officesecure.org Open in urlscan Pro
2606:4700:3030::6815:5297  Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. http://nwwrq.kgswc.org/ Page URL
2. https://officesecure.org/M Page URL
3. https://officesecure.org/M Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	/ nwwrq.kgswc.org/	93 B 474 B	527ms 157ms	Document text/html	147.124.221.154 MAJESTIC-HOSTING-01
General Check archive.org Show headers Download Go to Full URL http://nwwrq.kgswc.org/ Protocol HTTP/1.1 Server 147.124.221.154 Dallas, United States, ASN396073 (MAJESTIC-HOSTING-01, US), Reverse DNS c01.iservidorweb.com Software Apache / Resource Hash Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Cache-Control no-store, no-cache, must-revalidate Connection Keep-Alive Content-Type text/html; charset=UTF-8 Date Wed, 09 Aug 2023 08:25:33 GMT Expires Thu, 19 Nov 1981 08:52:00 GMT Keep-Alive timeout=5, max=100 Pragma no-cache Server Apache Transfer-Encoding chunked
GET H2	403	M Show response officesecure.org/	6 KB 5 KB	79ms 28ms	Document text/html	2606:4700:3030::6815:5297 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://officesecure.org/M Requested by Host: nwwrq.kgswc.org URL: http://nwwrq.kgswc.org/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::6815:5297 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f12e608a85e5ac58cc25bc8f6b4e036c6f86efdb6bd38a1e84d893e1e201dbba Security Headers Name Value X-Frame-Options SAMEORIGIN Request headers Referer http://nwwrq.kgswc.org/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cache-control private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-mitigated challenge cf-ray 7f3e9bf48f23365f-FRA content-encoding br content-type text/html; charset=UTF-8 cross-origin-embedder-policy require-corp cross-origin-opener-policy same-origin cross-origin-resource-policy same-origin date Wed, 09 Aug 2023 08:25:34 GMT expires Thu, 01 Jan 1970 00:00:01 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} origin-agent-cluster ?1 permissions-policy accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() referrer-policy same-origin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OLdGdFrqhxSCx%2BztRPiDV%2FUPNdzHKk%2Fj1kRfDijDv3e2FRXSxVAmtUN56kBjUeF9QDv1iDgR8x9c4%2BfqaFJpTP27gRt0Do89rrEs02K1vtHsbb9AIBFBWOIaD36ve0K73tpqBhCP0QpOKOr8nN6l"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding x-frame-options SAMEORIGIN
GET H2	200	challenges.css officesecure.org/cdn-cgi/styles/	6 KB 3 KB	23ms 22ms	Stylesheet text/css	2606:4700:3030::6815:5297 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://officesecure.org/cdn-cgi/styles/challenges.css Requested by Host: officesecure.org URL: https://officesecure.org/M Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::6815:5297 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2b0bd09c1cc7119d27e45353a59bf6c2721563e1689853ff704057a7439508d2 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options DENY Request headers accept-language de-DE,de;q=0.9 Referer https://officesecure.org/M User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers date Wed, 09 Aug 2023 08:25:34 GMT content-encoding gzip x-content-type-options nosniff last-modified Fri, 04 Aug 2023 16:29:28 GMT server cloudflare etag W/"64cd2768-19c8" x-frame-options DENY vary Accept-Encoding content-type text/css cache-control max-age=7200, public cf-ray 7f3e9bf56877365f-FRA expires Wed, 09 Aug 2023 10:25:34 GMT
