urlscan.io logo urlscan.io
SecurityTrails logo

ricourtforms.com Open in urlscan Pro
111.90.140.113  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://wqa12.info/#aW5mb2NlbnRlckBucmEuYmc
Effective URL: https://ricourtforms.com/red.php?tap=oYgDKWXaZvJqgRMSaVtmYSL8Ihj96jPlUnsuG56ljwSa1rU2UYCmnHRgHnfBY1TvikiCdx9q9gzyh6g7lA8K...
Submission Tags: 0xscam
Submission: On June 25 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 3 countries across 5 domains to perform 11 HTTP transactions. The main IP is 111.90.140.113, located in Malaysia and belongs to SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY. The main domain is ricourtforms.com.
TLS certificate: Issued by R11 on June 10th 2024. Valid for: 3 months.
This is the only time ricourtforms.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 5 111.90.140.113 45839 (SHINJIRU-...)
2 2a00:1450:400... 15169 (GOOGLE)
1 142.250.184.195 15169 (GOOGLE)
1 142.250.185.132 15169 (GOOGLE)
1 13.32.27.77 16509 (AMAZON-02)
11 6
5    111.90.140.113 (Malaysia)

ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY)
PTR: ptr.eknowledgebank.com
wqa12.info
ricourtforms.com
2    2a00:1450:4001:810::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
1    142.250.184.195 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f3.1e100.net
www.gstatic.com
1    142.250.185.132 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f4.1e100.net
www.google.com
1    13.32.27.77 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-27-77.fra56.r.cloudfront.net
logo.clearbit.com
Apex Domain
Subdomains		 Transfer
4 ricourtforms.com
ricourtforms.com
59 KB
3 google.com
www.google.com — Cisco Umbrella Rank: 5
1 KB
1 clearbit.com
logo.clearbit.com — Cisco Umbrella Rank: 27809
5 KB
1 gstatic.com
www.gstatic.com
207 KB
1 wqa12.info
wqa12.info
1 KB
11 5
Domain Requested by
4 ricourtforms.com 2 redirects wqa12.info
ricourtforms.com
3 www.google.com ricourtforms.com
www.gstatic.com
1 logo.clearbit.com
1 www.gstatic.com www.google.com
1 wqa12.info
11 5

This site contains no links.

Subject Issuer Validity Valid
*.wqa12.info
R10		 2024-06-10 -
2024-09-08		 3 months crt.sh
ricourtforms.com
R11		 2024-06-10 -
2024-09-08		 3 months crt.sh
www.google.com
WR2		 2024-06-03 -
2024-08-26		 3 months crt.sh
*.gstatic.com
WR2		 2024-06-03 -
2024-08-26		 3 months crt.sh
*.google.com
WR2		 2024-06-03 -
2024-08-26		 3 months crt.sh
clearbit.com
Amazon RSA 2048 M03		 2024-01-22 -
2025-02-18		 a year crt.sh

This page contains 2 frames:

Frame: https://ricourtforms.com/l/?email=infocenter%40nra.bg&sessid=MTcxOTMzNDE4NmExNGQwMjAzY2IwZmJkMWUxOGQ3MTA0MmZlOTI2ODMzZTRlNDE1NzQ2YjAwOGQwYjA4ZjBlNmMwMWQxNzJmOGI4YmMwOTk0YQ%3D%3D
Frame ID: 4AEEFA742682C289D3057A70256FA72B
Requests: 10 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcRbPUpAAAAAKpnccFt5MN2DGvBZ3ftUsA4dYSx&co=aHR0cHM6Ly9yaWNvdXJ0Zm9ybXMuY29tOjQ0Mw..&hl=de&v=KXX4ARWFlYTftefkdODAYWZh&size=invisible&cb=3qti4gkxhyu1
Frame ID: 5E0088690961433283CAD73BCCA81E98
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://wqa12.info/ Page URL
  2. https://ricourtforms.com/?email=infocenter@nra.bg HTTP 302
    https://ricourtforms.com/index.php?csrftoken=MTcxOTMzNDE4NmExNGQwMjAzY2IwZmJkMWUxOGQ3MTA0MmZlOTI2ODMz... HTTP 302
    https://ricourtforms.com/red.php?tap=oYgDKWXaZvJqgRMSaVtmYSL8Ihj96jPlUnsuG56ljwSa1rU2UYCmnHRgHnfBY1Tv... Page URL
  3. https://ricourtforms.com/red.php?tap=oYgDKWXaZvJqgRMSaVtmYSL8Ihj96jPlUnsuG56ljwSa1rU2UYCmnHRgHnfBY1Tv... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)
Overall confidence: 100%
Detected patterns
  • /recaptcha/api\.js

