officesecure.org Open in urlscan Pro
2606:4700:3035::ac43:cb1e  Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. http://nwwrq.kgswc.org/ Page URL
2. https://officesecure.org/M Page URL
3. https://officesecure.org/M Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ nwwrq.kgswc.org/	93 B 474 B	1097ms 147ms	Document text/html	147.124.221.154 MAJESTIC-HOSTING-01
General Check archive.org Show headers Download Go to Full URL http://nwwrq.kgswc.org/ Protocol HTTP/1.1 Server 147.124.221.154 Dallas, United States, ASN396073 (MAJESTIC-HOSTING-01, US), Reverse DNS c01.iservidorweb.com Software Apache / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Wed, 09 Aug 2023 08:25:01 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=100 Pragma no-cache Server Apache Transfer-Encoding chunked
GET H2	403	M Show response officesecure.org/	6 KB 5 KB	124ms 26ms	Document text/html	2606:4700:3035::ac43:cb1e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://officesecure.org/M Requested by Host: nwwrq.kgswc.org URL: http://nwwrq.kgswc.org/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::ac43:cb1e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b497683d179f4d45c7e09e33de063e29fafb278be21cac2da068f5f044401fea Security Headers Name Value X-Frame-Options SAMEORIGIN Request headers Referer http://nwwrq.kgswc.org/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cache-control private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-mitigated challenge cf-ray 7f3e9b28ea5c36e0-FRA content-encoding br content-type text/html; charset=UTF-8 cross-origin-embedder-policy require-corp cross-origin-opener-policy same-origin cross-origin-resource-policy same-origin date Wed, 09 Aug 2023 08:25:01 GMT expires Thu, 01 Jan 1970 00:00:01 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} origin-agent-cluster ?1 permissions-policy accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() referrer-policy same-origin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=w9y830YriNV9foWXN17WAfc5CLfEOsaAY414p5m9G6Ai32h3juUtHabAlwjKJkWa9FgCYZ1hqDDN58Fdo5GNaFZwWSVakcHEbdkvgCF4nhuDoGrQJSmc9h3gdtHwmwWrdjF5IIGhcQ0uWXUG%2F59T"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding x-frame-options SAMEORIGIN
GET H2	200	challenges.css officesecure.org/cdn-cgi/styles/	6 KB 3 KB	27ms 26ms	Stylesheet text/css	2606:4700:3035::ac43:cb1e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://officesecure.org/cdn-cgi/styles/challenges.css Requested by Host: officesecure.org URL: https://officesecure.org/M Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::ac43:cb1e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2b0bd09c1cc7119d27e45353a59bf6c2721563e1689853ff704057a7439508d2 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options DENY Request headers accept-language de-DE,de;q=0.9 Referer https://officesecure.org/M User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers date Wed, 09 Aug 2023 08:25:01 GMT content-encoding gzip x-content-type-options nosniff last-modified Fri, 04 Aug 2023 16:29:28 GMT server cloudflare etag W/"64cd2768-19c8" x-frame-options DENY vary Accept-Encoding content-type text/css cache-control max-age=7200, public cf-ray 7f3e9b292aa436e0-FRA expires Wed, 09 Aug 2023 10:25:01 GMT