GET H2	200	v1 Show response officesecure.org/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/	163 KB 56 KB	30ms 30ms	Script application/javascript	2606:4700:3030::6815:5297 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://officesecure.org/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=7f3e9bf48f23365f Requested by Host: officesecure.org URL: https://officesecure.org/M Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3030::6815:5297 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c94c472e2ad344866d5e2c682c83175b67eaa13c8693730a7d6107ff16e8a640 Request headers accept-language de-DE,de;q=0.9 Referer https://officesecure.org/M?__cf_chl_rt_tk=KNGS0FsfsA1YI.9kTJ1hiy5dN8pAwXG78DQXiliaV5A-1691569534-0-gaNycGzNC9A User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers date Wed, 09 Aug 2023 08:25:34 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=o%2Bxiie8CD1PyNS0aghb%2BTHfCVVMkvza1mNSt36FVeTQYA0aV4beKJF2ZBVF%2Bqc5ybMFvx4zdrbTS9j3tiTbSiWm9jB2IfR05ibp6UAiu5YKKumC2UD5xOMVf%2FGl4Dq8Q61SUAXtgjmK7SnlQJCE1"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=UTF-8 cache-control private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-ray 7f3e9bf598a1365f-FRA alt-svc h3=":443"; ma=86400
GET H2	200	api.js Show response challenges.cloudflare.com/turnstile/v0/g/74ac0d47/	27 KB 10 KB	103ms 57ms	Script application/javascript	2606:4700::6811:2b8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://challenges.cloudflare.com/turnstile/v0/g/74ac0d47/api.js?onload=aJ4&render=explicit Requested by Host: officesecure.org URL: https://officesecure.org/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=7f3e9bf48f23365f Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:2b8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e0f33190c14b543e76e11ab58c238e5d56508c3d0933c1cd7c64e478fedee376 Request headers Referer Origin https://officesecure.org accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers date Wed, 09 Aug 2023 08:25:34 GMT content-encoding br server cloudflare vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control max-age=31536000 cf-ray 7f3e9bf64c383659-FRA alt-svc h3=":443"; ma=86400
GET H3	403	favicon.ico officesecure.org/	6 KB 6 KB	29ms 29ms	Image text/html	2606:4700:3030::6815:5297 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://officesecure.org/favicon.ico Requested by Host: officesecure.org URL: https://officesecure.org/M Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3030::6815:5297 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash c3e11527b1344f8f5238510eaf51ca7b6f0e5df3ed8d065b7ae768fb80a3f98c Security Headers Name Value X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://officesecure.org/M User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers date Wed, 09 Aug 2023 08:25:34 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cross-origin-embedder-policy require-corp cross-origin-resource-policy same-origin alt-svc h3=":443"; ma=86400 referrer-policy same-origin server cloudflare cross-origin-opener-policy same-origin cf-mitigated challenge x-frame-options SAMEORIGIN report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FQsNWXzBdpAgFUCFg4jFX4%2F4ONuXumebWS%2FEv64jqiMS1ziFmp1CqIWcPCe88jZsDpyCpBHkISgGa8toljH0EGe81r8Zrc%2B0rahb73fPmswMZmHkS%2F44qJ8e%2Fxa9UD1sZF13E6PhfRVmojdCiGJ3"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=UTF-8 vary Accept-Encoding origin-agent-cluster ?1 cache-control private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 permissions-policy accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() cf-ray 7f3e9bf5ffe62c6b-FRA expires Thu, 01 Jan 1970 00:00:01 GMT
GET DATA	200 OK	truncated /	586 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash fc95732d9ff3b17fcb3e64fd12c0d451c38e64e1a4b420c556a7feb756a0a3fa Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers Content-Type image/png
