![](/screenshots/b4d78d98-4a0d-40e1-95e5-6cd8d76b3877.png)
xss.is
Open in
urlscan Pro
37.187.25.182
Public Scan
Effective URL: https://xss.is/
Submission: On February 14 via api from US — Scanned from US
Summary
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on May 19th 2023. Valid for: a year.
This is the only time xss.is was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 167.172.66.58 167.172.66.58 | 14061 (DIGITALOC...) (DIGITALOCEAN-ASN) | |
16 | 37.187.25.182 37.187.25.182 | 16276 (OVH) (OVH) | |
1 | 2a04:4e42:400... 2a04:4e42:400::485 | 54113 (FASTLY) (FASTLY) | |
6 | 104.19.219.90 104.19.219.90 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 | 104.19.218.90 104.19.218.90 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
24 | 5 |
ASN13335 (CLOUDFLARENET, US)
hcaptcha.com | |
newassets.hcaptcha.com | |
api2.hcaptcha.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
16 |
xss.is
xss.is |
848 KB |
7 |
hcaptcha.com
hcaptcha.com — Cisco Umbrella Rank: 5909 newassets.hcaptcha.com — Cisco Umbrella Rank: 7135 api2.hcaptcha.com — Cisco Umbrella Rank: 15474 |
545 KB |
1 |
jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 353 |
2 KB |
1 |
smbc.moe
1 redirects
smbc.moe |
341 B |
24 | 4 |
Domain | Requested by | |
---|---|---|
16 | xss.is |
xss.is
|
5 | newassets.hcaptcha.com |
hcaptcha.com
newassets.hcaptcha.com |
1 | api2.hcaptcha.com |
newassets.hcaptcha.com
|
1 | hcaptcha.com |
xss.is
|
1 | cdn.jsdelivr.net |
xss.is
|
1 | smbc.moe | 1 redirects |
24 | 6 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
xss.is Sectigo RSA Domain Validation Secure Server CA |
2023-05-19 - 2024-05-20 |
a year | crt.sh |
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2023 Q3 |
2023-09-27 - 2024-10-28 |
a year | crt.sh |
sni.cloudflaressl.com Cloudflare Inc ECC CA-3 |
2023-04-15 - 2024-04-14 |
a year | crt.sh |
This page contains 3 frames:
Primary Page:
https://xss.is/
Frame ID: F3D242EEDBAC2AD596900C5A52E7C578
Requests: 18 HTTP requests in this frame
Frame:
https://newassets.hcaptcha.com/captcha/v1/540c361/static/hcaptcha.html?_v=ad19gm40ax
Frame ID: 7CD3673BD9BC6DE439314D6D8AF364EF
Requests: 4 HTTP requests in this frame
Frame:
https://newassets.hcaptcha.com/captcha/v1/540c361/static/hcaptcha.html
Frame ID: 052498FA3A06CBACC70874C3EF2EA87F
Requests: 3 HTTP requests in this frame
Screenshot
![](/screenshots/b4d78d98-4a0d-40e1-95e5-6cd8d76b3877.png)
Page Title
Вход | XSS.is (ex DaMaGeLaB)Page URL History Show full URLs
-
https://smbc.moe/
HTTP 302
https://xss.is/ Page URL
Detected technologies
![](/vendor/wappa/icons/XenForo.png)
Detected patterns
Detected patterns
- https://hcaptcha.com/([\d]+?)/api.js
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Detected patterns
- //cdn\.jsdelivr\.net/
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://smbc.moe/
HTTP 302
https://xss.is/ Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
24 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
Primary Request
/
xss.is/ Redirect Chain
|
26 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fa-light-300.woff2
xss.is/styles/fonts/fa/ |
180 KB 180 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fa-solid-900.woff2
xss.is/styles/fonts/fa/ |
134 KB 134 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fa-brands-400.woff2
xss.is/styles/fonts/fa/ |
75 KB 76 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
css.php
xss.is/ |
391 KB 83 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
css.php
xss.is/ |
33 KB 8 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
preamble.min.js
xss.is/js/xf/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
jquery-3.5.1.min.js
xss.is/js/vendor/jquery/ |
87 KB 31 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
vendor-compiled.js
xss.is/js/vendor/ |
43 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
core-compiled.js
xss.is/js/xf/ |
211 KB 61 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
login_signup.min.js
