URL: https://ip.nexitally.buzz/
Submission: On March 31 via automatic, source certstream-suspicious — Scanned from DE

Summary

This website contacted 9 IPs in 3 countries across 9 domains to perform 11 HTTP transactions. The main IP is 2606:4700:3031::ac43:8d6f, located in United States and belongs to CLOUDFLARENET, US. The main domain is ip.nexitally.buzz.
TLS certificate: Issued by R3 on March 31st 2023. Valid for: 3 months.
This is the only time ip.nexitally.buzz was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2606:4700:303... 13335 (CLOUDFLAR...)
3 2606:4700::68... 13335 (CLOUDFLAR...)
1 172.67.0.127 13335 (CLOUDFLAR...)
1 23.128.64.141 32097 (WII)
1 240e:944:8:5:... 58541 (CHINATELE...)
1 2606:2800:133... 15133 (EDGECAST)
1 13.228.166.246 16509 (AMAZON-02)
1 13.32.121.125 16509 (AMAZON-02)
11 9
Apex Domain
Subdomains
Transfer
3 unpkg.com
unpkg.com — Cisco Umbrella Rank: 933
99 KB
1 tvbanywhere.com.sg
uapisfm.tvbanywhere.com.sg
1 KB
1 hbogoasia.com
api2.hbogoasia.com — Cisco Umbrella Rank: 400540
942 B
1 uplynk.com
x-live-fox-stgec.uplynk.com — Cisco Umbrella Rank: 257832
502 B
1 cf-ns.com
cf-ns.com
459 B
1 seeip.org
ip.seeip.org — Cisco Umbrella Rank: 39385
321 B
1 skk.moe
ip.skk.moe — Cisco Umbrella Rank: 907154
1 nexitally.buzz
ip.nexitally.buzz
4 KB
0 fast.com Failed
api.fast.com Failed
11 9
Domain Requested by
3 unpkg.com ip.nexitally.buzz
unpkg.com
1 uapisfm.tvbanywhere.com.sg ip.nexitally.buzz
1 api2.hbogoasia.com ip.nexitally.buzz
1 x-live-fox-stgec.uplynk.com ip.nexitally.buzz
1 cf-ns.com ip.nexitally.buzz
1 ip.seeip.org ip.nexitally.buzz
1 ip.skk.moe ip.nexitally.buzz
1 ip.nexitally.buzz
0 api.fast.com Failed ip.nexitally.buzz
11 9

This site contains links to these domains. Also see Links.

Domain
github.com
raw.githubusercontent.com
ipinfo.io
www.netflix.com
Subject Issuer Validity Valid
ip.nexitally.buzz
R3
2023-03-31 -
2023-06-29
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2022-06-01 -
2023-06-01
a year crt.sh
ip.skk.moe
Cloudflare Inc ECC CA-3
2022-05-07 -
2023-05-07
a year crt.sh
ip.seeip.org
R3
2023-02-24 -
2023-05-25
3 months crt.sh
*.uplynk.com
DigiCert TLS RSA SHA256 2020 CA1
2022-12-22 -
2024-01-22
a year crt.sh
api2.hbogoasia.com
Amazon RSA 2048 M02
2023-03-04 -
2024-04-01
a year crt.sh
*.tvbanywhere.com.sg
Amazon RSA 2048 M01
2023-02-28 -
2024-01-19
a year crt.sh

This page contains 2 frames:

Primary Page: https://ip.nexitally.buzz/
Frame ID: BA3AC5A8F4756F2CE2B11F0D00C7E6BE
Requests: 10 HTTP requests in this frame

Frame: https://ip.skk.moe/simple
Frame ID: B4D2A630993F4C08757E88FB3DB5D103
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

nfcheck - A webpage for checking current regions and unblocking status for Netflix.

