xafqo.rcialemphi.ru Open in urlscan Pro
2606:4700:3032::ac43:a78c Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://bmwag-rt-prod2-t.campaign.adobe.com/r/?id=h2ccc12b,8d23fb3,492093b&p1=//xafqo.rcialemphi.ru/e52g4ysm/
Effective URL:
https://xafqo.rcialemphi.ru/e52g4ysm/
Submission: On November 29 via manual (November 29th 2023, 3:46:08 pm UTC) from US — Scanned from US

Summary HTTP 17 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 5 domains to perform 17 HTTP transactions. The main IP is 2606:4700:3032::ac43:a78c, located in United States and belongs to CLOUDFLARENET, US. The main domain is xafqo.rcialemphi.ru.
TLS certificate: Issued by GTS CA 1P5 on November 23rd 2023. Valid for: 3 months.

This is the only time xafqo.rcialemphi.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	63.35.80.202 63.35.80.202	16509 (AMAZON-02) (AMAZON-02)
7	2606:4700:303... 2606:4700:3032::ac43:a78c	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a04:4e42:400... 2a04:4e42:400::649	54113 (FASTLY) (FASTLY)
1 2	2606:4700::68... 2606:4700::6811:3b8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	99.84.108.59 99.84.108.59	16509 (AMAZON-02) (AMAZON-02)
17	5

1 63.35.80.202 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-63-35-80-202.eu-west-1.compute.amazonaws.com

bmwag-rt-prod2-t.campaign.adobe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:4700:3032::ac43:a78c (United States)

ASN13335 (CLOUDFLARENET, US)

xafqo.rcialemphi.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:400::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:3b8 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

challenges.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.84.108.59 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-108-59.iad79.r.cloudfront.net

cdn.socket.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	rcialemphi.ru xafqo.rcialemphi.ru	208 KB
2	cloudflare.com 1 redirects challenges.cloudflare.com — Cisco Umbrella Rank: 6439	12 KB
1	socket.io cdn.socket.io — Cisco Umbrella Rank: 40153	14 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 762	30 KB
1	adobe.com 1 redirects bmwag-rt-prod2-t.campaign.adobe.com	917 B
17	5

	Domain	Requested by
7	xafqo.rcialemphi.ru	xafqo.rcialemphi.ru
2	challenges.cloudflare.com	1 redirects xafqo.rcialemphi.ru
1	cdn.socket.io	xafqo.rcialemphi.ru
1	code.jquery.com	xafqo.rcialemphi.ru
1	bmwag-rt-prod2-t.campaign.adobe.com	1 redirects
17	5

This site contains no links.

Subject Issuer	Validity	Valid
rcialemphi.ru GTS CA 1P5	`2023-11-23` - `2024-02-21`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh
cdn.socket.io Amazon RSA 2048 M03	`2023-10-22` - `2024-11-17`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://xafqo.rcialemphi.ru/e52g4ysm/
Frame ID: 4CE235AA446CC297571FD53A31F2961D
Requests: 17 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Loading

Page URL History Show full URLs

https://bmwag-rt-prod2-t.campaign.adobe.com/r/?id=h2ccc12b,8d23fb3,492093b&p1=//xafqo.rcialemphi.ru/e52g4ysm/ HTTP 302
https://xafqo.rcialemphi.ru/e52g4ysm/ Page URL

Detected technologies

Socket.io (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

socket\.io.*\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

17
Requests

53 %
HTTPS

60 %
IPv6

5
Domains

5
Subdomains

5
IPs

2
Countries

264 kB
Transfer

392 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://bmwag-rt-prod2-t.campaign.adobe.com/r/?id=h2ccc12b,8d23fb3,492093b&p1=//xafqo.rcialemphi.ru/e52g4ysm/ HTTP 302
https://xafqo.rcialemphi.ru/e52g4ysm/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2

https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit HTTP 302
https://challenges.cloudflare.com/turnstile/v0/g/9914b343/api.js?render=explicit

17 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
xafqo.rcialemphi.ru/e52g4ysm/
Redirect Chain

https://bmwag-rt-prod2-t.campaign.adobe.com/r/?id=h2ccc12b,8d23fb3,492093b&p1=//xafqo.rcialemphi.ru/e52g4ysm/
https://xafqo.rcialemphi.ru/e52g4ysm/

