a9328f77.33023cc9ae08612ab75b308f.workers.dev Open in urlscan Pro
2606:4700:3030::6815:19c2 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://search.ksrevenue.org/texis/search/redir.html?query=kselien&pr=KSRevenue&prox=page&rorder=500&rprox=500&rdfreq=500&rwf...
Effective URL:
https://a9328f77.33023cc9ae08612ab75b308f.workers.dev/?qrc=steve.eddy@hrsflow.com
Submission: On May 09 via manual (May 9th 2023, 7:35:29 am UTC) from IN — Scanned from DE

Summary HTTP 9 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 5 domains to perform 9 HTTP transactions. The main IP is 2606:4700:3030::6815:19c2, located in United States and belongs to CLOUDFLARENET, US. The main domain is a9328f77.33023cc9ae08612ab75b308f.workers.dev.
TLS certificate: Issued by GTS CA 1P5 on April 26th 2023. Valid for: 3 months.

This is the only time a9328f77.33023cc9ae08612ab75b308f.workers.dev was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	165.201.125.249 165.201.125.249	3446 (KANSAS) (KANSAS)
1	192.185.129.235 192.185.129.235	46606 (UNIFIEDLA...) (UNIFIEDLAYER-AS-1)
1	2606:4700:303... 2606:4700:3030::6815:19c2	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a06:98c1:312... 2a06:98c1:3120::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	104.16.169.131 104.16.169.131	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	5

1 165.201.125.249 (Topeka, United States) 1 redirects

ASN3446 (KANSAS, US)

search.ksrevenue.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.185.129.235 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: 192-185-129-235.unifiedlayer.com

4qyxe6.08zej.cybersecurity.ke	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3030::6815:19c2 (United States)

ASN13335 (CLOUDFLARENET, US)

a9328f77.33023cc9ae08612ab75b308f.workers.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a06:98c1:3120::3 (United States)

ASN13335 (CLOUDFLARENET, US)

1d192bbf.captcha222.pages.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.16.169.131 (None, )

ASN13335 (CLOUDFLARENET, US)

js.hcaptcha.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
newassets.hcaptcha.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api2.hcaptcha.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
6	hcaptcha.com js.hcaptcha.com — Cisco Umbrella Rank: 13326 newassets.hcaptcha.com — Cisco Umbrella Rank: 12271 api2.hcaptcha.com — Cisco Umbrella Rank: 25473	246 KB
1	pages.dev 1d192bbf.captcha222.pages.dev — Cisco Umbrella Rank: 824574	2 KB
1	workers.dev a9328f77.33023cc9ae08612ab75b308f.workers.dev	752 B
1	cybersecurity.ke 4qyxe6.08zej.cybersecurity.ke	1 KB
1	ksrevenue.org 1 redirects search.ksrevenue.org	278 B
9	5

	Domain	Requested by
4	newassets.hcaptcha.com	js.hcaptcha.com newassets.hcaptcha.com
1	api2.hcaptcha.com	newassets.hcaptcha.com
1	js.hcaptcha.com	a9328f77.33023cc9ae08612ab75b308f.workers.dev
1	1d192bbf.captcha222.pages.dev	a9328f77.33023cc9ae08612ab75b308f.workers.dev
1	a9328f77.33023cc9ae08612ab75b308f.workers.dev	4qyxe6.08zej.cybersecurity.ke
1	4qyxe6.08zej.cybersecurity.ke
1	search.ksrevenue.org	1 redirects
9	7

This site contains no links.

Subject Issuer	Validity	Valid
33023cc9ae08612ab75b308f.workers.dev GTS CA 1P5	`2023-04-26` - `2023-07-25`	3 months	crt.sh
captcha222.pages.dev GTS CA 1P5	`2023-04-20` - `2023-07-19`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-04-15` - `2024-04-14`	a year	crt.sh

This page contains 3 frames:

Primary Page: https://a9328f77.33023cc9ae08612ab75b308f.workers.dev/?qrc=steve.eddy@hrsflow.com
Frame ID: 9AE98E990C9EEBF42427CED1F9C586AA
Requests: 4 HTTP requests in this frame

Frame: https://newassets.hcaptcha.com/captcha/v1/be52ae5/static/hcaptcha.html
Frame ID: 9501F3F1E3017D5550662FE8F59D6033
Requests: 2 HTTP requests in this frame