GET BLOB	200 OK	43b0e5cd-c839-45c6-911c-082f78526b96 https://officesecure.org/	13 B 0		Other text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://officesecure.org/43b0e5cd-c839-45c6-911c-082f78526b96 Requested by Host: officesecure.org URL: https://officesecure.org/M Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 8860e7fef89219a219cb11d18bd8e4a322f32072613f86e935e7fe162ab69c04 Request headers accept-language de-DE,de;q=0.9 Referer https://officesecure.org/M User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers Content-Length 13 Content-Type text/javascript
POST H3	200	5a551c3be22598f Show response officesecure.org/cdn-cgi/challenge-platform/h/g/flow/ov1/1725885119:1691565739:ePHOwfDsngn_7SkZ88nPE_Eh7twMuCRl5Uaa755GZ4E/7f3e9bf48f23365f/	10 KB 8 KB	38ms 37ms	XHR text/plain	2606:4700:3030::6815:5297 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://officesecure.org/cdn-cgi/challenge-platform/h/g/flow/ov1/1725885119:1691565739:ePHOwfDsngn_7SkZ88nPE_Eh7twMuCRl5Uaa755GZ4E/7f3e9bf48f23365f/5a551c3be22598f Requested by Host: officesecure.org URL: https://officesecure.org/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=7f3e9bf48f23365f Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3030::6815:5297 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 1462d2cebbfa7f3d20d4df1ca13d1c70c6fb389e88be3ff6da9b759f40c7c201 Request headers Referer https://officesecure.org/M accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 CF-Challenge 5a551c3be22598f Content-type application/x-www-form-urlencoded Response headers date Wed, 09 Aug 2023 08:25:34 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ohEJFJmBY38S8ae7dCE5%2BUEArfsEnw81SIIyJyz1O23bftIOZHnucL14cV4BBvk6eVAnwbCQlzdGB8zcfBffBFwWxYZDYwoyWOq3pRP7oUeakfDtfsBO0gAeYREdrjRT%2BxCSPN%2BflBWTzupKYLU8"}],"group":"cf-nel","max_age":604800} content-type text/plain; charset=UTF-8 cf-ray 7f3e9bf6a87f2c6b-FRA alt-svc h3=":443"; ma=86400 cf-chl-gen 9mrxltSqjZxdV1cBcQd3PnGg5Gae1msYOyrrjXruvsiwCzF3wVTs0iGixA9jrlMY$/ZB9r/Yc+PgP1GwYiJGApw==
GET H3	200	normal challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/kdfr2/0x4AAAAAAADnPIDROrmt1Wwj/light/ Frame 0F51	0 0	63ms 40ms	Document text/html	2606:4700::6811:2b8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/kdfr2/0x4AAAAAAADnPIDROrmt1Wwj/light/normal Requested by Host: challenges.cloudflare.com URL: https://challenges.cloudflare.com/turnstile/v0/g/74ac0d47/api.js?onload=aJ4&render=explicit Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:2b8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Content-Security-Policy frame-src https://challenges.cloudflare.com/; base-uri 'self' Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cache-control private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-ray 7f3e9bf72d2b2bb9-FRA content-encoding br content-security-policy frame-src https://challenges.cloudflare.com/; base-uri 'self' content-type text/html; charset=UTF-8 cross-origin-embedder-policy require-corp cross-origin-opener-policy same-origin cross-origin-resource-policy cross-origin date Wed, 09 Aug 2023 08:25:34 GMT document-policy js-profiling origin-agent-cluster ?1 permissions-policy accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() referrer-policy same-origin server cloudflare