105 B
531 B

565ms
109ms

Document
text/html

2606:4700:3032::ac43:a78c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://xafqo.rcialemphi.ru/e52g4ysm/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::ac43:a78c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 486dc7fd85a578028ed75a2301e599b2a1c8808a8ee812bb73c5b122ce435c34

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 82dbfb324cbd4bc7-BUF
content-encoding: br
content-type: text/html; charset=UTF-8
date: Wed, 29 Nov 2023 15:46:03 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UjuPKeT1yLzC%2F5RCBSMD7hkkzjWR4fXJ31yPznezKiHcaAg8PcgwCaaWXrRO%2F5cogMcpJ%2BSqPmKwijFx3VwM5L77mdmCwH7QSLKOXsewuXosQs75P9jl38%2B7W3%2FNQw9LIRWRjddJfMSqeaenLm9dQDmn"}],"group":"cf-nel","max_age":604800}
server: cloudflare

Redirect headers

Connection: keep-alive
Content-Length: 17
Content-Type: text/plain; charset=utf-8
Date: Wed, 29 Nov 2023 15:46:02 GMT
Location: https:////xafqo.rcialemphi.ru/e52g4ysm/
P3P: CP="CAO DSP COR CURa DEVa TAIa OUR BUS IND UNI COM NAV"
Permissions-Policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()
Referrer-Policy: strict-origin
Server: Apache
Strict-Transport-Security: max-age=63072000; includeSubdomains;
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Robots-Tag: noindex

GET
H2 200 myscr320165.js Show response
xafqo.rcialemphi.ru/e52g4ysm/ 27 KB
8 KB 138ms
137ms Script
application/javascript 2606:4700:3032::ac43:a78c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://xafqo.rcialemphi.ru/e52g4ysm/myscr320165.js
Requested by: Host: xafqo.rcialemphi.ru
URL: https://xafqo.rcialemphi.ru/e52g4ysm/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::ac43:a78c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7a6d9b5a4d2067054395d49c51ad89e627724be1d0a2886dbd7475e0d5a9da47

Request headers

accept-language: en-US,en;q=0.9
Referer: https://xafqo.rcialemphi.ru/e52g4ysm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 15:46:03 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 27 Nov 2023 12:42:37 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wn1sLp5tcK9EDOoeM7g0pMpS9lXjJjCjVVvfT3HAFVSkVcFmynGkdZwKfBP%2F0dYzbgjtj%2BNHwlroGlVbPEWXnT%2Fn0wr2Yb7E64NnPCe%2BKpm9FRUZ9deZ5f9EJgvbuCs2yvdQUzhgnAIkZRqVY1Ng3qwM"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 82dbfb330cc44bc7-BUF
alt-svc: h3=":443"; ma=86400

GET
H2 200 jquery-3.6.0.min.js Show response
code.jquery.com/ 87 KB
30 KB 102ms
30ms Script
application/javascript 2a04:4e42:400::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.6.0.min.js
Requested by: Host: xafqo.rcialemphi.ru
URL: https://xafqo.rcialemphi.ru/e52g4ysm/myscr320165.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:400::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

Referer: https://xafqo.rcialemphi.ru/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 29 Nov 2023 15:46:03 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 670146
x-cache: HIT, HIT
content-length: 30875
x-served-by: cache-lga21931-LGA, cache-ewr18132-EWR
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1701272764.587141,VS0,VE0
etag: W/"28feccc0-15d9d"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 16, 7744

GET
H2

200

api.js Show response
challenges.cloudflare.com/turnstile/v0/g/9914b343/
Redirect Chain

https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit
https://challenges.cloudflare.com/turnstile/v0/g/9914b343/api.js?render=explicit

33 KB
11 KB

47ms
46ms

Script
application/javascript

2606:4700::6811:3b8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://challenges.cloudflare.com/turnstile/v0/g/9914b343/api.js?render=explicit
Requested by: Host: xafqo.rcialemphi.ru
URL: https://xafqo.rcialemphi.ru/e52g4ysm/
Protocol: H2
Server: 2606:4700::6811:3b8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 51cd12da61a7401c73472b2ac77067adfa30e9fc0545b4b7c240e9154e011fc7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://xafqo.rcialemphi.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 15:46:03 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31536000
cf-ray: 82dbfb34ad0a4bcf-BUF
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Wed, 29 Nov 2023 15:46:03 GMT
server: cloudflare
vary: accept-encoding
access-control-allow-origin: *
location: /turnstile/v0/g/9914b343/api.js?render=explicit
cache-control: max-age=300, public
cf-ray: 82dbfb347d074bcf-BUF
alt-svc: h3=":443"; ma=86400

