ggp1-nbpl.z-hh.asia Open in urlscan Pro
35.84.112.158 Public Scan

Go To Rescan
Add Verdict Report

URL:
http://ggp1-nbpl.z-hh.asia/
Submission: On September 30 via api (September 30th 2023, 7:02:13 am UTC) from IN — Scanned from DE

Summary HTTP 11 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 3 domains to perform 11 HTTP transactions. The main IP is 35.84.112.158, located in Boardman, United States and belongs to AMAZON-02, US. The main domain is ggp1-nbpl.z-hh.asia.

This is the only time ggp1-nbpl.z-hh.asia was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	35.84.112.158 35.84.112.158	16509 (AMAZON-02) (AMAZON-02)
2	2606:4700:310... 2606:4700:310c::ac42:2c5f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a06:98c1:312... 2a06:98c1:3121::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	104.16.169.131 104.16.169.131	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	5

1 35.84.112.158 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-84-112-158.us-west-2.compute.amazonaws.com

ggp1-nbpl.z-hh.asia	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:310c::ac42:2c5f (United States)

ASN13335 (CLOUDFLARENET, US)

www.retiehe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a06:98c1:3121::3 (United States)

ASN13335 (CLOUDFLARENET, US)

assets.retiehe.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.16.169.131 (None, )

ASN13335 (CLOUDFLARENET, US)

js.hcaptcha.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
newassets.hcaptcha.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api2.hcaptcha.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	hcaptcha.com js.hcaptcha.com — Cisco Umbrella Rank: 12653 newassets.hcaptcha.com — Cisco Umbrella Rank: 11729 api2.hcaptcha.com — Cisco Umbrella Rank: 25272	494 KB
3	retiehe.com www.retiehe.com assets.retiehe.com	18 KB
1	z-hh.asia ggp1-nbpl.z-hh.asia	1 KB
11	3

	Domain	Requested by
5	newassets.hcaptcha.com	js.hcaptcha.com newassets.hcaptcha.com
2	www.retiehe.com	ggp1-nbpl.z-hh.asia
1	api2.hcaptcha.com	newassets.hcaptcha.com
1	js.hcaptcha.com	www.retiehe.com
1	assets.retiehe.com	ggp1-nbpl.z-hh.asia
1	ggp1-nbpl.z-hh.asia
11	6

This site contains links to these domains. Also see Links.

Domain
www.retiehe.com
host.retiehe.com

Subject Issuer	Validity	Valid
www.retiehe.com E1	`2023-08-18` - `2023-11-16`	3 months	crt.sh
assets.retiehe.com GTS CA 1P5	`2023-08-17` - `2023-11-15`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-04-15` - `2024-04-14`	a year	crt.sh

This page contains 3 frames:

Primary Page: http://ggp1-nbpl.z-hh.asia/
Frame ID: 5DBF71742025E258D82BD46C4E37293C
Requests: 5 HTTP requests in this frame

Frame: https://newassets.hcaptcha.com/captcha/v1/0c844f3/static/hcaptcha.html
Frame ID: 2E6FD2E7C90F530DDB5A317A87D73B4B
Requests: 4 HTTP requests in this frame

Frame: https://newassets.hcaptcha.com/captcha/v1/0c844f3/static/hcaptcha.html
Frame ID: CA343CE33F69B481DA22FD4D675B9570
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

请求可疑

Page Statistics

11
Requests

91 %
HTTPS

50 %
IPv6

3
Domains

6
Subdomains

5
IPs

2
Countries

514 kB
Transfer

1523 kB
Size

1
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://www.retiehe.com/
Title: © 2023 热铁盒网络安全团队

Search URL Search Domain Scan URL

URL: https://host.retiehe.com/
Title: 热铁盒网页托管

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 403
Forbidden Primary Request / Show response
ggp1-nbpl.z-hh.asia/ 2 KB
1 KB 3937ms
183ms Document
text/html 35.84.112.158
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: http://ggp1-nbpl.z-hh.asia/
Protocol: HTTP/1.1
Server: 35.84.112.158 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-84-112-158.us-west-2.compute.amazonaws.com
Software: retiehe.com /
Resource Hash: 77bbfedd34fc3be20a12d1fbf64f6c4d6e98ea50894167ae1af14d4edddd7315

