ninecasino.com Open in urlscan Pro
2606:4700:10::ac43:27d7 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://circleplin.com/
Effective URL:
https://ninecasino.com/?cxd=36648_1295671_%7Cafp1%3A19qg66p6thirb%7Cafp10%3A&af_dev_key=BDREFvBLEZQKVYEhZafc85&af_id=&a...
Submission: On March 19 via api (March 19th 2024, 1:26:36 pm UTC) from US — Scanned from US

Summary HTTP 17 Redirects Behaviour Indicators

Summary

This website contacted 8 IPs in 2 countries across 10 domains to perform 17 HTTP transactions. The main IP is 2606:4700:10::ac43:27d7, located in and belongs to . The main domain is ninecasino.com.
TLS certificate: Issued by GTS CA 1P5 on January 22nd 2024. Valid for: 3 months.

This is the only time ninecasino.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 5	2606:4700:303... 2606:4700:3032::6815:1ea4	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2607:f8b0:400... 2607:f8b0:4006:80d::200a	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f01... 2a03:2880:f012:10c:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2607:f8b0:400... 2607:f8b0:4006:80b::2003	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f11... 2a03:2880:f112:182:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1 1	23.88.7.117 23.88.7.117	24940 (HETZNER-AS) (HETZNER-AS)
1 1	35.234.86.61 35.234.86.61	() ()
1 1	2606:4700:303... 2606:4700:3032::ac43:d2c8	() ()
4	2606:4700:10:... 2606:4700:10::ac43:27d7	() ()
2	2606:4700::68... 2606:4700::6811:2b8	() ()
17	8

5 2606:4700:3032::6815:1ea4 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

circleplin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:80d::200a (United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f012:10c:face:b00c:0:3 (Secaucus, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:80b::2003 (United States)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f112:182:face:b00c:0:25de (Secaucus, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.88.7.117 (Gunzenhausen, Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.117.7.88.23.clients.your-server.de

benioosn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.234.86.61 (None, ) 1 redirects

ASN- ()

track.chillipartners.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3032::ac43:d2c8 (None, ) 1 redirects

ASN- ()

ninecasino1go.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:10::ac43:27d7 (None, )

ASN- ()

ninecasino.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:2b8 (None, )

ASN- ()

challenges.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
5	circleplin.com 1 redirects circleplin.com	249 KB
4	ninecasino.com ninecasino.com	179 KB
2	cloudflare.com challenges.cloudflare.com	13 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 98	368 B
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 251	70 KB
1	ninecasino1go.com 1 redirects ninecasino1go.com	1023 B
1	chillipartners.com 1 redirects track.chillipartners.com	862 B
1	benioosn.com 1 redirects benioosn.com	1 KB
1	gstatic.com fonts.gstatic.com	33 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 110	1 KB
17	10

	Domain	Requested by
5	circleplin.com	1 redirects circleplin.com
4	ninecasino.com	circleplin.com ninecasino.com
2	challenges.cloudflare.com	ninecasino.com challenges.cloudflare.com
2	www.facebook.com	circleplin.com
2	connect.facebook.net	circleplin.com connect.facebook.net
1	ninecasino1go.com	1 redirects
1	track.chillipartners.com	1 redirects
1	benioosn.com	1 redirects
1	fonts.gstatic.com	fonts.googleapis.com
1	fonts.googleapis.com	circleplin.com
17	10

This site contains no links.

Subject Issuer	Validity	Valid
circleplin.com E1	`2024-03-18` - `2024-06-16`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-12-27` - `2024-03-26`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
ninecasino.com GTS CA 1P5	`2024-01-22` - `2024-04-21`	3 months	crt.sh
challenges.cloudflare.com Cloudflare Inc ECC CA-3	`2023-08-18` - `2024-08-17`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://ninecasino.com/?cxd=36648_1295671_%7Cafp1%3A19qg66p6thirb%7Cafp10%3A&af_dev_key=BDREFvBLEZQKVYEhZafc85&af_id=&af_sub1=&af_sub2=&af_sub3=&af_sub4=&af_sub5=&afp1=19qg66p6thirb&afp10=&brand=ninecasino&bta=36648&click_id=19qg66p6thirb&keitaro_country=US&keitaro_platform=Windows&keitaro_stream_id=388809&store_id=&rotatorId=55c864c4c38f875e77b8036f28b8dbd90602942e49ae89d03c78dd30bb3bbd3d&rotatorRouter=ninecasino1go.com
Frame ID: E0761B000657C427753C9454F044F21B
Requests: 16 HTTP requests in this frame

