urlscan.io logo urlscan.io
SecurityTrails logo

security-challenge.xyz Open in urlscan Pro
2606:4700:3030::681c:10b1  Public Scan

Go To Rescan Add Verdict Report
URL: https://security-challenge.xyz/
Submission: On May 10 via automatic, source certstream-suspicious
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 8 IPs in 3 countries across 8 domains to perform 15 HTTP transactions. The main IP is 2606:4700:3030::681c:10b1, located in United States and belongs to CLOUDFLARENET, US. The main domain is security-challenge.xyz.
TLS certificate: Issued by CloudFlare Inc ECC CA-2 on May 10th 2020. Valid for: 5 months.
This is the only time security-challenge.xyz was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

5    2606:4700:3030::681c:10b1 (United States)

ASN13335 (CLOUDFLARENET, US)
security-challenge.xyz
1    2a00:1450:4001:821::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
ajax.googleapis.com
1    2a03:2880:f21c:81e5:face:b00c:0:4420 (Ireland)

ASN32934 (FACEBOOK, US)
www.instagram.com
1    2606:4700:10::6814:442e (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.000webhost.com
1    23.111.11.182 (Phoenix, United States)

ASN33438 (HIGHWINDS2, US)
a.opmnstr.com
4    2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)
connect.facebook.net
staticxx.facebook.com
1    13.225.87.79 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-87-79.fra2.r.cloudfront.net
api.omappapi.com
2    2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)
www.facebook.com
Domain Requested by
5 security-challenge.xyz security-challenge.xyz
ajax.googleapis.com
2 www.facebook.com security-challenge.xyz
2 staticxx.facebook.com 1 redirects security-challenge.xyz
2 connect.facebook.net security-challenge.xyz
connect.facebook.net
1 api.omappapi.com a.opmnstr.com
1 a.opmnstr.com security-challenge.xyz
1 cdn.000webhost.com security-challenge.xyz
1 www.instagram.com security-challenge.xyz
1 ajax.googleapis.com security-challenge.xyz
15 9
Subject Issuer Validity Valid
sni.cloudflaressl.com
CloudFlare Inc ECC CA-2		 2020-05-10 -
2020-10-09		 5 months crt.sh
upload.video.google.com
GTS CA 1O1		 2020-04-15 -
2020-07-08		 3 months crt.sh
*.www.instagram.com
DigiCert SHA2 High Assurance Server CA		 2020-04-28 -
2020-07-27		 3 months crt.sh
*.000webhost.com
COMODO RSA Domain Validation Secure Server CA		 2018-10-19 -
2020-12-17		 2 years crt.sh
*.opmnstr.com
Go Daddy Secure Certificate Authority - G2		 2019-04-11 -
2021-04-11		 2 years crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2020-04-15 -
2020-07-14		 3 months crt.sh
api.opmnstr.com
Amazon		 2020-04-09 -
2021-05-09		 a year crt.sh

This page contains 2 frames:

Primary Page: https://security-challenge.xyz/
Frame ID: 126E58B811C9BF8F1119ACBA0ED637AA
Requests: 14 HTTP requests in this frame

Frame: https://staticxx.facebook.com/connect/xd_arbiter.php?version=46
Frame ID: ED1E6C12F32C6DC5EE66D406FF0C1BDD
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i
Overall confidence: 100%
Detected patterns
  • script /\/\/connect\.facebook\.net\/[^/]*\/[a-z]*\.js/i
Overall confidence: 100%
Detected patterns
  • script /\/([\d.]+)\/jquery(?:\.min)?\.js/i
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

15
Requests

100 %
HTTPS

75 %
IPv6

8
Domains

9
Subdomains

8
IPs

3
Countries

295 kB
Transfer

1078 kB
Size

5
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 7
  • https://staticxx.facebook.com/connect/xd_arbiter/r/lY4eZXm_YWu.js?version=42 HTTP 302
  • https://staticxx.facebook.com/connect/xd_arbiter.php?version=46

