urlscan.io logo urlscan.io
SecurityTrails logo

pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev Open in urlscan Pro
2606:4700::6812:323  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://grupogef63.com/redirect.php?v=0cf1ff2da4d5fcf
Effective URL: https://pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev/index.html
Submission: On September 13 via manual from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 7 IPs in 3 countries across 8 domains to perform 15 HTTP transactions. The main IP is 2606:4700::6812:323, located in United States and belongs to CLOUDFLARENET, US. The main domain is pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev.
TLS certificate: Issued by E1 on August 13th 2023. Valid for: 3 months.
This is the only time pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
4 4 167.250.49.16 263767 (CORPORACI...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
8 2a06:98c1:312... 13335 (CLOUDFLAR...)
1 2001:4de0:ac1... 20446 (STACKPATH...)
1 2 2606:4700::68... 13335 (CLOUDFLAR...)
2 2606:2800:233... 15133 (EDGECAST)
1 2606:2800:233... 15133 (EDGECAST)
15 7
4    167.250.49.16 (Caracas, Venezuela, Bolivarian Republic Of)

ASN263767 (CORPORACION GALA IT, C.A., VE)
PTR: gitvecpwhm-02.galawebhost.net
grupogef63.com
inkerberos.com
1    2606:4700::6812:323 (United States)

ASN13335 (CLOUDFLARENET, US)
pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev
1    2606:4700::6812:223 (United States)

ASN13335 (CLOUDFLARENET, US)
pub-4d5644b6a19b4feb9419c544ddb45f9d.r2.dev
8    2a06:98c1:3120::3 (United States)

ASN13335 (CLOUDFLARENET, US)
codecrafters.su
1    2001:4de0:ac18::1:a:3b (Netherlands)

ASN20446 (STACKPATH-CDN, US)
code.jquery.com
2    2606:4700::6811:2b8 (United States)

ASN13335 (CLOUDFLARENET, US)
challenges.cloudflare.com
2    2606:2800:233:78b9:f44e:2c1f:31aa:d9ef (United States)

ASN15133 (EDGECAST, US)
aadcdn.msftauth.net
1    2606:2800:233:b411:5612:27a2:d7a8:208d (United States)

ASN15133 (EDGECAST, US)
logincdn.msauth.net
Apex Domain
Subdomains		 Transfer
8 codecrafters.su
codecrafters.su
19 KB
3 inkerberos.com
inkerberos.com
826 B
2 msftauth.net
aadcdn.msftauth.net — Cisco Umbrella Rank: 1217
4 KB
2 cloudflare.com
challenges.cloudflare.com — Cisco Umbrella Rank: 5544
11 KB
2 r2.dev
pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev
pub-4d5644b6a19b4feb9419c544ddb45f9d.r2.dev
28 KB
1 msauth.net
logincdn.msauth.net — Cisco Umbrella Rank: 3863
688 B
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 918
30 KB
1 grupogef63.com
grupogef63.com
307 B
15 8
Domain Requested by
8 codecrafters.su pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev
pub-4d5644b6a19b4feb9419c544ddb45f9d.r2.dev
code.jquery.com
3 inkerberos.com 3 redirects
2 aadcdn.msftauth.net pub-4d5644b6a19b4feb9419c544ddb45f9d.r2.dev
2 challenges.cloudflare.com 1 redirects pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev
1 logincdn.msauth.net pub-4d5644b6a19b4feb9419c544ddb45f9d.r2.dev
1 code.jquery.com pub-4d5644b6a19b4feb9419c544ddb45f9d.r2.dev
1 pub-4d5644b6a19b4feb9419c544ddb45f9d.r2.dev pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev
1 pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev
1 grupogef63.com 1 redirects
15 9

This site contains no links.