Frame: https://newassets.hcaptcha.com/captcha/v1/be52ae5/static/hcaptcha.html
Frame ID: 3394FC6764EE9F168129D5D1BFFC6F30
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Verification

Page URL History Show full URLs

https://search.ksrevenue.org/texis/search/redir.html?query=kselien&pr=KSRevenue&prox=page&rorder=500&rpro... HTTP 302
http://4qyxe6.08zej.cybersecurity.ke/c3RldmUuZWRkeUBocnNmbG93LmNvbQ== Page URL
https://a9328f77.33023cc9ae08612ab75b308f.workers.dev/?qrc=steve.eddy@hrsflow.com Page URL

Page Statistics

9
Requests

89 %
HTTPS

40 %
IPv6

5
Domains

7
Subdomains

5
IPs

2
Countries

250 kB
Transfer

878 kB
Size

1
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://search.ksrevenue.org/texis/search/redir.html?query=kselien&pr=KSRevenue&prox=page&rorder=500&rprox=500&rdfreq=500&rwfreq=500&rlead=500&rdepth=0&sufs=0&order=dd&u=http%3A%2F%2F4qyxe6.08zej.cybersecurity.ke%2Fc3RldmUuZWRkeUBocnNmbG93LmNvbQ== HTTP 302
http://4qyxe6.08zej.cybersecurity.ke/c3RldmUuZWRkeUBocnNmbG93LmNvbQ== Page URL
https://a9328f77.33023cc9ae08612ab75b308f.workers.dev/?qrc=steve.eddy@hrsflow.com Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://search.ksrevenue.org/texis/search/redir.html?query=kselien&pr=KSRevenue&prox=page&rorder=500&rprox=500&rdfreq=500&rwfreq=500&rlead=500&rdepth=0&sufs=0&order=dd&u=http%3A%2F%2F4qyxe6.08zej.cybersecurity.ke%2Fc3RldmUuZWRkeUBocnNmbG93LmNvbQ== HTTP 302
http://4qyxe6.08zej.cybersecurity.ke/c3RldmUuZWRkeUBocnNmbG93LmNvbQ==

9 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

c3RldmUuZWRkeUBocnNmbG93LmNvbQ==
4qyxe6.08zej.cybersecurity.ke/
Redirect Chain

https://search.ksrevenue.org/texis/search/redir.html?query=kselien&pr=KSRevenue&prox=page&rorder=500&rprox=500&rdfreq=500&rwfreq=500&rlead=500&rdepth=0&sufs=0&order=dd&u=http%3A%2F%2F4qyxe6.08zej.c...
http://4qyxe6.08zej.cybersecurity.ke/c3RldmUuZWRkeUBocnNmbG93LmNvbQ==

2 KB
1 KB

5456ms
1190ms

Document
text/html

192.185.129.235
UNIFIEDLAYER-AS-1

General

Check archive.org

Show headers Download Go to

Full URL: http://4qyxe6.08zej.cybersecurity.ke/c3RldmUuZWRkeUBocnNmbG93LmNvbQ==
Protocol: HTTP/1.1
Server: 192.185.129.235 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS: 192-185-129-235.unifiedlayer.com
Software: Apache /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: Upgrade, Keep-Alive
Content-Encoding: gzip
Content-Length: 1232
Content-Type: text/html; charset=UTF-8
Date: Tue, 09 May 2023 07:35:23 GMT
Keep-Alive: timeout=5, max=75
Server: Apache
Upgrade: h2,h2c
Vary: Accept-Encoding

Redirect headers

Connection: Keep-Alive
Content-Length: 253
Content-Type: text/html; charset=iso-8859-1
Date: Tue, 09 May 2023 07:35:58 GMT
Keep-Alive: timeout=5, max=100
Location: http://4qyxe6.08zej.cybersecurity.ke/c3RldmUuZWRkeUBocnNmbG93LmNvbQ==
Server: Apache

GET
H2 200 Primary Request / Show response
a9328f77.33023cc9ae08612ab75b308f.workers.dev/ 426 B
752 B 47ms
13ms Document
text/html 2606:4700:3030::6815:19c2
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a9328f77.33023cc9ae08612ab75b308f.workers.dev/?qrc=steve.eddy@hrsflow.com
Requested by: Host: 4qyxe6.08zej.cybersecurity.ke
URL: http://4qyxe6.08zej.cybersecurity.ke/c3RldmUuZWRkeUBocnNmbG93LmNvbQ==
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::6815:19c2 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d782e3496aeb061dd392de9e7271d2105dc7639aef19176c32cb6bb8a8ccc0f5