15 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
security-challenge.xyz/ 		136 KB
30 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://security-challenge.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::681c:10b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6905524bc8354bf9a1489c40964534e62b37e8d15720c17fa72394116421ee20
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
security-challenge.xyz
:scheme
https
:path
/
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
date
Sun, 10 May 2020 17:32:34 GMT
content-type
text/html; charset=UTF-8
set-cookie
__cfduid=d39172c2a8b3e5980f3b10c7cc21781921589131954; expires=Tue, 09-Jun-20 17:32:34 GMT; path=/; domain=.security-challenge.xyz; HttpOnly; SameSite=Lax; Secure
x-xss-protection
1; mode=block
x-content-type-options
nosniff
x-request-id
9dd67015646aeb6c9012a4600648a802
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
5915667a3c629704-FRA
content-encoding
br
cf-request-id
02a13e606400009704e5871200000001
9e6f34142751.js
security-challenge.xyz/static/bundles/FBSignupPage.js/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://security-challenge.xyz/static/bundles/FBSignupPage.js/9e6f34142751.js
Requested by
Host: security-challenge.xyz
URL: https://security-challenge.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::681c:10b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://security-challenge.xyz/
Origin
https://security-challenge.xyz

Response headers

date
Sun, 10 May 2020 17:32:35 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
status
404
x-xss-protection
1; mode=block
cache-control
max-age=14400
cf-ray
5915667dd86a9704-FRA
cf-request-id
02a13e62aa00009704e5899200000001
x-request-id
c7bc7ffd494dc4e48c68060b00d92054
bb0e780484a5.js
security-challenge.xyz/static/bundles/LoginAndSignupPage.js/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://security-challenge.xyz/static/bundles/LoginAndSignupPage.js/bb0e780484a5.js
Requested by
Host: security-challenge.xyz
URL: https://security-challenge.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::681c:10b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://security-challenge.xyz/
Origin
https://security-challenge.xyz

Response headers

date
Sun, 10 May 2020 17:32:35 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
MISS
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/html; charset=UTF-8
status
404
x-xss-protection
1; mode=block
cache-control
max-age=14400
cf-ray
5915667dd86d9704-FRA
cf-request-id
02a13e62aa00009704e589a200000001
x-request-id
acd6507c92d254dcf9db41d86983b03d
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.1.1/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.1.1/jquery.min.js
Requested by
Host: security-challenge.xyz
URL: https://security-challenge.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://security-challenge.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Tue, 05 May 2020 21:43:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
416960
status
200
alt-svc
h3-27=":443"; ma=2592000,h3-25=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
30244
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 05 May 2021 21:43:14 GMT
f06b908907d5.png
www.instagram.com/static/images/appstore-install-badges/badge_android_english-en.png/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.instagram.com/static/images/appstore-install-badges/badge_android_english-en.png/f06b908907d5.png
Requested by
Host: security-challenge.xyz
URL: https://security-challenge.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f21c:81e5:face:b00c:0:4420 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
583714033cab0d76045a8d4bbfb2326983f40d5c2cfa239e9527da9617686e6b

