returnhex.com Open in urlscan Pro
208.123.116.222 Public Scan

Go To Rescan
Add Verdict Report

URL:
http://returnhex.com/
Submission Tags: @phishunt_io
Submission: On June 17 via api (June 17th 2022, 1:11:13 pm UTC) from DE — Scanned from DE

Summary HTTP 15 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 5 domains to perform 15 HTTP transactions. The main IP is 208.123.116.222, located in Piscataway, United States and belongs to SHOCK-1, US. The main domain is returnhex.com.

This is the only time returnhex.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
8	208.123.116.222 208.123.116.222	395092 (SHOCK-1) (SHOCK-1)
4	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:3b	20446 (STACKPATH...) (STACKPATH-CDN)
1	2606:4700::68... 2606:4700::6812:bcf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	192.0.77.17 192.0.77.17	2635 (AUTOMATTIC) (AUTOMATTIC)
15	5

8 208.123.116.222 (Piscataway, United States)

ASN395092 (SHOCK-1, US)
PTR: nj-s1.dedicatedpanel.net

returnhex.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:3b (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:bcf (United States)

ASN13335 (CLOUDFLARENET, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.77.17 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: cldup.com

cldup.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
8	returnhex.com returnhex.com	160 KB
4	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 246	97 KB
1	cldup.com cldup.com — Cisco Umbrella Rank: 191423	6 KB
1	bootstrapcdn.com maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 793	14 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 686	24 KB
15	5

	Domain	Requested by
8	returnhex.com	returnhex.com
4	cdnjs.cloudflare.com	returnhex.com cdnjs.cloudflare.com
1	cldup.com	returnhex.com
1	maxcdn.bootstrapcdn.com	returnhex.com
1	code.jquery.com	returnhex.com
15	5

This site contains links to these domains. Also see Links.

Domain
steamcommunity.com
github.com
getbootstrap.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-09-21` - `2022-09-20`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh
*.cldup.com Sectigo RSA Domain Validation Secure Server CA	`2022-05-22` - `2023-06-22`	a year	crt.sh

This page contains 1 frames:

Primary Page: http://returnhex.com/
Frame ID: DE05CB5292B10BCC733F2512B825886A
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Highscores

Detected technologies

Chart.js (JavaScript Graphics) Expand

Overall confidence: 75%
Detected patterns

/Chart(?:\.bundle)?(?:\.min)?\.js

particles.js (JavaScript Graphics) Expand

Overall confidence: 100%
Detected patterns

<div id="particles-js">

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Popper (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

/popper\.js/([0-9.]+)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

15
Requests

47 %
HTTPS

60 %
IPv6

5
Domains

5
Subdomains

5
IPs

2
Countries

301 kB
Transfer

1063 kB
Size

0
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://steamcommunity.com/id/codeRezzo/
Title: Steam

Search URL Search Domain Scan URL

URL: https://github.com/codeRezzo/
Title: Github

Search URL Search Domain Scan URL

URL: https://getbootstrap.com/
Title: Bootstrap

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
returnhex.com/ 35 KB
8 KB 946ms
424ms Document
text/html 208.123.116.222
SHOCK-1

General

Check archive.org

Show headers Download Go to

Full URL: http://returnhex.com/
Protocol: HTTP/1.1
Server: 208.123.116.222 Piscataway, United States, ASN395092 (SHOCK-1, US),
Reverse DNS: nj-s1.dedicatedpanel.net
Software: LiteSpeed /
Resource Hash: 34df65277ef2ec41156607f6be465fddc430cec59cd2fe48a83575e2e09c3ac2

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Fri, 17 Jun 2022 13:10:58 GMT
server: LiteSpeed
transfer-encoding: chunked
vary: Accept-Encoding

GET
H/1.1 200
OK bootstrap.css
returnhex.com/content/css/ 199 KB
26 KB 97ms
96ms Stylesheet
text/css 208.123.116.222
SHOCK-1

General

Check archive.org

Show headers Download Go to

Full URL: http://returnhex.com/content/css/bootstrap.css
Requested by: Host: returnhex.com
URL: http://returnhex.com/
Protocol: HTTP/1.1
Server: 208.123.116.222 Piscataway, United States, ASN395092 (SHOCK-1, US),
Reverse DNS: nj-s1.dedicatedpanel.net
Software: LiteSpeed /
Resource Hash: f6d53344fdd13d90a921978c5afd533ce1399e7f2bc4ae5db4cd0031378a7b69

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://returnhex.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 13:10:58 GMT
content-encoding: gzip
last-modified: Fri, 20 May 2022 00:34:00 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
Connection: Keep-Alive
accept-ranges: bytes
Keep-Alive: timeout=5, max=100
content-length: 26122

