTLI1Yyl1zWlfXKZrq8rfe/iLlbMnMX0tmyH9+VeKhJWPmk6DW1Y9mkJQQYOHDEpNtu0kWyWRAsqCqAdWqZZLWMgi/1VjuPE4Ku51VB2zebQ69ZVdX01aJaQz1dBCdLe9f9VhMyBQUlIQj8f87Cy9pNVgJQ6zkCW0etdc8EV3yFJh1vAzo2lLK0ucL34rRXv5MVUHSYXOSkCSdTbvlqk3CWzqA97WIm9TnJGypitS/K96jmEMZI1fFEH6oAIX11Rh7mnAfgIOvli2qwbQ6rOG0jVXo61oC5vKvLBqZyzbMvL42C6x7GR/HiT/YdX7ltTc1qHahQMBfL6+/YSBvXa+Rtd+zTQsDbgaYBGCfCNcGqmwMA/7abafa1XNS7yrvpMk7FEN7eWPHLI3GppfNh0gxOFS3sQ7gxDqHnIx3fIWboi6Vw3Y3+N3h2DWWfaD10XdCvB49kF/JANIW9etlJ04DLl8S39nXAgHBKy3rz5fZG9362hiq+g8dkqtwEERrQpxYrUHxpYdleszRzD8rcQ/yVSCvopmXw8sRypi/Br3Z+jJzbr80/+lwRIeFGerKgQAXdaMNz6HkkWTFzjKxIVAB0h9V4DGgNUXMlA+fD/odmUCHDMdGNCRysxCgnY6oFLjgAQfR4B2DEeyKwQNZMeeD3vUOdOhDS9FndpMlsuUsCvKuRFWtgZzriT2G9kWqY4aq3gaSk4CbIMZxV8OzGgueGX1e5XNGeKne+QRt6kjHQMo5fguHb3Mod72LouIui/mRm2VVSQn0Mybxi4Bo2l0mKDoGhPXU4I7KLOnhVhlbYD/9LeQM1eWhh9IIRC7wHyGsVe6tAA4lYtUbi3lv92M/d7JKVkCn9Ybcv6XyvPhChWyr6gTbKruEWlDMTyuXwXeXTcNEyoKMsG72TMktu5D9IYPmQUaSuQXqpiFo3JjyiiMmsXiA/8Y6r0VHsRe3XQFXcytpXnys3fAKd4PcDkCqm2n6omlXtfKSEkuubzHi0zvBJcQfj6MUyR9mWzb6CYMLHTVtkYZP2zOxQI$HV1V3goHN4uGbnTznjSoRw==
date
Mon, 15 Jun 2026 18:36:15 GMT
content-type
text/html; charset=UTF-8
server
cloudflare
GET
H2 		403
 Primary Request / Show response
www.nih.gov/ 		6 KB
5 KB 		114ms
114ms 		Document
text/html		 2606:4700:78::90:0:183
Cloudflare
General
Check archive.org
Download Go to
Full URL
https://www.nih.gov/
Requested by
Host: www.nih.gov
URL: https://www.nih.gov/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=a0c3adc50cfcbcaa
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:78::90:0:183 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8aac62ab0d0f9bd5d1d8dc41acf0c32c42b549442f23e165b2c0b54843db73f2
Security Headers
Name Value
Content-Security-Policy default-src 'none'; script-src 'nonce-GkEXa6vEyuLQaSy1CzIuXh' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.nih.gov/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-arch
"x86"
sec-ch-ua-bitness
"64"
sec-ch-ua-full-version
"149.0.7827.114"
sec-ch-ua-full-version-list
"Chromium";v="149.0.0.0", "Google Chrome";v="149.0.0.0", "Not-A.Brand";v="24.0.0.0"
sec-ch-ua-mobile
?0
sec-ch-ua-model
""
sec-ch-ua-platform
"Linux"
sec-ch-ua-platform-version
""

