claim.safethemoon.com Open in urlscan Pro
2606:4700:3031::ac43:aa50 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://safethemoon.com/
Effective URL:
https://claim.safethemoon.com/
Submission Tags: @phish_report
Submission: On September 06 via api (September 6th 2023, 8:02:31 pm UTC) from FI — Scanned from FI

Summary HTTP 17 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 17 HTTP transactions. The main IP is 2606:4700:3031::ac43:aa50, located in United States and belongs to CLOUDFLARENET, US. The main domain is claim.safethemoon.com.
TLS certificate: Issued by GTS CA 1P5 on August 31st 2023. Valid for: 3 months.

This is the only time claim.safethemoon.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 12	2606:4700:303... 2606:4700:3031::ac43:aa50	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2606:4700::68... 2606:4700::6811:2b8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
17	3

12 2606:4700:3031::ac43:aa50 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

safethemoon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
claim.safethemoon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6811:2b8 (United States)

ASN13335 (CLOUDFLARENET, US)

challenges.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	safethemoon.com 1 redirects safethemoon.com claim.safethemoon.com	278 KB
4	cloudflare.com challenges.cloudflare.com — Cisco Umbrella Rank: 6423	21 KB
17	2

	Domain	Requested by
11	claim.safethemoon.com	claim.safethemoon.com
4	challenges.cloudflare.com	claim.safethemoon.com challenges.cloudflare.com
1	safethemoon.com	1 redirects
17	3

This site contains links to these domains. Also see Links.

Domain
www.cloudflare.com

Subject Issuer	Validity	Valid
safethemoon.com GTS CA 1P5	`2023-08-31` - `2023-11-29`	3 months	crt.sh
challenges.cloudflare.com Cloudflare Inc ECC CA-3	`2023-08-18` - `2024-08-17`	a year	crt.sh

This page contains 3 frames:

Primary Page: https://claim.safethemoon.com/
Frame ID: 2DB46E48140B4040C58547ECAA4EA3E9
Requests: 17 HTTP requests in this frame

Frame: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/dqavf/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Frame ID: 696E11524E0828A033A6985E358E92D4
Requests: 1 HTTP requests in this frame

Frame: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/ykaf1/0x4AAAAAAADnPIDROrmt1Wwj/light/normal
Frame ID: 9ECFD4A65E1AEFE19E823448FB559660
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Just a moment...

Page URL History Show full URLs

https://safethemoon.com/ HTTP 301
https://claim.safethemoon.com/ Page URL
https://claim.safethemoon.com/ Page URL

Page Statistics

17
Requests

88 %
HTTPS

100 %
IPv6

2
Domains

3
Subdomains

3
IPs

1
Countries

298 kB
Transfer

575 kB
Size

1
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.cloudflare.com/?utm_source=challenge&utm_campaign=m
Title: Cloudflare

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://safethemoon.com/ HTTP 301
https://claim.safethemoon.com/ Page URL
https://claim.safethemoon.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://safethemoon.com/ HTTP 301
https://claim.safethemoon.com/

17 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

403

/ Show response
claim.safethemoon.com/
Redirect Chain

https://safethemoon.com/
https://claim.safethemoon.com/

5 KB
4 KB

79ms
78ms

Document
text/html

2606:4700:3031::ac43:aa50
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://claim.safethemoon.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::ac43:aa50 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

07cbd693190d838dc92ccafbf4f0b057ce549b1eb3153f52f0b0b72ec8533cda

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
accept-language: fi-FI,fi;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-mitigated: challenge
cf-ray: 80294f48abe2568a-OSL
content-encoding: br
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
date: Wed, 06 Sep 2023 20:02:27 GMT
expires: Thu, 01 Jan 1970 00:00:01 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UudYyj0%2BF63ifpEH%2B9rAohdi8fYgrTek%2BbCU2nAE9JK7dwKahqGbaBF%2FCr0xR%2FX1TH%2BSZaH9kMYFmcdpY%2FVEbyqPb81ZC0EddXqdnS5r7NnVnGWofZV5FcjQPg2qKT3vG028EH%2BKVqZrnUPCVk%2FX%2FjIi6ZY%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: max-age=3600
cf-ray: 80294f484b77568a-OSL
date: Wed, 06 Sep 2023 20:02:27 GMT
expires: Wed, 06 Sep 2023 21:02:27 GMT
location: https://claim.safethemoon.com/
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KTR%2FflQwtcFwjlRqdfGzB84inEexCufWEKMFbFadEEHnycZq4ChPYAvzo5yhCRbxJ7HQej6XVmfOU9IhsPwQHbJyl7MsCu5PdkIWRtFnrslPR0Issj%2BbiWT3YEvq34%2FHJUtHg3yVa66IMmi3%2Flk%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 200 challenges.css
claim.safethemoon.com/cdn-cgi/styles/ 6 KB
3 KB 63ms
62ms Stylesheet
text/css 2606:4700:3031::ac43:aa50
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://claim.safethemoon.com/cdn-cgi/styles/challenges.css