Frame: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/3gg31/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Frame ID: 664A902AFC622A700D4B3EC901EC159E
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://circleplin.com/ HTTP 302
https://circleplin.com/index.html Page URL
https://benioosn.com/rRtZfvFX?&sub_id_6=circleplin.com&sub_id_7=null&sub_id_8=undefined&sub_id_9=... HTTP 302
https://track.chillipartners.com/visit/?bta=36648&brand=ninecasino&afp1=19qg66p6thirb&afp10=&store_id=&af_id=... HTTP 302
https://ninecasino1go.com/?cxd=36648_1295671_|afp1:19qg66p6thirb|afp10:&af_dev_key=BDREFvBLEZQKVYEhZaf... HTTP 302
https://ninecasino.com/?cxd=36648_1295671_%7Cafp1%3A19qg66p6thirb%7Cafp10%3A&af_dev_key=BDREFvBLEZQ... Page URL

Detected technologies

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Page Statistics

17
Requests

94 %
HTTPS

80 %
IPv6

10
Domains

10
Subdomains

8
IPs

2
Countries

545 kB
Transfer

1228 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://circleplin.com/ HTTP 302
https://circleplin.com/index.html Page URL
https://benioosn.com/rRtZfvFX?&sub_id_6=circleplin.com&sub_id_7=null&sub_id_8=undefined&sub_id_9=fb.1.1710854782884.464345988 HTTP 302
https://track.chillipartners.com/visit/?bta=36648&brand=ninecasino&afp1=19qg66p6thirb&afp10=&store_id=&af_id=&af_dev_key=BDREFvBLEZQKVYEhZafc85&keitaro_stream_id=388809&keitaro_country=US&keitaro_platform=Windows&click_id=19qg66p6thirb&af_sub1=&af_sub2=&af_sub3=&af_sub4=&af_sub5= HTTP 302
https://ninecasino1go.com/?cxd=36648_1295671_|afp1:19qg66p6thirb|afp10:&af_dev_key=BDREFvBLEZQKVYEhZafc85&af_id=&af_sub1=&af_sub2=&af_sub3=&af_sub4=&af_sub5=&afp1=19qg66p6thirb&afp10=&brand=ninecasino&bta=36648&click_id=19qg66p6thirb&keitaro_country=US&keitaro_platform=Windows&keitaro_stream_id=388809&store_id= HTTP 302
https://ninecasino.com/?cxd=36648_1295671_%7Cafp1%3A19qg66p6thirb%7Cafp10%3A&af_dev_key=BDREFvBLEZQKVYEhZafc85&af_id=&af_sub1=&af_sub2=&af_sub3=&af_sub4=&af_sub5=&afp1=19qg66p6thirb&afp10=&brand=ninecasino&bta=36648&click_id=19qg66p6thirb&keitaro_country=US&keitaro_platform=Windows&keitaro_stream_id=388809&store_id=&rotatorId=55c864c4c38f875e77b8036f28b8dbd90602942e49ae89d03c78dd30bb3bbd3d&rotatorRouter=ninecasino1go.com Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://circleplin.com/ HTTP 302
https://circleplin.com/index.html

17 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

index.html Show response
circleplin.com/
Redirect Chain

https://circleplin.com/
https://circleplin.com/index.html

19 KB
5 KB

172ms
171ms

Document
text/html

2606:4700:3032::6815:1ea4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://circleplin.com/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3032::6815:1ea4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9c24d498efa1ea11e2a19e3d24eb8d35bf9883ea227630975bf2830140f1ee26

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 866dcb2d4ee1741d-MIA
content-encoding: br
content-type: text/html
date: Tue, 19 Mar 2024 13:26:21 GMT
last-modified: Fri, 15 Mar 2024 14:08:20 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AGRWwU6%2FYhySwh%2BCIn%2Fv%2Bbm0USUmTr6RFC%2B6Y8UgtJCkgTApyyXXIAefYz7WNUBgyFlG32FBT2KjDSha7nzVt3OUBvuPCRZtdNIaeBp7sLcJJ%2BLpXbyZQZ%2Bx4%2FJuB4zweaff1aGhjSTGDaxJsw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

Redirect headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 866dcb29fa03741d-MIA
content-type: text/html; charset=UTF-8
date: Tue, 19 Mar 2024 13:26:20 GMT
location: https://circleplin.com/index.html
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0YeF9t8vg8qf8zmZtH5iorwundmAsvnDVyng43p9gmFGje%2BgoacJkwFqwImebxLO0ydiOF845IO9i%2B98ZwGqgwCHKg2P%2BvYJqsvNv2E4qQ2zv1KVMwtHXnrn42bbNJ9xhuYo%2FSZTSHuQ3UNQSA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H3 200 style.min.css
circleplin.com/css/ 6 KB
2 KB 317ms
316ms Stylesheet
text/css 2606:4700:3032::6815:1ea4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://circleplin.com/css/style.min.css
Requested by: Host: circleplin.com
URL: https://circleplin.com/index.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3032::6815:1ea4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 76c02fbf3c857e362b7f4b23ad146677cba891ddaf3a7c701206f0e710320b38

