whatscaptcha.xyz Open in urlscan Pro
2606:4700:3031::ac43:a943  Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request index.html Show response whatscaptcha.xyz/lander/gksk193kd0/	16 KB 5 KB	397ms 312ms	Document text/html	2606:4700:3031::ac43:a943 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://whatscaptcha.xyz/lander/gksk193kd0/index.html Protocol HTTP/1.1 Server 2606:4700:3031::ac43:a943 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0a4efd689f6cb5a53e7fcb094c2ceef134b7a8ecbbbc78e44ee19347f6e68157 Security Headers Name Value X-Content-Type-Options nosniff Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36 accept-language en-US,en;q=0.9 Response headers CF-Cache-Status DYNAMIC CF-RAY 859225e39a124c1c-MIA Connection keep-alive Content-Encoding gzip Content-Type text/html Date Wed, 21 Feb 2024 21:40:29 GMT Last-Modified Tue, 06 Feb 2024 15:41:00 GMT NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Vlhy7a28ziNGdlA1Dekn5%2F8f5b5qWkpxswrFbykg4TeYVwFzHHn%2F6X4RNghyKQ2rtrDrIa5oCDUQzadYxjYCw4XAk%2FUG39U%2BL51D5M420r%2BmRQC7%2BprU%2FpcfSOB1Qnsr7Ge0fkaks%2B81w9Ba1GaC"}],"group":"cf-nel","max_age":604800} Server cloudflare Transfer-Encoding chunked X-Content-Type-Options nosniff alt-svc h3=":443"; ma=86400
GET H/1.1	200 OK	logo_image.png whatscaptcha.xyz/lander/gksk193kd0/	48 KB 48 KB	41ms 41ms	Image image/png	2606:4700:3031::ac43:a943 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL http://whatscaptcha.xyz/lander/gksk193kd0/logo_image.png Requested by Host: whatscaptcha.xyz URL: http://whatscaptcha.xyz/lander/gksk193kd0/index.html Protocol HTTP/1.1 Server 2606:4700:3031::ac43:a943 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b903f541c143f4dff9f5b26bb17dfd23579cd343591ed171ef95ada8f8a50e4c Request headers accept-language en-US,en;q=0.9 Referer http://whatscaptcha.xyz/lander/gksk193kd0/index.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36 Response headers Date Wed, 21 Feb 2024 21:40:29 GMT CF-Cache-Status HIT NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Age 95273 Connection keep-alive alt-svc h3=":443"; ma=86400 Content-Length 48813 Last-Modified Tue, 06 Feb 2024 15:41:00 GMT Server cloudflare ETag "65c2530c-bead" Vary Accept-Encoding Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zBsmUQHQS3dX3olIPteVOzOx%2BrimiNfSXFBW4cn3nSb9W74aky9m8761gzWsz2tlt4ek3bcMinkK3cnByE9msOltWhnnguJbA03J0ku%2FNx3Zo2xoCF5JiCMA0gvUKIAAlyQv1EzWHQjoxliuNDgq"}],"group":"cf-nel","max_age":604800} Content-Type image/png Access-Control-Allow-Origin * Cache-Control max-age=864000 Accept-Ranges bytes CF-RAY 859225e62dec4c1c-MIA Expires Fri, 01 Mar 2024 19:12:36 GMT
GET H/1.1	200 OK	micro.tag.min.js Show response desekansr.com/pfe/current/	33 KB 14 KB	318ms 139ms	Script application/javascript	139.45.197.250 RETN-AS
General Check archive.org Show headers Download Go to Full URL http://desekansr.com/pfe/current/micro.tag.min.js?z=5871421&ymid={subid}&var=null&sw=/sw-check-permissions-e1e8b.js Requested by Host: whatscaptcha.xyz URL: http://whatscaptcha.xyz/lander/gksk193kd0/index.html Protocol HTTP/1.1 Server 139.45.197.250 , United Kingdom, ASN9002 (RETN-AS, GB), Reverse DNS Software nginx / Resource Hash 13ab6a27afe39979f44047b51c1f57911c89ac5498c6fb861703aa960c2f6371 Request headers accept-language en-US,en;q=0.9 Referer http://whatscaptcha.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36 Response headers Pragma no-cache Date Wed, 21 Feb 2024 21:40:30 GMT Content-Encoding gzip Last-Modified Wed, 21 Feb 2024 13:28:14 GMT Server nginx ETag W/"65d5fa6e-8569" Transfer-Encoding chunked Content-Type application/javascript Cache-Control no-cache Access-Control-Allow-Credentials true Connection keep-alive