Requested by

Host: claim.safethemoon.com
URL: https://claim.safethemoon.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3031::ac43:aa50 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2b0bd09c1cc7119d27e45353a59bf6c2721563e1689853ff704057a7439508d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: https://claim.safethemoon.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 06 Sep 2023 20:02:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 04 Sep 2023 08:31:24 GMT
server: cloudflare
etag: W/"64f595dc-19c8"
x-frame-options: DENY
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=7200, public
cf-ray: 80294f494c6a568a-OSL
expires: Wed, 06 Sep 2023 22:02:27 GMT

GET
H2 200 v1 Show response
claim.safethemoon.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/ 165 KB
56 KB 71ms
70ms Script
application/javascript 2606:4700:3031::ac43:aa50
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://claim.safethemoon.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=80294f48abe2568a
Requested by: Host: claim.safethemoon.com
URL: https://claim.safethemoon.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:aa50 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8400991e9439585e61188b2ed3684348b1d147b8a00ec0acc6087d03266a00b3

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: https://claim.safethemoon.com/?__cf_chl_rt_tk=QUt0mOwD7P.pAQ9SO8EzZll_oZsttarmAflBb67QyFQ-1694030547-0-gaNycGzNCdA
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 06 Sep 2023 20:02:27 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OrbtzpwAvaX9qB98bPGjCI2wQn1E7ZR6TwRYWS1vPL%2BptiXHHHTP5iglw0ynWsNjb09MDvow2sQYT3S2oRxhQKirBAhlQLoS2ijuqxFyRHiVL%2BKpN2XoQPsUf2jF%2BZWR8rj9R1nY46giS3%2FUjsSTdnNYOnA%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 80294f49accb568a-OSL
alt-svc: h3=":443"; ma=86400

GET
H2 200 api.js Show response
challenges.cloudflare.com/turnstile/v0/g/3e377faf/ 30 KB
11 KB 222ms
92ms Script
application/javascript 2606:4700::6811:2b8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://challenges.cloudflare.com/turnstile/v0/g/3e377faf/api.js?onload=zcFqXW0&render=explicit
Requested by: Host: claim.safethemoon.com
URL: https://claim.safethemoon.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=80294f48abe2568a
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:2b8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b93365cd46e3907ba791b30e4b642efb926c647f2f65f8a8bf24af92e01aef3f

Request headers

Referer
Origin: https://claim.safethemoon.com
accept-language: fi-FI,fi;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 06 Sep 2023 20:02:27 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31536000
cf-ray: 80294f4b1fa956aa-OSL
alt-svc: h3=":443"; ma=86400

GET
H3 200 favicon.ico
claim.safethemoon.com/ 64 KB
64 KB 73ms
73ms Image
text/html 2606:4700:3031::ac43:aa50
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://claim.safethemoon.com/favicon.ico
Requested by: Host: claim.safethemoon.com
URL: https://claim.safethemoon.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:aa50 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: https://claim.safethemoon.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 06 Sep 2023 20:02:27 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 01 Sep 2023 22:18:20 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 130
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qgmmpnd%2B1Z3keuifmeOhzEIgpcsw0nsUoup%2Fps9dg2%2FTvEuhIoE9RLM1s7Y76NM2p4JZwn%2FnmoSWg3JvbkMACCamS0mK1sbq3dz00odu2iAmjNM1%2Fdh02niK1GGGlfAeBJiDkuifz9j%2B4WuYvuqXWNndOA8%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
cache-control: max-age=14400
cf-ray: 80294f4a4e1956bf-OSL
alt-svc: h3=":443"; ma=86400