Request headers

Referer: http://4qyxe6.08zej.cybersecurity.ke/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-ray: 7c4843fb0a7c3615-FRA
content-encoding: br
content-type: text/html;charset=UTF-8
date: Tue, 09 May 2023 07:35:24 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y4KWgKiVm6UBTeagqfcuhLq0Y6YNi2Ekhv0owH9VqYTzYuNuMduLqTwQjqIQl8ScinwFCcpHV4twGf%2FYtMHL1d%2BJxN852zrIr8U6KzLDl4uC9mk%2BNA7LKs7ZZ5EQz%2FwDMh%2FIU%2Bmx6FicLAxDzX7vhdoPK40A0OXN5m931804PdSnCezHIL%2FsjY%2BxKGE%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 200 style.js Show response
1d192bbf.captcha222.pages.dev/ 2 KB
2 KB 71ms
38ms Script
text/javascript 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://1d192bbf.captcha222.pages.dev/style.js

Requested by

Host: a9328f77.33023cc9ae08612ab75b308f.workers.dev
URL: https://a9328f77.33023cc9ae08612ab75b308f.workers.dev/?qrc=steve.eddy@hrsflow.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

60d43eae401ea375afebda0991058cc9651df01fe7633c06dcdd74677c935e2f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a9328f77.33023cc9ae08612ab75b308f.workers.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Tue, 09 May 2023 07:35:24 GMT
content-encoding: br
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"119584a8f7464eefbbe3b0f50b7a7f00"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WzodssRKEjIEJkn%2FX63f4wB2XrSj4uySfXn2xhKX%2BiKGNyGGUfNcolTuW1JF9t5%2F22cAHdxAIQzGiuqYn0%2FBVojeB1wZYDMiHAi2oP9aIlesZvkdM14zbVPDWBPx2QyordMgvqE%2FasvobHNsKMWxqo5y%2BnfJD1g2FMCKTw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
x-robots-tag: noindex
cf-ray: 7c4843fb5ef15c02-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 api.js Show response
js.hcaptcha.com/1/ 289 KB
81 KB 42ms
17ms Script
application/javascript 104.16.169.131
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hcaptcha.com/1/api.js?onload=onloadCallback&render=explicit

Requested by

Host: a9328f77.33023cc9ae08612ab75b308f.workers.dev
URL: https://a9328f77.33023cc9ae08612ab75b308f.workers.dev/?qrc=steve.eddy@hrsflow.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.169.131 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

328d09ea63d9363ca9df1ea4f7c3e0356b1b97fed003ffc1d33ca9878801bf60

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://a9328f77.33023cc9ae08612ab75b308f.workers.dev/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Tue, 09 May 2023 07:35:24 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 d21c7dc6bfb9c2f00dc62b8a7281a898.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-content-type-options: nosniff
x-amz-version-id: FrVUoj8TQdTB7JdZhU6sHMHQUkcToFdK
age: 0
x-amz-cf-pop: MXP63-P1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 04 May 2023 14:22:01 GMT
server: cloudflare
etag: W/"47d43bab99b4b988215c931a70cd3749"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=120
cf-ray: 7c4843fb4b589299-FRA
x-amz-cf-id: 3YkhW31GsigC-Q7e7nKHof5USGhuA9ychCc-2lDOCvuAEo3ObtM2XQ==

GET
H2 200 hcaptcha.html Show response
newassets.hcaptcha.com/captcha/v1/be52ae5/static/ Frame 9501 2 KB
969 B 23ms
15ms Document
text/html 104.16.169.131
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newassets.hcaptcha.com/captcha/v1/be52ae5/static/hcaptcha.html

Requested by

Host: js.hcaptcha.com
URL: https://js.hcaptcha.com/1/api.js?onload=onloadCallback&render=explicit