GET
H/1.1 200
OK background.css
returnhex.com/content/ 379 B
528 B 184ms
92ms Stylesheet
text/css 208.123.116.222
SHOCK-1

General

Check archive.org

Show headers Download Go to

Full URL: http://returnhex.com/content/background.css
Requested by: Host: returnhex.com
URL: http://returnhex.com/
Protocol: HTTP/1.1
Server: 208.123.116.222 Piscataway, United States, ASN395092 (SHOCK-1, US),
Reverse DNS: nj-s1.dedicatedpanel.net
Software: LiteSpeed /
Resource Hash: b533cd80ae678d5b7863e7ec19f811f94b7dbaf1c08aeaf10eb58fc3653ccea0

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://returnhex.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 13:10:58 GMT
content-encoding: gzip
last-modified: Fri, 20 May 2022 00:33:58 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: text/css
Connection: Keep-Alive
accept-ranges: bytes
Keep-Alive: timeout=5, max=100
content-length: 237

GET
H/1.1 200
OK bootstrap.js Show response
returnhex.com/content/js/ 145 KB
28 KB 190ms
97ms Script
application/javascript 208.123.116.222
SHOCK-1

General

Check archive.org

Show headers Download Go to

Full URL: http://returnhex.com/content/js/bootstrap.js
Requested by: Host: returnhex.com
URL: http://returnhex.com/
Protocol: HTTP/1.1
Server: 208.123.116.222 Piscataway, United States, ASN395092 (SHOCK-1, US),
Reverse DNS: nj-s1.dedicatedpanel.net
Software: LiteSpeed /
Resource Hash: e884ad4507ab05c8584b0e89d8659339618e9c346b59799a1b4afa9c2c0de6ce

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://returnhex.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 13:10:58 GMT
content-encoding: gzip
last-modified: Fri, 20 May 2022 00:34:02 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
Connection: Keep-Alive
accept-ranges: bytes
Keep-Alive: timeout=5, max=100
content-length: 28580

GET
H2 200 all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/css/ 57 KB
10 KB 42ms
23ms Stylesheet
text/css 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/css/all.min.css

Requested by

Host: returnhex.com
URL: http://returnhex.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

876d023d9d10c97941b80c3b03e2a5b94631ff7a4af9cee5604a6a2d39718d84

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://returnhex.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 13:10:58 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 751586
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 10301
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:10:08 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e60-e4d2"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BkbsHtEE8peqx1mcwH1k3YhAyd0LrBj9r1olmW%2Bzdsth67jwiCxbL954nEKz%2FbYezTlUFOgiPcVoKl%2FNrhvXcoIJ1%2Bc7phNUiUYqzGh7yCGP1iFlzU4iBKW1v6sogUVAWw%2F1SUwGEGih1Trj6PvitWrf"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 71cc07455c83911e-FRA
expires: Wed, 07 Jun 2023 13:10:58 GMT

GET
H2 200 normalize.min.css
cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/ 2 KB
1 KB 41ms
22ms Stylesheet
text/css 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css

Requested by

Host: returnhex.com
URL: http://returnhex.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b76ffbb2665f82b493e054b50d3d1bb3f2a8b4233be1795ca9937956eef196bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://returnhex.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 13:10:58 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1900619
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 745
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:13:31 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03f2b-897"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Tv%2BgZlYW532zAhi5Gd7eh%2B0NerdHgkI62E0i6jV5HtEi0bFN9potQSeSzAUO18T4pLfdnP1ga6lRhpfHa3c%2BFOe1colPBfg2H8Ej8MBrKX0O2hU%2FcCxyYOnoVrFfNeThlW1Az%2BJIbvKNydQobRUrrskV"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 71cc07456c85911e-FRA
expires: Wed, 07 Jun 2023 13:10:58 GMT

GET
H/1.1 200
OK style.css
returnhex.com/ 125 B
369 B 185ms
94ms Stylesheet
text/css 208.123.116.222
SHOCK-1

General

Check archive.org

Show headers Download Go to

Full URL: http://returnhex.com/style.css
Requested by: Host: returnhex.com
URL: http://returnhex.com/
Protocol: HTTP/1.1
Server: 208.123.116.222 Piscataway, United States, ASN395092 (SHOCK-1, US),
Reverse DNS: nj-s1.dedicatedpanel.net
Software: LiteSpeed /
Resource Hash: f2ecfc99b9bc67ce1e6d69a538535032ecea15e200073d27157ea53842a54f68

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://returnhex.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 13:10:58 GMT
last-modified: Fri, 20 May 2022 00:26:44 GMT
server: LiteSpeed
content-type: text/css
Connection: Keep-Alive
accept-ranges: bytes
Keep-Alive: timeout=5, max=100
content-length: 125