GET
DATA 200
OK truncated
/ 586 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fc95732d9ff3b17fcb3e64fd12c0d451c38e64e1a4b420c556a7feb756a0a3fa

Request headers

accept-language: fi-FI,fi;q=0.9
Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/png

GET
BLOB 200
OK cc7a09aa-5218-4378-a8c3-e65b4b348f95
https://claim.safethemoon.com/ 13 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://claim.safethemoon.com/cc7a09aa-5218-4378-a8c3-e65b4b348f95
Requested by: Host: claim.safethemoon.com
URL: https://claim.safethemoon.com/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8860e7fef89219a219cb11d18bd8e4a322f32072613f86e935e7fe162ab69c04

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: https://claim.safethemoon.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

Content-Length: 13
Content-Type: text/javascript

POST
H3 200 df2001192645fff Show response
claim.safethemoon.com/cdn-cgi/challenge-platform/h/g/flow/ov1/170074000:1694028250:eCghE9TXmw3fnmGEYl6qCFMex9tIuWveAIDFxld3SmE/80294f48abe2568a/ 10 KB
8 KB 75ms
75ms XHR
text/plain 2606:4700:3031::ac43:aa50
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://claim.safethemoon.com/cdn-cgi/challenge-platform/h/g/flow/ov1/170074000:1694028250:eCghE9TXmw3fnmGEYl6qCFMex9tIuWveAIDFxld3SmE/80294f48abe2568a/df2001192645fff
Requested by: Host: claim.safethemoon.com
URL: https://claim.safethemoon.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=80294f48abe2568a
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:aa50 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 74f007019c274d6e50d28057643ad822e20bd3f9d9b52111698c2d416a5186c9

Request headers

Referer: https://claim.safethemoon.com/
accept-language: fi-FI,fi;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
CF-Challenge: df2001192645fff
Content-type: application/x-www-form-urlencoded

Response headers

date: Wed, 06 Sep 2023 20:02:27 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6Mf5gd%2ByLWzT7M%2BG2vq7PEzN4ROCQf2l39na6%2BpaUIKMb%2B9%2Bz6LuSMGzkZy3Yj4lRcDjGFuX5O11EEnTxagNaH%2FYObJb9RCRi2s%2FRRI3LEVmiUWUgyhUPbyUMQNfChYeQRnfplbUzdYt6L%2F7FcsFBazlw94%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=UTF-8
cf-ray: 80294f4b0e9e56bf-OSL
alt-svc: h3=":443"; ma=86400
cf-chl-gen: q1AqfgYTMfaWdtZx/4zZhhMXu9LgHLDFII1mu//iYs3LIvZzOY0qOzQuJCCLeuRa$NGKODBb9MTSBVjhNruRVSw==

GET
H3 200 normal
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/dqavf/0x4AAAAAAADnPIDROrmt1Wwj/light/ Frame 696E 0
0 137ms
70ms Document
text/html 2606:4700::6811:2b8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/dqavf/0x4AAAAAAADnPIDROrmt1Wwj/light/normal

Requested by

Host: challenges.cloudflare.com
URL: https://challenges.cloudflare.com/turnstile/v0/g/3e377faf/api.js?onload=zcFqXW0&render=explicit

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:2b8 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-src https://challenges.cloudflare.com/; base-uri 'self'

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
accept-language: fi-FI,fi;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 80294f4c8d5056c5-OSL
content-encoding: br
content-security-policy: frame-src https://challenges.cloudflare.com/; base-uri 'self'
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
date: Wed, 06 Sep 2023 20:02:27 GMT
document-policy: js-profiling
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
server: cloudflare

POST
H3 200 df2001192645fff Show response
claim.safethemoon.com/cdn-cgi/challenge-platform/h/g/flow/ov1/170074000:1694028250:eCghE9TXmw3fnmGEYl6qCFMex9tIuWveAIDFxld3SmE/80294f48abe2568a/ 2 KB
2 KB 73ms
72ms XHR
text/html 2606:4700:3031::ac43:aa50
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://claim.safethemoon.com/cdn-cgi/challenge-platform/h/g/flow/ov1/170074000:1694028250:eCghE9TXmw3fnmGEYl6qCFMex9tIuWveAIDFxld3SmE/80294f48abe2568a/df2001192645fff
Requested by: Host: claim.safethemoon.com
URL: https://claim.safethemoon.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=80294f48abe2568a
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:aa50 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7a3bb81d5856543f93159b8d7c3a8e06819b47443ca3cf138ded0a18587f77da