Request headers

accept-language: en-US,en;q=0.9
Referer: https://circleplin.com/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Tue, 19 Mar 2024 13:26:21 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 24 Mar 2022 11:49:14 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"623c5aba-18de"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I3wHoqLpKZ5z6NRIx2%2FTReKrikd%2BLY1thVbBIS5SN9z54%2BS4xabHgJbdI8oskusR7Xp%2FUJ77U3wQ79Y2cWiEESoBKWVMCqljAy7YcKS8efForNUV0VkI89cKlY6hmXUsGDRi64ICjRp6FBX5sQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 866dcb2e7e75748d-MIA
alt-svc: h3=":443"; ma=86400

GET
H3 200 app.min.js Show response
circleplin.com/js/ 97 KB
33 KB 622ms
622ms Script
application/javascript 2606:4700:3032::6815:1ea4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://circleplin.com/js/app.min.js
Requested by: Host: circleplin.com
URL: https://circleplin.com/index.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3032::6815:1ea4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e496de7e3e10499716e7085601be7bfe513eb9d0bae623d6b486881785b23a75

Request headers

accept-language: en-US,en;q=0.9
Referer: https://circleplin.com/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Tue, 19 Mar 2024 13:26:21 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 08 Dec 2022 13:36:46 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"6391e86e-18281"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qFV5aXO2ji1ToBsj7JxXfyhCrmbgqfxxQQhwjQjKbc4lrOMwqnSjkoOcDdarwX1F8qCO36N6F67hy2lkBvnXDiYSIOD8AEi4njdZYJeDjnJOKFGgEFs0Pq9OaaUEY9vaePoMv1pg%2F0hronx4lw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 866dcb2e7e77748d-MIA
alt-svc: h3=":443"; ma=86400

GET
H2 200 css2
fonts.googleapis.com/ 7 KB
1 KB 536ms
367ms Stylesheet
text/css 2607:f8b0:4006:80d::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Montserrat:wght@400;500;700;900&display=swap

Requested by

Host: circleplin.com
URL: https://circleplin.com/css/style.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80d::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ad1fce96f87d256155db5c433075af35926be7d90c6bd109e8c66f6e6e8dc473

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://circleplin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 19 Mar 2024 13:26:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 19 Mar 2024 13:24:10 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 19 Mar 2024 13:26:21 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 216 KB
58 KB 311ms
87ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: circleplin.com
URL: https://circleplin.com/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

4e049bbdc40b8d2e87194216781b7ad54cdb528be6686225e510468c056facb0

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://circleplin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 19 Mar 2024 13:26:22 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 57659
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: GOOD; q=0.7, rtt=68, rtx=0, c=12, mss=1294, tbw=2796, tp=-1, tpl=-1, uplat=1, ullat=-1
pragma: public
x-fb-debug: A+qBI9fq+9KPqxtUCIEpnn6NA8IH57JOhBAkDJp/gjyCtnyIALkPwmJFkCaXlP2wiGM1XeUG5vBJDftz60SiYw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: public, max-age=1200
x-fb-optimizer: 0
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 bc-home.jpg
circleplin.com/img/ 207 KB
208 KB 601ms
597ms Image
image/jpeg 2606:4700:3032::6815:1ea4
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://circleplin.com/img/bc-home.jpg
Requested by: Host: circleplin.com
URL: https://circleplin.com/css/style.min.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3032::6815:1ea4 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7b0b8813139bbf9b8f52bbbc863e9e5ca07593ae5cdc477cf1c993f5fd2f009a

Request headers

accept-language: en-US,en;q=0.9
Referer: https://circleplin.com/css/style.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Tue, 19 Mar 2024 13:26:22 GMT
cf-cache-status: MISS
last-modified: Thu, 08 Dec 2022 13:33:14 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "6391e79a-33c9d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1Lus8oIfDjHmzyqskajUtaXDwbdUlQOcJg%2FjXp%2Bksj8vK2ZpF43LOMZY90h5XsLYwItWYxqAHo%2BH3w%2FMMDcquTBgu1C7s0fjNsyu1MQQ6R%2B%2Bk5E3IQiBJhp6wG8CGdAknJpjfLYsvOiVhhHvGQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 866dcb347dda748d-MIA
alt-svc: h3=":443"; ma=86400
content-length: 212125

GET
H2 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v26/ 32 KB
33 KB 257ms
91ms Font
font/woff2 2607:f8b0:4006:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:wght@400;500;700;900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb2f90081933c0f2475883ca2c5cfee94e96d7314a09433fffc42e37f4cffd3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://circleplin.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Wed, 13 Mar 2024 20:53:42 GMT
x-content-type-options: nosniff
age: 491560
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33092
x-xss-protection: 0
last-modified: Wed, 13 Sep 2023 22:51:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 13 Mar 2025 20:53:42 GMT