GET H2	200	v1 Show response officesecure.org/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/	171 KB 59 KB	29ms 29ms	Script application/javascript	2606:4700:3035::ac43:cb1e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://officesecure.org/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=7f3e9b28ea5c36e0 Requested by Host: officesecure.org URL: https://officesecure.org/M Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3035::ac43:cb1e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4f8b136d82220148a7be4fcbb89f996355715ee8cce66791b07a9986c0165778 Request headers accept-language de-DE,de;q=0.9 Referer https://officesecure.org/M?__cf_chl_rt_tk=hnPYBe2dJXljb8F8DjWpjqKaknJkAAu6uulolW8XphI-1691569501-0-gaNycGzNC9A User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers date Wed, 09 Aug 2023 08:25:01 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BedAa7MKoC0y6q4S7%2F9NH%2FB2BVGl9B5pn8CUwyUmrDm7hCwbjdjrkEfnXj1J7fc6tzQK%2BVg476Jgpmbb%2Frn9KzDPL57LOSZRS6eWT%2FqSyU635ee4uci3w6RACAX8z5PNOP990AmFwWr12MxVX51J"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=UTF-8 cache-control private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-ray 7f3e9b295ae236e0-FRA alt-svc h3=":443"; ma=86400
GET H2	200	api.js Show response challenges.cloudflare.com/turnstile/v0/g/74ac0d47/	27 KB 10 KB	93ms 46ms	Script application/javascript	2606:4700::6811:2b8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://challenges.cloudflare.com/turnstile/v0/g/74ac0d47/api.js?onload=aJ4&render=explicit Requested by Host: officesecure.org URL: https://officesecure.org/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=7f3e9b28ea5c36e0 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:2b8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e0f33190c14b543e76e11ab58c238e5d56508c3d0933c1cd7c64e478fedee376 Request headers Referer Origin https://officesecure.org accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers date Wed, 09 Aug 2023 08:25:01 GMT content-encoding br server cloudflare vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control max-age=31536000 cf-ray 7f3e9b2a0f1c691b-FRA alt-svc h3=":443"; ma=86400
GET H3	403	favicon.ico officesecure.org/	6 KB 6 KB	25ms 25ms	Image text/html	2606:4700:3035::ac43:cb1e CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://officesecure.org/favicon.ico Requested by Host: officesecure.org URL: https://officesecure.org/M Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3035::ac43:cb1e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e0b24ed875dfb1154ee4f00fe8256887f1256f8209f648888c0f06af6a5464d9 Security Headers Name Value X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://officesecure.org/M User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers date Wed, 09 Aug 2023 08:25:01 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cross-origin-embedder-policy require-corp cross-origin-resource-policy same-origin alt-svc h3=":443"; ma=86400 referrer-policy same-origin server cloudflare cross-origin-opener-policy same-origin cf-mitigated challenge x-frame-options SAMEORIGIN report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=V77ZRfpfrkP4TVME35g0azBNdZBwo8ZZ8Rer3ap2%2FuyNbvq2FVsJK2WKGTT%2BARBMvA6wJLqsRfNXH1X3hHkzq97C7jdkPbziiMw3lDwp1t7dJvSwuDeFbaXBm2CTffVwEEm%2Bu%2F751uKwxSn6raLl"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=UTF-8 vary Accept-Encoding origin-agent-cluster ?1 cache-control private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 permissions-policy accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() cf-ray 7f3e9b29bdc54d2b-FRA expires Thu, 01 Jan 1970 00:00:01 GMT
GET DATA	200 OK	truncated /	586 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash fc95732d9ff3b17fcb3e64fd12c0d451c38e64e1a4b420c556a7feb756a0a3fa Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers Content-Type image/png