Request headers

Referer: https://claim.safethemoon.com/
accept-language: fi-FI,fi;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
CF-Challenge: df2001192645fff
Content-type: application/x-www-form-urlencoded

Response headers

cf-chl-out: STsotLnBSfE6ZH9Iqz2ItX0fegM++y607GQqICigIVl9uts0lYzr81C+Jkk9M4DMLhNrIE83/0GOOoSOKudDt9aCiO017VVCQ+cVhxm59F0=$JSxJnsXtSsd/vOWMlkeYPQ==
cf-chl-out-s: XuQ3HMbTIl2B/0kPzpKKN3cKfp6R5iCw0cv75gBB+qXiIJFlBKiLMue4OdaDBqYAAKVZXy95jZXxTXgm/5z2bucmRM5BXk9HQblAmUXg4DRPM6lOyW/MwYHlJhy26Up9qvyyUJfzCNIcGYTh9zlbZ4duCBEEJCth7t9vN9ouaEy++307I1ZpT5P9jZ38JPfk$nn+j1NjIwuHFCc7f7a6a5w==
date: Wed, 06 Sep 2023 20:02:28 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z5LdZQfYU7U35xgyiyVA6%2BctvL0jSRzLthfQawdOzTl%2FiG7eSPx3zBUfuJUfR%2FgLbg1sH4w2SpCCFw%2FOagXBd4IqB5bFcjAVWbRPUgzOgnQtTeVRr%2FYAHcSVCOc%2F%2BpLGHtpIMvW6OHeESu3q6eSZYSrSF2w%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=UTF-8
cf-ray: 80294f50bbf856bf-OSL
alt-svc: h3=":443"; ma=86400

GET
H3 403 Primary Request / Show response
claim.safethemoon.com/ 5 KB
4 KB 69ms
67ms Document
text/html 2606:4700:3031::ac43:aa50
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://claim.safethemoon.com/

Requested by

Host: claim.safethemoon.com
URL: https://claim.safethemoon.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=80294f48abe2568a

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:aa50 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eb76f96754c81eb94e3545bd40632071f41fd012cb14a969332a6fbb203445b2

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://claim.safethemoon.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
accept-language: fi-FI,fi;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-mitigated: challenge
cf-ray: 80294f5dc94856bf-OSL
content-encoding: br
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
date: Wed, 06 Sep 2023 20:02:30 GMT
expires: Thu, 01 Jan 1970 00:00:01 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lqpq5NU6Uzyyd43lEjSLOR2Aq50LTWvBR3FgfnuF2JZwUpR6pCmplYRpIyyvRLy7Csjnc2nL6wbzwNAr%2F0BUKWCffX7uJW9zhL8KQHeTOIVRuQ%2B2f2i5pu8kQWHQuOtP1GpsSBesOLqxPcXyDnQizU4waKM%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN

GET
H3 200 challenges.css
claim.safethemoon.com/cdn-cgi/styles/ 6 KB
3 KB 63ms
62ms Stylesheet
text/css 2606:4700:3031::ac43:aa50
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://claim.safethemoon.com/cdn-cgi/styles/challenges.css

Requested by

Host: claim.safethemoon.com
URL: https://claim.safethemoon.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3031::ac43:aa50 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2b0bd09c1cc7119d27e45353a59bf6c2721563e1689853ff704057a7439508d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: https://claim.safethemoon.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 06 Sep 2023 20:02:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 04 Sep 2023 08:31:24 GMT
server: cloudflare
etag: W/"64f595dc-19c8"
x-frame-options: DENY
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=7200, public
cf-ray: 80294f5e49fd56bf-OSL
expires: Wed, 06 Sep 2023 22:02:30 GMT

GET
H3 200 v1 Show response
claim.safethemoon.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/ 176 KB
61 KB 71ms
70ms Script
application/javascript 2606:4700:3031::ac43:aa50
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://claim.safethemoon.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=80294f5dc94856bf
Requested by: Host: claim.safethemoon.com
URL: https://claim.safethemoon.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:aa50 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5a3ffb9e78dec1a08dc6b2b8c99e48a5f902d16b020a44494893b6f09fcc2561