GET
H2 200 1373094003447828 Show response
connect.facebook.net/signals/config/ 54 KB
11 KB 206ms
203ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1373094003447828?v=2.9.150&r=stable&domain=circleplin.com&hme=8b8eb2472f555e54a8b57f2b720f9bd3b1bc6aed031525376dd772ba51107995&ex_m=63%2C107%2C95%2C99%2C54%2C3%2C89%2C62%2C14%2C87%2C80%2C45%2C47%2C153%2C156%2C167%2C163%2C164%2C166%2C26%2C90%2C46%2C69%2C165%2C148%2C151%2C160%2C161%2C168%2C116%2C13%2C44%2C172%2C171%2C118%2C16%2C30%2C33%2C1%2C37%2C58%2C59%2C60%2C64%2C84%2C15%2C12%2C86%2C83%2C82%2C96%2C98%2C32%2C97%2C27%2C23%2C149%2C152%2C125%2C25%2C9%2C10%2C11%2C5%2C6%2C22%2C19%2C20%2C50%2C55%2C57%2C67%2C91%2C24%2C68%2C8%2C7%2C72%2C42%2C18%2C93%2C92%2C17%2C74%2C79%2C41%2C40%2C78%2C34%2C36%2C77%2C49%2C75%2C29%2C38%2C66%2C0%2C85%2C4%2C81%2C73%2C76%2C2%2C31%2C56%2C35%2C94%2C39%2C71%2C61%2C100%2C53%2C52%2C28%2C88%2C51%2C48%2C43%2C70%2C65%2C21%2C101

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e62dd14120b6b169b91fcc0d255c435894c634676871fa846d3ad60ea48b4413

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://circleplin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 19 Mar 2024 13:26:22 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-connection-quality: GOOD; q=0.7, rtt=76, rtx=1, c=39, mss=1294, tbw=62796, tp=-1, tpl=-1, uplat=119, ullat=0
pragma: public
x-fb-debug: clEpd4xKs2Wfq2pRhujZf8HpJKmn90crIuG0BxCHu82+um6qJB1vzWY3NWXkPnJsPR16hlX2x+kvjkc5jW0ppw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
270 B 239ms
72ms Image
text/plain 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1373094003447828&ev=PageView&dl=https%3A%2F%2Fcircleplin.com%2Findex.html&rl=&if=false&ts=1710854782902&sw=1600&sh=1200&v=2.9.150&r=stable&ec=0&o=4126&fbp=fb.1.1710854782884.464345988&ler=empty&cdl=API_unavailable&it=1710854782589&coo=false&rqm=GET

Requested by

Host: circleplin.com
URL: https://circleplin.com/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://circleplin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

x-fb-connection-quality: GOOD; q=0.7, rtt=66, rtx=0, c=10, mss=1294, tbw=2767, tp=-1, tpl=-1, uplat=0, ullat=0
strict-transport-security: max-age=31536000; includeSubDomains
date: Tue, 19 Mar 2024 13:26:23 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
98 B 71ms
70ms Image
text/plain 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1373094003447828&ev=Lead&dl=https%3A%2F%2Fcircleplin.com%2Findex.html&rl=&if=false&ts=1710854783167&sw=1600&sh=1200&v=2.9.150&r=stable&ec=1&o=4126&fbp=fb.1.1710854782884.464345988&ler=empty&cdl=API_unavailable&it=1710854782589&coo=false&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://circleplin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

x-fb-connection-quality: GOOD; q=0.7, rtt=67, rtx=0, c=10, mss=1294, tbw=3116, tp=-1, tpl=-1, uplat=0, ullat=0
strict-transport-security: max-age=31536000; includeSubDomains
date: Tue, 19 Mar 2024 13:26:23 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2

403

Primary Request / Show response
ninecasino.com/
Redirect Chain

https://benioosn.com/rRtZfvFX?&sub_id_6=circleplin.com&sub_id_7=null&sub_id_8=undefined&sub_id_9=fb.1.1710854782884.464345988
https://track.chillipartners.com/visit/?bta=36648&brand=ninecasino&afp1=19qg66p6thirb&afp10=&store_id=&af_id=&af_dev_key=BDREFvBLEZQKVYEhZafc85&keitaro_stream_id=388809&keitaro_country=US&keitaro_p...
https://ninecasino1go.com/?cxd=36648_1295671_|afp1:19qg66p6thirb|afp10:&af_dev_key=BDREFvBLEZQKVYEhZafc85&af_id=&af_sub1=&af_sub2=&af_sub3=&af_sub4=&af_sub5=&afp1=19qg66p6thirb&afp10=&brand=ninecas...
https://ninecasino.com/?cxd=36648_1295671_%7Cafp1%3A19qg66p6thirb%7Cafp10%3A&af_dev_key=BDREFvBLEZQKVYEhZafc85&af_id=&af_sub1=&af_sub2=&af_sub3=&af_sub4=&af_sub5=&afp1=19qg66p6thirb&afp10=&brand=ni...