GET
H3 200 pages-head-top-web.min.js Show response
xafqo.rcialemphi.ru/web6/assets/js/ 2 KB
1 KB 3253ms
3253ms Script
text/javascript 2606:4700:3032::ac43:a78c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://xafqo.rcialemphi.ru/web6/assets/js/pages-head-top-web.min.js?cb=1701272763672

Requested by

Host: xafqo.rcialemphi.ru
URL: https://xafqo.rcialemphi.ru/e52g4ysm/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3032::ac43:a78c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b325e049a223118610d89fa42c186efc2c718a9138f30c70cefa764c2787b0dc

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://xafqo.rcialemphi.ru/e52g4ysm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 15:46:06 GMT
content-security-policy: frame-ancestors 'none'
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Wed, 08 Nov 2023 20:47:39 GMT
server: cloudflare
etag: W/"95a-609aa32abefe8-gzip"
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/javascript
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l%2BOxKMyb3Hab82QIhvOPXlUDUgiCi%2B3mRffNszr3VSKGnXRp02a4GpuRtlee3DM9Ae45j5kboLKksVAcgdiVn7sFJxixjrfb0Rvc07KBkn6JttrY4YyJfnmbqMig"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=14400
cf-ray: 82dbfb350c7f4bc6-BUF

GET 92697c8m.css
xafqo.rcialemphi.ru/web6/assets/pages/ 0
0

GET
H2 200 socket.io.min.js Show response
cdn.socket.io/4.6.0/ 45 KB
14 KB 623ms
36ms Script
application/javascript 99.84.108.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.socket.io/4.6.0/socket.io.min.js

Requested by

Host: xafqo.rcialemphi.ru
URL: https://xafqo.rcialemphi.ru/web6/assets/js/pages-head-top-web.min.js?cb=1701272763672

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.84.108.59 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-84-108-59.iad79.r.cloudfront.net

Software

Vercel /

Resource Hash

0401de33701f1cad16ecf952899d23990b6437d0a5b7335524edf6bdfb932542

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://xafqo.rcialemphi.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 18 Oct 2023 04:39:30 GMT
content-encoding: gzip
via: 1.1 84998cd5f1fa5882ba3f758f388fd37a.cloudfront.net (CloudFront)
strict-transport-security: max-age=63072000
x-amz-cf-pop: IAD79-C2
age: 9041197
x-cache: Hit from cloudfront
content-disposition: inline; filename="socket.io.min.js"
server: Vercel
x-vercel-id: iad1::xwkcq-1697603970373-a07dae08c660
etag: W/"80f5b8c6a9eeac15de93e5a112036a06"
x-vercel-cache: HIT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
x-amz-cf-id: Z6nNKeyXBEUaF25XYtMvKifCemQcL3r9M9yfBCf9FwdgqnKWUqFN3Q==

GET pages.min.css
xafqo.rcialemphi.ru/web6/assets/css/ 0
0

GET pages-godaddy.css
xafqo.rcialemphi.ru/web6/assets/css/ 0
0

GET pages-okta.css
xafqo.rcialemphi.ru/web6/assets/css/ 0
0

GET pages-head-web.min.js
xafqo.rcialemphi.ru/web6/assets/js/ 0
0

GET GDSherpa-bold.woff2
xafqo.rcialemphi.ru/web6/assets/fonts/ 0
0

GET
H3 200 GDSherpa-bold.woff
xafqo.rcialemphi.ru/web6/assets/fonts/ 35 KB
36 KB 150ms
148ms Font
font/woff 2606:4700:3032::ac43:a78c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://xafqo.rcialemphi.ru/web6/assets/fonts/GDSherpa-bold.woff

Requested by

Host: xafqo.rcialemphi.ru
URL: https://xafqo.rcialemphi.ru/web6/assets/js/pages-head-top-web.min.js?cb=1701272763672

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3032::ac43:a78c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ae40a04f95df12b0c364f26ab691dc0c391d394a28bcdb4aeacfaca325d0a798