xss.is/js/xf/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
captcha.min.js
xss.is/js/xf/ |
8 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
triangles.png
xss.is/styles/ |
77 KB 77 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
fa-regular-400.woff2
xss.is/styles/fonts/fa/ |
165 KB 165 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
1f1f7-1f1fa.png
cdn.jsdelivr.net/joypixels/assets/8.0/png/unicode/64/ |
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
keep-alive
xss.is/login/ |
166 B 961 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
api.js
hcaptcha.com/1/ |
376 KB 107 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
job.php
xss.is/ |
14 B 804 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hcaptcha.html
newassets.hcaptcha.com/captcha/v1/540c361/static/ Frame 7CD3 |
2 KB 1 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hcaptcha.html
newassets.hcaptcha.com/captcha/v1/540c361/static/ Frame 0524 |
2 KB 757 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hcaptcha.js
newassets.hcaptcha.com/captcha/v1/540c361/ Frame 7CD3 |
376 KB 106 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
hcaptcha.js
newassets.hcaptcha.com/captcha/v1/540c361/ Frame 0524 |
376 KB 106 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ Frame 0524 |
798 B 0 |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
checksiteconfig
api2.hcaptcha.com/ Frame 7CD3 |
700 B 978 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
hsw.js
newassets.hcaptcha.com/c/bf09596/ Frame 7CD3 |
509 KB 222 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
14 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| 1 object| XF function| $ function| jQuery object| Mustache function| autosize function| XFReCaptchaCallback function| XFTurnstileCaptchaCallback function| XFHCaptchaCallback object| Raven object| msgpack object| hcaptcha object| grecaptcha3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
smbc.moe/ | Name: PHPSESSID Value: b227e10a661d2b8a3767dd21ac7e5348 |
|
xss.is/ | Name: xf_csrf Value: W2jp3LC1CC6FFVXo |
|
api2.hcaptcha.com/ | Name: __cflb Value: 0H28vk2VKwPbLoawFincekpozDKK5F2caakiN5sEXG9 |
2 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | upgrade-insecure-requests |
Strict-Transport-Security | max-age=31536000; includeSubDomains |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
api2.hcaptcha.com
cdn.jsdelivr.net
hcaptcha.com
newassets.hcaptcha.com
smbc.moe
xss.is
104.19.218.90
104.19.219.90
167.172.66.58
2a04:4e42:400::485
37.187.25.182
1a691f964812845338d0cccac1f3dfcbddc96e3ae0c64ed9e3bfe8bd487ec1b3
2736895664e774ca40150c235815f2005d5149911ef1be5f7eeb5ba8a82859ce
304e77733a818935ddeb447ed9d6d6d4f16e44b8cc262ee05c89324ee7afdc6c
30eba7671379cde90f5a18dc095299cd56886172dbf361ff9ca2c4360ac02288
3155fd137ba366f10f545f30d1dfb6cb281be0e4eb06ca24793669cd3e43e798
3507ca14c84cbffccd872e634a84d93f50882c817e66ffdf2643a7ed884a205e
4de49631fe60b17010f7cda29a6236ca6ad6102ea204e5c31d2c1e79ee276938
4ea1ef4b90f6f72386f18255deb7ff39662ac8cc42e7520647b35d10bb3c3f0d
57cafa49fb677c3f09d6e90b051917d10e7bb54e83102a25f3d32b06e8fa59a7
7750242ff49057446a145f97f6e0bd33e25e4ff0dcecdf8fbd3fb7a3e71b46dd
7ba4dc2f27d40ef39a66d999bbd7bb131747b70167ed091ba7e8aa5b22de99cd
87c1485b49078a8cf6e2fe375ca6f1db87dd92619672fb6742a094d389ceaf5b
943efdb4b38963df0653d778f233b55db3e19f44794e4ff944e33b8849dcdb3c
9e47a6bef674d7258ca4576458433953510960993cac4affd1f90f83ac799b63
b3094cd77b54f390f354010b92ef05b7e75a7ff68fc01b07ed738126feecf1c6
c2497d559960ba9e1c68f41674e8bc980d3b229155e068bc7f42f157f81c4388
d471df95018bfa4fadf22ed62f4f9ac12f7c58b7d6c3788d717a535324a56853
dcef95d20b4adfd7358aa6bc640600a62dd3adffa84dc3250a574d69d1f26afb
e9f0d24d1230e0a5760800e4a1657801cff8edf2ba87a05c5d96f74ce44ec06d
f164331c6c9251b4533ba156fe6f1186f9ef2b8cef06a3afc1fa67fd71c4c6c0
f779de80f6ebd5d15cb3209e82969f8ad90e4ba02899e24c1796f2c9aca80343
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
ff2145ad3e406bb539aa4022f4e72b7a138d7d81b2d2013d950907a24f14d1f3