Response headers

accept-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
alt-svc
h3=":443"; ma=86400
cf-mitigated
challenge
cf-ray
a0c3adf10d37bcaa-ATL
content-encoding
gzip
content-security-policy
default-src 'none'; script-src 'nonce-GkEXa6vEyuLQaSy1CzIuXh' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self'
content-type
text/html; charset=UTF-8
critical-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy
same-origin
cross-origin-resource-policy
same-origin
date
Mon, 15 Jun 2026 18:36:17 GMT
expect-ct
max-age=86400, enforce
origin-agent-cluster
?1
permissions-policy
accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=(),xr-spatial-tracking=*
referrer-policy
same-origin
server
cloudflare
server-timing
chlray;desc="a0c3adf10d37bcaa"
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
accept-encoding
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
GET
H2 		200
 v1 Show response
www.nih.gov/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/ 		190 KB
67 KB 		132ms
131ms 		Script
application/javascript		 2606:4700:78::90:0:183
Cloudflare
General
Check archive.org
Download Go to
Full URL
https://www.nih.gov/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=a0c3adf10d37bcaa
Requested by
Host: www.nih.gov
URL: https://www.nih.gov/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:78::90:0:183 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2d097fbb7d9867296c99815c65a4619918fd7336d80d1fa46ff5de59c3f7cc8f

Request headers

sec-ch-ua-full-version-list
"Chromium";v="149.0.0.0", "Google Chrome";v="149.0.0.0", "Not-A.Brand";v="24.0.0.0"
sec-ch-ua-platform
"Linux"
Referer
https://www.nih.gov/?__cf_chl_rt_tk=cGmAzyzWwtqHedFwqZcbW4DzqBO0vBxgbjorqCP5T6A-1781548577-1.0.1.1-KQ1JR0So0QN2O2be1Aa5Qrv66ikn5yUJ_eZbCsJdhxE
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-bitness
"64"
sec-ch-ua-model
""
sec-ch-ua-mobile
?0
sec-ch-ua-arch
"x86"
sec-ch-ua-full-version
"149.0.7827.114"
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua-platform-version
""

Response headers

cf-ray
a0c3adf1cdc5bcaa-ATL
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
alt-svc
h3=":443"; ma=86400
content-encoding
gzip
date
Mon, 15 Jun 2026 18:36:17 GMT
content-type
application/javascript; charset=UTF-8
server
cloudflare
GET

ab413bd4-e43c-4bc4-9c23-354c62ff8582
https://www.nih.gov/ 		0
0

GET
H2 		200
 api.js Show response
challenges.cloudflare.com/turnstile/v0/g/8fc8ed1d8752/ 		65 KB
0 		0ms
0ms 		Script
application/javascript		 2606:4700::6812:5f29
Cloudflare
General
Check archive.org
Download Go to
Full URL
https://challenges.cloudflare.com/turnstile/v0/g/8fc8ed1d8752/api.js?onload=NoWu9&render=explicit
Requested by
Host: www.nih.gov
URL: https://www.nih.gov/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=a0c3adf10d37bcaa
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:5f29 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
550ee5324f2c405d2e21206bd7099b9dcca18a052483b70695f2c7c971322d4e