GET
H2 200 jquery-3.2.1.slim.min.js Show response
code.jquery.com/ 68 KB
24 KB 41ms
18ms Script
application/javascript 2001:4de0:ac18::1:a:3b
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.2.1.slim.min.js
Requested by: Host: returnhex.com
URL: http://returnhex.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:3b , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: nginx /
Resource Hash: 9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398

Request headers

Referer: http://returnhex.com/
Origin: http://returnhex.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 13:10:58 GMT
content-encoding: gzip
last-modified: Fri, 20 Aug 2021 17:47:53 GMT
server: nginx
etag: W/"611feac9-10fdd"
vary: Accept-Encoding
x-hw: 1655471458.dop159.fr8.t,1655471458.cds057.fr8.hn,1655471458.cds257.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 23856

GET
H3 200 popper.min.js Show response
cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/ 19 KB
7 KB 39ms
29ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js

Requested by

Host: returnhex.com
URL: http://returnhex.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: http://returnhex.com/
Origin: http://returnhex.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 13:10:58 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 53723
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 6157
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:15:37 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03fa9-4af4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ETkX1dW3z9YDP%2B6vpmbVSPmB0Zu7%2BXbhbPnNN0CzEmpXFg6SernxXke%2FnbMVWMADOV0aNwEb19HBzZWcTLDkkjg5tZ2cNrmdViJf6lgA%2Ftiaa3DqEeunreY89PLNBIsPAlo1pCbbF2JCVRfOyNevMhIG"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 71cc07463c699164-FRA
expires: Wed, 07 Jun 2023 13:10:58 GMT

GET
H2 200 bootstrap.min.js Show response
maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/ 48 KB
14 KB 82ms
46ms Script
application/javascript 2606:4700::6812:bcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js

Requested by

Host: returnhex.com
URL: http://returnhex.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://returnhex.com/
Origin: http://returnhex.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 13:10:58 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: MISS
cdn-edgestorageid: 860
access-control-allow-origin: *
cdn-cachedat: 03/10/2022 17:24:53
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cdn-proxyver: 1.02
timing-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:04 GMT
server: cloudflare
cdn-requestpullcode: 200
etag: W/"14d449eb8876fa55e1ef3c2cc52b0c17"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 2b0ea52fafea1962ae2ced3d9ac7ab96
cf-ray: 71cc07466f43cc46-ZRH
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H/1.1 200
OK Chart.js Show response
returnhex.com/content/js/chartjs/ 387 KB
95 KB 100ms
99ms Script
application/javascript 208.123.116.222
SHOCK-1

General

Check archive.org

Show headers Download Go to

Full URL: http://returnhex.com/content/js/chartjs/Chart.js
Requested by: Host: returnhex.com
URL: http://returnhex.com/
Protocol: HTTP/1.1
Server: 208.123.116.222 Piscataway, United States, ASN395092 (SHOCK-1, US),
Reverse DNS: nj-s1.dedicatedpanel.net
Software: LiteSpeed /
Resource Hash: 02a452513d20180c559e1d91cb343fc9ecdf86670f4330b62fc71eda25ccc582

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://returnhex.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 13:10:58 GMT
content-encoding: gzip
last-modified: Fri, 20 May 2022 00:34:04 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
Connection: Keep-Alive
accept-ranges: bytes
Keep-Alive: timeout=5, max=100
content-length: 97258

GET
H2 200 S6Ptkwu_qA.js Show response
cldup.com/ 23 KB
6 KB 30ms
7ms Script
application/x-javascript 192.0.77.17
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://cldup.com/S6Ptkwu_qA.js

Requested by

Host: returnhex.com
URL: http://returnhex.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.17 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

cldup.com

Software

nginx /

Resource Hash

faee7815a5fd27e938d1e01c8392b66332024908eb118048f608eee671371df6

Security Headers

Name	Value
Content-Security-Policy	worker-src 'none'
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://returnhex.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

x-nc: HIT hhn 2
date: Fri, 17 Jun 2022 13:10:58 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Thu, 16 Mar 2017 18:36:46 GMT
server: nginx
etag: W/"00debcf6cf0789a19cee2278011afcd4"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=31536000
content-security-policy: worker-src 'none'
expires: Sat, 17 Jun 2023 13:10:58 GMT

GET
H/1.1 200
OK script.js Show response
returnhex.com/ 2 KB
883 B 126ms
93ms Script
application/javascript 208.123.116.222
SHOCK-1

General

Check archive.org

Show headers Download Go to

Full URL: http://returnhex.com/script.js
Requested by: Host: returnhex.com
URL: http://returnhex.com/
Protocol: HTTP/1.1
Server: 208.123.116.222 Piscataway, United States, ASN395092 (SHOCK-1, US),
Reverse DNS: nj-s1.dedicatedpanel.net
Software: LiteSpeed /
Resource Hash: 1b29068935aa0ade9896336fca0ca047f97b656d207426d0d94cc05cfa442de9