GET BLOB	200 OK	4522313d-c2c9-43f8-8b80-594eaff54210 https://officesecure.org/	13 B 0		Other text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://officesecure.org/4522313d-c2c9-43f8-8b80-594eaff54210 Requested by Host: officesecure.org URL: https://officesecure.org/M Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 8860e7fef89219a219cb11d18bd8e4a322f32072613f86e935e7fe162ab69c04 Request headers accept-language de-DE,de;q=0.9 Referer https://officesecure.org/M User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers Content-Length 13 Content-Type text/javascript
POST H3	200	a926af64865a671 Show response officesecure.org/cdn-cgi/challenge-platform/h/g/flow/ov1/2144254940:1691565776:2Ep7AFAWapGUogLmXrey4sMTgFux2HuWW2dsdrf4kkM/7f3e9b28ea5c36e0/	9 KB 8 KB	38ms 38ms	XHR text/plain	2606:4700:3035::ac43:cb1e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://officesecure.org/cdn-cgi/challenge-platform/h/g/flow/ov1/2144254940:1691565776:2Ep7AFAWapGUogLmXrey4sMTgFux2HuWW2dsdrf4kkM/7f3e9b28ea5c36e0/a926af64865a671 Requested by Host: officesecure.org URL: https://officesecure.org/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=7f3e9b28ea5c36e0 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3035::ac43:cb1e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a3c542e61f98be39726949f1070fcb4b1f83a41ebce9e2bbdc1e9fa26ff62ed6 Request headers Referer https://officesecure.org/M accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 CF-Challenge a926af64865a671 Content-type application/x-www-form-urlencoded Response headers date Wed, 09 Aug 2023 08:25:01 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pqfHcPs%2BJyUcly4l3%2BAauqS9jWs0uP5j%2BnB6AB92uraRVsXt4D8iindWH4WHTWAHL%2F4lrmDx3Bi3g%2F5Ud4Dm52XaOJwjqEzyL4he9%2BPnCbtY8L7ZAtaOrn31JeB2WKV71%2FlmZVXoIjBLNIDu%2BHN%2B"}],"group":"cf-nel","max_age":604800} content-type text/plain; charset=UTF-8 cf-ray 7f3e9b2a6e714d2b-FRA alt-svc h3=":443"; ma=86400 cf-chl-gen pLFDfyQFZjerZe4fk7Y6gi65bEPerHpAWmoSj+aN7B5zKn2EYbOmxORD0JuYG1a8$Am9wP0F064HAZ7dDnRuO8A==
GET H3	200	normal challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/ojqv3/0x4AAAAAAADnPIDROrmt1Wwj/light/ Frame 61CD	0 0	55ms 31ms	Document text/html	2606:4700::6811:2b8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/ojqv3/0x4AAAAAAADnPIDROrmt1Wwj/light/normal Requested by Host: challenges.cloudflare.com URL: https://challenges.cloudflare.com/turnstile/v0/g/74ac0d47/api.js?onload=aJ4&render=explicit Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:2b8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Content-Security-Policy frame-src https://challenges.cloudflare.com/; base-uri 'self' Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cache-control private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-ray 7f3e9b2ae90c4d7c-FRA content-encoding br content-security-policy frame-src https://challenges.cloudflare.com/; base-uri 'self' content-type text/html; charset=UTF-8 cross-origin-embedder-policy require-corp cross-origin-opener-policy same-origin cross-origin-resource-policy cross-origin date Wed, 09 Aug 2023 08:25:01 GMT document-policy js-profiling origin-agent-cluster ?1 permissions-policy accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() referrer-policy same-origin server cloudflare
POST H3	200	a926af64865a671 Show response officesecure.org/cdn-cgi/challenge-platform/h/g/flow/ov1/2144254940:1691565776:2Ep7AFAWapGUogLmXrey4sMTgFux2HuWW2dsdrf4kkM/7f3e9b28ea5c36e0/	2 KB 2 KB	36ms 36ms	XHR text/html	2606:4700:3035::ac43:cb1e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://officesecure.org/cdn-cgi/challenge-platform/h/g/flow/ov1/2144254940:1691565776:2Ep7AFAWapGUogLmXrey4sMTgFux2HuWW2dsdrf4kkM/7f3e9b28ea5c36e0/a926af64865a671 Requested by Host: officesecure.org URL: https://officesecure.org/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=7f3e9b28ea5c36e0 