urlscan.io logo urlscan.io
SecurityTrails logo

99epicphotos.cyou Open in urlscan Pro
2606:4700:3031::ac43:9e45  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://monietarysalabeneeefit.zg5c3y99bp.free.hr/Newmlcft
Effective URL: https://99epicphotos.cyou/TWnAS/
Submission: On October 11 via manual from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 8 IPs in 1 countries across 6 domains to perform 16 HTTP transactions. The main IP is 2606:4700:3031::ac43:9e45, located in United States and belongs to CLOUDFLARENET, US. The main domain is 99epicphotos.cyou.
TLS certificate: Issued by WE1 on October 10th 2024. Valid for: 3 months.
This is the only time 99epicphotos.cyou was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 6 2606:4700:303... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2607:f8b0:400... 15169 (GOOGLE)
1 2606:2800:11f... 15133 (EDGECAST)
4 173.255.129.123 13213 (UK2NET-AS)
3 2606:4700:303... 13335 (CLOUDFLAR...)
1 3 2606:4700::68... 13335 (CLOUDFLAR...)
16 8
6    2606:4700:3030::6815:4291 (United States)

ASN13335 (CLOUDFLARENET, US)
monietarysalabeneeefit.zg5c3y99bp.free.hr
1    2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
1    2607:f8b0:400d:c0c::5f (Morganton, United States)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    2606:2800:11f:1cb7:261b:1f9c:2074:3c (United States)

ASN15133 (EDGECAST, US)
aadcdn.msftauth.net
4    173.255.129.123 (United States)

ASN13213 (UK2NET-AS, GB)
PTR: iotaflow.com
iotaflow.com
3    2606:4700:3031::ac43:9e45 (United States)

ASN13335 (CLOUDFLARENET, US)
99epicphotos.cyou
3    2606:4700::6812:5f29 (United States)

ASN13335 (CLOUDFLARENET, US)
challenges.cloudflare.com
Apex Domain
Subdomains		 Transfer
6 free.hr
monietarysalabeneeefit.zg5c3y99bp.free.hr
14 KB
4 iotaflow.com
iotaflow.com
3 KB
4 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 220
challenges.cloudflare.com — Cisco Umbrella Rank: 3443
44 KB
3 99epicphotos.cyou
99epicphotos.cyou
4 KB
1 msftauth.net
aadcdn.msftauth.net — Cisco Umbrella Rank: 866
17 KB
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 30
1 KB
16 6
Domain Requested by
6 monietarysalabeneeefit.zg5c3y99bp.free.hr 2 redirects monietarysalabeneeefit.zg5c3y99bp.free.hr
4 iotaflow.com monietarysalabeneeefit.zg5c3y99bp.free.hr
3 challenges.cloudflare.com 1 redirects 99epicphotos.cyou
challenges.cloudflare.com
3 99epicphotos.cyou iotaflow.com
1 aadcdn.msftauth.net monietarysalabeneeefit.zg5c3y99bp.free.hr
1 fonts.googleapis.com monietarysalabeneeefit.zg5c3y99bp.free.hr
1 cdnjs.cloudflare.com monietarysalabeneeefit.zg5c3y99bp.free.hr
16 7

This site contains no links.

Subject Issuer Validity Valid
zg5c3y99bp.free.hr
WE1		 2024-10-02 -
2024-12-31		 3 months crt.sh
cdnjs.cloudflare.com
WE1		 2024-09-28 -
2024-12-27		 3 months crt.sh
upload.video.google.com
WR2		 2024-09-24 -
2024-12-17		 3 months crt.sh
aadcdn.msftauth.net
DigiCert SHA2 Secure Server CA		 2024-05-25 -
2025-05-25		 a year crt.sh
webmail.iotaflow.com
R11		 2024-09-26 -
2024-12-25		 3 months crt.sh
99epicphotos.cyou
WE1		 2024-10-10 -
2025-01-08		 3 months crt.sh
challenges.cloudflare.com
WE1		 2024-09-05 -
2024-12-04		 3 months crt.sh

This page contains 3 frames:

Primary Page: https://99epicphotos.cyou/TWnAS/
Frame ID: E1DCF503BAB5AEA5B9000EF8C1AB9BEF
Requests: 15 HTTP requests in this frame

Frame: https://monietarysalabeneeefit.zg5c3y99bp.free.hr/cdn-cgi/challenge-platform/h/b/scripts/jsd/62ec4f065604/main.js
Frame ID: 7F3483E0E1ACB026362766E8C86C13E6
Requests: 2 HTTP requests in this frame

Frame: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/64zg6/0x4AAAAAAAxOgBC5mpQiqiK6/auto/fbE/normal/auto/
Frame ID: CBAA70896DE50C6BD62B4BE121DCB9FC
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

⁤

Page URL History Show full URLs

  1. https://monietarysalabeneeefit.zg5c3y99bp.free.hr/Newmlcft HTTP 301
    http://monietarysalabeneeefit.zg5c3y99bp.free.hr/Newmlcft/ HTTP 307
    https://monietarysalabeneeefit.zg5c3y99bp.free.hr/Newmlcft/ Page URL
  2. https://iotaflow.com/arull.php?7096797967704b536932307465337445777479457775794d677679532f57533637... Page URL
  3. https://iotaflow.com/arull.php Page URL
  4. https://iotaflow.com/arull.php Page URL
  5. https://99epicphotos.cyou/TWnAS/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