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Sat, 30 Sep 2023 07:02:05 GMT
Server: retiehe.com
Transfer-Encoding: chunked
Vary: Accept-Encoding

GET
H2 200 error-tip.css
www.retiehe.com/css/ 3 KB
1 KB 3230ms
204ms Stylesheet
text/css 2606:4700:310c::ac42:2c5f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.retiehe.com/css/error-tip.css

Requested by

Host: ggp1-nbpl.z-hh.asia
URL: http://ggp1-nbpl.z-hh.asia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:310c::ac42:2c5f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8ebe8714cd106c4a6ea30fbc61e6a25272498e011f1459016dbed091fd85f1ed

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors file: https://.retiehe.com https://airportal.cn https://.airportal.cn https://localhost http://localhost:*
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://ggp1-nbpl.z-hh.asia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Sat, 30 Sep 2023 07:02:08 GMT
content-security-policy: frame-ancestors file: https://*.retiehe.com https://airportal.cn https://*.airportal.cn https://localhost http://localhost:*
referrer-policy: strict-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
etag: W/"8b1e412126b3e7bae7bd9672503b91e7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=a%2FGWYIeM1NJ%2BrqK%2B8DQ30lpgKhJdnCFVSNTSfm09YV69%2BZSxQzdrpwvyi5zWQfhir9gpxhjaIyD2uHGMHL9RcusYYwF%2B9laFX8%2F9QwfD%2FHXwwl3KSOfRs8jAlivjFuNQehDH0L9%2F41cmzwrtEss%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=600
cf-ray: 80ea993f59ca1d94-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 host-icon-512.png
assets.retiehe.com/ 15 KB
16 KB 2438ms
41ms Image
image/png 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://assets.retiehe.com/host-icon-512.png

Requested by

Host: ggp1-nbpl.z-hh.asia
URL: http://ggp1-nbpl.z-hh.asia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

636ea7f43b50e76fc62264cf799cd797afef51a6dc42e7ae24a29ef32baaff26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://ggp1-nbpl.z-hh.asia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Sat, 30 Sep 2023 07:02:07 GMT
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "b716d17554d162e8197d895a94905e3b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=p%2FmiC3iQ0f%2FmfK7Tx4ZfY9sNZL2fa13rnJ1%2BXUIEdkFwmuamCUz6y01ZL2wHM%2F2Bxa9IBtjzvwO0OaG4g97F0MhX6cognoaclu1%2B%2BCpcinn4WAnHsPlDBX1yOiU8Vj9H0CxlxmBiy92JjRijHOGeWKQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000, immutable
cf-ray: 80ea993b7facbbd1-FRA
alt-svc: h3=":443"; ma=86400
content-length: 15504

GET
H2 200 waf.js Show response
www.retiehe.com/js/ 1 KB
1 KB 3064ms
39ms Script
application/javascript 2606:4700:310c::ac42:2c5f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.retiehe.com/js/waf.js

Requested by

Host: ggp1-nbpl.z-hh.asia
URL: http://ggp1-nbpl.z-hh.asia/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:310c::ac42:2c5f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7b48707af0b46dfc8aa96ac667a491e56070b82704c478f79ce9b43bd06b56e8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors file: https://.retiehe.com https://airportal.cn https://.airportal.cn https://localhost http://localhost:*
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://ggp1-nbpl.z-hh.asia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Sat, 30 Sep 2023 07:02:08 GMT
content-security-policy: frame-ancestors file: https://*.retiehe.com https://airportal.cn https://*.airportal.cn https://localhost http://localhost:*
referrer-policy: strict-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br
etag: W/"2c0cf3010945ff54f502ebd54e65ba2d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=C6NuGUF1sd7igXRXQvzhNOt7IWDL8LB5zHl6tBY9DJCmqIJqtB0msplHxwrLIeRkEpUP8%2FpNRPrOkp58sYqpRaalrlKMtcyRBHja8iJm1NY5YRvAz070aJpHkoWlwyvIebxHkvIh7q5wTtWU1Ss%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=600
cf-ray: 80ea993f59cb1d94-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 api.js Show response
js.hcaptcha.com/1/ 320 KB
91 KB 67ms
19ms Script
application/javascript 104.16.169.131
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hcaptcha.com/1/api.js