POST H3	200	5a551c3be22598f Show response officesecure.org/cdn-cgi/challenge-platform/h/g/flow/ov1/1725885119:1691565739:ePHOwfDsngn_7SkZ88nPE_Eh7twMuCRl5Uaa755GZ4E/7f3e9bf48f23365f/	2 KB 2 KB	44ms 43ms	XHR text/html	2606:4700:3030::6815:5297 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://officesecure.org/cdn-cgi/challenge-platform/h/g/flow/ov1/1725885119:1691565739:ePHOwfDsngn_7SkZ88nPE_Eh7twMuCRl5Uaa755GZ4E/7f3e9bf48f23365f/5a551c3be22598f Requested by Host: officesecure.org URL: https://officesecure.org/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=7f3e9bf48f23365f Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3030::6815:5297 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 04dc7c4ef0a7c85fd747204904f978b86fcafa0515fdc23740bf39efb70d3662 Request headers Referer https://officesecure.org/M accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 CF-Challenge 5a551c3be22598f Content-type application/x-www-form-urlencoded Response headers cf-chl-out KgSy+XtuovroYIyYMRBguNvURQD94mspFgO1vM/5kV3xP3PICU7zKk5DQf0Xai24ppfLJzxAbCPHAmIi38Yk/J4rWPXF5dXyh0rSKlTrqOI=$bP65gE+oSTF/noMgqJOgzw== cf-chl-out-s dmCRrbPYx8ldeiJYYBikAoEoUEmTt4eE5/ukZ9YCVlo63DVoKnYiDDIEaFBlR7ILDHC8whoP9r9sYtMNQI4Fxg==$wh8Ij+qoQ8dkIhBy4xVa6w== date Wed, 09 Aug 2023 08:25:34 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LXW2vDNguhStQiKc%2B6Vg0AhtA0IvGhvNy6PpHnxgqgrZh9FpE5QjlI4binrji55x91D%2FNiQBh%2F4tU%2BfJjKyc%2FxseQUuuNOzc6Fb2a%2Batx9h2mzugV49JUFAj5CV5SaGtxzOcEAHPwePCGXTg5MDv"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=UTF-8 cf-ray 7f3e9bf90af62c6b-FRA alt-svc h3=":443"; ma=86400
GET H3	403	Primary Request M Show response officesecure.org/	6 KB 4 KB	27ms 26ms	Document text/html	2606:4700:3030::6815:5297 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://officesecure.org/M Requested by Host: officesecure.org URL: https://officesecure.org/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=7f3e9bf48f23365f Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3030::6815:5297 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4c4e59a10e47a30b7cdaf57024c89ffb99bd7d64a48c8a390a673a6335aae6e8 Security Headers Name Value X-Frame-Options SAMEORIGIN Request headers Referer https://officesecure.org/M Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cache-control private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-mitigated challenge cf-ray 7f3e9c08bc772c6b-FRA content-encoding br content-type text/html; charset=UTF-8 cross-origin-embedder-policy require-corp cross-origin-opener-policy same-origin cross-origin-resource-policy same-origin date Wed, 09 Aug 2023 08:25:37 GMT expires Thu, 01 Jan 1970 00:00:01 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} origin-agent-cluster ?1 permissions-policy accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() referrer-policy same-origin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5uQADABNQd2KOdObDIHryo%2F4PH6kK5P03vJXccH13eLwJEq8m21VwH%2B%2FAEvB2eebNvofRlDDSwkzTxLPk0umlva9OQtY9%2BD4HSKd%2FLQSofEH50Kn0LhBtuKNZJ2Nf4LhbUiwzdr40zAy4whzl8Kh"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding x-frame-options SAMEORIGIN
GET H3	200	challenges.css officesecure.org/cdn-cgi/styles/	6 KB 3 KB	23ms 22ms	Stylesheet text/css	2606:4700:3030::6815:5297 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://officesecure.org/cdn-cgi/styles/challenges.css Requested by Host: officesecure.org URL: https://officesecure.org/M Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3030::6815:5297 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2b0bd09c1cc7119d27e45353a59bf6c2721563e1689853ff704057a7439508d2 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options DENY Request headers accept-language de-DE,de;q=0.9 Referer https://officesecure.org/M User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers date Wed, 09 Aug 2023 08:25:37 GMT content-encoding gzip x-content-type-options nosniff last-modified Fri, 04 Aug 2023 16:29:28 GMT server cloudflare etag W/"64cd2768-19c8" x-frame-options DENY vary Accept-Encoding content-type text/css cache-control max-age=7200, public cf-ray 7f3e9c08eca72c6b-FRA expires Wed, 09 Aug 2023 10:25:37 GMT
