![](/screenshots/9d390deb-d141-4a68-8cc6-fde870428945.png)
xss.is
Open in
urlscan Pro
37.187.25.182
Public Scan
Effective URL: https://xss.is/
Submission: On February 14 via api from US — Scanned from US
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on May 19th 2023. Valid for: a year.
This is the only time xss.is was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 167.172.66.58 167.172.66.58 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
15 | 37.187.25.182 37.187.25.182 | 16276 (OVH) (OVH) | |
1 | 2a04:4e42:600... 2a04:4e42:600::485 | 54113 (FASTLY) (FASTLY) | |
6 | 104.19.219.90 104.19.219.90 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 104.19.218.90 104.19.218.90 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
23 | 5 |
ASN13335 (CLOUDFLARENET, US)
hcaptcha.com | |
newassets.hcaptcha.com | |
api.hcaptcha.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
15 |
xss.is
xss.is |
848 KB |
7 |
hcaptcha.com
hcaptcha.com — Cisco Umbrella Rank: 5909 newassets.hcaptcha.com — Cisco Umbrella Rank: 7135 api.hcaptcha.com — Cisco Umbrella Rank: 7336 |
545 KB |
1 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 353 |
2 KB |
1 |
smbc.support
1 redirects
smbc.support |
342 B |
23 | 4 |
Domain | Requested by | |
---|---|---|
15 | xss.is |
xss.is
|
5 | newassets.hcaptcha.com |
hcaptcha.com
newassets.hcaptcha.com |
1 | api.hcaptcha.com |
newassets.hcaptcha.com
|
1 | hcaptcha.com |
xss.is
|
1 | cdn.jsdelivr.net |
xss.is
|
1 | smbc.support | 1 redirects |
23 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
xss.is Sectigo RSA Domain Validation Secure Server CA |
2023-05-19 - 2024-05-20 |
a year | crt.sh |
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2023 Q3 |
2023-09-27 - 2024-10-28 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-04-15 - 2024-04-14 |
a year | crt.sh |
This page contains 3 frames:
Primary Page:
https://xss.is/
Frame ID: 9E1BECC46A216186688EEF5B3F373C98
Requests: 17 HTTP requests in this frame
Frame:
https://newassets.hcaptcha.com/captcha/v1/540c361/static/hcaptcha.html?_v=lobj5vg41g
Frame ID: 6E83ABAA6C300253C9328EC554FFD0AE
Requests: 4 HTTP requests in this frame
Frame:
https://newassets.hcaptcha.com/captcha/v1/540c361/static/hcaptcha.html
Frame ID: 8ECB1630A1FB4618882CF83BD749D7D8
Requests: 3 HTTP requests in this frame
Screenshot
![](/screenshots/9d390deb-d141-4a68-8cc6-fde870428945.png)
Page Title
Вход | XSS.is (ex DaMaGeLaB)Page URL History Show full URLs
-
https://smbc.support/
HTTP 302
https://xss.is/ Page URL
Detected technologies
![](/vendor/wappa/icons/XenForo.png)
Detected patterns
Detected patterns
- https://hcaptcha.com/([\d]+?)/api.js
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Detected patterns
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://smbc.support/
HTTP 302
https://xss.is/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
23 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
xss.is/ Redirect Chain
|
26 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fa-light-300.woff2
xss.is/styles/fonts/fa/ |
180 KB 180 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fa-solid-900.woff2
xss.is/styles/fonts/fa/ |
134 KB 134 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fa-brands-400.woff2
xss.is/styles/fonts/fa/ |
75 KB 76 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
css.php
xss.is/ |
391 KB 83 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
css.php
xss.is/ |
33 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
preamble.min.js
xss.is/js/xf/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-3.5.1.min.js
xss.is/js/vendor/jquery/ |
87 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
vendor-compiled.js
xss.is/js/vendor/ |
43 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
core-compiled.js