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3035::ac43:cb1e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 84149e0e20faa635f10b90ed5f02dc1f251a55b9f18791b437d6b7e96739b5b2 Request headers Referer https://officesecure.org/M accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 CF-Challenge a926af64865a671 Content-type application/x-www-form-urlencoded Response headers cf-chl-out 2tSpIksk4B66x+5ln1s3arOLunKlAB/T/CgtAkjGRTTNKja37W+bRCO1zfhMOEyY1a6gqcbNNGjD8EtwYCq6zzeTNzK5S+Tn0zgYYmBDDDE=$qTTrBwuWoU/z2QmFloYj/A== cf-chl-out-s hqbJZbniNwaql6VwuoG7AaFVPJ64DGhEoPcrx8GnUb/w8JD5Y2EB81dncbeT0Jj7YwMQ9diMnGrirFF6suTxfw==$qxBA8GLyyksjzvJfDH5TvA== date Wed, 09 Aug 2023 08:25:02 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JV5eUFNiD6ScTjYy6O%2B%2BvHUClM9v8Mm4oh%2BX%2FmV%2FhVUhllrYj05PE96m01lOi%2ByD6n%2Fb3O6lYqlMeOMymgNyM4dX9pq1ydWD84khPUcqC7wWgIsYXeZ%2BgHcLi4reUFvPNhypDKJl75AAdTxRp2qZ"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=UTF-8 cf-ray 7f3e9b2cf9824d2b-FRA alt-svc h3=":443"; ma=86400
GET H3	403	Primary Request M Show response officesecure.org/	6 KB 5 KB	26ms 26ms	Document text/html	2606:4700:3035::ac43:cb1e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://officesecure.org/M Requested by Host: officesecure.org URL: https://officesecure.org/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=7f3e9b28ea5c36e0 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3035::ac43:cb1e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 42fbd880e46b8a26a2bd4f39d95ef977b5152e63d1a13c2c677a155761557e61 Security Headers Name Value X-Frame-Options SAMEORIGIN Request headers Referer https://officesecure.org/M Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cache-control private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-mitigated challenge cf-ray 7f3e9b3c8b804d2b-FRA content-encoding br content-type text/html; charset=UTF-8 cross-origin-embedder-policy require-corp cross-origin-opener-policy same-origin cross-origin-resource-policy same-origin date Wed, 09 Aug 2023 08:25:04 GMT expires Thu, 01 Jan 1970 00:00:01 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} origin-agent-cluster ?1 permissions-policy accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() referrer-policy same-origin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eQr6b98M7leQ4T237WrTKqzX1%2FRBc3DseCiNzxLLOrVDuVvDdJlOunTELuZmNePlDpT%2F24ztBZb7RAnaaRRuIX%2BHNte%2FcaOqWe6zaFvUduSvd9pFuAJabQshJsyZAJ69gN3uAbIlh2UeZYBCvkdT"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding x-frame-options SAMEORIGIN
GET H3	200	challenges.css officesecure.org/cdn-cgi/styles/	6 KB 3 KB	24ms 24ms	Stylesheet text/css	2606:4700:3035::ac43:cb1e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://officesecure.org/cdn-cgi/styles/challenges.css Requested by Host: officesecure.org URL: https://officesecure.org/M Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3035::ac43:cb1e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2b0bd09c1cc7119d27e45353a59bf6c2721563e1689853ff704057a7439508d2 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options DENY Request headers accept-language de-DE,de;q=0.9 Referer https://officesecure.org/M User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers date Wed, 09 Aug 2023 08:25:04 GMT content-encoding gzip x-content-type-options nosniff last-modified Fri, 04 Aug 2023 16:29:28 GMT server cloudflare etag W/"64cd2768-19c8" x-frame-options DENY vary Accept-Encoding content-type text/css cache-control max-age=7200, public cf-ray 7f3e9b3cbbbf4d2b-FRA expires Wed, 09 Aug 2023 10:25:04 GMT