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.169.131 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2cdd7212c1386cda696dd22225b0063b11b59c576a9456edb5515307f22d699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://a9328f77.33023cc9ae08612ab75b308f.workers.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-origin: *
age: 113762
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=1209600
cf-cache-status: HIT
cf-ray: 7c4843fbcba99299-FRA
content-encoding: br
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Tue, 09 May 2023 07:35:24 GMT
last-modified: Thu, 04 May 2023 14:22:01 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
via: 1.1 25c0ae8b5b888081618bca2ea4f27faa.cloudfront.net (CloudFront)
x-amz-cf-id: JKiH3O9qZN1_Wlo8244y8_9FMmEWIuJDepahPnPmtfB8-XMYeDcvdQ==
x-amz-cf-pop: MXP63-P1
x-amz-server-side-encryption: AES256
x-amz-version-id: 7zX.2azz4WORy_nHwEMKC8WhXeXCX1UW
x-cache: Hit from cloudfront
x-content-type-options: nosniff

GET
H2 200 hcaptcha.html Show response
newassets.hcaptcha.com/captcha/v1/be52ae5/static/ Frame 3394 2 KB
809 B 23ms
15ms Document
text/html 104.16.169.131
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newassets.hcaptcha.com/captcha/v1/be52ae5/static/hcaptcha.html

Requested by

Host: js.hcaptcha.com
URL: https://js.hcaptcha.com/1/api.js?onload=onloadCallback&render=explicit

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.169.131 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2cdd7212c1386cda696dd22225b0063b11b59c576a9456edb5515307f22d699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://a9328f77.33023cc9ae08612ab75b308f.workers.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-origin: *
age: 113762
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=1209600
cf-cache-status: HIT
cf-ray: 7c4843fbcba79299-FRA
content-encoding: br
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Tue, 09 May 2023 07:35:24 GMT
last-modified: Thu, 04 May 2023 14:22:01 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
via: 1.1 25c0ae8b5b888081618bca2ea4f27faa.cloudfront.net (CloudFront)
x-amz-cf-id: JKiH3O9qZN1_Wlo8244y8_9FMmEWIuJDepahPnPmtfB8-XMYeDcvdQ==
x-amz-cf-pop: MXP63-P1
x-amz-server-side-encryption: AES256
x-amz-version-id: 7zX.2azz4WORy_nHwEMKC8WhXeXCX1UW
x-cache: Hit from cloudfront
x-content-type-options: nosniff

GET
H2 200 hcaptcha.js Show response
newassets.hcaptcha.com/captcha/v1/be52ae5/ Frame 9501 289 KB
81 KB 15ms
15ms Script
application/javascript 104.16.169.131
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newassets.hcaptcha.com/captcha/v1/be52ae5/hcaptcha.js

Requested by

Host: newassets.hcaptcha.com
URL: https://newassets.hcaptcha.com/captcha/v1/be52ae5/static/hcaptcha.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.169.131 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

328d09ea63d9363ca9df1ea4f7c3e0356b1b97fed003ffc1d33ca9878801bf60

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://newassets.hcaptcha.com/captcha/v1/be52ae5/static/hcaptcha.html
Origin: https://newassets.hcaptcha.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Tue, 09 May 2023 07:35:24 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 d21c7dc6bfb9c2f00dc62b8a7281a898.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-content-type-options: nosniff
x-amz-version-id: FrVUoj8TQdTB7JdZhU6sHMHQUkcToFdK
age: 113886
x-amz-cf-pop: MXP63-P1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 04 May 2023 14:22:01 GMT
server: cloudflare
etag: W/"47d43bab99b4b988215c931a70cd3749"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=1209600
cf-ray: 7c4843fbdbbf9299-FRA
x-amz-cf-id: 3YkhW31GsigC-Q7e7nKHof5USGhuA9ychCc-2lDOCvuAEo3ObtM2XQ==

GET
H2 200 hcaptcha.js Show response
newassets.hcaptcha.com/captcha/v1/be52ae5/ Frame 3394 289 KB
81 KB 15ms
14ms Script
application/javascript 104.16.169.131
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newassets.hcaptcha.com/captcha/v1/be52ae5/hcaptcha.js

Requested by

Host: newassets.hcaptcha.com
URL: https://newassets.hcaptcha.com/captcha/v1/be52ae5/static/hcaptcha.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.169.131 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