Subject Issuer Validity Valid
*.r2.dev
E1		 2023-08-13 -
2023-11-11		 3 months crt.sh
codecrafters.su
GTS CA 1P5		 2023-08-06 -
2023-11-04		 3 months crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2023-07-11 -
2024-07-14		 a year crt.sh
aadcdn.msftauth.net
DigiCert SHA2 Secure Server CA		 2023-01-31 -
2024-01-31		 a year crt.sh
identitycdn.msauth.net
Microsoft Azure TLS Issuing CA 02		 2023-08-10 -
2024-06-27		 a year crt.sh

This page contains 1 frames:

Primary Page: https://pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev/index.html
Frame ID: 341C5B5676867D81A32730ADAC6E7FAC
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://grupogef63.com/redirect.php?v=0cf1ff2da4d5fcf HTTP 302
    https://inkerberos.com//redirect.php?v=e91bd02961909eb HTTP 302
    https://inkerberos.com//redirect.php?v=5570476871c3c38 HTTP 302
    https://inkerberos.com//redirect.php?v=c9e4eea77238ad8 HTTP 302
    https://pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev/index.html Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

15
Requests

93 %
HTTPS

88 %
IPv6

8
Domains

9
Subdomains

7
IPs

3
Countries

93 kB
Transfer

331 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://grupogef63.com/redirect.php?v=0cf1ff2da4d5fcf HTTP 302
    https://inkerberos.com//redirect.php?v=e91bd02961909eb HTTP 302
    https://inkerberos.com//redirect.php?v=5570476871c3c38 HTTP 302
    https://inkerberos.com//redirect.php?v=c9e4eea77238ad8 HTTP 302
    https://pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev/index.html Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 7
  • https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit HTTP 302
  • https://challenges.cloudflare.com/turnstile/v0/g/0cecfec7/api.js?render=explicit

15 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request index.html
pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev/
Redirect Chain
  • https://grupogef63.com/redirect.php?v=0cf1ff2da4d5fcf
  • https://inkerberos.com//redirect.php?v=e91bd02961909eb
  • https://inkerberos.com//redirect.php?v=5570476871c3c38
  • https://inkerberos.com//redirect.php?v=c9e4eea77238ad8
  • https://pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev/index.html
130 B
479 B 		Document
General
Check archive.org
Download Go to
Full URL
https://pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev/index.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:323 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
94a386496a2fb87caf557c3f1eda70583f306c1029af4310f537060979bb931a

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

CF-RAY
806142750afb9966-FRA
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html
Date
Wed, 13 Sep 2023 15:00:24 GMT
ETag
W/"886e9ffafe7ce841763e65c28b12473e"
Last-Modified
Tue, 05 Sep 2023 13:35:26 GMT
Server
cloudflare
Transfer-Encoding
chunked
Vary
Accept-Encoding

Redirect headers

cache-control
no-store, no-cache, must-revalidate s-maxage=10
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Wed, 13 Sep 2023 15:00:24 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
location
https://pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev/index.html#
pragma
no-cache
server
nginx
vary
Accept-Encoding
myscr115516.js
pub-4d5644b6a19b4feb9419c544ddb45f9d.r2.dev/ 		121 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pub-4d5644b6a19b4feb9419c544ddb45f9d.r2.dev/myscr115516.js
Requested by
Host: pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev
URL: https://pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev/index.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
611e3969ca80ab322b49d8e9c2dd7b4333f5a7893447a106adc9dae76a819277