POST H2	200	custom jouteetu.net/	0 0	617ms 134ms	Ping application/json	139.45.197.251 RETN-AS
General Check archive.org Show headers Download Go to Full URL https://jouteetu.net/custom Requested by Host: desekansr.com URL: http://desekansr.com/pfe/current/micro.tag.min.js?z=5871421&ymid={subid}&var=null&sw=/sw-check-permissions-e1e8b.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer http://whatscaptcha.xyz/ accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers
GET H/1.1	200 OK	sw-check-permissions-e1e8b.js whatscaptcha.xyz/	0 1 KB	310ms 310ms	Other application/javascript	2606:4700:3031::ac43:a943 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL http://whatscaptcha.xyz/sw-check-permissions-e1e8b.js?var=null&ymid=%7Bsubid%7D&zoneId=5871421 Requested by Host: desekansr.com URL: http://desekansr.com/pfe/current/micro.tag.min.js?z=5871421&ymid={subid}&var=null&sw=/sw-check-permissions-e1e8b.js Protocol HTTP/1.1 Server 2606:4700:3031::ac43:a943 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language en-US,en;q=0.9 Referer http://whatscaptcha.xyz/lander/gksk193kd0/index.html User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36 Response headers Date Wed, 21 Feb 2024 21:40:31 GMT Content-Encoding gzip CF-Cache-Status MISS NEL {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Transfer-Encoding chunked Connection keep-alive alt-svc h3=":443"; ma=86400 Last-Modified Fri, 14 Apr 2023 11:00:33 GMT Server cloudflare ETag W/"64393251-238" Vary Accept-Encoding Report-To {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GqFKCSKx9C3H1B0nQEPB0PQi0Ufk17i544q39uGkNrzw%2FkP3yGluYOkK%2Fw11LVq5Wz0SnYzsBeWM7Z9F5Hq2kgxmJvGYXBHucI48eS43dzZPnm14Y88wOhk0G%2FiYjdisaSnmynp3Gna0VPjxZuCP"}],"group":"cf-nel","max_age":604800} Content-Type application/javascript Access-Control-Allow-Origin * Cache-Control max-age=864000 CF-RAY 859225ec8fda4c1c-MIA Expires Sat, 02 Mar 2024 21:40:31 GMT
POST H2	200	custom jouteetu.net/	0 0	616ms 135ms	Ping application/json	139.45.197.251 RETN-AS
General Check archive.org Show headers Download Go to Full URL https://jouteetu.net/custom Requested by Host: desekansr.com URL: http://desekansr.com/pfe/current/micro.tag.min.js?z=5871421&ymid={subid}&var=null&sw=/sw-check-permissions-e1e8b.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer http://whatscaptcha.xyz/ accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers
POST H2	200	zone desekansr.com/	0 259 B	619ms 138ms	Ping text/plain	139.45.197.250 RETN-AS
General Check archive.org Show headers Download Go to Full URL https://desekansr.com/zone?&pub=0&zone_id=5871421&is_mobile=false&domain=whatscaptcha.xyz&var=null&ymid=%7Bsubid%7D&var_3=&var_4=&dsig=&tg=1&sw=3.1.488&trace_id=e6e6d0d9-90e6-48f9-b192-f2f9d330e0fa&action=prerequest Requested by Host: desekansr.com URL: http://desekansr.com/pfe/current/micro.tag.min.js?z=5871421&ymid={subid}&var=null&sw=/sw-check-permissions-e1e8b.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 139.45.197.250 , United Kingdom, ASN9002 (RETN-AS, GB), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=1 X-Content-Type-Options nosniff Request headers accept-language en-US,en;q=0.9 Referer http://whatscaptcha.xyz/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36 Response headers x-trace-id 1bc5f22c4c661da24c6de27abe6396d1 date Wed, 21 Feb 2024 21:40:30 GMT strict-transport-security max-age=1 x-content-type-options nosniff server nginx access-control-allow-origin http://whatscaptcha.xyz access-control-allow-credentials true access-control-allow-headers Origin, X-Requested-With, X-Oaid, Content-Type, Accept content-length 0
POST H2	200	custom jouteetu.net/	0 0	616ms 136ms	Ping application/json	139.45.197.251 RETN-AS