Requested by

Host: www.retiehe.com
URL: https://www.retiehe.com/js/waf.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.169.131 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

64b483e268f9e01dd581c940151350cf57c5d7bfd0faf438f0c52d97e39ce5e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: http://ggp1-nbpl.z-hh.asia/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Sat, 30 Sep 2023 07:02:08 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 ade2b5e2170ccd4f394b741b27bb0eec.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-content-type-options: nosniff
x-amz-version-id: FoL6tDXFLvPuspxbdBIqVsPQ5bGCwhdg
age: 0
x-amz-cf-pop: FRA56-P4
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 28 Sep 2023 10:09:43 GMT
server: cloudflare
etag: W/"95833e6a30dee68dbfb0eb2eeac77fec"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=120
cf-ray: 80ea9941682d383b-FRA
x-amz-cf-id: HHYcOXWpE5gYj5_lGWbfxz5QK8uKd4zwsGLfqZ-etAARRJ64N4ogZA==

GET
H2 200 hcaptcha.html Show response
newassets.hcaptcha.com/captcha/v1/0c844f3/static/ Frame 2E6F 2 KB
764 B 46ms
23ms Document
text/html 104.16.169.131
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newassets.hcaptcha.com/captcha/v1/0c844f3/static/hcaptcha.html

Requested by

Host: js.hcaptcha.com
URL: https://js.hcaptcha.com/1/api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.169.131 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc2dcb085bfb87b7bfad68a01fcc788056ca35f33b7b4068ecf5ef2e21110714

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://ggp1-nbpl.z-hh.asia/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-origin: *
age: 37684
alt-svc: h3=":443"; ma=86400
cache-control: max-age=1209600
cf-cache-status: HIT
cf-ray: 80ea9941f89e383b-FRA
content-encoding: br
content-type: text/html
cross-origin-embedder-policy: credentialless
cross-origin-resource-policy: cross-origin
date: Sat, 30 Sep 2023 07:02:08 GMT
last-modified: Thu, 28 Sep 2023 10:09:43 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
via: 1.1 10f3c0984ab3eaba3e5720ed830a77b6.cloudfront.net (CloudFront)
x-amz-cf-id: NBK_8dryBU5gkS2_6YqWG_z83JImhEmGOIt0pq8jRAtzhwXjl6Qghg==
x-amz-cf-pop: FRA56-P4
x-amz-server-side-encryption: AES256
x-amz-version-id: 7z09fwwjsvWLPayVO2O.uH_uiYuA4upQ
x-cache: Hit from cloudfront
x-content-type-options: nosniff

GET
H2 200 hcaptcha.html Show response
newassets.hcaptcha.com/captcha/v1/0c844f3/static/ Frame CA34 2 KB
946 B 20ms
19ms Document
text/html 104.16.169.131
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newassets.hcaptcha.com/captcha/v1/0c844f3/static/hcaptcha.html

Requested by

Host: js.hcaptcha.com
URL: https://js.hcaptcha.com/1/api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.169.131 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc2dcb085bfb87b7bfad68a01fcc788056ca35f33b7b4068ecf5ef2e21110714

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: http://ggp1-nbpl.z-hh.asia/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-origin: *
age: 37684
alt-svc: h3=":443"; ma=86400
cache-control: max-age=1209600
cf-cache-status: HIT
cf-ray: 80ea9941f89c383b-FRA
content-encoding: br
content-type: text/html
cross-origin-embedder-policy: credentialless
cross-origin-resource-policy: cross-origin
date: Sat, 30 Sep 2023 07:02:08 GMT
last-modified: Thu, 28 Sep 2023 10:09:43 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
via: 1.1 10f3c0984ab3eaba3e5720ed830a77b6.cloudfront.net (CloudFront)
x-amz-cf-id: NBK_8dryBU5gkS2_6YqWG_z83JImhEmGOIt0pq8jRAtzhwXjl6Qghg==
x-amz-cf-pop: FRA56-P4
x-amz-server-side-encryption: AES256
x-amz-version-id: 7z09fwwjsvWLPayVO2O.uH_uiYuA4upQ
x-cache: Hit from cloudfront
x-content-type-options: nosniff