Page Statistics

11
Requests

91 %
HTTPS

50 %
IPv6

9
Domains

9
Subdomains

9
IPs

3
Countries

106 kB
Transfer

449 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
ip.nexitally.buzz/
14 KB
4 KB
Document
General
Full URL
https://ip.nexitally.buzz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3031::ac43:8d6f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9aa228c7ba4fff1b583028907dd280bd0681fbe7f73dba16ec309c5b3c0de153
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
public, max-age=0, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
7b05828cee7d3665-FRA
content-encoding
br
content-type
text/html; charset=utf-8
date
Fri, 31 Mar 2023 03:29:47 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DiOXfyHUdYPBJ8B%2B8meJicLuzditpcD7szE7u1h8rK3fUnTcF5iiYtp3E2E%2Fq1ca2QBoXsK2zAFX9Xkej7WyONeobBThercAGy%2BdRCATN0giXIBEjTm47W7txtfL9r3YUT6LNtgsIyQ7cW%2BVFw3Lbw%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-content-type-options
nosniff
mdui.min.css
unpkg.com/mdui@1.0.2/dist/css/
318 KB
34 KB
Stylesheet
General
Full URL
https://unpkg.com/mdui@1.0.2/dist/css/mdui.min.css
Requested by
Host: ip.nexitally.buzz
URL: https://ip.nexitally.buzz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7caf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1c2fda3c0aed39cef2c3ad98701cc6db8b095e35c9bb46adba3661f5ae0bb54c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ip.nexitally.buzz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Fri, 31 Mar 2023 03:29:47 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
4959312
last-modified
Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id
01GR71V8VTEJQ9WV3QYY9CH2N6-fra
server
cloudflare
etag
W/"4f6da-r8CbHxaeKloJRtPzOADq4COux68"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7b05828dba8e39d6-FRA
mdui.min.js
unpkg.com/mdui@1.0.2/dist/js/
72 KB
21 KB
Script
General
Full URL
https://unpkg.com/mdui@1.0.2/dist/js/mdui.min.js
Requested by
Host: ip.nexitally.buzz
URL: https://ip.nexitally.buzz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7caf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a50321aede22fb162e6737ca6e85d31369675c371c67ca88d8587c8321ad5fa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ip.nexitally.buzz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Fri, 31 Mar 2023 03:29:47 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
4952535
last-modified
Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id
01GR78A64VJ2VX623107SEA75Y-fra
server
cloudflare
etag
W/"12125-7MZesUCol9rrmaR3bvNplxUa14A"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
cf-ray
7b05828dba9139d6-FRA
simple
ip.skk.moe/ Frame B4D2
0
0
Document
General
Full URL
https://ip.skk.moe/simple
Requested by
Host: ip.nexitally.buzz
URL: https://ip.nexitally.buzz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.0.127 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://ip.nexitally.buzz/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
7b05828dea619b55-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy
same-origin
cross-origin-resource-policy
same-origin
date
Fri, 31 Mar 2023 03:29:47 GMT
expires
Thu, 01 Jan 1970 00:00:01 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
permissions-policy
accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy
same-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ps%2FgoNUrJu8CxoIgtp1UEFy4KQPxTX1m%2FLCCwHzDTIEj%2FtW5yXfa%2BQ5R%2Fgovx3PTjF%2B9gz6mC2RJthMFPy7IOdJmOL0BDVehh61sPtoRVufY6Rz2cQAdy2k9GlBl"}],"group":"cf-nel","max_age":604800}
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Accept-Encoding
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
v2
api.fast.com/netflix/speedtest/
0
0