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://xafqo.rcialemphi.ru/e52g4ysm/
Origin: https://xafqo.rcialemphi.ru
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 15:46:07 GMT
content-security-policy: frame-ancestors 'none'
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 35970
x-xss-protection: 1; mode=block
last-modified: Thu, 24 Aug 2023 14:00:22 GMT
server: cloudflare
etag: "8c82-603aba6250980"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=84a%2F6XLH9Kb59vj9A9vm%2BCLALTUVAgdbMDrqYMwsb9IQmFCZ%2FCzrVxTYVXvxTcb%2BV0g783HP61ybZIi5QabXWvgCic1GGXNLqrFSou8xIDbzWOUwxt%2BbGM2VXN48"}],"group":"cf-nel","max_age":604800}
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=14400
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 82dbfb496d424bc6-BUF

GET
H3 200 GDSherpa-regular.woff2
xafqo.rcialemphi.ru/web6/assets/fonts/ 28 KB
28 KB 209ms
208ms Font
font/woff2 2606:4700:3032::ac43:a78c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://xafqo.rcialemphi.ru/web6/assets/fonts/GDSherpa-regular.woff2

Requested by

Host: xafqo.rcialemphi.ru
URL: https://xafqo.rcialemphi.ru/web6/assets/js/pages-head-top-web.min.js?cb=1701272763672

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3032::ac43:a78c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2c7292014e2ef00374aeb63691d9f23159a010455784ee0b274ba7db2bcca956

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://xafqo.rcialemphi.ru/e52g4ysm/
Origin: https://xafqo.rcialemphi.ru
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 15:46:07 GMT
content-security-policy: frame-ancestors 'none'
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 28584
x-xss-protection: 1; mode=block
last-modified: Thu, 24 Aug 2023 14:00:24 GMT
server: cloudflare
etag: "6fa8-603aba6438e00"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uTJ7u0RTi0WAi3ucUJkorCz1tzszeUzhTAflov561iJlvcFOHIrZW6zAGN85SeljVuJ76LaoYW0MMkVZvyVIF7NcxIwBgTe8WACL1PrSiUDdsHIjOeveGHtHPI%2F0"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=14400
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 82dbfb496d434bc6-BUF

GET GDSherpa-regular.woff
xafqo.rcialemphi.ru/web6/assets/fonts/ 0
0

GET
H3 200 GDSherpa-vf.woff2
xafqo.rcialemphi.ru/web6/assets/fonts/ 43 KB
43 KB 210ms
209ms Font
font/woff2 2606:4700:3032::ac43:a78c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://xafqo.rcialemphi.ru/web6/assets/fonts/GDSherpa-vf.woff2

Requested by

Host: xafqo.rcialemphi.ru
URL: https://xafqo.rcialemphi.ru/web6/assets/js/pages-head-top-web.min.js?cb=1701272763672

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3032::ac43:a78c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3efcb941aaddaf4aea08dab3fb97d3e904aa1b83264e64b4d5bda53bc7c798ec

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://xafqo.rcialemphi.ru/e52g4ysm/
Origin: https://xafqo.rcialemphi.ru
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 15:46:07 GMT
content-security-policy: frame-ancestors 'none'
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 43596
x-xss-protection: 1; mode=block
last-modified: Thu, 24 Aug 2023 14:00:36 GMT
server: cloudflare
etag: "aa4c-603aba6faa900"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2F60DIaxPDzsI2U54FBRv1eQGfF%2BFQgg7EncRoXLLGewcBbeFgRUhu%2Bfo1Jv4pWks221qrb3NMefKW2vAYGqkZAZsUPg7Xlufp56cTCf0SZgX8pe0EACBXQe45cK4"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=14400
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 82dbfb496d454bc6-BUF

GET
H3 200 GDSherpa-vf2.woff2
xafqo.rcialemphi.ru/web6/assets/fonts/ 91 KB
92 KB 238ms
237ms Font
font/woff2 2606:4700:3032::ac43:a78c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://xafqo.rcialemphi.ru/web6/assets/fonts/GDSherpa-vf2.woff2

Requested by

Host: xafqo.rcialemphi.ru
URL: https://xafqo.rcialemphi.ru/web6/assets/js/pages-head-top-web.min.js?cb=1701272763672