GET
H2 200 hcaptcha.js Show response
newassets.hcaptcha.com/captcha/v1/0c844f3/ Frame CA34 320 KB
91 KB 27ms
26ms Script
application/javascript 104.16.169.131
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newassets.hcaptcha.com/captcha/v1/0c844f3/hcaptcha.js

Requested by

Host: newassets.hcaptcha.com
URL: https://newassets.hcaptcha.com/captcha/v1/0c844f3/static/hcaptcha.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.169.131 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

64b483e268f9e01dd581c940151350cf57c5d7bfd0faf438f0c52d97e39ce5e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://newassets.hcaptcha.com/captcha/v1/0c844f3/static/hcaptcha.html
Origin: https://newassets.hcaptcha.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Sat, 30 Sep 2023 07:02:09 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 ade2b5e2170ccd4f394b741b27bb0eec.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-content-type-options: nosniff
x-amz-version-id: FoL6tDXFLvPuspxbdBIqVsPQ5bGCwhdg
age: 37686
x-amz-cf-pop: FRA56-P4
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 28 Sep 2023 10:09:43 GMT
server: cloudflare
etag: W/"95833e6a30dee68dbfb0eb2eeac77fec"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=1209600
cf-ray: 80ea994238d2383b-FRA
x-amz-cf-id: HHYcOXWpE5gYj5_lGWbfxz5QK8uKd4zwsGLfqZ-etAARRJ64N4ogZA==

GET
H2 200 hcaptcha.js Show response
newassets.hcaptcha.com/captcha/v1/0c844f3/ Frame 2E6F 320 KB
91 KB 19ms
18ms Script
application/javascript 104.16.169.131
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newassets.hcaptcha.com/captcha/v1/0c844f3/hcaptcha.js

Requested by

Host: newassets.hcaptcha.com
URL: https://newassets.hcaptcha.com/captcha/v1/0c844f3/static/hcaptcha.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.169.131 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

64b483e268f9e01dd581c940151350cf57c5d7bfd0faf438f0c52d97e39ce5e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://newassets.hcaptcha.com/captcha/v1/0c844f3/static/hcaptcha.html
Origin: https://newassets.hcaptcha.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Sat, 30 Sep 2023 07:02:09 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 ade2b5e2170ccd4f394b741b27bb0eec.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-content-type-options: nosniff
x-amz-version-id: FoL6tDXFLvPuspxbdBIqVsPQ5bGCwhdg
age: 37686
x-amz-cf-pop: FRA56-P4
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 28 Sep 2023 10:09:43 GMT
server: cloudflare
etag: W/"95833e6a30dee68dbfb0eb2eeac77fec"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=1209600
cf-ray: 80ea994238d3383b-FRA
x-amz-cf-id: HHYcOXWpE5gYj5_lGWbfxz5QK8uKd4zwsGLfqZ-etAARRJ64N4ogZA==

GET
DATA 200
OK truncated
/ Frame CA34 798 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 57cafa49fb677c3f09d6e90b051917d10e7bb54e83102a25f3d32b06e8fa59a7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

Content-Type: image/png

POST
H2 200 checksiteconfig Show response
api2.hcaptcha.com/ Frame 2E6F 759 B
1 KB 42ms
23ms XHR
application/json 104.16.169.131
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api2.hcaptcha.com/checksiteconfig?v=0c844f3&host=ggp1-nbpl.z-hh.asia&sitekey=eb3b2867-d0bf-438d-be42-fa3113e7d545&sc=1&swa=1&spst=0

Requested by

Host: newassets.hcaptcha.com
URL: https://newassets.hcaptcha.com/captcha/v1/0c844f3/hcaptcha.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.169.131 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b5aa0b0302de236556bdb96dabf57c707aaaa688dd51290c91e903420eead0a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://newassets.hcaptcha.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 30 Sep 2023 07:02:09 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
x-envoy-upstream-service-time: 3
alt-svc: h3=":443"; ma=86400
server: cloudflare
vary: Origin, Accept-Encoding
access-control-allow-methods: GET, HEAD, POST, OPTIONS
content-type: application/json
access-control-allow-origin: https://newassets.hcaptcha.com
access-control-allow-credentials: true
cf-ray: 80ea9942d948383b-FRA
access-control-allow-headers: Cache-Control, Content-Type, DNT, Referer, User-Agent, challenge-bypass-token, cf-chl-bypass, challenge-bypass-token, challenge-bypass-host, challenge-bypass-path
cf-chl-bypass: 2