19 KB
10 KB

205ms
48ms

Document
text/html

2606:4700:10::ac43:27d7

General

Check archive.org

Show headers Download Go to

Full URL

https://ninecasino.com/?cxd=36648_1295671_%7Cafp1%3A19qg66p6thirb%7Cafp10%3A&af_dev_key=BDREFvBLEZQKVYEhZafc85&af_id=&af_sub1=&af_sub2=&af_sub3=&af_sub4=&af_sub5=&afp1=19qg66p6thirb&afp10=&brand=ninecasino&bta=36648&click_id=19qg66p6thirb&keitaro_country=US&keitaro_platform=Windows&keitaro_stream_id=388809&store_id=&rotatorId=55c864c4c38f875e77b8036f28b8dbd90602942e49ae89d03c78dd30bb3bbd3d&rotatorRouter=ninecasino1go.com

Requested by

Host: circleplin.com
URL: https://circleplin.com/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:27d7 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

d553134752a50290c1d4e03c9662034d6f3d09c349d8aeedbe8f75a156bb1cac

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://circleplin.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-chl-out: YpeSRCdbXOr8VUD72ZBdIXcjwJdMpgL8h9f59Pqg6p/ZjTdHBsukubajru+3p+93ZuK+LH6t/KQaz9HN4PLs7knC61yrzdX8Hoq0HRFRwaLGXcy2Oh1OA7FGItUAypKOq+vpmU5bCyY5Sf588xHtWw==$OWFE4NQExxVsQrJVbljLaA==
cf-mitigated: challenge
cf-ray: 866dcb5e2fdb498a-MIA
content-encoding: gzip
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
date: Tue, 19 Mar 2024 13:26:28 GMT
expires: Thu, 01 Jan 1970 00:00:01 GMT
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN

Redirect headers

access-control-allow-headers: Authorization, Content-Type, X-Auth-Token, cache-control, x-requested-with
access-control-allow-methods: *
access-control-allow-origin: *
access-control-expose-headers: x-meta-count
alt-svc: h3=":443"; ma=86400
cache-control: no-cache, private
cf-cache-status: DYNAMIC
cf-ray: 866dcb54c8498dd8-MIA
content-type: text/html; charset=UTF-8
date: Tue, 19 Mar 2024 13:26:27 GMT
location: https://ninecasino.com/?cxd=36648_1295671_%7Cafp1%3A19qg66p6thirb%7Cafp10%3A&af_dev_key=BDREFvBLEZQKVYEhZafc85&af_id=&af_sub1=&af_sub2=&af_sub3=&af_sub4=&af_sub5=&afp1=19qg66p6thirb&afp10=&brand=ninecasino&bta=36648&click_id=19qg66p6thirb&keitaro_country=US&keitaro_platform=Windows&keitaro_stream_id=388809&store_id=&rotatorId=55c864c4c38f875e77b8036f28b8dbd90602942e49ae89d03c78dd30bb3bbd3d&rotatorRouter=ninecasino1go.com
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CZEjXPEk51A9S%2FRV6jkLdzW5Kh0mZM%2F%2FK5vAO0K8ZF0XSQFxM1mIsPnipdxL9GbtgplXkGEswHVKCmKNrZrXHKd2oPMYHFxx903JzGTZLWjGpL8KY7l6rKUkR0W6NGiq0geuqvGHtQ%2Fq2ZcLvZITYA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2 200 v1 Show response
ninecasino.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/ 502 KB
143 KB 48ms
47ms Script
application/javascript 2606:4700:10::ac43:27d7

General

Check archive.org

Show headers Download Go to

Full URL: https://ninecasino.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=866dcb5e2fdb498a
Requested by: Host: ninecasino.com
URL: https://ninecasino.com/?cxd=36648_1295671_%7Cafp1%3A19qg66p6thirb%7Cafp10%3A&af_dev_key=BDREFvBLEZQKVYEhZafc85&af_id=&af_sub1=&af_sub2=&af_sub3=&af_sub4=&af_sub5=&afp1=19qg66p6thirb&afp10=&brand=ninecasino&bta=36648&click_id=19qg66p6thirb&keitaro_country=US&keitaro_platform=Windows&keitaro_stream_id=388809&store_id=&rotatorId=55c864c4c38f875e77b8036f28b8dbd90602942e49ae89d03c78dd30bb3bbd3d&rotatorRouter=ninecasino1go.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:27d7 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: 797cdccaacce5161dadd5db8fb4dc0f3d85240aca0eec7cc9bd20f0d22a17ca9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ninecasino.com/?cxd=36648_1295671_%7Cafp1%3A19qg66p6thirb%7Cafp10%3A&af_dev_key=BDREFvBLEZQKVYEhZafc85&af_id=&af_sub1=&af_sub2=&af_sub3=&af_sub4=&af_sub5=&afp1=19qg66p6thirb&afp10=&brand=ninecasino&bta=36648&click_id=19qg66p6thirb&keitaro_country=US&keitaro_platform=Windows&keitaro_stream_id=388809&store_id=&rotatorId=55c864c4c38f875e77b8036f28b8dbd90602942e49ae89d03c78dd30bb3bbd3d&rotatorRouter=ninecasino1go.com&__cf_chl_rt_tk=Vsw93cMcANnDzQ7nXucb6nXrcKIiaVHOZB_8uPpiHN8-1710854788-0.0.1.1-2645
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Tue, 19 Mar 2024 13:26:29 GMT
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-encoding: gzip
server: cloudflare
cf-ray: 866dcb5f2936498a-MIA
content-type: application/javascript; charset=UTF-8