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

Date
Wed, 13 Sep 2023 15:00:25 GMT
Content-Encoding
gzip
Last-Modified
Tue, 05 Sep 2023 13:29:29 GMT
Server
cloudflare
ETag
W/"885844c5f65d390cc3441a88313a2f8f"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
text/javascript
Connection
keep-alive
CF-RAY
806142763a5835e0-FRA
pages-head-top.min.js
codecrafters.su/assets/js/ 		2 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://codecrafters.su/assets/js/pages-head-top.min.js?cb=1694617225337
Requested by
Host: pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev
URL: https://pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev/index.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ca8cdb63b1eed15609613e1b66585a080f28d39eb84e0bec72c6924b3d060e3c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date
Wed, 13 Sep 2023 15:00:26 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Thu, 07 Sep 2023 17:32:11 GMT
server
cloudflare
etag
W/"8f9-604c83d7bd120"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NhVeLknQ9y3yCmigOQm%2BZog2TBRa5mDWN5ZHgCCIv6Em4CRtKn2%2BVllpRgz8lqV4xUXLhvJ7mHM9iYe8mspxIJPgzQF0mUiksCxFw9ME4GFMhhWGj5yuwJFmEtULJmt4v7QLFRdK2sWrKRoeYqo%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
vary
Accept-Encoding
cf-ray
8061427e5d993816-FRA
q2b8bnIImW1.css
codecrafters.su/assets/pages/ 		1 KB
918 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://codecrafters.su/assets/pages/q2b8bnIImW1.css?cb=1694617226091
Requested by
Host: pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev
URL: https://pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5649fb4226d21eda7474614810b324f33d4463e7316e6161dc6993e0c3ee15b4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date
Wed, 13 Sep 2023 15:00:26 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Thu, 07 Sep 2023 16:16:14 GMT
server
cloudflare
etag
W/"499-604c72dd27101"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xEQLYmuOXDrIDnC%2B6JyHH1RCLvqCudIogDYmSkCW%2Bp74JY%2FhHDlH2%2Fvc4M2IM9%2B86txEtl0VcUrhUufDfWYPYUx8XCND5yXXrS7IZB7nnEihX2FDCf8c8UMABa%2FXQcT%2B9cOnsuM4wdreIAdML0s%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=14400
vary
Accept-Encoding
cf-ray
8061427f4fb3372c-FRA
pages.min.css
codecrafters.su/assets/css/ 		16 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://codecrafters.su/assets/css/pages.min.css?cb=1694617226091
Requested by
Host: pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev
URL: https://pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a15bbdc08a7f9c72de1e67cf0c58b5e044c84b5ddc566d6b8f504e54ca111945
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date
Wed, 13 Sep 2023 15:00:26 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Thu, 10 Aug 2023 14:47:26 GMT
server
cloudflare
etag
W/"3f37-60292acb6f793"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kdmF96OhZIJMK3lrcZJizCcSKo0Ca6jdoaqHuxoyNp6o3iG5o4AzDh3MoYNtn4000Nqutp0LOvtM2cdFqoD2e1lruWxDwL0g10IT6NP2GxFLkXGr654aCUQZ6Obn8gSuvvOA9H%2BJShFBqchjl1s%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=14400
vary
Accept-Encoding
cf-ray
8061427f4fb4372c-FRA
pages-head.min.js
codecrafters.su/assets/js/ 		8 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://codecrafters.su/assets/js/pages-head.min.js?cb=1694617226091
Requested by
Host: pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev
URL: https://pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2726fe9a48bdbca5b61b2f9f25d7e2fe7fedd95689b95e917490689b8ece7865
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date
Wed, 13 Sep 2023 15:00:26 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Tue, 12 Sep 2023 20:37:29 GMT
server
cloudflare
etag
W/"1e82-6052f695de6aa"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=D%2BkaTilCNlSK0UoW8vPg9iMFV5kuh6lHs1O1BHHW9hOtGR%2FjwzKKr5W7uQSwh%2BtSnVedyNsji1%2BYSAwLwreErJJrVwzyL%2B%2FNzQlojuv563%2BN7UqwI1ZjAVXV3ygfgAbcw8OZUj3pnqcSbarAWzg%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
vary
Accept-Encoding
cf-ray
8061427fd879372c-FRA
pages.min.js
codecrafters.su/assets/js/ 		54 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://codecrafters.su/assets/js/pages.min.js?cb=1694617226091
Requested by
Host: pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev
URL: https://pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev/index.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ff887f711d4a7fa4466a6064ac8aaa3b1ee76a386218da908e8bd5a12d468f7f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date
Wed, 13 Sep 2023 15:00:26 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block
last-modified
Wed, 13 Sep 2023 06:13:03 GMT
server
cloudflare
etag
W/"d8bd-6053773b88bb5"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SN5ZptSDpqs9lsN4zn8Ddfylu8n5XchHMO5nc1T0l5fKJ8PZXUOl4WVP%2B4%2Biu1c8s6bdUTiNxhR98mfZQeiT0ShrnWpuPDzSG1pAF60LOZlWK3dq15busMfS%2FLcomgrXG7yKxK3wyNLPbC%2Fau3Y%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
vary
Accept-Encoding
cf-ray
8061427fd87f372c-FRA
jquery-3.6.0.min.js
code.jquery.com/ 		87 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.6.0.min.js
Requested by
Host: pub-4d5644b6a19b4feb9419c544ddb45f9d.r2.dev
URL: https://pub-4d5644b6a19b4feb9419c544ddb45f9d.r2.dev/myscr115516.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:3b , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software
nginx /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

