Submitted URL: https://rqlredw.cn/?Login
Effective URL: https://twafgig.cn/wctx1D1DFxFDg.do.php
Submission: On July 20 via api from JP — Scanned from JP

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 18 HTTP transactions. The main IP is 2606:4700:3033::ac43:8547, located in United States and belongs to CLOUDFLARENET, US. The main domain is twafgig.cn.
TLS certificate: Issued by E1 on July 20th 2022. Valid for: 3 months.
This is the only time twafgig.cn was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 23.94.73.208 36352 (AS-COLOCR...)
13 2606:4700:303... 13335 (CLOUDFLAR...)
18 3
Domain Requested by
13 twafgig.cn rqlredw.cn
twafgig.cn
2 rqlredw.cn rqlredw.cn
0 tls-ech-experiment.cloudflareresearch.com Failed rqlredw.cn
0 tls-ech-experiment-c.cloudflareresearch.com Failed rqlredw.cn
18 4

This site contains links to these domains. Also see Links.

Domain
darksoulz.us
www.cloudflare.com
Subject Issuer Validity Valid
rqlredw.cn
R3
2022-07-20 -
2022-10-18
3 months crt.sh
*.twafgig.cn
E1
2022-07-20 -
2022-10-18
3 months crt.sh

This page contains 1 frames:

Primary Page: https://twafgig.cn/wctx1D1DFxFDg.do.php
Frame ID: B1A5FC42B1EE17D59927942FDE1FDC70
Requests: 19 HTTP requests in this frame

Screenshot

Page Title

Just a moment...

Page URL History Show full URLs

  1. https://rqlredw.cn/?Login Page URL
  2. https://twafgig.cn/wctx1D1DFxFDg.do.php Page URL
  3. https://twafgig.cn/wctx1D1DFxFDg.do.php Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.php(?:$|\?)

Page Statistics

18
Requests

83 %
HTTPS

50 %
IPv6

3
Domains

4
Subdomains

3
IPs

1
Countries

107 kB
Transfer

289 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://rqlredw.cn/?Login Page URL
  2. https://twafgig.cn/wctx1D1DFxFDg.do.php Page URL
  3. https://twafgig.cn/wctx1D1DFxFDg.do.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

18 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
rqlredw.cn/
224 B
377 B
Document
General
Full URL
https://rqlredw.cn/?Login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.94.73.208 Seattle, United States, ASN36352 (AS-COLOCROSSING, US),
Reverse DNS
mail1.fkvytbaq.cn
Software
nginx /
Resource Hash
9207caaf79f20da386783d5ba03e0e308f8eec0d31ebf6e81b6c26cf662c0c8e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

accept-ranges
bytes
content-length
224
content-type
text/html
date
Wed, 20 Jul 2022 15:51:05 GMT
etag
"62d795a7-e0"
last-modified
Wed, 20 Jul 2022 05:41:59 GMT
server
nginx
strict-transport-security
max-age=31536000
1.js
rqlredw.cn/
253 B
466 B
Script
General
Full URL
https://rqlredw.cn/1.js
Requested by
Host: rqlredw.cn
URL: https://rqlredw.cn/?Login
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.94.73.208 Seattle, United States, ASN36352 (AS-COLOCROSSING, US),
Reverse DNS
mail1.fkvytbaq.cn
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://rqlredw.cn/?Login
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Wed, 20 Jul 2022 15:51:05 GMT
last-modified
Wed, 20 Jul 2022 05:52:22 GMT
server
nginx
etag
"62d79816-fd"
strict-transport-security
max-age=31536000
content-type
application/javascript
cache-control
max-age=43200
accept-ranges
bytes
content-length
253
expires
Thu, 21 Jul 2022 03:51:05 GMT
wctx1D1DFxFDg.do.php
twafgig.cn/
10 KB
11 KB
Document
General
Full URL
https://twafgig.cn/wctx1D1DFxFDg.do.php
Requested by
Host: rqlredw.cn
URL: https://rqlredw.cn/1.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::ac43:8547 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ad98315eeff9fc3a6d3f1a7cb141ce479ef85b78950c13fd90d3713688f73e1f
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://rqlredw.cn/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
72dcdb32bb668a8d-NRT
content-type
text/html; charset=UTF-8
date
Wed, 20 Jul 2022 15:51:05 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires
Thu, 01 Jan 1970 00:00:01 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
permissions-policy
accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NzM8WtYA0PVH4qM3gikYnGDtydCJUL9WmErrlglGo5yXN9sUPlMOzLNHYz4jsdbupzcgwcczRVOdwFBpqQULgwtyHJ5MPHmeXOMoJlyAKtxmqOzV1fTC9su5ByBQyUHNYDVlpE0EIsN8"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
v1
twafgig.cn/cdn-cgi/challenge-platform/h/g/orchestrate/jsch/
31 KB
12 KB
Script
General
Full URL
https://twafgig.cn/cdn-cgi/challenge-platform/h/g/orchestrate/jsch/v1?ray=72dcdb32bb668a8d
Requested by
Host: twafgig.cn
URL: https://twafgig.cn/wctx1D1DFxFDg.do.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::ac43:8547 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
18c5034eedac06a87a92950ab8d75b4a6c6918a9a95a45778798b8dff6895688