GET
H3 200 hsw.js Show response
newassets.hcaptcha.com/c/bf600bd/ Frame 2E6F 537 KB
219 KB 16ms
16ms Script
application/javascript 104.16.169.131
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://newassets.hcaptcha.com/c/bf600bd/hsw.js

Requested by

Host: newassets.hcaptcha.com
URL: https://newassets.hcaptcha.com/captcha/v1/0c844f3/hcaptcha.js

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.169.131 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3650b356a2548dba9960b85ab48fba4d4f825b4368a53997ce581ffe6876f798

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://newassets.hcaptcha.com/captcha/v1/0c844f3/static/hcaptcha.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36

Response headers

date: Sat, 30 Sep 2023 07:02:09 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 7279057aafa9070c677136c3d9c68912.cloudfront.net (CloudFront)
cf-cache-status: HIT
content-encoding: br
x-content-type-options: nosniff
x-amz-version-id: WUkhAAiTggMXSyOjg4ZzE1fVv3Tyq3vJ
age: 884314
x-amz-cf-pop: CDG50-P1
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 18 Sep 2023 15:57:28 GMT
server: cloudflare
etag: W/"6618d6d5428581d73d60516cb29da2a8"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3024000
cf-ray: 80ea99430fc59136-FRA
x-amz-cf-id: 4xns__J3AK-qTCiCOUGS7VQpy_0bUE9hU66-LxxiORHFtM3d-3eE1w==

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			api2.hcaptcha.com/	1970-01-20 15:07:39	Name: __cflb Value: 0H28vk2VKwPbLoawFj9mU2fhedYxxWRD5gCqzBtXT9w

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://ggp1-nbpl.z-hh.asia/ Message: Failed to load resource: the server responded with a status of 403 (Forbidden)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api2.hcaptcha.com
assets.retiehe.com
ggp1-nbpl.z-hh.asia
js.hcaptcha.com
newassets.hcaptcha.com
www.retiehe.com
104.16.169.131
2606:4700:310c::ac42:2c5f
2a06:98c1:3121::3
35.84.112.158
3650b356a2548dba9960b85ab48fba4d4f825b4368a53997ce581ffe6876f798
57cafa49fb677c3f09d6e90b051917d10e7bb54e83102a25f3d32b06e8fa59a7
636ea7f43b50e76fc62264cf799cd797afef51a6dc42e7ae24a29ef32baaff26
64b483e268f9e01dd581c940151350cf57c5d7bfd0faf438f0c52d97e39ce5e4
77bbfedd34fc3be20a12d1fbf64f6c4d6e98ea50894167ae1af14d4edddd7315
7b48707af0b46dfc8aa96ac667a491e56070b82704c478f79ce9b43bd06b56e8
8ebe8714cd106c4a6ea30fbc61e6a25272498e011f1459016dbed091fd85f1ed
b5aa0b0302de236556bdb96dabf57c707aaaa688dd51290c91e903420eead0a1
dc2dcb085bfb87b7bfad68a01fcc788056ca35f33b7b4068ecf5ef2e21110714

ggp1-nbpl.z-hh.asia Open in urlscan Pro 35.84.112.158 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

11 Requests

91 %HTTPS

50 %IPv6

3 Domains

6 Subdomains

5 IPs

2 Countries

514 kBTransfer

1523 kBSize

1 Cookies

2 Outgoing links

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

1 Cookies

1 Console Messages

Indicators

ggp1-nbpl.z-hh.asia Open in urlscan Pro
35.84.112.158 Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

91 %
HTTPS

50 %
IPv6

3
Domains

6
Subdomains

5
IPs

2
Countries

514 kB
Transfer

1523 kB
Size

1
Cookies

11 HTTP transactions
1 data transactions