General Check archive.org Show headers Download Go to Full URL https://jouteetu.net/custom Requested by Host: desekansr.com URL: http://desekansr.com/pfe/current/micro.tag.min.js?z=5871421&ymid={subid}&var=null&sw=/sw-check-permissions-e1e8b.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 139.45.197.251 , United Kingdom, ASN9002 (RETN-AS, GB), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer http://whatscaptcha.xyz/ accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers
POST H2	200	event Show response amunfezanttor.com/	94 B 354 B	419ms 138ms	Fetch application/json	139.45.197.250 RETN-AS
General Check archive.org Show headers Download Go to Full URL https://amunfezanttor.com/event Requested by Host: desekansr.com URL: http://desekansr.com/pfe/current/micro.tag.min.js?z=5871421&ymid={subid}&var=null&sw=/sw-check-permissions-e1e8b.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 139.45.197.250 , United Kingdom, ASN9002 (RETN-AS, GB), Reverse DNS Software nginx / Resource Hash ff2fe32e393a52d81a5138d45bae849106e4f2d9a856f35b3aa46004a01707f6 Security Headers Name Value Strict-Transport-Security max-age=1 X-Content-Type-Options nosniff Request headers Referer http://whatscaptcha.xyz/ accept-language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36 Content-Type application/json Response headers date Wed, 21 Feb 2024 21:40:31 GMT strict-transport-security max-age=1 x-content-type-options nosniff server nginx content-type application/json; charset=utf-8 access-control-allow-origin http://whatscaptcha.xyz access-control-allow-credentials true access-control-allow-headers Origin, X-Requested-With, X-Oaid, Content-Type, Accept content-length 94
OPTIONS H2	200	event amunfezanttor.com/	0 0	613ms 134ms	Preflight text/plain	139.45.197.250 RETN-AS
General Check archive.org Show headers Download Go to Full URL https://amunfezanttor.com/event Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 139.45.197.250 , United Kingdom, ASN9002 (RETN-AS, GB), Reverse DNS Software nginx / Resource Hash Request headers Accept */* Access-Control-Request-Headers content-type Access-Control-Request-Method POST Origin http://whatscaptcha.xyz Sec-Fetch-Mode cors User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.184 Safari/537.36 Response headers access-control-allow-credentials true access-control-allow-headers DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization-Token,X-Oaid access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin http://whatscaptcha.xyz access-control-max-age 86400 content-length 0 content-type text/plain; charset=utf-8 date Wed, 21 Feb 2024 21:40:30 GMT server nginx

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| timer function| _0x5168bf function| _0x1e20 string| redirect string| additionalOffer function| goto function| _0x23c2 string| native number| count_click boolean| pagePersisted function| newLand function| _0x5456bf function| _0x23db object| url string| pci object| ppi object| s function| _0x35dd function| _0x22a5 function| _0x45e19b function| _0x5c7f object| zfgformats

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: http://whatscaptcha.xyz/lander/gksk193kd0/index.html(Line 7) Message: Error parsing a meta element's content: ';' is not a valid key-value pair separator. Please use ',' instead.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

amunfezanttor.com
desekansr.com
jouteetu.net
whatscaptcha.xyz
139.45.197.250
139.45.197.251
2606:4700:3031::ac43:a943
0a4efd689f6cb5a53e7fcb094c2ceef134b7a8ecbbbc78e44ee19347f6e68157
13ab6a27afe39979f44047b51c1f57911c89ac5498c6fb861703aa960c2f6371
b903f541c143f4dff9f5b26bb17dfd23579cd343591ed171ef95ada8f8a50e4c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ff2fe32e393a52d81a5138d45bae849106e4f2d9a856f35b3aa46004a01707f6