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://twafgig.cn/wctx1D1DFxFDg.do.php?__cf_chl_rt_tk=4KfKUcoHCrWYbHmbygy5tgC.gaLKizpJ1GgPcKZ68es-1658332265-0-gaNycGzNCFE
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Wed, 20 Jul 2022 15:51:05 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XBbaLXEAzRFtSrKR7hlCr2eli2158KS%2BGEv%2FKn76ei8J2omppXsL2lhPjuWUm9Sweb4Uuhg6vsuZnWinYLSjDz7TPgLDnk%2Fc7uConmY%2FCM12OPYgDvEen746YR1cTPNMM3OJvVZLlK3Q"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=0, must-revalidate
cf-ray
72dcdb332bc68a8d-NRT
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
transparent.gif
twafgig.cn/cdn-cgi/images/trace/jschal/js/
42 B
220 B
Image
General
Full URL
https://twafgig.cn/cdn-cgi/images/trace/jschal/js/transparent.gif?ray=72dcdb32bb668a8d
Requested by
Host: twafgig.cn
URL: https://twafgig.cn/wctx1D1DFxFDg.do.php?__cf_chl_rt_tk=4KfKUcoHCrWYbHmbygy5tgC.gaLKizpJ1GgPcKZ68es-1658332265-0-gaNycGzNCFE
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::ac43:8547 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://twafgig.cn/wctx1D1DFxFDg.do.php?__cf_chl_rt_tk=4KfKUcoHCrWYbHmbygy5tgC.gaLKizpJ1GgPcKZ68es-1658332265-0-gaNycGzNCFE
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Wed, 20 Jul 2022 15:51:05 GMT
x-content-type-options
nosniff
last-modified
Fri, 15 Jul 2022 15:34:13 GMT
server
cloudflare
etag
"62d188f5-2a"
x-frame-options
DENY
content-type
image/gif
cache-control
max-age=7200, public
accept-ranges
bytes
cf-ray
72dcdb332bc88a8d-NRT
vary
Accept-Encoding
content-length
42
expires
Wed, 20 Jul 2022 17:51:05 GMT
transparent.gif
twafgig.cn/cdn-cgi/images/trace/jschal/nojs/
42 B
101 B
Image
General
Full URL
https://twafgig.cn/cdn-cgi/images/trace/jschal/nojs/transparent.gif?ray=72dcdb32bb668a8d
Requested by
Host: twafgig.cn
URL: https://twafgig.cn/wctx1D1DFxFDg.do.php?__cf_chl_rt_tk=4KfKUcoHCrWYbHmbygy5tgC.gaLKizpJ1GgPcKZ68es-1658332265-0-gaNycGzNCFE
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::ac43:8547 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://twafgig.cn/wctx1D1DFxFDg.do.php?__cf_chl_rt_tk=4KfKUcoHCrWYbHmbygy5tgC.gaLKizpJ1GgPcKZ68es-1658332265-0-gaNycGzNCFE
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Wed, 20 Jul 2022 15:51:05 GMT
x-content-type-options
nosniff
last-modified
Fri, 15 Jul 2022 15:34:13 GMT
server
cloudflare
etag
"62d188f5-2a"
x-frame-options
DENY
content-type
image/gif
cache-control
max-age=7200, public
accept-ranges
bytes
cf-ray
72dcdb332bca8a8d-NRT
vary
Accept-Encoding
content-length
42
expires
Wed, 20 Jul 2022 17:51:05 GMT
63d3995fa2cc5f9
twafgig.cn/cdn-cgi/challenge-platform/h/g/flow/ov1/0.4991021819519408:1658329662:57CTvjtOcBORki4cP_3TvalDZpYEj6ZjiUSDxKUsRok/72dcdb32bb668a8d/
94 KB
56 KB
XHR
General
Full URL
https://twafgig.cn/cdn-cgi/challenge-platform/h/g/flow/ov1/0.4991021819519408:1658329662:57CTvjtOcBORki4cP_3TvalDZpYEj6ZjiUSDxKUsRok/72dcdb32bb668a8d/63d3995fa2cc5f9
Requested by
Host: twafgig.cn
URL: https://twafgig.cn/cdn-cgi/challenge-platform/h/g/orchestrate/jsch/v1?ray=72dcdb32bb668a8d
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3033::ac43:8547 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a030e405ed1a641c126a248d5ff5f0194cb43dcb79886b2c768a939265c8943a