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: https://claim.safethemoon.com/?__cf_chl_rt_tk=wEKBgTI6KicjmP5SFYzWhVqgfEd_UGvy576NPdFBI5M-1694030550-0-gaNycGzNCaU
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 06 Sep 2023 20:02:30 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FkGhzpC6PnZWWiNtkZA6oEtkISH0%2F41uauPtQpvoojfK5FZJ4Lii%2BWN%2Fa7dPVhx9tTVQ2X5ME%2B8w6OUhxMOqVM7Job8EPikwJT1YUAXBS48LsOnQ1G1QZ1A%2FVQRVb%2FLmSVOzcxelsoG2kGfbZRMkcA4H1qo%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 80294f5eaa5556bf-OSL
alt-svc: h3=":443"; ma=86400

GET
H2 200 api.js Show response
challenges.cloudflare.com/turnstile/v0/g/3e377faf/ 30 KB
10 KB 88ms
87ms Script
application/javascript 2606:4700::6811:2b8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://challenges.cloudflare.com/turnstile/v0/g/3e377faf/api.js?onload=zcFqXW0&render=explicit
Requested by: Host: claim.safethemoon.com
URL: https://claim.safethemoon.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=80294f5dc94856bf
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:2b8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b93365cd46e3907ba791b30e4b642efb926c647f2f65f8a8bf24af92e01aef3f

Request headers

Referer
Origin: https://claim.safethemoon.com
accept-language: fi-FI,fi;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 06 Sep 2023 20:02:31 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31536000
cf-ray: 80294f5fdc2256aa-OSL
alt-svc: h3=":443"; ma=86400

GET
H3 200 favicon.ico
claim.safethemoon.com/ 64 KB
64 KB 70ms
70ms Image
text/html 2606:4700:3031::ac43:aa50
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://claim.safethemoon.com/favicon.ico
Requested by: Host: claim.safethemoon.com
URL: https://claim.safethemoon.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:aa50 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: https://claim.safethemoon.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

date: Wed, 06 Sep 2023 20:02:31 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 01 Sep 2023 22:18:20 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 134
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Wxf06g05sZJbiB8VqF0x3I8APNzq4mqCmfjFab06s5cV7RBeqceATkfxdLPDA%2FAosSiMrJJzBh4do0W1O6sWG3xoh3xAohdIuJqt5Vgu676RmUaKZj5TxBxbbK9h3GHNk%2FgPA6aXrfCHYCbLm5nKKeJeHis%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
cache-control: max-age=14400
cf-ray: 80294f5fdb8b56bf-OSL
alt-svc: h3=":443"; ma=86400

GET
DATA 200
OK truncated
/ 586 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fc95732d9ff3b17fcb3e64fd12c0d451c38e64e1a4b420c556a7feb756a0a3fa

Request headers

accept-language: fi-FI,fi;q=0.9
Referer
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

Content-Type: image/png

GET
BLOB 200
OK e9b4beb3-a933-48dc-8642-d11341240437
https://claim.safethemoon.com/ 13 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://claim.safethemoon.com/e9b4beb3-a933-48dc-8642-d11341240437
Requested by: Host: claim.safethemoon.com
URL: https://claim.safethemoon.com/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8860e7fef89219a219cb11d18bd8e4a322f32072613f86e935e7fe162ab69c04

Request headers

accept-language: fi-FI,fi;q=0.9
Referer: https://claim.safethemoon.com/
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1

Response headers

Content-Length: 13
Content-Type: text/javascript

POST
H3 200 1b9f776ca1254d0 Show response
claim.safethemoon.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1126488650:1694028137:0oJHes46EsTaL4lZ77GcDr-BUBMgIefDF-2TmzbD1k0/80294f5dc94856bf/ 10 KB
8 KB 76ms
76ms XHR
text/plain 2606:4700:3031::ac43:aa50
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://claim.safethemoon.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1126488650:1694028137:0oJHes46EsTaL4lZ77GcDr-BUBMgIefDF-2TmzbD1k0/80294f5dc94856bf/1b9f776ca1254d0
Requested by: Host: claim.safethemoon.com
URL: https://claim.safethemoon.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=80294f5dc94856bf
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3031::ac43:aa50 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f3d26e542174ca2ea66ab992247d1846aa866f1d2fb72482fb77a7fd911d62a

Request headers

Referer: https://claim.safethemoon.com/
accept-language: fi-FI,fi;q=0.9
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
CF-Challenge: 1b9f776ca1254d0
Content-type: application/x-www-form-urlencoded