GET
H2 200 api.js Show response
challenges.cloudflare.com/turnstile/v0/g/956dacbeead0/ 39 KB
13 KB 338ms
60ms Script
application/javascript 2606:4700::6811:2b8

General

Check archive.org

Show headers Download Go to

Full URL: https://challenges.cloudflare.com/turnstile/v0/g/956dacbeead0/api.js?onload=LCxP0&render=explicit
Requested by: Host: ninecasino.com
URL: https://ninecasino.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=866dcb5e2fdb498a
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:2b8 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: d7bed0ec1b182c64e160f602e4e60abbb43c89db99a03d89561da6dd39073515

Request headers

Referer
Origin: https://ninecasino.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Tue, 19 Mar 2024 13:26:29 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31536000
cross-origin-resource-policy: cross-origin
cf-ray: 866dcb62ce9d0355-MIA
alt-svc: h3=":443"; ma=86400

GET
H2 403 favicon.ico
ninecasino.com/ 15 KB
15 KB 45ms
43ms Image
text/html 2606:4700:10::ac43:27d7

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ninecasino.com/favicon.ico

Requested by

Host: ninecasino.com
URL: https://ninecasino.com/?cxd=36648_1295671_%7Cafp1%3A19qg66p6thirb%7Cafp10%3A&af_dev_key=BDREFvBLEZQKVYEhZafc85&af_id=&af_sub1=&af_sub2=&af_sub3=&af_sub4=&af_sub5=&afp1=19qg66p6thirb&afp10=&brand=ninecasino&bta=36648&click_id=19qg66p6thirb&keitaro_country=US&keitaro_platform=Windows&keitaro_stream_id=388809&store_id=&rotatorId=55c864c4c38f875e77b8036f28b8dbd90602942e49ae89d03c78dd30bb3bbd3d&rotatorRouter=ninecasino1go.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:27d7 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

cd932d21b17c33ece635297edc9e4284ec3bf5620b2888715219165cefebc006

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ninecasino.com/?cxd=36648_1295671_%7Cafp1%3A19qg66p6thirb%7Cafp10%3A&af_dev_key=BDREFvBLEZQKVYEhZafc85&af_id=&af_sub1=&af_sub2=&af_sub3=&af_sub4=&af_sub5=&afp1=19qg66p6thirb&afp10=&brand=ninecasino&bta=36648&click_id=19qg66p6thirb&keitaro_country=US&keitaro_platform=Windows&keitaro_stream_id=388809&store_id=&rotatorId=55c864c4c38f875e77b8036f28b8dbd90602942e49ae89d03c78dd30bb3bbd3d&rotatorRouter=ninecasino1go.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

date: Tue, 19 Mar 2024 13:26:29 GMT
content-encoding: gzip
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: same-origin
cf-chl-out: W0YOaskqRIEr6ctbsBJuNZ80nYlDSAlX2bSS0W2Ekj5YSW6OQLtmE2bF9tojdH0y/hUdVZNgf6HhY1Yw0GdznT2wO0IAppTuo2Kx6UN+a96NQOSN6pXUgyB4TgmtXF1a3QCb6joZs49wAMvUTurDUQ==$MQA5p5hGsg+hcZY8RgMBFg==
referrer-policy: same-origin
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-opener-policy: same-origin
cf-mitigated: challenge
server: cloudflare
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
origin-agent-cluster: ?1
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
cf-ray: 866dcb613b5a498a-MIA
expires: Thu, 01 Jan 1970 00:00:01 GMT

GET
BLOB 200
OK cd7c5ced-6dac-421f-a25d-3911678f8d92
https://ninecasino.com/ 13 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://ninecasino.com/cd7c5ced-6dac-421f-a25d-3911678f8d92
Requested by: Host: ninecasino.com
URL: https://ninecasino.com/?cxd=36648_1295671_%7Cafp1%3A19qg66p6thirb%7Cafp10%3A&af_dev_key=BDREFvBLEZQKVYEhZafc85&af_id=&af_sub1=&af_sub2=&af_sub3=&af_sub4=&af_sub5=&afp1=19qg66p6thirb&afp10=&brand=ninecasino&bta=36648&click_id=19qg66p6thirb&keitaro_country=US&keitaro_platform=Windows&keitaro_stream_id=388809&store_id=&rotatorId=55c864c4c38f875e77b8036f28b8dbd90602942e49ae89d03c78dd30bb3bbd3d&rotatorRouter=ninecasino1go.com
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8860e7fef89219a219cb11d18bd8e4a322f32072613f86e935e7fe162ab69c04