GET H3	200	v1 Show response officesecure.org/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/	164 KB 57 KB	30ms 30ms	Script application/javascript	2606:4700:3030::6815:5297 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://officesecure.org/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=7f3e9c08bc772c6b Requested by Host: officesecure.org URL: https://officesecure.org/M Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3030::6815:5297 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 49cf935fbd724bd05064eec6cf5347b0551a7036ee6429236136d1fcd33ca986 Request headers accept-language de-DE,de;q=0.9 Referer https://officesecure.org/M?__cf_chl_rt_tk=pkakjlMbQcqxpZRlr5Ncm_zdhona1w3DeD3NvX6uLrQ-1691569537-0-gaNycGzNCeU User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers date Wed, 09 Aug 2023 08:25:37 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZkHLP%2BamaR0XqEBJLgSChElp53nFUZuZNH6DM4Cr1TufyjSWgNgkucQT9ReUlo1pQhZOLMWghiWSY9Hhg2p3zU3qjCJPHD9Mx8WdK7mqWqxhpqBK4oUzvRxrjgAuu0tLoeNihBTlR9qWMNl33MYu"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=UTF-8 cache-control private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-ray 7f3e9c091ccd2c6b-FRA alt-svc h3=":443"; ma=86400
GET H2	200	api.js Show response challenges.cloudflare.com/turnstile/v0/g/74ac0d47/	27 KB 10 KB	42ms 42ms	Script application/javascript	2606:4700::6811:2b8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://challenges.cloudflare.com/turnstile/v0/g/74ac0d47/api.js?onload=aJ4&render=explicit Requested by Host: officesecure.org URL: https://officesecure.org/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=7f3e9c08bc772c6b Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:2b8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e0f33190c14b543e76e11ab58c238e5d56508c3d0933c1cd7c64e478fedee376 Request headers Referer Origin https://officesecure.org accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers date Wed, 09 Aug 2023 08:25:37 GMT content-encoding br server cloudflare vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control max-age=31536000 cf-ray 7f3e9c099fd43659-FRA alt-svc h3=":443"; ma=86400
GET H3	403	favicon.ico officesecure.org/	6 KB 6 KB	26ms 26ms	Image text/html	2606:4700:3030::6815:5297 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://officesecure.org/favicon.ico Requested by Host: officesecure.org URL: https://officesecure.org/M Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3030::6815:5297 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash f2879066f986695e5af0c5c671ee2988adff4dc8cb88645cac017f8ca35f791d Security Headers Name Value X-Frame-Options SAMEORIGIN Request headers accept-language de-DE,de;q=0.9 Referer https://officesecure.org/M User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers date Wed, 09 Aug 2023 08:25:37 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cross-origin-embedder-policy require-corp cross-origin-resource-policy same-origin alt-svc h3=":443"; ma=86400 referrer-policy same-origin server cloudflare cross-origin-opener-policy same-origin cf-mitigated challenge x-frame-options SAMEORIGIN report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BE7FtoAP5XRaIFMUxsyhYvo6kWthBYNyy3LZ1w9z6jsuXoPmWP%2BmCzIcFFK7sEDRLPt0sqN6cJmt%2B70F6iS9sDNWS0ZooVz2AWO8hLdg3pME5mTFZlVmXmzuxrBrWbw8hmZmRVjlJJuGSwgT8yDh"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=UTF-8 vary Accept-Encoding origin-agent-cluster ?1 cache-control private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 permissions-policy accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() cf-ray 7f3e9c099d912c6b-FRA expires Thu, 01 Jan 1970 00:00:01 GMT