Request headers

Origin
https://www.nih.gov
sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public
timing-allow-origin
https://www.nih.gov
content-encoding
br
cross-origin-resource-policy
cross-origin
cf-ray
a0c3adc6ca95d295-FRA
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
date
Mon, 15 Jun 2026 18:36:10 GMT
content-type
application/javascript; charset=UTF-8
last-modified
Thu, 28 May 2026 15:08:54 GMT
server
cloudflare
GET
H2 		403
 favicon.ico
www.nih.gov/ 		3 KB
3 KB 		117ms
117ms 		Image
text/html		 2606:4700:78::90:0:183
Cloudflare
General
Check archive.org
Download Go to Show image
Full URL
https://www.nih.gov/favicon.ico
Requested by
Host: www.nih.gov
URL: https://www.nih.gov/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:78::90:0:183 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0f2dc6da3d90b148f746f2c9cb96d9b2d72ac63c072dea48b894ad536f9e8722
Security Headers
Name Value
Content-Security-Policy default-src 'none'; script-src 'nonce-RZxynMH9cCD5bGSkmFAOvH' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua-full-version-list
"Chromium";v="149.0.0.0", "Google Chrome";v="149.0.0.0", "Not-A.Brand";v="24.0.0.0"
sec-ch-ua-platform
"Linux"
Referer
https://www.nih.gov/
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-bitness
"64"
sec-ch-ua-model
""
sec-ch-ua-mobile
?0
sec-ch-ua-arch
"x86"
sec-ch-ua-full-version
"149.0.7827.114"
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua-platform-version
""

Response headers

content-encoding
gzip
expect-ct
max-age=86400, enforce
critical-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
x-content-type-options
nosniff
server-timing
chlray;desc="a0c3adf2feb9bcaa"
alt-svc
h3=":443"; ma=86400
date
Mon, 15 Jun 2026 18:36:17 GMT
content-type
text/html; charset=UTF-8
vary
accept-encoding
x-frame-options
SAMEORIGIN
cf-mitigated
challenge
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'none'; script-src 'nonce-RZxynMH9cCD5bGSkmFAOvH' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self'
cross-origin-opener-policy
same-origin
accept-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-resource-policy
same-origin
referrer-policy
same-origin
cf-ray
a0c3adf2feb9bcaa-ATL
cross-origin-embedder-policy
require-corp
permissions-policy
accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=(),xr-spatial-tracking=*
x-xss-protection
1; mode=block
origin-agent-cluster
?1
server
cloudflare
POST
H2 		200
 zs5a4anJlUa5WY7NIMXqXZVr_VZ.tG_HDawxH3tTX0E-1781548577-1.2.1.1-jvgkVoA._u8K0fboo1n3askBzWZSMGjqXmlPj8axbyzlVsipubcS4T1ITrv2PDnW Show response
www.nih.gov/cdn-cgi/challenge-platform/h/g/flow/ov1/563723632:1781547023:RGYj_px0d_LFjlV6cF9MOmqsWYnTvIY1IJmjr3GUfwU/a0c3adf10d37bcaa/ 		21 KB
16 KB 		121ms
120ms 		XHR
text/plain		 2606:4700:78::90:0:183
Cloudflare
General
Check archive.org
Download Go to
Full URL
https://www.nih.gov/cdn-cgi/challenge-platform/h/g/flow/ov1/563723632:1781547023:RGYj_px0d_LFjlV6cF9MOmqsWYnTvIY1IJmjr3GUfwU/a0c3adf10d37bcaa/zs5a4anJlUa5WY7NIMXqXZVr_VZ.tG_HDawxH3tTX0E-1781548577-1.2.1.1-jvgkVoA._u8K0fboo1n3askBzWZSMGjqXmlPj8axbyzlVsipubcS4T1ITrv2PDnW
Requested by
Host: www.nih.gov
URL: https://www.nih.gov/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=a0c3adf10d37bcaa
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:78::90:0:183 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
62ad5547212f6486cdcd995896ebc88336350b0804df616d8322a084e129987f

Request headers

sec-ch-ua-full-version-list
"Chromium";v="149.0.0.0", "Google Chrome";v="149.0.0.0", "Not-A.Brand";v="24.0.0.0"
sec-ch-ua-platform
"Linux"
Referer
https://www.nih.gov/
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-bitness
"64"
cf-chl-ra
0
sec-ch-ua-mobile
?0
sec-ch-ua-model
""
sec-ch-ua-arch
"x86"
sec-ch-ua-full-version
"149.0.7827.114"
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
cf-chl
zs5a4anJlUa5WY7NIMXqXZVr_VZ.tG_HDawxH3tTX0E-1781548577-1.2.1.1-jvgkVoA._u8K0fboo1n3askBzWZSMGjqXmlPj8axbyzlVsipubcS4T1ITrv2PDnW
sec-ch-ua-platform-version
""