Page Statistics

11
Requests

73 %
HTTPS

20 %
IPv6

5
Domains

5
Subdomains

6
IPs

3
Countries

272 kB
Transfer

620 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://wqa12.info/ Page URL
  2. https://ricourtforms.com/?email=infocenter@nra.bg HTTP 302
    https://ricourtforms.com/index.php?csrftoken=MTcxOTMzNDE4NmExNGQwMjAzY2IwZmJkMWUxOGQ3MTA0MmZlOTI2ODMzZTRlNDE1NzQ2YjAwOGQwYjA4ZjBlNmMwMWQxNzJmOGI4YmMwOTk0YQ== HTTP 302
    https://ricourtforms.com/red.php?tap=oYgDKWXaZvJqgRMSaVtmYSL8Ihj96jPlUnsuG56ljwSa1rU2UYCmnHRgHnfBY1TvikiCdx9q9gzyh6g7lA8K7aNVA1MhhJ1PR555aADzlkowrIFUkdd9aWKgbGxDY4A8 Page URL
  3. https://ricourtforms.com/red.php?tap=oYgDKWXaZvJqgRMSaVtmYSL8Ihj96jPlUnsuG56ljwSa1rU2UYCmnHRgHnfBY1TvikiCdx9q9gzyh6g7lA8K7aNVA1MhhJ1PR555aADzlkowrIFUkdd9aWKgbGxDY4A8 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1
  • https://ricourtforms.com/?email=infocenter@nra.bg HTTP 302
  • https://ricourtforms.com/index.php?csrftoken=MTcxOTMzNDE4NmExNGQwMjAzY2IwZmJkMWUxOGQ3MTA0MmZlOTI2ODMzZTRlNDE1NzQ2YjAwOGQwYjA4ZjBlNmMwMWQxNzJmOGI4YmMwOTk0YQ== HTTP 302
  • https://ricourtforms.com/red.php?tap=oYgDKWXaZvJqgRMSaVtmYSL8Ihj96jPlUnsuG56ljwSa1rU2UYCmnHRgHnfBY1TvikiCdx9q9gzyh6g7lA8K7aNVA1MhhJ1PR555aADzlkowrIFUkdd9aWKgbGxDY4A8
Request Chain 9
  • https://ricourtforms.com/l?email=infocenter%40nra.bg&sessid=MTcxOTMzNDE4NmExNGQwMjAzY2IwZmJkMWUxOGQ3MTA0MmZlOTI2ODMzZTRlNDE1NzQ2YjAwOGQwYjA4ZjBlNmMwMWQxNzJmOGI4YmMwOTk0YQ%3D%3D HTTP 301
  • https://ricourtforms.com/l/?email=infocenter%40nra.bg&sessid=MTcxOTMzNDE4NmExNGQwMjAzY2IwZmJkMWUxOGQ3MTA0MmZlOTI2ODMzZTRlNDE1NzQ2YjAwOGQwYjA4ZjBlNmMwMWQxNzJmOGI4YmMwOTk0YQ%3D%3D

11 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
wqa12.info/ 		907 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://wqa12.info/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
111.90.140.113 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
ptr.eknowledgebank.com
Software
Apache /
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Tue, 25 Jun 2024 16:49:45 GMT
Keep-Alive
timeout=5, max=100
Server
Apache
Transfer-Encoding
chunked
red.php
ricourtforms.com/
Redirect Chain
  • https://ricourtforms.com/?email=infocenter@nra.bg
  • https://ricourtforms.com/index.php?csrftoken=MTcxOTMzNDE4NmExNGQwMjAzY2IwZmJkMWUxOGQ3MTA0MmZlOTI2ODMzZTRlNDE1NzQ2YjAwOGQwYjA4ZjBlNmMwMWQxNzJmOGI4YmMwOTk0YQ==
  • https://ricourtforms.com/red.php?tap=oYgDKWXaZvJqgRMSaVtmYSL8Ihj96jPlUnsuG56ljwSa1rU2UYCmnHRgHnfBY1TvikiCdx9q9gzyh6g7lA8K7aNVA1MhhJ1PR555aADzlkowrIFUkdd9aWKgbGxDY4A8
58 KB
58 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ricourtforms.com/red.php?tap=oYgDKWXaZvJqgRMSaVtmYSL8Ihj96jPlUnsuG56ljwSa1rU2UYCmnHRgHnfBY1TvikiCdx9q9gzyh6g7lA8K7aNVA1MhhJ1PR555aADzlkowrIFUkdd9aWKgbGxDY4A8
Requested by
Host: wqa12.info
URL: https://wqa12.info/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
111.90.140.113 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
ptr.eknowledgebank.com
Software
Apache /
Resource Hash
7a75a3e0f63ef4e06013c9fc17a527ed37587b32b3dfcd2ebc558e54d194f70e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://wqa12.info/#aW5mb2NlbnRlckBucmEuYmc
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Tue, 25 Jun 2024 16:49:47 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=5, max=98
Pragma
no-cache
Server
Apache
Transfer-Encoding
chunked
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block