GET H3	200	v1 Show response officesecure.org/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/	161 KB 55 KB	31ms 31ms	Script application/javascript	2606:4700:3035::ac43:cb1e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://officesecure.org/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=7f3e9b3c8b804d2b Requested by Host: officesecure.org URL: https://officesecure.org/M Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3035::ac43:cb1e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 332989d3cd67969521f05284ce9b8bc5f19a3b21ef77473d46892632f020dcd8 Request headers accept-language de-DE,de;q=0.9 Referer https://officesecure.org/M?__cf_chl_rt_tk=GUypumyXRC0ICrVzlcmAbXN1ctaejIt1mx59vrDcRJE-1691569504-0-gaNycGzNCfs User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers date Wed, 09 Aug 2023 08:25:04 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hNL3EVF9kMrPyFU1ohWqbbiboam3u%2F8nVSuLjFw%2BZ6pbTvm98R%2BbipReaaQ4LpuMP4gsXLVPPYsSlaFlcAvehaN2sf%2BUN4QCnKPg0Wf%2FdINI0lzQ5WdULvVlWhKQzW36J%2FDdx1EGFBQBo9tsDCYz"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=UTF-8 cache-control private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-ray 7f3e9b3cebfb4d2b-FRA alt-svc h3=":443"; ma=86400
GET H2	200	api.js Show response challenges.cloudflare.com/turnstile/v0/g/74ac0d47/	27 KB 10 KB	51ms 50ms	Script application/javascript	2606:4700::6811:2b8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://challenges.cloudflare.com/turnstile/v0/g/74ac0d47/api.js?onload=aJ4&render=explicit Requested by Host: officesecure.org URL: https://officesecure.org/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=7f3e9b3c8b804d2b Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:2b8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e0f33190c14b543e76e11ab58c238e5d56508c3d0933c1cd7c64e478fedee376 Request headers Referer Origin https://officesecure.org accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers date Wed, 09 Aug 2023 08:25:04 GMT content-encoding br server cloudflare vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control max-age=31536000 cf-ray 7f3e9b3d6994691b-FRA alt-svc h3=":443"; ma=86400
GET H3	403	favicon.ico officesecure.org/	6 KB 6 KB	26ms 26ms	Image text/html	2606:4700:3035::ac43:cb1e CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://officesecure.org/favicon.ico Requested by Host: officesecure.org URL: https://officesecure.org/M Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3035::ac43:cb1e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e2adb1eac96e7a1cfe845127dabef3aa5bf4626fbadc497d2ee9e1022f4dcf5b Security Headers Name Value X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://officesecure.org/M User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers date Wed, 09 Aug 2023 08:25:04 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cross-origin-embedder-policy require-corp cross-origin-resource-policy same-origin alt-svc h3=":443"; ma=86400 referrer-policy same-origin server cloudflare cross-origin-opener-policy same-origin cf-mitigated challenge x-frame-options SAMEORIGIN report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yn0O2Jajnbhk8uNbI%2FGvDvLkPvjeh%2BbJKQfGhYX5uAsCvrNe1ER69ZVw4TEBqhBlBzf8ZNQO5ktWLSoyyoGsgPV8u2eb%2FAVO8HAVxhBdLCjz7j9VJmZrI6Kqe5ytD6Rz9TWcNVCMDktWOKM0MjPT"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=UTF-8 vary Accept-Encoding origin-agent-cluster ?1 cache-control private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 permissions-policy accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() cf-ray 7f3e9b3d6cc44d2b-FRA expires Thu, 01 Jan 1970 00:00:01 GMT