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ninecasino.com/?cxd=36648_1295671_%7Cafp1%3A19qg66p6thirb%7Cafp10%3A&af_dev_key=BDREFvBLEZQKVYEhZafc85&af_id=&af_sub1=&af_sub2=&af_sub3=&af_sub4=&af_sub5=&afp1=19qg66p6thirb&afp10=&brand=ninecasino&bta=36648&click_id=19qg66p6thirb&keitaro_country=US&keitaro_platform=Windows&keitaro_stream_id=388809&store_id=&rotatorId=55c864c4c38f875e77b8036f28b8dbd90602942e49ae89d03c78dd30bb3bbd3d&rotatorRouter=ninecasino1go.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

Content-Length: 13
Content-Type: text/javascript

POST
H2 200 8df4f58a69d36e8 Show response
ninecasino.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1859762681:1710853895:rEnlR6rJsPP6Ab29m0C-1p2GYTF0G0nHbALBmaWaVa0/866dcb5e2fdb498a/ 14 KB
11 KB 66ms
66ms XHR
text/plain 2606:4700:10::ac43:27d7

General

Check archive.org

Show headers Download Go to

Full URL: https://ninecasino.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1859762681:1710853895:rEnlR6rJsPP6Ab29m0C-1p2GYTF0G0nHbALBmaWaVa0/866dcb5e2fdb498a/8df4f58a69d36e8
Requested by: Host: ninecasino.com
URL: https://ninecasino.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=866dcb5e2fdb498a
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:27d7 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: 8aea8f3b1bc50bb103f3ef773966cc409d53fa9b8e39dd6959e9d28a6ff4fe32

Request headers

Referer: https://ninecasino.com/?cxd=36648_1295671_%7Cafp1%3A19qg66p6thirb%7Cafp10%3A&af_dev_key=BDREFvBLEZQKVYEhZafc85&af_id=&af_sub1=&af_sub2=&af_sub3=&af_sub4=&af_sub5=&afp1=19qg66p6thirb&afp10=&brand=ninecasino&bta=36648&click_id=19qg66p6thirb&keitaro_country=US&keitaro_platform=Windows&keitaro_stream_id=388809&store_id=&rotatorId=55c864c4c38f875e77b8036f28b8dbd90602942e49ae89d03c78dd30bb3bbd3d&rotatorRouter=ninecasino1go.com
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
CF-Challenge: 8df4f58a69d36e8
Content-type: application/x-www-form-urlencoded

Response headers

cf-chl-gen: A7sGBLZ9Cug3L7hG01p0pebrYHDsHKWfpaJXiJSWgF953Esu573S3Hxjroh9zJEp$/LoXRR3UnOPwmxIhEfwgrg==
date: Tue, 19 Mar 2024 13:26:29 GMT
content-encoding: gzip
server: cloudflare
cf-ray: 866dcb624cb4498a-MIA
content-type: text/plain; charset=UTF-8

GET
H3 200 normal
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/3gg31/0x4AAAAAAADnPIDROrmt1Wwj/light/ Frame 664A 0
0 90ms
49ms Document
text/html 2606:4700::6811:2b8

General

Check archive.org

Show headers Download Go to

Full URL

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/3gg31/0x4AAAAAAADnPIDROrmt1Wwj/light/normal

Requested by

Host: challenges.cloudflare.com
URL: https://challenges.cloudflare.com/turnstile/v0/g/956dacbeead0/api.js?onload=LCxP0&render=explicit

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:2b8 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-src https://challenges.cloudflare.com/ blob:; base-uri 'self'

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
alt-svc: h3=":443"; ma=86400
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 866dcb638e253dd2-MIA
content-encoding: br
content-security-policy: frame-src https://challenges.cloudflare.com/ blob:; base-uri 'self'
content-type: text/html; charset=UTF-8
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
date: Tue, 19 Mar 2024 13:26:29 GMT
document-policy: js-profiling
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
server: cloudflare

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.circleplin.com/	1970-01-20 21:23:50	Name: _fbp Value: fb.1.1710854782884.464345988
benioosn.com/	1970-01-20 19:58:53	Name: _subid Value: 19qg66p6thirb
benioosn.com/	1970-01-21 04:50:14	Name: 4d606 Value: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjM4ODgwOVwiOjE3MTA4NTQ3ODV9LFwiY2FtcGFpZ25zXCI6e1wiOTM4NlwiOjE3MTA4NTQ3ODV9LFwidGltZVwiOjE3MTA4NTQ3ODV9In0.gXjxiPo-TAEkBZJvr6778ojzQD3kWK0u1Zu2gzfnLYk
benioosn.com/	1970-01-20 19:58:53	Name: _token Value: uuid_19qg66p6thirb_19qg66p6thirb65f992812d4228.77915674