Request headers

Referer
https://security-challenge.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sun, 10 May 2020 10:49:38 GMT, Sun, 10 May 2020 10:49:38 GMT, Sun, 10 May 2020 17:32:34 GMT
x-fb-trip-id
1679558926
status
200
etag
"f06b908907d5"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
edge-control
max-age=1209600, no-transform
cache-control
public,max-age=31536000,immutable
content-encoding
br
content-length
9799
footer-powered-by-000webhost-white2.png
cdn.000webhost.com/000webhost/logo/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.000webhost.com/000webhost/logo/footer-powered-by-000webhost-white2.png
Requested by
Host: security-challenge.xyz
URL: https://security-challenge.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6814:442e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
86f2673ec74a632865109a76b2232f4f5b3587daa219e07a17ef1d9c76a0fda5
Security Headers
Name Value
Strict-Transport-Security max-age=2592000
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://security-challenge.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sun, 10 May 2020 17:32:34 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
785
cf-polished
origFmt=png, origSize=2046
status
200
content-disposition
inline; filename="footer-powered-by-000webhost-white2.webp"
x-hostinger-datacenter
srv
vary
Accept
content-length
1696
x-xss-protection
1; mode=block
last-modified
Thu, 07 May 2020 14:25:18 GMT
server
cloudflare
x-frame-options
sameorigin
etag
"5eb41a4e-7fe"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=2592000
content-type
image/webp
expires
Sun, 10 May 2020 21:32:34 GMT
cache-control
public, max-age=14400
x-hostinger-node
nl-srv-cdn2
cf-request-id
02a13e62fc0000d729fab68200000001
accept-ranges
bytes
cf-ray
5915667e6d33d729-FRA
cf-bgj
imgq:100,h2pri
api.min.js
a.opmnstr.com/app/js/ 		199 KB
59 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.opmnstr.com/app/js/api.min.js
Requested by
Host: security-challenge.xyz
URL: https://security-challenge.xyz/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.111.11.182 Phoenix, United States, ASN33438 (HIGHWINDS2, US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
6dea8865dbcf331b73dbdd5969a09f69bf6be3f0a4b76a6c14acece427b3a828

Request headers

Referer
https://security-challenge.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sun, 10 May 2020 17:32:34 GMT
content-encoding
gzip
last-modified
Fri, 08 May 2020 17:30:52 GMT
server
NetDNA-cache/2.2
x-amz-request-id
F1690A67A41461D6
etag
W/"ebff8892b7f75a12a225fa7566f1d9d1"
x-cache
HIT
content-type
application/javascript
status
200
cache-control
max-age=31104000
access-control-allow-origin
*
x-amz-id-2
vSwuOstD5RhxiumQ3uKdmZLb/fWM6dtH0eAAFS1zrmv0afbxh7xF52FL5SoD15yt/w+76pqoBCg=
expires
Wed, 05 May 2021 17:32:34 GMT
fbevents.js
connect.facebook.net/en_US/ 		131 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: security-challenge.xyz
URL: https://security-challenge.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
4cb61e44bf63a9e090e666898cd04d382e4c33b55b62cc5e9ff7dab055fbf787
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://security-challenge.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
status
200
content-length
31766
x-xss-protection
0
pragma
public
x-fb-debug
o0CIxJWP4WvTADhdUGJpQuUJb/kPtMZLHF7EYmmsPde/s+N7bcsHiog/YpAq+Qatl27jyBWIb8EAmzlJMkiEdA==
x-fb-trip-id
664085054
x-frame-options
DENY
date
Sun, 10 May 2020 17:32:35 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
cache-control
public, max-age=1200
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires
Sat, 01 Jan 2000 00:00:00 GMT
xd_arbiter.php
staticxx.facebook.com/connect/ Frame ED1E
Redirect Chain
  • https://staticxx.facebook.com/connect/xd_arbiter/r/lY4eZXm_YWu.js?version=42
  • https://staticxx.facebook.com/connect/xd_arbiter.php?version=46
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://staticxx.facebook.com/connect/xd_arbiter.php?version=46
Requested by
Host: security-challenge.xyz
URL: https://security-challenge.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
staticxx.facebook.com
:scheme
https
:path
/connect/xd_arbiter.php?version=46
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://security-challenge.xyz/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
fr=0tRwEZE26Elwsl3h4..BeuDqy...1.0.BeuDqy.
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
https://security-challenge.xyz/