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3032::ac43:a78c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6528a0bf9a836a53dfd8536e1786ba6831c9d1faa74967126fddf5b2081b858c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://xafqo.rcialemphi.ru/e52g4ysm/
Origin: https://xafqo.rcialemphi.ru
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 15:46:07 GMT
content-security-policy: frame-ancestors 'none'
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
content-length: 93276
x-xss-protection: 1; mode=block
last-modified: Thu, 24 Aug 2023 14:00:32 GMT
server: cloudflare
etag: "16c5c-603aba6bda000"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bYSDjB5fltSSsSgBGN0SF5mJkG3atcCyvdFopLO2zmFLUvIT7RdcTFoMlM7IjXrmFNfn6%2BpIZPGTHAYkoGX9c%2FaWBA2a3spM%2FpczqPMMsmSQikWAs%2BS5Yqk0MBxx"}],"group":"cf-nel","max_age":604800}
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=14400
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 82dbfb496d464bc6-BUF

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: xafqo.rcialemphi.ru
URL: https://xafqo.rcialemphi.ru/web6/assets/pages/92697c8m.css?cb=1701272766927

Domain: xafqo.rcialemphi.ru
URL: https://xafqo.rcialemphi.ru/web6/assets/css/pages.min.css?cb=1701272766927

Domain: xafqo.rcialemphi.ru
URL: https://xafqo.rcialemphi.ru/web6/assets/css/pages-godaddy.css?cb=1701272766927

Domain: xafqo.rcialemphi.ru
URL: https://xafqo.rcialemphi.ru/web6/assets/css/pages-okta.css?cb=1701272766927

Domain: xafqo.rcialemphi.ru
URL: https://xafqo.rcialemphi.ru/web6/assets/js/pages-head-web.min.js?cb=1701272766927

Domain: xafqo.rcialemphi.ru
URL: https://xafqo.rcialemphi.ru/web6/assets/fonts/GDSherpa-bold.woff2

Domain: xafqo.rcialemphi.ru
URL: https://xafqo.rcialemphi.ru/web6/assets/fonts/GDSherpa-regular.woff

Verdicts & Comments Add Verdict or Comment

17 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.adobe.com/	1970-01-21 01:56:08	Name: AMCV_B52D1CFE5330949C0A490D45%40AdobeOrg Value: MCMID%7C16008889300418559991134836461397344255
.adobe.com/	1969-12-31 23:59:59	Name: nlid Value: 2ccc12b\|8d23fb3
.adobe.com/	1970-01-21 01:56:08	Name: nllastdelid Value: 8d23fb3

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://xafqo.rcialemphi.ru/e52g4ysm/myscr320165.js(Line 1212) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.6.0.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://xafqo.rcialemphi.ru/e52g4ysm/myscr320165.js(Line 1212) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.6.0.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://xafqo.rcialemphi.ru/e52g4ysm/myscr320165.js(Line 1212) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bmwag-rt-prod2-t.campaign.adobe.com
cdn.socket.io
challenges.cloudflare.com
code.jquery.com
xafqo.rcialemphi.ru
xafqo.rcialemphi.ru
2606:4700:3032::ac43:a78c
2606:4700::6811:3b8
2a04:4e42:400::649
63.35.80.202
99.84.108.59
0401de33701f1cad16ecf952899d23990b6437d0a5b7335524edf6bdfb932542
2c7292014e2ef00374aeb63691d9f23159a010455784ee0b274ba7db2bcca956
3efcb941aaddaf4aea08dab3fb97d3e904aa1b83264e64b4d5bda53bc7c798ec
486dc7fd85a578028ed75a2301e599b2a1c8808a8ee812bb73c5b122ce435c34
51cd12da61a7401c73472b2ac77067adfa30e9fc0545b4b7c240e9154e011fc7
6528a0bf9a836a53dfd8536e1786ba6831c9d1faa74967126fddf5b2081b858c
7a6d9b5a4d2067054395d49c51ad89e627724be1d0a2886dbd7475e0d5a9da47
ae40a04f95df12b0c364f26ab691dc0c391d394a28bcdb4aeacfaca325d0a798
b325e049a223118610d89fa42c186efc2c718a9138f30c70cefa764c2787b0dc
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

xafqo.rcialemphi.ru Open in urlscan Pro 2606:4700:3032::ac43:a78c Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

17 Requests

53 %HTTPS

60 %IPv6

5 Domains

5 Subdomains

5 IPs

2 Countries

264 kBTransfer

392 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

17 JavaScript Global Variables

3 Cookies

3 Console Messages

Indicators

xafqo.rcialemphi.ru Open in urlscan Pro
2606:4700:3032::ac43:a78c Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

53 %
HTTPS

60 %
IPv6

5
Domains

5
Subdomains

5
IPs

2
Countries

264 kB
Transfer

392 kB
Size

3
Cookies

17 HTTP transactions
0 data transactions