jsonip
ip.seeip.org/
22 B
321 B
XHR
General
Full URL
https://ip.seeip.org/jsonip?
Requested by
Host: ip.nexitally.buzz
URL: https://ip.nexitally.buzz/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server
23.128.64.141 Portland, United States, ASN32097 (WII, US),
Reverse DNS
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
044ec534d6c7357107c0f3f73ff68f4ecdaeabcefa06882072f47ae231ec579c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ip.nexitally.buzz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date
Fri, 31 Mar 2023 03:29:49 GMT
strict-transport-security
max-age=31536000; includeSubDomains
Server
nginx/1.14.0 (Ubuntu)
Content-Type
application/json; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
no-cache
Connection
keep-alive
Content-Length
22
trace
cf-ns.com/cdn-cgi/
325 B
459 B
XHR
General
Full URL
https://cf-ns.com/cdn-cgi/trace
Requested by
Host: ip.nexitally.buzz
URL: https://ip.nexitally.buzz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
240e:944:8:5:3d1e:3cd2:c8f7:fffe , China, ASN58541 (CHINATELECOM-SHANDONG-QINGDAO-IDC Qingdao,266000, CN),
Reverse DNS
Software
cloudflare /
Resource Hash
b87a7ee6a5dd1349d2661485801f9f142d8542cb172ff2dcbf8d226bb9b8e716
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ip.nexitally.buzz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Fri, 31 Mar 2023 03:29:49 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cloudflare
x-frame-options
DENY
content-type
text/plain
access-control-allow-origin
*
cache-control
no-cache
cf-ray
7b0582993a1c0f44-TAO
expires
Thu, 01 Jan 1970 00:00:01 GMT
G00000000.ts
x-live-fox-stgec.uplynk.com/ausw/slices/8d1/d8e6eec26bf544f084bad49a7fa2eac5/8d1de292bcc943a6b886d029e6c0dc87/
345 B
502 B
XHR
General
Full URL
https://x-live-fox-stgec.uplynk.com/ausw/slices/8d1/d8e6eec26bf544f084bad49a7fa2eac5/8d1de292bcc943a6b886d029e6c0dc87/G00000000.ts?pbs=c61e60ee63ce43359679fb9f65d21564&cloud=aws&si=0
Requested by
Host: ip.nexitally.buzz
URL: https://ip.nexitally.buzz/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:133:202d:cd5:25f1:103b:1d26 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (ama/48BC) /
Resource Hash
d9f7e0aa1bff501986995b7c69742a14f373819ab6ecd599af29d67f9d8b4794