Response headers

timing-allow-origin
https://www.nih.gov
content-encoding
gzip
cf-ray
a0c3adf3af47bcaa-ATL
alt-svc
h3=":443"; ma=86400
date
Mon, 15 Jun 2026 18:36:17 GMT
content-type
text/plain; charset=UTF-8
cf-chl-gen
kfhC38Qvk2rcXQTUcRElWBl14bqUn2+gIQ8ruwog1cw=$vGJhYubmvTZ8Z4VKDiRaZg==
server
cloudflare
GET
H2 		403
 favicon.ico
www.nih.gov/ 		6 KB
5 KB 		119ms
118ms 		Other
text/html		 2606:4700:78::90:0:183
Cloudflare
General
Check archive.org
Download Go to
Full URL
https://www.nih.gov/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:78::90:0:183 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
53965b475d10608a6720054e210cb478476ff9994f1bc2ef929413a86e0c582d
Security Headers
Name Value
Content-Security-Policy default-src 'none'; script-src 'nonce-JjseSOxh4KAuXMWOHnjwAD' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua-full-version-list
"Chromium";v="149.0.0.0", "Google Chrome";v="149.0.0.0", "Not-A.Brand";v="24.0.0.0"
sec-ch-ua-platform
"Linux"
Referer
https://www.nih.gov/
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-bitness
"64"
sec-ch-ua-model
""
sec-ch-ua-mobile
?0
sec-ch-ua-arch
"x86"
sec-ch-ua-full-version
"149.0.7827.114"
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua-platform-version
""

Response headers

content-encoding
gzip
expect-ct
max-age=86400, enforce
critical-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
x-content-type-options
nosniff
server-timing
chlray;desc="a0c3adf3cf58bcaa"
alt-svc
h3=":443"; ma=86400
date
Mon, 15 Jun 2026 18:36:17 GMT
content-type
text/html; charset=UTF-8
vary
accept-encoding
x-frame-options
SAMEORIGIN
cf-mitigated
challenge
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'none'; script-src 'nonce-JjseSOxh4KAuXMWOHnjwAD' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self'
cross-origin-opener-policy
same-origin
accept-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-resource-policy
same-origin
referrer-policy
same-origin
cf-ray
a0c3adf3cf58bcaa-ATL
cross-origin-embedder-policy
require-corp
permissions-policy
accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=(),xr-spatial-tracking=*
x-xss-protection
1; mode=block
origin-agent-cluster
?1
server
cloudflare
GET

ed23860c-3f4c-48b7-83c0-058810e71b96
https://www.nih.gov/ 		0
0

GET
H3 		200
 normal
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/f/ov2/av0/rch/trcc2/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/ Frame E2F0 		0
0 		27ms
27ms 		Document
text/html		 2606:4700::6812:5f29
Cloudflare
General
Check archive.org
Download Go to
Full URL
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/f/ov2/av0/rch/trcc2/0x4AAAAAAADnPIDROrmt1Wwj/light/fbE/new/normal?lang=auto
Requested by
Host: challenges.cloudflare.com
URL: https://challenges.cloudflare.com/turnstile/v0/g/8fc8ed1d8752/api.js?onload=NoWu9&render=explicit
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:5f29 -, , ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src 'none'; script-src 'nonce-JNFkihPyVnyqNcgcV3S9qf' 'unsafe-eval'; script-src-attr 'none'; worker-src blob:; style-src 'unsafe-inline'; img-src 'self'; connect-src 'self'; frame-src 'self' blob:; child-src 'self' blob:; form-action 'none'; base-uri 'self'; trusted-types twKxV6 default; require-trusted-types-for 'script'; sandbox allow-same-origin allow-scripts allow-popups allow-forms