Referer
https://pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Wed, 13 Sep 2023 15:00:26 GMT
content-encoding
gzip
last-modified
Fri, 20 Aug 2021 17:47:53 GMT
server
nginx
etag
W/"611feac9-15d9d"
vary
Accept-Encoding
x-hw
1694617226.dop206.fr8.t,1694617226.cds287.fr8.hn,1694617226.cds144.fr8.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
30875
api.js
challenges.cloudflare.com/turnstile/v0/g/0cecfec7/
Redirect Chain
  • https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit
  • https://challenges.cloudflare.com/turnstile/v0/g/0cecfec7/api.js?render=explicit
30 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://challenges.cloudflare.com/turnstile/v0/g/0cecfec7/api.js?render=explicit
Requested by
Host: pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev
URL: https://pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev/index.html
Protocol
H2
Server
2606:4700::6811:2b8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
997e1bdccc2046e6ab9fc361a9340cfdaa49bd28d9b6157b9020dffe8512453e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date
Wed, 13 Sep 2023 15:00:26 GMT
content-encoding
br
server
cloudflare
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
max-age=31536000
cf-ray
8061427f9de79974-FRA
alt-svc
h3=":443"; ma=86400

Redirect headers

date
Wed, 13 Sep 2023 15:00:26 GMT
server
cloudflare
vary
accept-encoding
location
/turnstile/v0/g/0cecfec7/api.js?render=explicit
access-control-allow-origin
*
cache-control
max-age=300, public
cf-ray
8061427f7dc29974-FRA
alt-svc
h3=":443"; ma=86400
back.png
codecrafters.su/assets/ 		231 B
711 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://codecrafters.su/assets/back.png
Requested by
Host: pub-4d5644b6a19b4feb9419c544ddb45f9d.r2.dev
URL: https://pub-4d5644b6a19b4feb9419c544ddb45f9d.r2.dev/myscr115516.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
70e32b2db3f079bb0295a85a0db15ed9e5926294dd947938d6cfa595f5ab18b4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date
Wed, 13 Sep 2023 15:00:26 GMT
x-content-type-options
nosniff
cf-cache-status
REVALIDATED
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
content-length
231
x-xss-protection
1; mode=block
last-modified
Sun, 19 Mar 2023 15:20:17 GMT
server
cloudflare
etag
"e7-5f7425905ae40"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=N0KdOCmVPFQCZLlwI8ywsgd%2FSoBpUb4Q73vfpfp2RT%2Floqj10j8s9QOfGWoY7cxGMw2M1AffVu7zW4s0tPyxBqssnS0IYac1DREufLLFskxFOlub5KBdvL0cXmlCamy8z48cUvyOPVtVQR9gzoU%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=14400
vary
Accept-Encoding
accept-ranges
bytes
cf-ray
8061427fd882372c-FRA
key.png
codecrafters.su/assets/ 		727 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://codecrafters.su/assets/key.png
Requested by
Host: pub-4d5644b6a19b4feb9419c544ddb45f9d.r2.dev
URL: https://pub-4d5644b6a19b4feb9419c544ddb45f9d.r2.dev/myscr115516.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
40ecb8832f6a9a8aaa0cc6e1287e867a4fca38433d091d86c6cab1f28fbab652
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