Redirect headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Content-Length
0
Content-Type
text/html; charset=UTF-8
Date
Tue, 25 Jun 2024 16:49:46 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=5, max=99
Location
red.php?tap=oYgDKWXaZvJqgRMSaVtmYSL8Ihj96jPlUnsuG56ljwSa1rU2UYCmnHRgHnfBY1TvikiCdx9q9gzyh6g7lA8K7aNVA1MhhJ1PR555aADzlkowrIFUkdd9aWKgbGxDY4A8
Pragma
no-cache
Server
Apache
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
api.js
www.google.com/recaptcha/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api.js?render=6LcRbPUpAAAAAKpnccFt5MN2DGvBZ3ftUsA4dYSx
Requested by
Host: ricourtforms.com
URL: https://ricourtforms.com/red.php?tap=oYgDKWXaZvJqgRMSaVtmYSL8Ihj96jPlUnsuG56ljwSa1rU2UYCmnHRgHnfBY1TvikiCdx9q9gzyh6g7lA8K7aNVA1MhhJ1PR555aADzlkowrIFUkdd9aWKgbGxDY4A8
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
482abf19d8676df149cbc74c6877ff5c55860f8de982535a6be3fdad058e12ea
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 25 Jun 2024 16:49:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
frame-ancestors 'self'
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=utf-8
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
1; mode=block
expires
Tue, 25 Jun 2024 16:49:47 GMT
recaptcha__de.js
www.gstatic.com/recaptcha/releases/KXX4ARWFlYTftefkdODAYWZh/ 		518 KB
207 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/KXX4ARWFlYTftefkdODAYWZh/recaptcha__de.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?render=6LcRbPUpAAAAAKpnccFt5MN2DGvBZ3ftUsA4dYSx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.184.195 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s11-in-f3.1e100.net
Software
sffe /
Resource Hash
612ad04469fba362238294e47106a2e6061ef90c111851c0cdcae2e3ee27a6bb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
Origin
https://ricourtforms.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Mon, 24 Jun 2024 11:40:32 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
104956
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
210814
x-xss-protection
0
last-modified
Sat, 15 Jun 2024 04:02:13 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Tue, 24 Jun 2025 11:40:32 GMT
segoeui-regular.woff
ricourtforms.com/prem/fonts/ 		0
0
anchor
www.google.com/recaptcha/api2/ Frame 5E00 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcRbPUpAAAAAKpnccFt5MN2DGvBZ3ftUsA4dYSx&co=aHR0cHM6Ly9yaWNvdXJ0Zm9ybXMuY29tOjQ0Mw..&hl=de&v=KXX4ARWFlYTftefkdODAYWZh&size=invisible&cb=3qti4gkxhyu1
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/KXX4ARWFlYTftefkdODAYWZh/recaptcha__de.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.132 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s50-in-f4.1e100.net
Software
GSE /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-jvbhgsQZdFAKD0AQtBUX2w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-security-policy
script-src 'report-sample' 'nonce-jvbhgsQZdFAKD0AQtBUX2w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Tue, 25 Jun 2024 16:49:48 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
segoeui-regular.ttf
ricourtforms.com/prem/fonts/ 		0
0
nra.bg
logo.clearbit.com/ 		5 KB
5 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://logo.clearbit.com/nra.bg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.27.77 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-27-77.fra56.r.cloudfront.net
Software
Clearbit /
Resource Hash
0180b7175b600b66404ea3026fa65878bb7f507d67ec058e84bc2eaf3aff801a
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 25 Jun 2024 16:44:13 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
x-content-type-options
nosniff
x-envoy-response-flags
-
via
1.1 fd3cce3e0bafd8b312277d0ad9f4762e.cloudfront.net (CloudFront)
server
Clearbit
x-amz-cf-pop
FRA56-C2
age
336
x-cache
Hit from cloudfront
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=2592000
x-amz-cf-id
FDlDjsjKcV7bHVhu0S-DrX3f-z-gnGK6QzSKoQ5noLhAOMvvuxu9sw==
Primary Request red.php
ricourtforms.com/ 		35 KB
0 		Document
General
Check archive.org
Download Go to
Full URL
https://ricourtforms.com/red.php?tap=oYgDKWXaZvJqgRMSaVtmYSL8Ihj96jPlUnsuG56ljwSa1rU2UYCmnHRgHnfBY1TvikiCdx9q9gzyh6g7lA8K7aNVA1MhhJ1PR555aADzlkowrIFUkdd9aWKgbGxDY4A8
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
111.90.140.113 , Malaysia, ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY),
Reverse DNS
ptr.eknowledgebank.com
Software
Apache /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Content-Type
application/x-www-form-urlencoded
Origin
null
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