GET DATA	200 OK	truncated /	586 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash fc95732d9ff3b17fcb3e64fd12c0d451c38e64e1a4b420c556a7feb756a0a3fa Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers Content-Type image/png
GET BLOB	200 OK	a12c4bd5-dc90-4a31-abea-c2efa586f792 https://officesecure.org/	13 B 0		Other text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://officesecure.org/a12c4bd5-dc90-4a31-abea-c2efa586f792 Requested by Host: officesecure.org URL: https://officesecure.org/M Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 8860e7fef89219a219cb11d18bd8e4a322f32072613f86e935e7fe162ab69c04 Request headers accept-language de-DE,de;q=0.9 Referer https://officesecure.org/M User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers Content-Length 13 Content-Type text/javascript
POST H3	200	092ae073561cae6 Show response officesecure.org/cdn-cgi/challenge-platform/h/g/flow/ov1/613825046:1691565753:7aIyrh9Z1uO4zl9NrdVYwInM2jXW-NzHTWlRTnIDAjY/7f3e9b3c8b804d2b/	9 KB 8 KB	45ms 45ms	XHR text/plain	2606:4700:3035::ac43:cb1e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://officesecure.org/cdn-cgi/challenge-platform/h/g/flow/ov1/613825046:1691565753:7aIyrh9Z1uO4zl9NrdVYwInM2jXW-NzHTWlRTnIDAjY/7f3e9b3c8b804d2b/092ae073561cae6 Requested by Host: officesecure.org URL: https://officesecure.org/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=7f3e9b3c8b804d2b Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3035::ac43:cb1e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 25bce97b622a3ea5d668c9f768aaa626845100d99fdb19882cfa889f6b30d595 Request headers Referer https://officesecure.org/M accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 CF-Challenge 092ae073561cae6 Content-type application/x-www-form-urlencoded Response headers date Wed, 09 Aug 2023 08:25:04 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TWzqdb9466doUkdHTb4vaqceIpQdtrPjvk%2F1T%2BJbytTVlOS%2FbKANS8qxvIhR9pFii%2BaW%2F9pIjI5gx7SVAFlKqrsPSa1KCsumN5vll2Nm77IiGVebPNNHo7wDEKIxU5K8bHtGQOVo5INMAiHymlY2"}],"group":"cf-nel","max_age":604800} content-type text/plain; charset=UTF-8 cf-ray 7f3e9b3e1d904d2b-FRA alt-svc h3=":443"; ma=86400 cf-chl-gen ZVLh43V2r2fqvE4j3+Kasmj4Y0/LX/MOjQ7fymeYTfTe3M1rlByxIEy7WS/hqbZN$l/TKUmeYPF6Of4zI2gUyFA==
GET H3	200	normal challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/ork26/0x4AAAAAAADnPIDROrmt1Wwj/light/ Frame 9B5E	0 0	32ms 31ms	Document text/html	2606:4700::6811:2b8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/ork26/0x4AAAAAAADnPIDROrmt1Wwj/light/normal Requested by Host: challenges.cloudflare.com URL: https://challenges.cloudflare.com/turnstile/v0/g/74ac0d47/api.js?onload=aJ4&render=explicit Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:2b8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Content-Security-Policy frame-src https://challenges.cloudflare.com/; base-uri 'self' Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cache-control private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-ray 7f3e9b3e7e5b4d7c-FRA content-encoding br content-security-policy frame-src https://challenges.cloudflare.com/; base-uri 'self' content-type text/html; charset=UTF-8 cross-origin-embedder-policy require-corp cross-origin-opener-policy same-origin cross-origin-resource-policy cross-origin date Wed, 09 Aug 2023 08:25:05 GMT document-policy js-profiling origin-agent-cluster ?1 permissions-policy accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() referrer-policy same-origin server cloudflare