date
Wed, 13 Sep 2023 15:00:26 GMT
x-content-type-options
nosniff
cf-cache-status
REVALIDATED
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc
h3=":443"; ma=86400
content-length
727
x-xss-protection
1; mode=block
last-modified
Sun, 19 Mar 2023 15:20:17 GMT
server
cloudflare
etag
"2d7-5f7425905ae40"
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QCeZKbiGLWAFdEh0Kq5kl9%2BwivP5Eg4eODcyA9HXPSpGzTxKRghtfCv5NurukoGeLoqpuSTIQeUfSzzyLuThc%2BJccH%2ByrS3iBYhPC013kYU4V8ptj7TEFaAB5AFbMRbIQxb9Dmgqpk5TGzM2VeU%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=14400
vary
Accept-Encoding
accept-ranges
bytes
cf-ray
8061427fd884372c-FRA
picker_verify_fluent_authenticator_59892f1e05e3adf9fd2f71b42d92a27f.svg
aadcdn.msftauth.net/shared/1.0/content/images/ 		7 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aadcdn.msftauth.net/shared/1.0/content/images/picker_verify_fluent_authenticator_59892f1e05e3adf9fd2f71b42d92a27f.svg
Requested by
Host: pub-4d5644b6a19b4feb9419c544ddb45f9d.r2.dev
URL: https://pub-4d5644b6a19b4feb9419c544ddb45f9d.r2.dev/myscr115516.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:78b9:f44e:2c1f:31aa:d9ef , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/4CE1) /
Resource Hash
a7ee799dd5b6f6dbb70b043b766362a6724e71458f9839306c995f06b218c2f8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 13 Sep 2023 15:00:26 GMT
content-encoding
gzip
content-md5
nTculR1Fom7eLci0F6rk+A==
age
9049459
x-cache
HIT
content-length
2407
x-ms-lease-status
unlocked
last-modified
Wed, 24 May 2023 10:11:51 GMT
server
ECAcc (frc/4CE1)
etag
0x8DB5C3F4ADC079A
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
5fa84d31-801e-006c-5b05-9490f5000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
picker_verify_call_c2616792e1950f83fdef6e72dab97293.svg
aadcdn.msftauth.net/shared/1.0/content/images/ 		3 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aadcdn.msftauth.net/shared/1.0/content/images/picker_verify_call_c2616792e1950f83fdef6e72dab97293.svg
Requested by
Host: pub-4d5644b6a19b4feb9419c544ddb45f9d.r2.dev
URL: https://pub-4d5644b6a19b4feb9419c544ddb45f9d.r2.dev/myscr115516.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:78b9:f44e:2c1f:31aa:d9ef , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/4CF6) /
Resource Hash
55ce3b0ce5bc71339308107982cd7671f96014256ded0be36dc8062e64c847f1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 13 Sep 2023 15:00:26 GMT
content-encoding
gzip
content-md5
XHrPYKKsqlxUvysuxtSE2A==
age
8987752
x-cache
HIT
content-length
1173
x-ms-lease-status
unlocked
last-modified
Wed, 24 May 2023 10:11:50 GMT
server
ECAcc (frc/4CF6)
etag
0x8DB5C3F4A98E9BB
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
c90ed806-201e-007d-6094-94d1d0000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
picker_verify_email_958962caa7cf6b75cd412e9e3b687b22.svg
logincdn.msauth.net/shared/1.0/content/images/ 		268 B
688 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://logincdn.msauth.net/shared/1.0/content/images/picker_verify_email_958962caa7cf6b75cd412e9e3b687b22.svg
Requested by
Host: pub-4d5644b6a19b4feb9419c544ddb45f9d.r2.dev
URL: https://pub-4d5644b6a19b4feb9419c544ddb45f9d.r2.dev/myscr115516.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:b411:5612:27a2:d7a8:208d , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frb/6688) /
Resource Hash
b02b5df3ecd59d6cd90c60878683477532cbfc24660028657f290bdc7bc774b5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Wed, 13 Sep 2023 15:00:26 GMT
content-encoding
gzip
content-md5
pFQUXilUkzYtIbvSwGgVBQ==
age
2454966
x-cache
HIT
content-length
212
x-ms-lease-status
unlocked
last-modified
Wed, 24 May 2023 10:21:22 GMT
server
ECAcc (frb/6688)
etag
0x8DB5C409F549E50
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
204a795f-701e-0052-1cff-cf9062000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
info
codecrafters.su/ 		13 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://codecrafters.su/info
Requested by
Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.6.0.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/8.1.10
Resource Hash
f9da16abdbf82f25c87416ab90c448cd30e8b47c1c85330769be5af0e279ece3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
*/*
Referer
https://pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.187 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Wed, 13 Sep 2023 15:00:26 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
PHP/8.1.10
x-frame-options
SAMEORIGIN
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=W6ccQAK4PzHuAV6ieSOf3yeVm7xmwLiCxTkqvikgA8yv40gzPHoGpvlb3IyaZQOIGrnYvR57kThXq45Rh4R1xM4ZK8FfZevZaYzHsiVIUuxMz5MN61BQFTs6gx9nVvJUt0%2FVCoTGsXO%2FJXdTg8w%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/json
access-control-allow-origin
*
cache-control
no-cache, private
cf-ray
806142807fe63816-FRA
alt-svc
h3=":443"; ma=86400
x-xss-protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