Cache-Control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
Date
Tue, 25 Jun 2024 16:49:51 GMT
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Keep-Alive
timeout=5, max=95
Pragma
no-cache
Server
Apache
Transfer-Encoding
chunked
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
api.js
www.google.com/recaptcha/ 		1 KB
0 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api.js?render=6LcRbPUpAAAAAKpnccFt5MN2DGvBZ3ftUsA4dYSx
Requested by
Host: ricourtforms.com
URL: https://ricourtforms.com/red.php?tap=oYgDKWXaZvJqgRMSaVtmYSL8Ihj96jPlUnsuG56ljwSa1rU2UYCmnHRgHnfBY1TvikiCdx9q9gzyh6g7lA8K7aNVA1MhhJ1PR555aADzlkowrIFUkdd9aWKgbGxDY4A8
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 25 Jun 2024 16:49:47 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
frame-ancestors 'self'
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=utf-8
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
1; mode=block
expires
Tue, 25 Jun 2024 16:49:47 GMT
/
ricourtforms.com/l/
Redirect Chain
  • https://ricourtforms.com/l?email=infocenter%40nra.bg&sessid=MTcxOTMzNDE4NmExNGQwMjAzY2IwZmJkMWUxOGQ3MTA0MmZlOTI2ODMzZTRlNDE1NzQ2YjAwOGQwYjA4ZjBlNmMwMWQxNzJmOGI4YmMwOTk0YQ%3D%3D
  • https://ricourtforms.com/l/?email=infocenter%40nra.bg&sessid=MTcxOTMzNDE4NmExNGQwMjAzY2IwZmJkMWUxOGQ3MTA0MmZlOTI2ODMzZTRlNDE1NzQ2YjAwOGQwYjA4ZjBlNmMwMWQxNzJmOGI4YmMwOTk0YQ%3D%3D
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
ricourtforms.com
URL
https://ricourtforms.com/prem/fonts/segoeui-regular.woff
Domain
ricourtforms.com
URL
https://ricourtforms.com/prem/fonts/segoeui-regular.ttf
Domain
ricourtforms.com
URL
https://ricourtforms.com/l/?email=infocenter%40nra.bg&sessid=MTcxOTMzNDE4NmExNGQwMjAzY2IwZmJkMWUxOGQ3MTA0MmZlOTI2ODMzZTRlNDE1NzQ2YjAwOGQwYjA4ZjBlNmMwMWQxNzJmOGI4YmMwOTk0YQ%3D%3D

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage

2 Cookies

Domain/Path Name / Value
www.google.com/recaptcha Name: _GRECAPTCHA
Value: 09AF2wc0AyRplWGgtDoakhuac-veNNPyrZCFYgnDW5OwiOm8ReecbYUbmASFPiijlSIOLl0rbi0u7w0HB4tJD2vXg
ricourtforms.com/ Name: PHPSESSID
Value: d3c7ae06e43d31a9ea2aae76088b12cd

2 Console Messages

Source Level URL
Text
network error URL: https://ricourtforms.com/prem/fonts/segoeui-regular.woff
Message:
Failed to load resource: net::ERR_INVALID_REDIRECT
network error URL: https://ricourtforms.com/prem/fonts/segoeui-regular.ttf
Message:
Failed to load resource: net::ERR_INVALID_REDIRECT