GET DATA	200 OK	truncated /	586 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash fc95732d9ff3b17fcb3e64fd12c0d451c38e64e1a4b420c556a7feb756a0a3fa Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers Content-Type image/png
GET BLOB	200 OK	e29c16cd-8071-454b-a053-aae0e1e02339 https://officesecure.org/	13 B 0		Other text/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://officesecure.org/e29c16cd-8071-454b-a053-aae0e1e02339 Requested by Host: officesecure.org URL: https://officesecure.org/M Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 8860e7fef89219a219cb11d18bd8e4a322f32072613f86e935e7fe162ab69c04 Request headers accept-language de-DE,de;q=0.9 Referer https://officesecure.org/M User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 Response headers Content-Length 13 Content-Type text/javascript
POST H3	200	1ee3d21f05d9687 Show response officesecure.org/cdn-cgi/challenge-platform/h/g/flow/ov1/1551816184:1691565678:jD69R1jle7_6_lrRg6wYdr7__kR-qEYH3dRcJDFbxK8/7f3e9c08bc772c6b/	9 KB 8 KB	38ms 38ms	XHR text/plain	2606:4700:3030::6815:5297 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://officesecure.org/cdn-cgi/challenge-platform/h/g/flow/ov1/1551816184:1691565678:jD69R1jle7_6_lrRg6wYdr7__kR-qEYH3dRcJDFbxK8/7f3e9c08bc772c6b/1ee3d21f05d9687 Requested by Host: officesecure.org URL: https://officesecure.org/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=7f3e9c08bc772c6b Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3030::6815:5297 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 89cf5137d074c6031d7aefaa4ef7a3dda7908ef8b2e859a6320321282b6818c8 Request headers Referer https://officesecure.org/M accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 CF-Challenge 1ee3d21f05d9687 Content-type application/x-www-form-urlencoded Response headers date Wed, 09 Aug 2023 08:25:37 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ivyN0oB%2BeuCL7qD%2FnxllT8UyHqhjiI3tj%2FmlfFp%2FEvwB6HfmsmNSburjf36WAmFnruU%2Fce5Eb81IhEM%2Bg79NJi%2F4UyAgCxwbau%2FxTJ0dh1viUrT%2BmX%2Fm%2FjZICH8uHVSoAfuOt4XMNUA5f9LB1xcL"}],"group":"cf-nel","max_age":604800} content-type text/plain; charset=UTF-8 cf-ray 7f3e9c0a4e4b2c6b-FRA alt-svc h3=":443"; ma=86400 cf-chl-gen DGfvuo2OVxYlGY1cFKzB3XWRu8e9+4lcWxMLNPOGbrcW6T6SCYTWFVUlEQ6ptX3O$GdCPNLdddAmqqX7cn6EKbw==
GET H3	200	normal challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/9v3xc/0x4AAAAAAADnPIDROrmt1Wwj/light/ Frame 3442	0 0	35ms 34ms	Document text/html	2606:4700::6811:2b8 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/9v3xc/0x4AAAAAAADnPIDROrmt1Wwj/light/normal Requested by Host: challenges.cloudflare.com URL: https://challenges.cloudflare.com/turnstile/v0/g/74ac0d47/api.js?onload=aJ4&render=explicit Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700::6811:2b8 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Security Headers Name Value Content-Security-Policy frame-src https://challenges.cloudflare.com/; base-uri 'self' Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400 cache-control private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0 cf-ray 7f3e9c0aaf162bb9-FRA content-encoding br content-security-policy frame-src https://challenges.cloudflare.com/; base-uri 'self' content-type text/html; charset=UTF-8 cross-origin-embedder-policy require-corp cross-origin-opener-policy same-origin cross-origin-resource-policy cross-origin date Wed, 09 Aug 2023 08:25:37 GMT document-policy js-profiling origin-agent-cluster ?1 permissions-policy accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=() referrer-policy same-origin server cloudflare