xss.is/js/xf/ |
211 KB 61 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login_signup.min.js
xss.is/js/xf/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
captcha.min.js
xss.is/js/xf/ |
8 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
triangles.png
xss.is/styles/ |
77 KB 77 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fa-regular-400.woff2
xss.is/styles/fonts/fa/ |
165 KB 165 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1f1f7-1f1fa.png
cdn.jsdelivr.net/joypixels/assets/8.0/png/unicode/64/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
keep-alive
xss.is/login/ |
166 B 961 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
api.js
hcaptcha.com/1/ |
376 KB 107 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hcaptcha.html
newassets.hcaptcha.com/captcha/v1/540c361/static/ Frame 6E83 |
2 KB 886 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hcaptcha.html
newassets.hcaptcha.com/captcha/v1/540c361/static/ Frame 8ECB |
2 KB 950 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hcaptcha.js
newassets.hcaptcha.com/captcha/v1/540c361/ Frame 8ECB |
376 KB 106 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hcaptcha.js
newassets.hcaptcha.com/captcha/v1/540c361/ Frame 6E83 |
376 KB 106 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame 8ECB |
798 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
checksiteconfig
api.hcaptcha.com/ Frame 6E83 |
700 B 900 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
hsw.js
newassets.hcaptcha.com/c/bf09596/ Frame 6E83 |
509 KB 222 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| XF function| $ function| jQuery object| Mustache function| autosize function| XFReCaptchaCallback function| XFTurnstileCaptchaCallback function| XFHCaptchaCallback object| Raven object| msgpack object| hcaptcha object| grecaptcha2 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
smbc.support/ | Name: PHPSESSID Value: b0589362d16b6d2b6310c26344d56dff |
|
xss.is/ | Name: xf_csrf Value: NICytHvNTK4cFYMK |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | upgrade-insecure-requests |
Strict-Transport-Security | max-age=31536000; includeSubDomains |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api.hcaptcha.com
cdn.jsdelivr.net
hcaptcha.com
newassets.hcaptcha.com
smbc.support
xss.is
104.19.218.90
104.19.219.90
167.172.66.58
2a04:4e42:600::485
37.187.25.182
1a691f964812845338d0cccac1f3dfcbddc96e3ae0c64ed9e3bfe8bd487ec1b3
28a034bed5ceb191a09be0f3ff58836fea2515066bff257d3c893417d1c4f4d2
304e77733a818935ddeb447ed9d6d6d4f16e44b8cc262ee05c89324ee7afdc6c
30eba7671379cde90f5a18dc095299cd56886172dbf361ff9ca2c4360ac02288
3155fd137ba366f10f545f30d1dfb6cb281be0e4eb06ca24793669cd3e43e798
3507ca14c84cbffccd872e634a84d93f50882c817e66ffdf2643a7ed884a205e
4de49631fe60b17010f7cda29a6236ca6ad6102ea204e5c31d2c1e79ee276938
57cafa49fb677c3f09d6e90b051917d10e7bb54e83102a25f3d32b06e8fa59a7
74a6946719dd9809e3e522186bbaf71f03d26afe232865242eb1c9c04c8c9b89
7750242ff49057446a145f97f6e0bd33e25e4ff0dcecdf8fbd3fb7a3e71b46dd
7ba4dc2f27d40ef39a66d999bbd7bb131747b70167ed091ba7e8aa5b22de99cd
87c1485b49078a8cf6e2fe375ca6f1db87dd92619672fb6742a094d389ceaf5b
8a07937005407050a3602e0722fd97e7dc05b1f23af40a2ac081b62d23b285a9
943efdb4b38963df0653d778f233b55db3e19f44794e4ff944e33b8849dcdb3c
9e47a6bef674d7258ca4576458433953510960993cac4affd1f90f83ac799b63
b3094cd77b54f390f354010b92ef05b7e75a7ff68fc01b07ed738126feecf1c6
c2497d559960ba9e1c68f41674e8bc980d3b229155e068bc7f42f157f81c4388
d471df95018bfa4fadf22ed62f4f9ac12f7c58b7d6c3788d717a535324a56853
defb6cd53981d76a18ad7c4cf3cf440c880352f1b83fbdb1a8243404e5fbf188
e9f0d24d1230e0a5760800e4a1657801cff8edf2ba87a05c5d96f74ce44ec06d
f164331c6c9251b4533ba156fe6f1186f9ef2b8cef06a3afc1fa67fd71c4c6c0
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d