Response headers

status
200
content-type
text/html; charset=utf-8
expires
Mon, 10 May 2021 00:44:42 GMT
strict-transport-security
max-age=15552000; preload
content-encoding
br
content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
cache-control
public,max-age=31536000,immutable
x-fb-debug
njlNS6POWOuWuwLQAME5xLWejbR5z7eEnXBcYgndUl/SIB164Cf9xL0bW2ACgmkryRMJRa9WqbapHKv4FAfPMQ==
content-length
9767
x-fb-trip-id
664085054
date
Sun, 10 May 2020 17:32:35 GMT

Redirect headers

status
302
location
https://staticxx.facebook.com/connect/xd_arbiter.php?version=46
x-xss-protection
0
x-content-type-options
nosniff
content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
strict-transport-security
max-age=15552000; preload
content-type
text/html; charset="utf-8"
x-fb-debug
FGsWz9/eiLmXaguFYwP0CXITDOAANvPBNKPAhD0KGev8R/XQJsSaPdSwiSQZFDegLHVmgE9vTerXFvHJTNCiTA==
content-length
0
x-fb-trip-id
664085054
date
Sun, 10 May 2020 17:32:35 GMT
procesar.php
security-challenge.xyz/ 		21 KB
5 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://security-challenge.xyz/procesar.php
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.1.1/jquery.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::681c:10b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
475d7712f4a6a3997f41807e56f4c61a9e51b7b4883da9064291df4ea6ebd2ac
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept
*/*
Referer
https://security-challenge.xyz/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Sun, 10 May 2020 17:32:35 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type
text/html; charset=UTF-8
status
404
x-xss-protection
1; mode=block
cf-ray
5915667f2a0a9704-FRA
cf-request-id
02a13e637900009704e58ab200000001
x-request-id
d6c6f4dc2e29c8564c381ebdaaa4664f
procesar.php
security-challenge.xyz/ 		21 KB
5 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://security-challenge.xyz/procesar.php
Requested by
Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/jquery/3.1.1/jquery.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::681c:10b1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
475d7712f4a6a3997f41807e56f4c61a9e51b7b4883da9064291df4ea6ebd2ac
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept
*/*
Referer
https://security-challenge.xyz/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Sun, 10 May 2020 17:32:35 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type
text/html; charset=UTF-8
status
404
x-xss-protection
1; mode=block
cf-ray
5915667f2a109704-FRA
cf-request-id
02a13e637a00009704e58ad200000001
x-request-id
877546b7773e1ebde332dc0a926c9758
1425767024389221
connect.facebook.net/signals/config/ 		476 KB
121 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/1425767024389221?v=2.9.18&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
f1d902aa3e665b016b2d91f9b41abfa7dafcbc4b39f0a81b6d8f43be8671a090
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://security-challenge.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-fb-trip-id
664085054
pragma
public
x-fb-debug
Pd/sHE8Kr/mFUvPho9IWXbAeOXeABtLYfHY7mwRq7bRaeBP3ItfwbP63+6V66HEbaY+ggnSnlTJz1Ox1YRRd8Q==
content-encoding
gzip
x-content-type-options
nosniff
x-frame-options
DENY
date
Sun, 10 May 2020 17:32:35 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-type
application/x-javascript; charset=utf-8
status
200
cache-control
public, max-age=1200
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
vary
Accept-Encoding
x-xss-protection
0
expires
Sat, 01 Jan 2000 00:00:00 GMT
f6brbmuxflyqoriatchv
api.omappapi.com/v2/embed/71036/ 		126 B
505 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.omappapi.com/v2/embed/71036/f6brbmuxflyqoriatchv
Requested by
Host: a.opmnstr.com
URL: https://a.opmnstr.com/app/js/api.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.225.87.79 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-87-79.fra2.r.cloudfront.net
Software
Pagely Gateway/1.5.1 /
Resource Hash
fcb673f7da578b0230aa24d90df47b3e751de9e9f19c2a1a9972394c20358285