5 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://connect.facebook.net/signals/config/1373094003447828?v=2.9.150&r=stable&domain=circleplin.com&hme=8b8eb2472f555e54a8b57f2b720f9bd3b1bc6aed031525376dd772ba51107995&ex_m=63%2C107%2C95%2C99%2C54%2C3%2C89%2C62%2C14%2C87%2C80%2C45%2C47%2C153%2C156%2C167%2C163%2C164%2C166%2C26%2C90%2C46%2C69%2C165%2C148%2C151%2C160%2C161%2C168%2C116%2C13%2C44%2C172%2C171%2C118%2C16%2C30%2C33%2C1%2C37%2C58%2C59%2C60%2C64%2C84%2C15%2C12%2C86%2C83%2C82%2C96%2C98%2C32%2C97%2C27%2C23%2C149%2C152%2C125%2C25%2C9%2C10%2C11%2C5%2C6%2C22%2C19%2C20%2C50%2C55%2C57%2C67%2C91%2C24%2C68%2C8%2C7%2C72%2C42%2C18%2C93%2C92%2C17%2C74%2C79%2C41%2C40%2C78%2C34%2C36%2C77%2C49%2C75%2C29%2C38%2C66%2C0%2C85%2C4%2C81%2C73%2C76%2C2%2C31%2C56%2C35%2C94%2C39%2C71%2C61%2C100%2C53%2C52%2C28%2C88%2C51%2C48%2C43%2C70%2C65%2C21%2C101(Line 97) Message: Unrecognized feature: 'attribution-reporting'.
security	warning	Message: Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'browsing-topics'.
security	warning	Message: Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.
network	error	URL: https://ninecasino.com/?cxd=36648_1295671_%7Cafp1%3A19qg66p6thirb%7Cafp10%3A&af_dev_key=BDREFvBLEZQKVYEhZafc85&af_id=&af_sub1=&af_sub2=&af_sub3=&af_sub4=&af_sub5=&afp1=19qg66p6thirb&afp10=&brand=ninecasino&bta=36648&click_id=19qg66p6thirb&keitaro_country=US&keitaro_platform=Windows&keitaro_stream_id=388809&store_id=&rotatorId=55c864c4c38f875e77b8036f28b8dbd90602942e49ae89d03c78dd30bb3bbd3d&rotatorRouter=ninecasino1go.com Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://ninecasino.com/favicon.ico Message: Failed to load resource: the server responded with a status of 403 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

benioosn.com
challenges.cloudflare.com
circleplin.com
connect.facebook.net
fonts.googleapis.com
fonts.gstatic.com
ninecasino.com
ninecasino1go.com
track.chillipartners.com
www.facebook.com
23.88.7.117
2606:4700:10::ac43:27d7
2606:4700:3032::6815:1ea4
2606:4700:3032::ac43:d2c8
2606:4700::6811:2b8
2607:f8b0:4006:80b::2003
2607:f8b0:4006:80d::200a
2a03:2880:f012:10c:face:b00c:0:3
2a03:2880:f112:182:face:b00c:0:25de
35.234.86.61
4e049bbdc40b8d2e87194216781b7ad54cdb528be6686225e510468c056facb0
76c02fbf3c857e362b7f4b23ad146677cba891ddaf3a7c701206f0e710320b38
797cdccaacce5161dadd5db8fb4dc0f3d85240aca0eec7cc9bd20f0d22a17ca9
7b0b8813139bbf9b8f52bbbc863e9e5ca07593ae5cdc477cf1c993f5fd2f009a
8860e7fef89219a219cb11d18bd8e4a322f32072613f86e935e7fe162ab69c04
8aea8f3b1bc50bb103f3ef773966cc409d53fa9b8e39dd6959e9d28a6ff4fe32
9c24d498efa1ea11e2a19e3d24eb8d35bf9883ea227630975bf2830140f1ee26
ad1fce96f87d256155db5c433075af35926be7d90c6bd109e8c66f6e6e8dc473
bb2f90081933c0f2475883ca2c5cfee94e96d7314a09433fffc42e37f4cffd3b
cd932d21b17c33ece635297edc9e4284ec3bf5620b2888715219165cefebc006
d553134752a50290c1d4e03c9662034d6f3d09c349d8aeedbe8f75a156bb1cac
d7bed0ec1b182c64e160f602e4e60abbb43c89db99a03d89561da6dd39073515
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e496de7e3e10499716e7085601be7bfe513eb9d0bae623d6b486881785b23a75
e62dd14120b6b169b91fcc0d255c435894c634676871fa846d3ad60ea48b4413

ninecasino.com Open in urlscan Pro 2606:4700:10::ac43:27d7 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

17 Requests

94 %HTTPS

80 %IPv6

10 Domains

10 Subdomains

8 IPs

2 Countries

545 kBTransfer

1228 kBSize

4 Cookies

0 Outgoing links

Page URL History

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

4 Cookies

5 Console Messages

Indicators

ninecasino.com Open in urlscan Pro
2606:4700:10::ac43:27d7 Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

94 %
HTTPS

80 %
IPv6

10
Domains

10
Subdomains

8
IPs

2
Countries

545 kB
Transfer

1228 kB
Size

4
Cookies

17 HTTP transactions
0 data transactions