328d09ea63d9363ca9df1ea4f7c3e0356b1b97fed003ffc1d33ca9878801bf60

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://newassets.hcaptcha.com/captcha/v1/be52ae5/static/hcaptcha.html
Origin: https://newassets.hcaptcha.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Tue, 09 May 2023 07:35:24 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 d21c7dc6bfb9c2f00dc62b8a7281a898.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-content-type-options: nosniff
x-amz-version-id: FrVUoj8TQdTB7JdZhU6sHMHQUkcToFdK
age: 113886
x-amz-cf-pop: MXP63-P1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
last-modified: Thu, 04 May 2023 14:22:01 GMT
server: cloudflare
etag: W/"47d43bab99b4b988215c931a70cd3749"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=1209600
cf-ray: 7c4843fbdbc29299-FRA
x-amz-cf-id: 3YkhW31GsigC-Q7e7nKHof5USGhuA9ychCc-2lDOCvuAEo3ObtM2XQ==

GET
DATA 200
OK truncated
/ Frame 3394 798 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 57cafa49fb677c3f09d6e90b051917d10e7bb54e83102a25f3d32b06e8fa59a7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/png

POST
H2 200 checksiteconfig Show response
api2.hcaptcha.com/ Frame 3394 554 B
970 B 30ms
23ms XHR
application/json 104.16.169.131
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api2.hcaptcha.com/checksiteconfig?v=be52ae5&host=a9328f77.33023cc9ae08612ab75b308f.workers.dev&sitekey=43d73dac-3e57-4783-ace6-7e8278ff6ede&sc=1&swa=1

Requested by

Host: newassets.hcaptcha.com
URL: https://newassets.hcaptcha.com/captcha/v1/be52ae5/hcaptcha.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.169.131 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

203148befbe78d993ae5c17be46b1e9636242fa5b231a1eea8d511b4158dec79

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://newassets.hcaptcha.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 09 May 2023 07:35:24 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
server: cloudflare
vary: Origin, Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://newassets.hcaptcha.com
access-control-allow-credentials: true
cf-ray: 7c4843fc6c1a9299-FRA
access-control-allow-headers: Cache-Control, Content-Type, DNT, Referer, User-Agent, challenge-bypass-token, cf-chl-bypass, challenge-bypass-token, challenge-bypass-host, challenge-bypass-path
cf-chl-bypass: 2
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

Verdicts & Comments Add Verdict or Comment

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			api2.hcaptcha.com/	1970-01-20 11:41:40	Name: __cflb Value: 02DiuHLwzyAZNoSCVjnt7XQujxDoodH3WtqWat8qqU6Da

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1d192bbf.captcha222.pages.dev
4qyxe6.08zej.cybersecurity.ke
a9328f77.33023cc9ae08612ab75b308f.workers.dev
api2.hcaptcha.com
js.hcaptcha.com
newassets.hcaptcha.com
search.ksrevenue.org
104.16.169.131
165.201.125.249
192.185.129.235
2606:4700:3030::6815:19c2
2a06:98c1:3120::3
203148befbe78d993ae5c17be46b1e9636242fa5b231a1eea8d511b4158dec79
2cdd7212c1386cda696dd22225b0063b11b59c576a9456edb5515307f22d699a
328d09ea63d9363ca9df1ea4f7c3e0356b1b97fed003ffc1d33ca9878801bf60
57cafa49fb677c3f09d6e90b051917d10e7bb54e83102a25f3d32b06e8fa59a7
60d43eae401ea375afebda0991058cc9651df01fe7633c06dcdd74677c935e2f
d782e3496aeb061dd392de9e7271d2105dc7639aef19176c32cb6bb8a8ccc0f5

a9328f77.33023cc9ae08612ab75b308f.workers.dev Open in urlscan Pro 2606:4700:3030::6815:19c2 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

9 Requests

89 %HTTPS

40 %IPv6

5 Domains

7 Subdomains

5 IPs

2 Countries

250 kBTransfer

878 kBSize

1 Cookies

0 Outgoing links

Page URL History

Redirected requests

9 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

14 JavaScript Global Variables

1 Cookies

Indicators

a9328f77.33023cc9ae08612ab75b308f.workers.dev Open in urlscan Pro
2606:4700:3030::6815:19c2 Public Scan

Screenshot
Live screenshot

Full Image

9
Requests

89 %
HTTPS

40 %
IPv6

5
Domains

7
Subdomains

5
IPs

2
Countries

250 kB
Transfer

878 kB
Size

1
Cookies

9 HTTP transactions
1 data transactions