Response headers

date: Wed, 06 Sep 2023 20:02:31 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nNu0GG0Ru90X8rnMZ5Fkx%2BgDTHDg%2BPg%2FB6EVw%2BLzipVUZpcF2eilcmmsJLj47Fg5vvABX0U0cooWNGVORjv3o6003BoAl0Uk07fOT%2FLvFidtNvBOH3Ap7U7zD5jWhj7CsVTFQwCpBUL%2F5Mm8K9FAT2Yz2QY%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=UTF-8
cf-ray: 80294f608c5456bf-OSL
alt-svc: h3=":443"; ma=86400
cf-chl-gen: AJWQSQhpKGrV+mfo9UACE1eagTy5TYaY7xoE+91DuAJG2q/fKRF/Ik1Iv7u/Q1km$nbyn32QGjFAVuzsdmeMmWg==

GET
H3 200 normal
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/ykaf1/0x4AAAAAAADnPIDROrmt1Wwj/light/ Frame 9ECF 0
0 70ms
70ms Document
text/html 2606:4700::6811:2b8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/ykaf1/0x4AAAAAAADnPIDROrmt1Wwj/light/normal

Requested by

Host: challenges.cloudflare.com
URL: https://challenges.cloudflare.com/turnstile/v0/g/3e377faf/api.js?onload=zcFqXW0&render=explicit

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:2b8 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-src https://challenges.cloudflare.com/; base-uri 'self'

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Mobile/15E148 Safari/604.1
accept-language: fi-FI,fi;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 80294f6129b056c5-OSL
content-encoding: br
content-security-policy: frame-src https://challenges.cloudflare.com/; base-uri 'self'
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
date: Wed, 06 Sep 2023 20:02:31 GMT
document-policy: js-profiling
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
server: cloudflare

Verdicts & Comments Add Verdict or Comment

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			claim.safethemoon.com/	1970-01-20 14:33:54	Name: cf_chl_rc_m Value: 1

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	Message: Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.
network	error	URL: https://claim.safethemoon.com/ Message: Failed to load resource: the server responded with a status of 403 ()
security	warning	Message: Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.
network	error	URL: https://claim.safethemoon.com/ Message: Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

challenges.cloudflare.com
claim.safethemoon.com
safethemoon.com
2606:4700:3031::ac43:aa50
2606:4700::6811:2b8
07cbd693190d838dc92ccafbf4f0b057ce549b1eb3153f52f0b0b72ec8533cda
2b0bd09c1cc7119d27e45353a59bf6c2721563e1689853ff704057a7439508d2
4f3d26e542174ca2ea66ab992247d1846aa866f1d2fb72482fb77a7fd911d62a
5a3ffb9e78dec1a08dc6b2b8c99e48a5f902d16b020a44494893b6f09fcc2561
74f007019c274d6e50d28057643ad822e20bd3f9d9b52111698c2d416a5186c9
7a3bb81d5856543f93159b8d7c3a8e06819b47443ca3cf138ded0a18587f77da
8400991e9439585e61188b2ed3684348b1d147b8a00ec0acc6087d03266a00b3
8860e7fef89219a219cb11d18bd8e4a322f32072613f86e935e7fe162ab69c04
b93365cd46e3907ba791b30e4b642efb926c647f2f65f8a8bf24af92e01aef3f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eb76f96754c81eb94e3545bd40632071f41fd012cb14a969332a6fbb203445b2
fc95732d9ff3b17fcb3e64fd12c0d451c38e64e1a4b420c556a7feb756a0a3fa

claim.safethemoon.com Open in urlscan Pro 2606:4700:3031::ac43:aa50 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

17 Requests

88 %HTTPS

100 %IPv6

2 Domains

3 Subdomains

3 IPs

1 Countries

298 kBTransfer

575 kBSize

1 Cookies

1 Outgoing links

Page URL History

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

16 JavaScript Global Variables

1 Cookies

4 Console Messages

Security Headers

Indicators

claim.safethemoon.com Open in urlscan Pro
2606:4700:3031::ac43:aa50 Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

88 %
HTTPS

100 %
IPv6

2
Domains

3
Subdomains

3
IPs

1
Countries

298 kB
Transfer

575 kB
Size

1
Cookies

17 HTTP transactions
2 data transactions