44 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture object| erp string| em number| tmp object| xhr object| s function| _0xa3ee function| _0x560558 object| linkElement object| linkElementcss object| scriptElementhead function| _0xac4d object| scriptElement function| $ function| jQuery object| turnstile object| pagedata string| portnum string| redirecturl string| cloudflaresitekey function| bottomsectionlinks function| getEmailParamFromURL number| interacted function| loadinganimation function| runanimation function| changebackbutton function| backbuttonclick function| linkoptionclick function| authappbottomtext function| selectprotectoption function| displayprotectoptions function| displaymultipleaccounts function| displaytwofamethods function| sendinfo function| selectmultipleaccount function| selecttwofamethod function| protectsend function| valaction function| checkerrordesc function| sendemail function| validate function| backbtn string| emailval boolean| pwdVal

2 Cookies

Domain/Path Name / Value
grupogef63.com/ Name: PHPSESSID
Value: 462c50fd87495ad5ce1d92931708efaf
inkerberos.com/ Name: PHPSESSID
Value: 035c565319991f9e9baef55969092538

3 Console Messages

Source Level URL
Text
javascript warning URL: https://pub-4d5644b6a19b4feb9419c544ddb45f9d.r2.dev/myscr115516.js(Line 5293)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.6.0.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-4d5644b6a19b4feb9419c544ddb45f9d.r2.dev/myscr115516.js(Line 5293)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.6.0.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://pub-4d5644b6a19b4feb9419c544ddb45f9d.r2.dev/myscr115516.js(Line 5293)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msftauth.net
challenges.cloudflare.com
code.jquery.com
codecrafters.su
grupogef63.com
inkerberos.com
logincdn.msauth.net
pub-4d5644b6a19b4feb9419c544ddb45f9d.r2.dev
pub-fbe2ad94e6644a39a084d76e0bae536c.r2.dev
167.250.49.16
2001:4de0:ac18::1:a:3b
2606:2800:233:78b9:f44e:2c1f:31aa:d9ef
2606:2800:233:b411:5612:27a2:d7a8:208d
2606:4700::6811:2b8
2606:4700::6812:223
2606:4700::6812:323
2a06:98c1:3120::3
2726fe9a48bdbca5b61b2f9f25d7e2fe7fedd95689b95e917490689b8ece7865
40ecb8832f6a9a8aaa0cc6e1287e867a4fca38433d091d86c6cab1f28fbab652
55ce3b0ce5bc71339308107982cd7671f96014256ded0be36dc8062e64c847f1
5649fb4226d21eda7474614810b324f33d4463e7316e6161dc6993e0c3ee15b4
611e3969ca80ab322b49d8e9c2dd7b4333f5a7893447a106adc9dae76a819277
70e32b2db3f079bb0295a85a0db15ed9e5926294dd947938d6cfa595f5ab18b4
94a386496a2fb87caf557c3f1eda70583f306c1029af4310f537060979bb931a
997e1bdccc2046e6ab9fc361a9340cfdaa49bd28d9b6157b9020dffe8512453e
a15bbdc08a7f9c72de1e67cf0c58b5e044c84b5ddc566d6b8f504e54ca111945
a7ee799dd5b6f6dbb70b043b766362a6724e71458f9839306c995f06b218c2f8
b02b5df3ecd59d6cd90c60878683477532cbfc24660028657f290bdc7bc774b5
ca8cdb63b1eed15609613e1b66585a080f28d39eb84e0bec72c6924b3d060e3c
f9da16abdbf82f25c87416ab90c448cd30e8b47c1c85330769be5af0e279ece3
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
ff887f711d4a7fa4466a6064ac8aaa3b1ee76a386218da908e8bd5a12d468f7f