Request headers

Referer
https://twafgig.cn/wctx1D1DFxFDg.do.php
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
CF-Challenge
63d3995fa2cc5f9
Content-type
application/x-www-form-urlencoded

Response headers

date
Wed, 20 Jul 2022 15:51:05 GMT
content-encoding
br
cf_chl_gen
RHYLMZ/NQrP1dGJCDK/7lcyWfaagq+Nc8XtG6Gwo0L1OWAcb88C+iqrPbG0eTWaikUTg8aVBaCH1rendiPLymnqQNJU+YTTCH91zQt/RcjrL6FDZLEfLVadREowxUDAQyQL3fdle0wOvZ8MjjQW0rgnqZAdkeX4lEIrcwriOHqg5Vl5a/VrJ/rvXMy3LjwRp1MZ52AhixjKxAhIuVDjGnzLu+ZAKg3P015YS6+KP766Jafuo74HmWLdKm937tuHoZ8RYRYMsrRCRBwd5Dc4U67K/AaXRZwK4WxHO01yjno6U6N6y39YdRq36+hV8m8hUFOrzP/s5XTKM5ODDfn6lCw==$Ur0Uk+eGcRNmk+wwXnjpzw==
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FO7b2%2F%2F%2FceYRp7kIE82k9M6wjADEZBhu1Y3pE4ctjrwNIF4c3hxxuiV6mB1SsU1GM4mEkT8hWRotiYwsdoZRrRt%2BqtwhBRYY%2BfrycQXGCiv4lS7SEKpPY80VGfZgNYqjqBzRv2dZoaWc"}],"group":"cf-nel","max_age":604800}
content-type
text/plain; charset=UTF-8
cf-ray
72dcdb33f9c70ad0-NRT
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
truncated
/
68 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
63ef318d96b5d0d0ceba6e04a4e622b1158335cdc67c49e27839132c6f655058

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/png
pYlXFD_blidbxkC
twafgig.cn/cdn-cgi/challenge-platform/h/g/pat/72dcdb32bb668a8d/1658332265611/87b242d175f11212320020e9350ef135558ba71e11f970b8c159c792fbe79008/
1 B
977 B
Fetch
General
Full URL
https://twafgig.cn/cdn-cgi/challenge-platform/h/g/pat/72dcdb32bb668a8d/1658332265611/87b242d175f11212320020e9350ef135558ba71e11f970b8c159c792fbe79008/pYlXFD_blidbxkC
Requested by
Host: rqlredw.cn
URL: https://rqlredw.cn/?Login
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3033::ac43:8547 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6da43b944e494e885e69af021f93c6d9331c78aa228084711429160a5bbd15b5

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://twafgig.cn/wctx1D1DFxFDg.do.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Wed, 20 Jul 2022 15:51:06 GMT
www-authenticate
PrivateToken challenge=AAIAGXBhdC1pc3N1ZXIuY2xvdWRmbGFyZS5jb20gh7JC0XXxEhIyACDpNQ7xNVWLpx4R-XC4wVnHkvvnkAgACnR3YWZnaWcuY24=, token-key=MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgKiAwIBMAOCAQ8AMIIBCgKCAQEAj_nzogphx4Z_OsXPuMsa2inAodCsAIgqaw73FElcDPa4QHTpyy7UqftvPEcjX7QfTJGvHUb32L-6l_Exr3UFmpcK1fVxhEKR56F89LrZzhkEVF4cv_AtBamJk2gyIBnksFciUkfF1TDEugQnREyaUSHKFWyA-wbZ1FJd_KGXNp1X6smtnk4qHS1fh5IZAtLyCAlsEzGyImQ5uC3ASv3mA9wuMtvlwzmyAwQou3f-l-DVf0ZHo7tmx3ONGDyatQLIOy_MMdkfkpw5Exgg6-rg3kOFQV5sb6JljM_ZMopDUHFIcWXoCgW3_3lGJT3yJlAHOrThP1yjP_doDc4fZlpcCQIDAQAB, max-age=15
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=s1MDkFL2nTdXMqOwTLL9FmxG8iSjICmHqNXoNdG4I%2BZzczoyOyiCzbfTfAI9%2B142u0A%2BkecQSAGoWFD1LJLNvb4xxfWEesqrB7vz8QnQvDyaciUY6jkOiFPe1zM0BeVH4n6OU9%2B1pL6U"}],"group":"cf-nel","max_age":604800}
content-type
text/plain; charset=UTF-8
cf-ray
72dcdb36bc320ad0-NRT
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
probe
tls-ech-experiment-c.cloudflareresearch.com/.well-known/
0
0

probe
tls-ech-experiment.cloudflareresearch.com/.well-known/
0
0

0LrYQkUNh31VgHU
twafgig.cn/cdn-cgi/challenge-platform/h/g/img/72dcdb32bb668a8d/1658332265612/
61 B
509 B
Image
General
Full URL
https://twafgig.cn/cdn-cgi/challenge-platform/h/g/img/72dcdb32bb668a8d/1658332265612/0LrYQkUNh31VgHU
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3033::ac43:8547 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
85635a11a6bd0f6244829189744582c0e11b6d3acacdb7efc544bf4c1cb671cd

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://twafgig.cn/wctx1D1DFxFDg.do.php
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Wed, 20 Jul 2022 15:51:06 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YToazBM534Zv46msxV4%2FWBzeuheMtUecoWONjNQkz23xhYmEWhUy5DuMDhSxat8BF0vPdux2W9EQ1fLr7EdSobZhiUG1a5YGz53t%2Bg4wPU3T4KyCMv8FXFpyvRolX3AjXRPzx2kWih%2BA"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cf-ray
72dcdb38adb80ad0-NRT
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
e393be87-e440-44b6-8201-b56801aae684
https://twafgig.cn/
172 B
0
Other
General
Full URL
blob:https://twafgig.cn/e393be87-e440-44b6-8201-b56801aae684
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ed3ba3bf2cbfc82fdae58f74571364f3722d12d9faf37fcedd89fc5b04412a0e

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Length
172
Content-Type
application/javascript
63d3995fa2cc5f9
twafgig.cn/cdn-cgi/challenge-platform/h/g/flow/ov1/0.4991021819519408:1658329662:57CTvjtOcBORki4cP_3TvalDZpYEj6ZjiUSDxKUsRok/72dcdb32bb668a8d/
1 KB
2 KB
XHR
General
Full URL
https://twafgig.cn/cdn-cgi/challenge-platform/h/g/flow/ov1/0.4991021819519408:1658329662:57CTvjtOcBORki4cP_3TvalDZpYEj6ZjiUSDxKUsRok/72dcdb32bb668a8d/63d3995fa2cc5f9
Requested by
Host: twafgig.cn
URL: https://twafgig.cn/cdn-cgi/challenge-platform/h/g/orchestrate/jsch/v1?ray=72dcdb32bb668a8d
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3033::ac43:8547 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1bc54ef6a3628d10f6d34e21ad802ff46f378d5e83bf00eb268108062ce9e693

Request headers

Referer
https://twafgig.cn/wctx1D1DFxFDg.do.php
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
CF-Challenge
63d3995fa2cc5f9
Content-type
application/x-www-form-urlencoded

Response headers

date
Wed, 20 Jul 2022 15:51:07 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf_chl_out
y9qE8EJfcGU+UtfCz6GmbsvtwDNFf76c38IVb1+SYwsY7Ue7SgDFqtBMKwiD1HhNxO01DmQhGtygynpzLN7EqA==$b8muaRHf8zWAtOseMlycbQ==
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LqhfI70XK9DBmxMOxevJbwgwj%2B76ERjdQCTW%2BnKcYf7SuRUHZlA6MowBlQV3%2FDZTieE3PVNpZXOzCrQkfeo1ycnoP95kaxq7CwC8gu5rsWVs2%2By%2BQDx6gD2FezlK42wTP5EVYvCnGPfw"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=UTF-8
cf_chl_out_s
/tFbbq+nctFUJ3OwbfQz1v3ldWyWu7xnCFoqeIfTU34ScZmQCsAD8vP2gJd8io1JvC2so+dphk2UPzpraF1YKTt/kAgP8A2W3DuqTrK5GChpa+o4JXMxv7ylSOIYpAAmUWFOeNdJSYbqCi1PTAbHQRpmFz4OMva0NhsixU/ZSEkd4Exg5aHsLtfZXwIRseaQ86PyONoZ2y402Rfev1TJF2t5ARUoPBbc39UUFAcqJnCp8t93b3lHxEsKV69TI13TLdRjBcG+6Qb9XiKzIR1CcyAg64V18zjw09jLBomiH1s5sgEHBe6nShGduNbW3h0FK+n68ocsgn4GhDX06p23VR7RXU2BsP41+EjrfeuuyAYZkhFzFaNWBwoo3cc/2iqnwkwXBy17VH028t/VUR0M4cSE8KNI4x0yUiHOzYIQT4ICRVAC6O/sH+WPmlRNRuDVZ1/DI8NQ6ESZQh5tmTy6tebUACSzTKIxtOP4gbqM/qP7t5IDCDR1nWECvTfjIYD/ritP4a8tOTNJ1+4USL+e061ddZ7PprU3F5K1aKyCqSCEwARNX5hQccSPI3Gxzqi3Ubx41q8e6/iljpuYGAO84w==$qV+CjotWSstt4180BdpGQw==
cf-ray
72dcdb3dc9f20ad0-NRT
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
Primary Request wctx1D1DFxFDg.do.php
twafgig.cn/
10 KB
11 KB
Document
General
Full URL
https://twafgig.cn/wctx1D1DFxFDg.do.php
Requested by
Host: rqlredw.cn
URL: https://rqlredw.cn/?Login
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3033::ac43:8547 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2bbfb586dd9184f0cc4de75f7845b02845c4c8d6ae03eac4ef377d2c88821506
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://twafgig.cn/wctx1D1DFxFDg.do.php
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
72dcdb4a9bae0ad0-NRT
content-type
text/html; charset=UTF-8
date
Wed, 20 Jul 2022 15:51:09 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires
Thu, 01 Jan 1970 00:00:01 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
permissions-policy
accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=D9BlhiI0lQ%2BLn8mlhNIV%2BrPSVTCJd%2BW8u33jzZyVxxMCa%2BgruyiBYgJ7dizJIIhXvn%2B7ryDa6oNaEXW7atnpIxaT2%2BnNmXWRRWrSh5CUXL5ali%2F0NZQseMpJSbDTrNDR6h2pNTv7Y%2FYg"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
v1
twafgig.cn/cdn-cgi/challenge-platform/h/g/orchestrate/jsch/
32 KB
12 KB
Script
General
Full URL
https://twafgig.cn/cdn-cgi/challenge-platform/h/g/orchestrate/jsch/v1?ray=72dcdb4a9bae0ad0
Requested by
Host: twafgig.cn
URL: https://twafgig.cn/wctx1D1DFxFDg.do.php
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3033::ac43:8547 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c1a567aa774785a605ba43a9470138d798e0292efff5e8ceadfcfe5eb087fd4a

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://twafgig.cn/wctx1D1DFxFDg.do.php?__cf_chl_rt_tk=l3zWIwrbFklYh8IwOOXQP35CMxKG3NFmqhdloszpPwU-1658332269-0-gaNycGzNBmU
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Wed, 20 Jul 2022 15:51:09 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nkm%2BAO1h56eSW%2Bd772gcf%2FjajHf3RRm2s10fUe%2F%2FctjQa1gbpBFYSUqR8Q%2FZ7w0Rlfw1UcWc5pzoecsw3gPtOGU2OTWbLJKpdGe5YyvI3UoO3ZV%2Bv9je6dTsKsBJ6vxdd9LQtTwW0e5H"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=0, must-revalidate
cf-ray
72dcdb4aebfa0ad0-NRT
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
transparent.gif
twafgig.cn/cdn-cgi/images/trace/jschal/js/
42 B
222 B
Image
General
Full URL
https://twafgig.cn/cdn-cgi/images/trace/jschal/js/transparent.gif?ray=72dcdb4a9bae0ad0
Requested by
Host: twafgig.cn
URL: https://twafgig.cn/wctx1D1DFxFDg.do.php?__cf_chl_rt_tk=l3zWIwrbFklYh8IwOOXQP35CMxKG3NFmqhdloszpPwU-1658332269-0-gaNycGzNBmU
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3033::ac43:8547 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://twafgig.cn/wctx1D1DFxFDg.do.php?__cf_chl_rt_tk=l3zWIwrbFklYh8IwOOXQP35CMxKG3NFmqhdloszpPwU-1658332269-0-gaNycGzNBmU
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Wed, 20 Jul 2022 15:51:09 GMT
x-content-type-options
nosniff
last-modified
Fri, 15 Jul 2022 15:34:13 GMT
server
cloudflare
etag
"62d188f5-2a"
x-frame-options
DENY
content-type
image/gif
cache-control
max-age=7200, public
accept-ranges
bytes
cf-ray
72dcdb4aebfc0ad0-NRT
vary
Accept-Encoding
content-length
42
expires
Wed, 20 Jul 2022 17:51:09 GMT
transparent.gif
twafgig.cn/cdn-cgi/images/trace/jschal/nojs/
42 B
222 B
Image
General
Full URL
https://twafgig.cn/cdn-cgi/images/trace/jschal/nojs/transparent.gif?ray=72dcdb4a9bae0ad0
Requested by
Host: twafgig.cn
URL: https://twafgig.cn/wctx1D1DFxFDg.do.php?__cf_chl_rt_tk=l3zWIwrbFklYh8IwOOXQP35CMxKG3NFmqhdloszpPwU-1658332269-0-gaNycGzNBmU
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3033::ac43:8547 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://twafgig.cn/wctx1D1DFxFDg.do.php?__cf_chl_rt_tk=l3zWIwrbFklYh8IwOOXQP35CMxKG3NFmqhdloszpPwU-1658332269-0-gaNycGzNBmU
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Wed, 20 Jul 2022 15:51:09 GMT
x-content-type-options
nosniff
last-modified
Fri, 15 Jul 2022 15:34:13 GMT
server
cloudflare
etag
"62d188f5-2a"
x-frame-options
DENY
content-type
image/gif
cache-control
max-age=7200, public
accept-ranges
bytes
cf-ray
72dcdb4afbfd0ad0-NRT
vary
Accept-Encoding
content-length
42
expires
Wed, 20 Jul 2022 17:51:09 GMT
3e08737aab86964
twafgig.cn/cdn-cgi/challenge-platform/h/g/flow/ov1/0.3467997383596281:1658329649:oTu7bhvMe9uE4_3WFJw4vK7ohRNSdY4jstZJOjs9SBk/72dcdb4a9bae0ad0/
109 KB
0
XHR
General
Full URL
https://twafgig.cn/cdn-cgi/challenge-platform/h/g/flow/ov1/0.3467997383596281:1658329649:oTu7bhvMe9uE4_3WFJw4vK7ohRNSdY4jstZJOjs9SBk/72dcdb4a9bae0ad0/3e08737aab86964
Requested by
Host: twafgig.cn
URL: https://twafgig.cn/cdn-cgi/challenge-platform/h/g/orchestrate/jsch/v1?ray=72dcdb4a9bae0ad0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3033::ac43:8547 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://twafgig.cn/wctx1D1DFxFDg.do.php
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
CF-Challenge
3e08737aab86964
Content-type
application/x-www-form-urlencoded

Response headers

date
Wed, 20 Jul 2022 15:51:09 GMT
content-encoding
br
cf_chl_gen
n7msNq+ygdVK+tmQQr2E4iGX7ROFairl1Vs0a5zjEBNCeoNs5chIq2MmhCUY/osk4Qg4l73RsYw2wQojviVoRILfI0gTM/0PraAzF0QbDywb5duXM/PvJr3J4BrYRnNMA3xMFC9yhy4KEVMx5cvOGi/1oos7+HaViN+y7863rrCbq8Zn7vy4xPcRQtSs5nh9fuduIjIUV3SCKjlJ0ebiM/fdDr8uio9uDWiLyzsQZjLDirMfpUy0z/vXYiq19wM7Ff+rub4Cbbpjc/N9q1vGMN9Q0PTuGTSyBw6I1hXdGk/0rRDbXypDYrsroqAYniXieQZQKX1d8I87TuUJM2E4+HD9Ntpaz4dha1G6X77AELttB/MKqfNUGPKjz+0Y2b3HKTQc/qSc1YxNTtVIaQ10Iw==$bZdRMfaJW6gFx7qKNkS7fw==
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3vkbd3KjtTBXOCbfVu1rjfOLXEI%2FpQvDcIwdxhVh%2FQLIHrWixjMJfXrxLJpFLjSX8zh38mZKTMiJ0HSnuHxyuUJRAWySK1rnatzykVzFJcvup%2B0tNnmw%2BjtJbMv1np9rzY%2FYYE0VoCT%2F"}],"group":"cf-nel","max_age":604800}
content-type
text/plain; charset=UTF-8
cf-ray
72dcdb4bcc990ad0-NRT
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
tls-ech-experiment-c.cloudflareresearch.com
URL
https://tls-ech-experiment-c.cloudflareresearch.com/.well-known/probe
Domain
tls-ech-experiment.cloudflareresearch.com
URL
https://tls-ech-experiment.cloudflareresearch.com/.well-known/probe

Verdicts & Comments Add Verdict or Comment

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| _cf_chl_opt function| _cf_chl_enter function| sendRequest boolean| _cf_chl_done_ran function| _cf_chl_done function| SHA256 object| _cf_chl_ctx object| _

2 Cookies

Domain/Path Name / Value
twafgig.cn/ Name: cf_chl_prog
Value: F13
twafgig.cn/ Name: cf_chl_rc_ni
Value: 1

9 Console Messages

Source Level URL
Text
security warning
Message:
Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.
network error URL: https://twafgig.cn/wctx1D1DFxFDg.do.php
Message:
Failed to load resource: the server responded with a status of 503 ()
network error URL: https://twafgig.cn/cdn-cgi/challenge-platform/h/g/pat/72dcdb32bb668a8d/1658332265611/87b242d175f11212320020e9350ef135558ba71e11f970b8c159c792fbe79008/pYlXFD_blidbxkC
Message:
Failed to load resource: the server responded with a status of 401 ()
javascript error URL: https://twafgig.cn/wctx1D1DFxFDg.do.php
Message:
Access to XMLHttpRequest at 'https://tls-ech-experiment-c.cloudflareresearch.com/.well-known/probe' from origin 'https://twafgig.cn' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://tls-ech-experiment-c.cloudflareresearch.com/.well-known/probe
Message:
Failed to load resource: net::ERR_FAILED
javascript error URL: https://twafgig.cn/wctx1D1DFxFDg.do.php
Message:
Access to XMLHttpRequest at 'https://tls-ech-experiment.cloudflareresearch.com/.well-known/probe' from origin 'https://twafgig.cn' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network error URL: https://tls-ech-experiment.cloudflareresearch.com/.well-known/probe
Message:
Failed to load resource: net::ERR_FAILED
security warning
Message:
Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.
network error URL: https://twafgig.cn/wctx1D1DFxFDg.do.php
Message:
Failed to load resource: the server responded with a status of 503 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000