POST H3	200	092ae073561cae6 Show response officesecure.org/cdn-cgi/challenge-platform/h/g/flow/ov1/613825046:1691565753:7aIyrh9Z1uO4zl9NrdVYwInM2jXW-NzHTWlRTnIDAjY/7f3e9b3c8b804d2b/	2 KB 2 KB	35ms 34ms	XHR text/html	2606:4700:3035::ac43:cb1e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://officesecure.org/cdn-cgi/challenge-platform/h/g/flow/ov1/613825046:1691565753:7aIyrh9Z1uO4zl9NrdVYwInM2jXW-NzHTWlRTnIDAjY/7f3e9b3c8b804d2b/092ae073561cae6 Requested by Host: officesecure.org URL: https://officesecure.org/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=7f3e9b3c8b804d2b Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3035::ac43:cb1e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2ff5e8dd0a656508e2570df9c99cd46802fccec2fc79783900c04b3654bb1fa8 Request headers Referer https://officesecure.org/M accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 CF-Challenge 092ae073561cae6 Content-type application/x-www-form-urlencoded Response headers cf-chl-out JKSk8tbTHXFuc2oJzd+xlw8YdUqNZ2tU4vHJRC/A96MVE5v2nCe2e3vqe15ZhC6NWBPsFbHxhCG2U4zryx9jA+a/M1w77PL+jPBYgN5oGh8=$Gu7UZ+4LoVchbvmHO89KPQ== cf-chl-out-s oCsvxZeLOzsjsehLoip5p6Vh7yBYoUVZ90yxm3k/ncw2cJPxRwI7b929zmvLeAjlxexHKHgoZEtk252lXpa68ePyWNH7s7Gv8DO7mO6/BbpAxsQzBvvLpI7fd0Y47fcvwU2yd/ScQcxqdEbLdmpWmWTGl/8romTw0+NQVaDbAUg=$zaCVG+GQDCW8TYPLMf0MIA== date Wed, 09 Aug 2023 08:25:05 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O4kizHpd1ns2rCeo85kTQERxHyHEkHKx12KWpEtPDQURrkYKJZ9OpWP0pXyCbaR60vk3wbu0RHVrQaQ4L5%2FMyJZohenwslo2KxFYgDhEdh6Agxv%2BZZyPJNk1Oiut7P6f3mpDi3dKFZMGSF8fPUBI"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=UTF-8 cf-ray 7f3e9b4078644d2b-FRA alt-svc h3=":443"; ma=86400

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| _cf_chl_opt function| JxrZVR3 function| aJ4 boolean| hB6 function| jONVS1 function| OmMkiGZRYC function| nmb6 function| nS3 function| YwhN0 object| PQf2 object| JkGxse9 object| turnstile boolean| nYmegH0 string| iDYwS6

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			nwwrq.kgswc.org/	1969-12-31 23:59:59	Name: PHPSESSID Value: f52d938a966bdb08d9f45fb276c44c69
			officesecure.org/	1970-01-20 13:52:53	Name: cf_chl_rc_m Value: 1

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	Message: Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.
network	error	URL: https://officesecure.org/M Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://officesecure.org/favicon.ico Message: Failed to load resource: the server responded with a status of 403 ()
security	warning	Message: Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.
network	error	URL: https://officesecure.org/M Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://officesecure.org/favicon.ico Message: Failed to load resource: the server responded with a status of 403 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

challenges.cloudflare.com
nwwrq.kgswc.org
officesecure.org
147.124.221.154
2606:4700:3035::ac43:cb1e
2606:4700::6811:2b8
25bce97b622a3ea5d668c9f768aaa626845100d99fdb19882cfa889f6b30d595
2b0bd09c1cc7119d27e45353a59bf6c2721563e1689853ff704057a7439508d2
2ff5e8dd0a656508e2570df9c99cd46802fccec2fc79783900c04b3654bb1fa8
332989d3cd67969521f05284ce9b8bc5f19a3b21ef77473d46892632f020dcd8
42fbd880e46b8a26a2bd4f39d95ef977b5152e63d1a13c2c677a155761557e61
4f8b136d82220148a7be4fcbb89f996355715ee8cce66791b07a9986c0165778
84149e0e20faa635f10b90ed5f02dc1f251a55b9f18791b437d6b7e96739b5b2
8860e7fef89219a219cb11d18bd8e4a322f32072613f86e935e7fe162ab69c04
a3c542e61f98be39726949f1070fcb4b1f83a41ebce9e2bbdc1e9fa26ff62ed6
b497683d179f4d45c7e09e33de063e29fafb278be21cac2da068f5f044401fea
e0b24ed875dfb1154ee4f00fe8256887f1256f8209f648888c0f06af6a5464d9
e0f33190c14b543e76e11ab58c238e5d56508c3d0933c1cd7c64e478fedee376
e2adb1eac96e7a1cfe845127dabef3aa5bf4626fbadc497d2ee9e1022f4dcf5b
fc95732d9ff3b17fcb3e64fd12c0d451c38e64e1a4b420c556a7feb756a0a3fa