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://returnhex.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 13:10:58 GMT
content-encoding: gzip
last-modified: Fri, 20 May 2022 00:01:00 GMT
server: LiteSpeed
vary: Accept-Encoding
content-type: application/javascript
Connection: Keep-Alive
accept-ranges: bytes
Keep-Alive: timeout=5, max=100
content-length: 578

GET
H/1.1 404
Not Found bg.jpg
returnhex.com/content/images/ 708 B
708 B 93ms
93ms Image
text/html 208.123.116.222
SHOCK-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://returnhex.com/content/images/bg.jpg
Requested by: Host: returnhex.com
URL: http://returnhex.com/content/background.css
Protocol: HTTP/1.1
Server: 208.123.116.222 Piscataway, United States, ASN395092 (SHOCK-1, US),
Reverse DNS: nj-s1.dedicatedpanel.net
Software: LiteSpeed /
Resource Hash: 37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://returnhex.com/content/background.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Jun 2022 13:10:58 GMT
server: LiteSpeed
content-type: text/html
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
content-length: 708

GET
H3 200 fa-solid-900.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/webfonts/ 78 KB
78 KB 14ms
14ms Font
application/octet-stream 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/webfonts/fa-solid-900.woff2

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/css/all.min.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4c3e8276a03b75d40fdbc5b40e665022127cbbd1722b6de06839ca69f664b7af

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.13.0/css/all.min.css
Origin: http://returnhex.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 13:10:58 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 646337
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 79444
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:10:08 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e60-13654"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0Bmaik8zExJOTvD%2BH5TcvlZSPwfLZUgjx8L57iVljQDSO%2FCJwRdGtUjjXcuFbzOMS2gY1YdtE449%2BT%2BeVEEbcGj7GdN8mvMzMtaa2p8Jn4YXt4XT83xHXmbSQGOhEtBcQTWgRs0YuVZFQ9XtvZdFKSyP"}],"group":"cf-nel","max_age":604800}
content-type: application/octet-stream; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 71cc07475eb49164-FRA
expires: Wed, 07 Jun 2023 13:10:58 GMT

Verdicts & Comments Add Verdict or Comment

26 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://returnhex.com/content/images/bg.jpg Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdnjs.cloudflare.com
cldup.com
code.jquery.com
maxcdn.bootstrapcdn.com
returnhex.com
192.0.77.17
2001:4de0:ac18::1:a:3b
208.123.116.222
2606:4700::6811:190e
2606:4700::6812:bcf
02a452513d20180c559e1d91cb343fc9ecdf86670f4330b62fc71eda25ccc582
1b29068935aa0ade9896336fca0ca047f97b656d207426d0d94cc05cfa442de9
34df65277ef2ec41156607f6be465fddc430cec59cd2fe48a83575e2e09c3ac2
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
4c3e8276a03b75d40fdbc5b40e665022127cbbd1722b6de06839ca69f664b7af
876d023d9d10c97941b80c3b03e2a5b94631ff7a4af9cee5604a6a2d39718d84
9365920887b11b33a3dc4ba28a0f93951f200341263e3b9cefd384798e4be398
a52f7aa54d7bcaafa056ee0a050262dfc5694ae28dee8b4cac3429af37ff0d66
b533cd80ae678d5b7863e7ec19f811f94b7dbaf1c08aeaf10eb58fc3653ccea0
b76ffbb2665f82b493e054b50d3d1bb3f2a8b4233be1795ca9937956eef196bc
e7ed36ceee5450b4243bbc35188afabdfb4280c7c57597001de0ed167299b01b
e884ad4507ab05c8584b0e89d8659339618e9c346b59799a1b4afa9c2c0de6ce
f2ecfc99b9bc67ce1e6d69a538535032ecea15e200073d27157ea53842a54f68
f6d53344fdd13d90a921978c5afd533ce1399e7f2bc4ae5db4cd0031378a7b69
faee7815a5fd27e938d1e01c8392b66332024908eb118048f608eee671371df6

returnhex.com Open in urlscan Pro 208.123.116.222 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

15 Requests

47 %HTTPS

60 %IPv6

5 Domains

5 Subdomains

5 IPs

2 Countries

301 kBTransfer

1063 kBSize

0 Cookies

3 Outgoing links

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

26 JavaScript Global Variables

0 Cookies

1 Console Messages

Indicators

returnhex.com Open in urlscan Pro
208.123.116.222 Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

47 %
HTTPS

60 %
IPv6

5
Domains

5
Subdomains

5
IPs

2
Countries

301 kB
Transfer

1063 kB
Size

0
Cookies

15 HTTP transactions
0 data transactions