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="149", "Google Chrome";v="149", "Not-A.Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

accept-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
alt-svc
h3=":443"; ma=86400
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
a0c3adf44f7adb10-FRA
content-encoding
br
content-security-policy
default-src 'none'; script-src 'nonce-JNFkihPyVnyqNcgcV3S9qf' 'unsafe-eval'; script-src-attr 'none'; worker-src blob:; style-src 'unsafe-inline'; img-src 'self'; connect-src 'self'; frame-src 'self' blob:; child-src 'self' blob:; form-action 'none'; base-uri 'self'; trusted-types twKxV6 default; require-trusted-types-for 'script'; sandbox allow-same-origin allow-scripts allow-popups allow-forms
content-type
text/html; charset=UTF-8
critical-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy
same-origin
cross-origin-resource-policy
cross-origin
date
Mon, 15 Jun 2026 18:36:17 GMT
document-policy
js-profiling
origin-agent-cluster
?1
permissions-policy
accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=(),xr-spatial-tracking=*
priority
u=0,i
referrer-policy
same-origin
server
cloudflare
server-timing
pp78cu17;dur=233237 cfExtPri

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www.nih.gov
URL
blob:https://www.nih.gov/2b408115-3081-4f83-b021-96571b7a9f51
Domain
www.nih.gov
URL
blob:https://www.nih.gov/ccfd059b-10c3-4b90-9927-d27bb9f1c247
Domain
www.nih.gov
URL
blob:https://www.nih.gov/ab413bd4-e43c-4bc4-9c23-354c62ff8582
Domain
www.nih.gov
URL
blob:https://www.nih.gov/ed23860c-3f4c-48b7-83c0-058810e71b96

Verdicts & Comments Add Verdict or Comment

36 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

object| _cf_chl_opt function| yPalf4 function| yaIf9 function| bodh4 function| jDII3 function| NoWu9 boolean| uStot7 function| ZsVW2 function| twSh8 function| TCRR3 function| ipWO6 object| SKWg2 number| TthBu1 function| xECJ4 function| HBTm7 function| SJER8 function| kgLR3 function| NfEHo2 function| HOFt5 function| NunvH9 object| jyspP3 object| aCuz9 function| runProgram object| dWAHV3 function| SOjP9 function| ySrR0 number| mVenj5 object| angular object| LHpm9 string| cUmKl2 object| uPydZ1 object| turnstile boolean| Luvb6 boolean| AqiC0 string| HydS8 boolean| gxGB3

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path Expires Name / Value
www.nih.gov/ 1970-01-21
14:52:32 		Name: cf_chl_rc_ni
Value: 1
.nih.gov/ 1970-01-21
14:52:30 		Name: __cf_bm
Value: vK3fyEOyPe0k15m3MTp2Fjl0OGQumfbcNSQEhEbadrY-1781548577.8700354-1.0.1.1-npO3c5MgCiofdswPRbTk9ekV4kNA8d7o_rcs_BQcjfcnq73BMNseO4HWSpT9PyljuhC_pxg3N40fJKgWIMYUcJJ86VRIt.HTiwsIW_koHXPYg.ik4GImikJw8C.7_VKG

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source Level URL
Text
network error URL: https://www.nih.gov/
Message:
Failed to load resource: the server responded with a status of 403 ()
network error URL: https://www.nih.gov/favicon.ico
Message:
Failed to load resource: the server responded with a status of 403 ()
network error URL: https://www.nih.gov/favicon.ico
Message:
Failed to load resource: the server responded with a status of 403 ()
network error URL: https://www.nih.gov/
Message:
Failed to load resource: the server responded with a status of 403 ()
network error URL: https://www.nih.gov/favicon.ico
Message:
Failed to load resource: the server responded with a status of 403 ()
network error URL: https://www.nih.gov/favicon.ico
Message:
Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'none'; script-src 'nonce-Fi0ALsyBkhHSGquwecjHzC' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block