POST H3	200	1ee3d21f05d9687 Show response officesecure.org/cdn-cgi/challenge-platform/h/g/flow/ov1/1551816184:1691565678:jD69R1jle7_6_lrRg6wYdr7__kR-qEYH3dRcJDFbxK8/7f3e9c08bc772c6b/	2 KB 2 KB	39ms 38ms	XHR text/html	2606:4700:3030::6815:5297 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://officesecure.org/cdn-cgi/challenge-platform/h/g/flow/ov1/1551816184:1691565678:jD69R1jle7_6_lrRg6wYdr7__kR-qEYH3dRcJDFbxK8/7f3e9c08bc772c6b/1ee3d21f05d9687 Requested by Host: officesecure.org URL: https://officesecure.org/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=7f3e9c08bc772c6b Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3030::6815:5297 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 451cf6ca04cf5d6345045bd5d26a4de9453fd9232d613d1c158d5592731d0006 Request headers Referer https://officesecure.org/M accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.170 Safari/537.36 CF-Challenge 1ee3d21f05d9687 Content-type application/x-www-form-urlencoded Response headers cf-chl-out utYVJO/lwHhDem/CNPtIQtJm+V0j4wBF20rdmw7SvWCjjEXPJGbdDFzGc00hg70Bar1g4KtQUotIQSIAPJchlfSWTQg9dbAWMPCHLs0qkGc=$v9I2JJnUHiRcZUDECvBAtQ== cf-chl-out-s OE6I1qweZjGPLFYX+JCD8HHwB8OmpS/xTx4luVZOoXsziUPaTx2xZlk8MVLXCTWkEnqoORx/3tv+IcglF6DEP5399s5Hk7LAJlpYUvsURaf7UT2eXDk8psEkKBVi++dXYqp934EiAbQaogFLWW96QTqpGM1y56+EsP7wOOkc140=$8zkjiX2wwGQD+nyOAm94hQ== date Wed, 09 Aug 2023 08:25:38 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LLU2DiHzCwCACgBXnlBGXeyFy46akmRILbi8E9URng%2BMIxHjI%2F%2B9w150xw%2BpO8166JSzyO49WPYNRJtVYZ6j1zF6aM4EHzcpr8XTrVsLgknJPhcywfuooU10V8%2Fe1VZ%2FFc6THVkKLyz57rZZlniG"}],"group":"cf-nel","max_age":604800} content-type text/html; charset=UTF-8 cf-ray 7f3e9c0d8a4c2c6b-FRA alt-svc h3=":443"; ma=86400

15 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| _cf_chl_opt function| nmb6 function| nS3 function| YwhN0 object| PQf2 function| OmMkiGZRYC function| aJ4 boolean| hB6 function| jONVS1 function| JxrZVR3 object| JkGxse9 object| turnstile boolean| nYmegH0 string| iDYwS6

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			nwwrq.kgswc.org/	1969-12-31 23:59:59	Name: PHPSESSID Value: c7ba5b9e4d145ab526d2bba0aec23617
			officesecure.org/	1970-01-20 13:52:53	Name: cf_chl_rc_m Value: 1

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	Message: Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.
network	error	URL: https://officesecure.org/M Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://officesecure.org/favicon.ico Message: Failed to load resource: the server responded with a status of 403 ()
security	warning	Message: Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.
network	error	URL: https://officesecure.org/M Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://officesecure.org/favicon.ico Message: Failed to load resource: the server responded with a status of 403 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

challenges.cloudflare.com
nwwrq.kgswc.org
officesecure.org
147.124.221.154
2606:4700:3030::6815:5297
2606:4700::6811:2b8
04dc7c4ef0a7c85fd747204904f978b86fcafa0515fdc23740bf39efb70d3662
1462d2cebbfa7f3d20d4df1ca13d1c70c6fb389e88be3ff6da9b759f40c7c201
2b0bd09c1cc7119d27e45353a59bf6c2721563e1689853ff704057a7439508d2
451cf6ca04cf5d6345045bd5d26a4de9453fd9232d613d1c158d5592731d0006
49cf935fbd724bd05064eec6cf5347b0551a7036ee6429236136d1fcd33ca986
4c4e59a10e47a30b7cdaf57024c89ffb99bd7d64a48c8a390a673a6335aae6e8
8860e7fef89219a219cb11d18bd8e4a322f32072613f86e935e7fe162ab69c04
89cf5137d074c6031d7aefaa4ef7a3dda7908ef8b2e859a6320321282b6818c8
c3e11527b1344f8f5238510eaf51ca7b6f0e5df3ed8d065b7ae768fb80a3f98c
c94c472e2ad344866d5e2c682c83175b67eaa13c8693730a7d6107ff16e8a640
e0f33190c14b543e76e11ab58c238e5d56508c3d0933c1cd7c64e478fedee376
f12e608a85e5ac58cc25bc8f6b4e036c6f86efdb6bd38a1e84d893e1e201dbba
f2879066f986695e5af0c5c671ee2988adff4dc8cb88645cac017f8ca35f791d
fc95732d9ff3b17fcb3e64fd12c0d451c38e64e1a4b420c556a7feb756a0a3fa