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ip.nexitally.buzz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Fri, 31 Mar 2023 03:29:47 GMT
server
ECAcc (ama/48BC)
content-type
text/html
access-control-allow-origin
*
cache-control
no-cache
cdn-request-id
465355940544717075916370787770860870628
content-length
345
expires
Fri, 31 Mar 2023 03:29:46 GMT
geog
api2.hbogoasia.com/v1/
606 B
942 B
XHR
General
Full URL
https://api2.hbogoasia.com/v1/geog?lang=undefined&version=0&bundleId=www.hbogoasia.com
Requested by
Host: ip.nexitally.buzz
URL: https://ip.nexitally.buzz/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.228.166.246 , Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-13-228-166-246.ap-southeast-1.compute.amazonaws.com
Software
/
Resource Hash
189b6e708104e11be638a53e4f6c5c196aadcc959e90fef462211b667580628d
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ip.nexitally.buzz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Fri, 31 Mar 2023 03:29:47 GMT
strict-transport-security
max-age=15552000; includeSubDomains
x-content-type-options
nosniff
etag
W/"25e-bxoExQbTt7tq37fTdj5TqXa49WU"
x-download-options
noopen
vary
Accept-Encoding
x-dns-prefetch-control
off
content-type
application/json; charset=utf-8
access-control-allow-origin
*
cache-control
no-cache
x-frame-options
SAMEORIGIN
content-length
606
x-xss-protection
1; mode=block
android
uapisfm.tvbanywhere.com.sg/geoip/check/platform/
100 B
1 KB
XHR
General
Full URL
https://uapisfm.tvbanywhere.com.sg/geoip/check/platform/android
Requested by
Host: ip.nexitally.buzz
URL: https://ip.nexitally.buzz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.121.125 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-121-125.fra60.r.cloudfront.net
Software
/
Resource Hash
a846e66b75813f011e4964f155513d48f8143758b2b54dfdd7188918a569998c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ip.nexitally.buzz/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Fri, 31 Mar 2023 03:29:47 GMT
via
1.1 490f651effcacfa7d80143d3047d794e.cloudfront.net (CloudFront)
x-content-type-options
nosniff
x-amz-cf-pop
FRA60-P1
etag
"64-zcrlhHiB/h4fIYBj8UMctLJPlc8"
x-download-options
noopen
x-frame-options
DENY
x-cache
Miss from cloudfront
content-type
application/json; charset=utf-8
access-control-allow-origin
https://ip.nexitally.buzz
cache-control
no-cache, no-store, s-maxage=0
access-control-allow-credentials
true
content-length
100
x-xss-protection
1; mode=block
x-amz-cf-id
GVnVNlRRQLxe50_QRlF3H_fn4rqfrK--6qMivmaB5E2h8qtP0-HHGA==
MaterialIcons-Regular.woff2
unpkg.com/mdui@1.0.2/dist/icons/material-icons/
43 KB
44 KB
Font
General
Full URL
https://unpkg.com/mdui@1.0.2/dist/icons/material-icons/MaterialIcons-Regular.woff2
Requested by
Host: unpkg.com
URL: https://unpkg.com/mdui@1.0.2/dist/css/mdui.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7caf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a87d66c91b2e7dc5530aef76c03bd6a3d25ea5826110bf4803b561b811cc8726
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://unpkg.com/mdui@1.0.2/dist/css/mdui.min.css
Origin
https://ip.nexitally.buzz
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Fri, 31 Mar 2023 03:29:47 GMT
via
1.1 fly.io
x-content-type-options
nosniff
cf-cache-status
HIT
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
591374
content-length
44300
last-modified
Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id
01GW97EA6TW986TVCW6X5P305J-fra
server
cloudflare
etag
"ad0c-CZY1kujJU8x+FOP7ClsF1QQuhDU"
vary
Accept-Encoding
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7b05828e0ca935fe-FRA

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
api.fast.com
URL
https://api.fast.com/netflix/speedtest/v2?https=true&token=YXNkZmFzZGxmbnNkYWZoYXNkZmhrYWxm&urlCount=1

Verdicts & Comments Add Verdict or Comment

11 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 boolean| credentialless string| regioncheck object| httpRequest object| httpRequest1 object| httpRequest2 object| httpRequest3 object| httpRequest4 object| httpRequest5 number| checkstat object| mdui

0 Cookies

5 Console Messages

Source Level URL
Text
network error URL: chrome-error://chromewebdata/
Message:
Failed to load resource: the server responded with a status of 403 ()
other error URL: chrome-error://chromewebdata/
Message:
Refused to display 'https://ip.skk.moe/' in a frame because it set 'X-Frame-Options' to 'sameorigin'.
network error URL: https://x-live-fox-stgec.uplynk.com/ausw/slices/8d1/d8e6eec26bf544f084bad49a7fa2eac5/8d1de292bcc943a6b886d029e6c0dc87/G00000000.ts?pbs=c61e60ee63ce43359679fb9f65d21564&cloud=aws&si=0
Message:
Failed to load resource: the server responded with a status of 403 ()
javascript error URL: https://ip.nexitally.buzz/
Message:
Access to XMLHttpRequest at 'https://api.fast.com/netflix/speedtest/v2?https=true&token=YXNkZmFzZGxmbnNkYWZoYXNkZmhrYWxm&urlCount=1' from origin 'https://ip.nexitally.buzz' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://api.fast.com/netflix/speedtest/v2?https=true&token=YXNkZmFzZGxmbnNkYWZoYXNkZmhrYWxm&urlCount=1
Message:
Failed to load resource: net::ERR_FAILED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff