Submitted URL: https://bit.ly/3tCaVI1
Effective URL: https://en.us-wordpress.org/plugins/human-verification-challenge/tujt8f?continue
Submission Tags: @phish_report
Submission: On January 05 via api from FI — Scanned from FI

Summary

This website contacted 3 IPs in 3 countries across 3 domains to perform 9 HTTP transactions. The main IP is 193.32.162.181, located in Romania and belongs to UNMANAGED-DEDICATED-SERVERS, GB. The main domain is en.us-wordpress.org.
TLS certificate: Issued by R3 on December 28th 2023. Valid for: 3 months.
This is the only time en.us-wordpress.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 67.199.248.11 396982 (GOOGLE-CL...)
2 193.32.162.181 47890 (UNMANAGED...)
7 104.19.219.90 13335 (CLOUDFLAR...)
9 3
Apex Domain
Subdomains
Transfer
7 hcaptcha.com
hcaptcha.com — Cisco Umbrella Rank: 6229
newassets.hcaptcha.com — Cisco Umbrella Rank: 7636
api.hcaptcha.com — Cisco Umbrella Rank: 7827
498 KB
2 us-wordpress.org
en.us-wordpress.org
107 KB
1 bit.ly
bit.ly — Cisco Umbrella Rank: 6271
321 B
9 3
Domain Requested by
5 newassets.hcaptcha.com hcaptcha.com
newassets.hcaptcha.com
2 en.us-wordpress.org en.us-wordpress.org
1 api.hcaptcha.com newassets.hcaptcha.com
1 hcaptcha.com en.us-wordpress.org
1 bit.ly 1 redirects
9 5

This site contains no links.

Subject Issuer Validity Valid
en.us-wordpress.org
R3
2023-12-28 -
2024-03-27
3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2023-04-15 -
2024-04-14
a year crt.sh

This page contains 3 frames:

Primary Page: https://en.us-wordpress.org/plugins/human-verification-challenge/tujt8f?continue
Frame ID: 3E9B27915D7BADE13AEC7E13040FF541
Requests: 4 HTTP requests in this frame

Frame: https://newassets.hcaptcha.com/captcha/v1/3b797c3/static/hcaptcha.html?_v=rvqs310xn5a
Frame ID: 739495E0600B2E6A5D58D96F08738AE5
Requests: 4 HTTP requests in this frame

Frame: https://newassets.hcaptcha.com/captcha/v1/3b797c3/static/hcaptcha.html
Frame ID: E547C42C86DFA55001BE8E9DD880D861
Requests: 3 HTTP requests in this frame

Screenshot

Page Title

Just a moment...

Page URL History Show full URLs

  1. https://bit.ly/3tCaVI1 HTTP 301
    https://en.us-wordpress.org/plugins/human-verification-challenge/tujt8f?continue Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • https://hcaptcha.com/([\d]+?)/api.js

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

9
Requests

100 %
HTTPS

0 %
IPv6

3
Domains

5
Subdomains

3
IPs

3
Countries

605 kB
Transfer

1596 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://bit.ly/3tCaVI1 HTTP 301
    https://en.us-wordpress.org/plugins/human-verification-challenge/tujt8f?continue Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

9 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request tujt8f
en.us-wordpress.org/plugins/human-verification-challenge/
Redirect Chain
  • https://bit.ly/3tCaVI1
  • https://en.us-wordpress.org/plugins/human-verification-challenge/tujt8f?continue
19 KB
19 KB
Document
General
Full URL
https://en.us-wordpress.org/plugins/human-verification-challenge/tujt8f?continue
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.32.162.181 , Romania, ASN47890 (UNMANAGED-DEDICATED-SERVERS, GB),
Reverse DNS
Software
Caddy / PHP/8.0.30
Resource Hash
da3f7da27887eee5a3d37a0575f4e24bc6fa6074d1bd45c9e5e969a19a71a29d

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language
fi-FI,fi;q=0.9

Response headers

content-length
19806
content-type
text/html; charset=utf-8
date
Fri, 05 Jan 2024 21:22:24 GMT
server
Caddy
x-powered-by
PHP/8.0.30

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=90
content-length
167
content-security-policy
referrer always;
content-type
text/html; charset=utf-8
date
Fri, 05 Jan 2024 21:22:23 GMT
location
https://en.us-wordpress.org/plugins/human-verification-challenge/tujt8f?continue
referrer-policy
unsafe-url
server
nginx
via
1.1 google
api.js
hcaptcha.com/1/
326 KB
92 KB
Script
General
Full URL
https://hcaptcha.com/1/api.js?hl=en
Requested by
Host: en.us-wordpress.org
URL: https://en.us-wordpress.org/plugins/human-verification-challenge/tujt8f?continue
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.19.219.90 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
319e5a4819a9b54b551ca09ee13f2e9f7f34cc7c3b53369c9fe5e5493dbb32e7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://en.us-wordpress.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Fri, 05 Jan 2024 21:22:24 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
1.1 8c6057fa6de6f566cdf8dbf994c18e80.cloudfront.net (CloudFront)
cf-cache-status
HIT
content-encoding
br
x-content-type-options
nosniff
x-amz-version-id
hseit97.H306pA6BIbqxKZ.3ehwcD0gP
age
0
x-amz-cf-pop
HEL51-P1
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
last-modified
Wed, 20 Dec 2023 14:33:57 GMT
server
cloudflare
etag
W/"e80b1a7098d3b9624a08a3ac7a13046f"
vary
Accept-Encoding
content-type
application/javascript
cache-control
max-age=300
cf-ray
840ec6c61b64376f-HEL
x-amz-cf-id
mndRAuM_amkFLXPucFPQqIApv4B2dblazhOTHVybIjDGDGiRFiISSg==
jquery.min.js
en.us-wordpress.org/captcha/assets/
87 KB
88 KB
Script
General
Full URL
https://en.us-wordpress.org/captcha/assets/jquery.min.js
Requested by
Host: en.us-wordpress.org
URL: https://en.us-wordpress.org/plugins/human-verification-challenge/tujt8f?continue
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.32.162.181 , Romania, ASN47890 (UNMANAGED-DEDICATED-SERVERS, GB),
Reverse DNS
Software
Caddy /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://en.us-wordpress.org/plugins/human-verification-challenge/tujt8f?continue
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Fri, 05 Jan 2024 21:22:24 GMT
last-modified
Thu, 17 Nov 2022 23:19:34 GMT
server
Caddy
accept-ranges
bytes
etag
"rlim4m1x1g"
content-length
89476
content-type
text/javascript; charset=utf-8
truncated
/
187 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4ddc1e33de02a96249bf85fc7b16e669317a81d8e2fc403ddb1ded6c465dd578

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Content-Type
image/png
hcaptcha.html
newassets.hcaptcha.com/captcha/v1/3b797c3/static/ Frame 7394
2 KB
1 KB
Document
General
Full URL
https://newassets.hcaptcha.com/captcha/v1/3b797c3/static/hcaptcha.html?_v=rvqs310xn5a
Requested by
Host: hcaptcha.com
URL: https://hcaptcha.com/1/api.js?hl=en
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.19.219.90 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
74cb5b3667b0fe54b5192da313bcd2d707933fce885a8477057f171160e82c9c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://en.us-wordpress.org/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language
fi-FI,fi;q=0.9

Response headers

access-control-allow-origin
*
age
1234613
alt-svc
h3=":443"; ma=86400
cache-control
max-age=1209600
cf-cache-status
HIT
cf-ray
840ec6c75e10376f-HEL
content-encoding
br
content-type
text/html
cross-origin-embedder-policy
credentialless
cross-origin-resource-policy
cross-origin
date
Fri, 05 Jan 2024 21:22:24 GMT
last-modified
Wed, 20 Dec 2023 14:33:57 GMT
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Accept-Encoding
via
1.1 45ff2040e09b26d7b6a62f48718e1406.cloudfront.net (CloudFront)
x-amz-cf-id
oroeJm48nojM6sV-T2OWpjnIxjgsi0BiecMR2DlgfGcdwX0n2dbjMg==
x-amz-cf-pop
HEL51-P1
x-amz-server-side-encryption
AES256
x-amz-version-id
zqmRvj.5H3xz3glqyfc6p0MpeMIvCHe2
x-cache
Hit from cloudfront
x-content-type-options
nosniff
hcaptcha.html
newassets.hcaptcha.com/captcha/v1/3b797c3/static/ Frame E547
2 KB
763 B
Document
General
Full URL
https://newassets.hcaptcha.com/captcha/v1/3b797c3/static/hcaptcha.html
Requested by
Host: hcaptcha.com
URL: https://hcaptcha.com/1/api.js?hl=en
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.19.219.90 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2a9421e36647973f38d80cd149c3d4b30211aba44dbb1c28d82927be59e9a224
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://en.us-wordpress.org/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
accept-language
fi-FI,fi;q=0.9

Response headers

access-control-allow-origin
*
age
1234613
alt-svc
h3=":443"; ma=86400
cache-control
max-age=1209600
cf-cache-status
HIT
cf-ray
840ec6c75e0b376f-HEL
content-encoding
br
content-type
text/html
cross-origin-embedder-policy
credentialless
cross-origin-resource-policy
cross-origin
date
Fri, 05 Jan 2024 21:22:24 GMT
last-modified
Wed, 20 Dec 2023 14:33:57 GMT
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
Accept-Encoding
via
1.1 45ff2040e09b26d7b6a62f48718e1406.cloudfront.net (CloudFront)
x-amz-cf-id
oroeJm48nojM6sV-T2OWpjnIxjgsi0BiecMR2DlgfGcdwX0n2dbjMg==
x-amz-cf-pop
HEL51-P1
x-amz-server-side-encryption
AES256
x-amz-version-id
zqmRvj.5H3xz3glqyfc6p0MpeMIvCHe2
x-cache
Hit from cloudfront
x-content-type-options
nosniff
hcaptcha.js
newassets.hcaptcha.com/captcha/v1/3b797c3/ Frame 7394
326 KB
92 KB
Script
General
Full URL
https://newassets.hcaptcha.com/captcha/v1/3b797c3/hcaptcha.js
Requested by
Host: newassets.hcaptcha.com
URL: https://newassets.hcaptcha.com/captcha/v1/3b797c3/static/hcaptcha.html?_v=rvqs310xn5a
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.19.219.90 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
319e5a4819a9b54b551ca09ee13f2e9f7f34cc7c3b53369c9fe5e5493dbb32e7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://newassets.hcaptcha.com/captcha/v1/3b797c3/static/hcaptcha.html?_v=rvqs310xn5a
Origin
https://newassets.hcaptcha.com
accept-language
fi-FI,fi;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Fri, 05 Jan 2024 21:22:24 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
1.1 8c6057fa6de6f566cdf8dbf994c18e80.cloudfront.net (CloudFront)
cf-cache-status
HIT
content-encoding
br
x-content-type-options
nosniff
x-amz-version-id
hseit97.H306pA6BIbqxKZ.3ehwcD0gP
age
520634
x-amz-cf-pop
HEL51-P1
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
last-modified
Wed, 20 Dec 2023 14:33:57 GMT
server
cloudflare
etag
W/"e80b1a7098d3b9624a08a3ac7a13046f"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=1209600
cf-ray
840ec6c81f8c376f-HEL
x-amz-cf-id
mndRAuM_amkFLXPucFPQqIApv4B2dblazhOTHVybIjDGDGiRFiISSg==
hcaptcha.js
newassets.hcaptcha.com/captcha/v1/3b797c3/ Frame E547
326 KB
92 KB
Script
General
Full URL
https://newassets.hcaptcha.com/captcha/v1/3b797c3/hcaptcha.js
Requested by
Host: newassets.hcaptcha.com
URL: https://newassets.hcaptcha.com/captcha/v1/3b797c3/static/hcaptcha.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.19.219.90 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
319e5a4819a9b54b551ca09ee13f2e9f7f34cc7c3b53369c9fe5e5493dbb32e7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://newassets.hcaptcha.com/captcha/v1/3b797c3/static/hcaptcha.html
Origin
https://newassets.hcaptcha.com
accept-language
fi-FI,fi;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Fri, 05 Jan 2024 21:22:24 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
1.1 8c6057fa6de6f566cdf8dbf994c18e80.cloudfront.net (CloudFront)
cf-cache-status
HIT
content-encoding
br
x-content-type-options
nosniff
x-amz-version-id
hseit97.H306pA6BIbqxKZ.3ehwcD0gP
age
520634
x-amz-cf-pop
HEL51-P1
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
last-modified
Wed, 20 Dec 2023 14:33:57 GMT
server
cloudflare
etag
W/"e80b1a7098d3b9624a08a3ac7a13046f"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=1209600
cf-ray
840ec6c85fee376f-HEL
x-amz-cf-id
mndRAuM_amkFLXPucFPQqIApv4B2dblazhOTHVybIjDGDGiRFiISSg==
checksiteconfig
api.hcaptcha.com/ Frame 7394
700 B
870 B
XHR
General
Full URL
https://api.hcaptcha.com/checksiteconfig?v=3b797c3&host=en.us-wordpress.org&sitekey=b78dcc00-43b2-4958-a460-f62423971ce0&sc=1&swa=1&spst=1
Requested by
Host: newassets.hcaptcha.com
URL: https://newassets.hcaptcha.com/captcha/v1/3b797c3/hcaptcha.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.19.219.90 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fc21cc83e1ed86733d520c353889af0a1dde000fcc6d9a3511c253b6986110ff
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept
application/json
Referer
https://newassets.hcaptcha.com/
accept-language
fi-FI,fi;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36
Content-Type
text/plain

Response headers

date
Fri, 05 Jan 2024 21:22:24 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
content-encoding
br
server
cloudflare
vary
Origin, Accept-Encoding
access-control-allow-methods
GET, HEAD, POST, OPTIONS
content-type
application/json
access-control-allow-origin
https://newassets.hcaptcha.com
access-control-allow-credentials
true
cf-ray
840ec6c999ef376f-HEL
access-control-allow-headers
Cache-Control, Content-Type, DNT, Referer, User-Agent, challenge-bypass-token, cf-chl-bypass, challenge-bypass-token, challenge-bypass-host, challenge-bypass-path
alt-svc
h3=":443"; ma=86400
truncated
/ Frame E547
798 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
57cafa49fb677c3f09d6e90b051917d10e7bb54e83102a25f3d32b06e8fa59a7

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

Content-Type
image/png
hsw.js
newassets.hcaptcha.com/c/46b8fec/ Frame 7394
507 KB
220 KB
Script
General
Full URL
https://newassets.hcaptcha.com/c/46b8fec/hsw.js
Requested by
Host: newassets.hcaptcha.com
URL: https://newassets.hcaptcha.com/captcha/v1/3b797c3/hcaptcha.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.19.219.90 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a72d7b59d499f68ee9814cede398e42fbd87d5c579137f65032123c4f8dd6f47
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
fi-FI,fi;q=0.9
Referer
https://newassets.hcaptcha.com/captcha/v1/3b797c3/static/hcaptcha.html?_v=rvqs310xn5a
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.129 Safari/537.36

Response headers

date
Fri, 05 Jan 2024 21:22:25 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
1.1 732d3ca1627bbec3dcfe750ff23e18bc.cloudfront.net (CloudFront)
cf-cache-status
HIT
content-encoding
br
x-content-type-options
nosniff
x-amz-version-id
LhbIACCIseZhml8Xk2JUrr99P7mYK8d0
age
57873
x-amz-cf-pop
HEL51-P1
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
last-modified
Tue, 26 Dec 2023 18:49:30 GMT
server
cloudflare
etag
W/"d85d85be5bdb20c10f4397e54155215e"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=3024000
cf-ray
840ec6ca7cddd906-HEL
x-amz-cf-id
AyiP3Et-027vPpsl7jnCeVRy-nOw5nmGRIT1hwUpw5L3MdhaG2yVZg==

Verdicts & Comments Add Verdict or Comment

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| documentPictureInPicture function| $ function| jQuery undefined| hcaptchaVal function| onSubmit object| Raven object| hcaptcha object| grecaptcha

2 Cookies

Domain/Path Name / Value
.bit.ly/ Name: _bit
Value: o05lmn-8c1e89afc4f79eca91-00j
en.us-wordpress.org/ Name: PHPSESSID
Value: 04ci7f0ijbn7vm49i7mfgg3olf