Request headers

Referer
https://security-challenge.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-user-agent
standard
via
1.1 784dd167d622737126ee2d76985e7d3c.cloudfront.net (CloudFront)
x-cache-config
0 0
server
Pagely Gateway/1.5.1
x-amz-cf-pop
FRA2-C2
status
410
date
Sun, 10 May 2020 17:32:35 GMT
vary
Accept-Encoding, User-Agent
x-cache
Error from cloudfront
content-type
application/json;charset=utf-8
access-control-allow-origin
*
access-control-allow-headers
X-CSRF-Token
content-length
126
x-amz-cf-id
fgh4poPFc1bZvkh2pqhZJctG_yuUrFquJtk35qIzRcVfC1BdEiknWw==
/
www.facebook.com/tr/ 		44 B
146 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=1425767024389221&ev=PageView&dl=https%3A%2F%2Fsecurity-challenge.xyz%2F&rl=&if=false&ts=1589131955385&sw=1600&sh=1200&v=2.9.18&r=stable&ec=0&o=30&fbp=fb.1.1589131955384.1905737146&it=1589131955077&coo=false&rqm=GET
Requested by
Host: security-challenge.xyz
URL: https://security-challenge.xyz/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://security-challenge.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sun, 10 May 2020 17:32:35 GMT, Sun, 10 May 2020 17:32:35 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
status
200
cache-control
no-cache, must-revalidate, max-age=0
content-length
44
expires
Sun, 10 May 2020 17:32:35 GMT
/
www.facebook.com/tr/ 		44 B
100 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=1425767024389221&ev=Microdata&dl=https%3A%2F%2Fsecurity-challenge.xyz%2F&rl=&if=false&ts=1589131956889&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Login%20%E2%80%A2%20Instagram%22%2C%22meta%3Adescription%22%3A%22Welcome%20back%20to%20Instagram.%20Sign%20in%20to%20check%20out%20what%20your%20friends%2C%20family%20%26%20interests%20have%20been%20capturing%20%26%20sharing%20around%20the%20world.%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.18&r=stable&ec=1&o=30&fbp=fb.1.1589131956888.2119440873&it=1589131955077&coo=false&es=automatic&tm=3&rqm=GET
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://security-challenge.xyz/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Sun, 10 May 2020 17:32:36 GMT, Sun, 10 May 2020 17:32:36 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
status
200
cache-control
no-cache, must-revalidate, max-age=0
content-length
44
expires
Sun, 10 May 2020 17:32:36 GMT

Verdicts & Comments Add Verdict or Comment

33 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| $ function| jQuery object| __bufferedPerformance function| fbq function| _fbq function| getCookie undefined| wordpressAdminBody object| notification object| hostingerLogo undefined| mainContent object| wpSidebar object| wpTopBarRight undefined| googleFont undefined| css undefined| style undefined| sheet undefined| button undefined| link undefined| mainContentHolder undefined| h1Tag undefined| h2Tag undefined| paragraph undefined| list undefined| org_html undefined| new_html undefined| saleImage function| setImmediate function| clearImmediate function| OptinMonsterApp boolean| om_loaded object| f6brbmuxflyqoriatchv

5 Cookies

Domain/Path Name / Value
.security-challenge.xyz/ Name: _fbp
Value: fb.1.1589131955384.1905737146
security-challenge.xyz/ Name: _omappvs
Value: 1589131955098
.facebook.com/ Name: fr
Value: 0tRwEZE26Elwsl3h4..BeuDqy...1.0.BeuDqy.
security-challenge.xyz/ Name: _omappvp
Value: SnSkiwqSerRv1r9Z2qPC95cfOZRiamJPJGpVJDI7W13cTrdXzHwwCglmeVtBohghotQ29BYn9nVRUXENeQC2X5yD1g3ibAD5
.security-challenge.xyz/ Name: __cfduid
Value: d39172c2a8b3e5980f3b10c7cc21781921589131954

1 Console Messages

Source Level URL
Text
console-api error URL: https://a.opmnstr.com/app/js/api.min.js(Line 2)
Message:
[OptinMonster] The campaign could not be found. Check to make sure it is active.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block