16
Requests

88 %
HTTPS

86 %
IPv6

6
Domains

7
Subdomains

8
IPs

1
Countries

81 kB
Transfer

202 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://monietarysalabeneeefit.zg5c3y99bp.free.hr/Newmlcft HTTP 301
    http://monietarysalabeneeefit.zg5c3y99bp.free.hr/Newmlcft/ HTTP 307
    https://monietarysalabeneeefit.zg5c3y99bp.free.hr/Newmlcft/ Page URL
  2. https://iotaflow.com/arull.php?7096797967704b536932307465337445777479457775794d677679532f575336374d4c3955504363397a444e594841413d3d Page URL
  3. https://iotaflow.com/arull.php Page URL
  4. https://iotaflow.com/arull.php Page URL
  5. https://99epicphotos.cyou/TWnAS/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://monietarysalabeneeefit.zg5c3y99bp.free.hr/Newmlcft HTTP 301
  • http://monietarysalabeneeefit.zg5c3y99bp.free.hr/Newmlcft/ HTTP 307
  • https://monietarysalabeneeefit.zg5c3y99bp.free.hr/Newmlcft/
Request Chain 7
  • https://monietarysalabeneeefit.zg5c3y99bp.free.hr/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://monietarysalabeneeefit.zg5c3y99bp.free.hr/cdn-cgi/challenge-platform/h/b/scripts/jsd/62ec4f065604/main.js
Request Chain 14
  • https://challenges.cloudflare.com/turnstile/v0/api.js HTTP 302
  • https://challenges.cloudflare.com/turnstile/v0/b/62ec4f065604/api.js

16 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
monietarysalabeneeefit.zg5c3y99bp.free.hr/Newmlcft/
Redirect Chain
  • https://monietarysalabeneeefit.zg5c3y99bp.free.hr/Newmlcft
  • http://monietarysalabeneeefit.zg5c3y99bp.free.hr/Newmlcft/
  • https://monietarysalabeneeefit.zg5c3y99bp.free.hr/Newmlcft/
15 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://monietarysalabeneeefit.zg5c3y99bp.free.hr/Newmlcft/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::6815:4291 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
77564a1ff0dc9c26645ffaeb1bb34329229bd08695ec876d3bbdd9d152215bbf

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8d1130f71df81825-EWR
content-encoding
zstd
content-type
text/html
date
Fri, 11 Oct 2024 19:17:36 GMT
last-modified
Fri, 11 Oct 2024 15:46:59 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DHISqq1mOY2sLhubc8ZhSIWUtunS992BNg2YbN0s1VRZ9qBl%2F2zBIKYXJ05mvWL%2FECGmoZiMUWl0SSEXmbNT4dD65lvW7yqAr9q1xU1z7iwhbgIrUPqoxE3K%2F%2F8yA2QvRAa6CYgvoVgA74OxGd6di9d1pS3MlR2sEnsrAnhy5qbMGCZ3EQZFNg%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
speculation-rules
"/cdn-cgi/speculation"

Redirect headers

Location
https://monietarysalabeneeefit.zg5c3y99bp.free.hr/Newmlcft/
Non-Authoritative-Reason
HttpsUpgrades
speculation
monietarysalabeneeefit.zg5c3y99bp.free.hr/cdn-cgi/ 		128 B
657 B 		Other
General
Check archive.org
Download Go to
Full URL
https://monietarysalabeneeefit.zg5c3y99bp.free.hr/cdn-cgi/speculation
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:4291 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin
https://monietarysalabeneeefit.zg5c3y99bp.free.hr
Referer
https://monietarysalabeneeefit.zg5c3y99bp.free.hr/Newmlcft/

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zwdHstFmSrlgpvGNZ%2FQdu%2F1meYCz6j2S0gy6fUNz7J%2Bu24Jh55uTHlC4fic8mkRs%2BUmUqWCFuKu1BXc4c9pC7vKOSsSo0azN7q58XfnaFd4scgRU63mekZ77iI%2Brc4qAv90bMiiqMmUDto6lIaaf45LYWrkeNZzrrOMI%2BP06jqfF6XM7kkAFcw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8d1130f9bc4943c2-EWR
access-control-allow-origin
https://monietarysalabeneeefit.zg5c3y99bp.free.hr
alt-svc
h3=":443"; ma=86400
content-length
128
date
Fri, 11 Oct 2024 19:17:36 GMT
content-type
application/speculationrules+json
vary
Origin, Accept-Encoding
server
cloudflare
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/ 		87 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js
Requested by
Host: monietarysalabeneeefit.zg5c3y99bp.free.hr
URL: https://monietarysalabeneeefit.zg5c3y99bp.free.hr/Newmlcft/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://monietarysalabeneeefit.zg5c3y99bp.free.hr/

Response headers

cf-cdnjs-via
cfworker/kv
content-encoding
br
cf-cache-status
HIT
etag
"603e8adc-15d9d"
age
642950
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bM81wSpd6RvlXj1s%2Byep0k2pWobGRtz7ab6GZZzZ1jPBNAcISfd8apomUu9umMUfURduKHEN5bCvwSQPF2Mb%2BdTcbVjxC%2BYhoQCA5lgEneYW0HLJoGmZ03cYtOVtqPXQJEmUWMdmGowoby3Pf3K255at"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Wed, 01 Oct 2025 19:17:37 GMT
alt-svc
h3=":443"; ma=86400
date
Fri, 11 Oct 2024 19:17:37 GMT
content-type
application/javascript; charset=utf-8
last-modified
Tue, 02 Mar 2021 18:58:36 GMT
vary
Accept-Encoding
strict-transport-security
max-age=15780000
cache-control
public, max-age=30672000
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
8d1130fd5a934350-EWR
accept-ranges
bytes
access-control-allow-origin
*
content-length
27938
server
cloudflare
css2
fonts.googleapis.com/ 		21 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Inter:wght@100;200;300;400;500;600;700;800;900&display=swap
Requested by
Host: monietarysalabeneeefit.zg5c3y99bp.free.hr
URL: https://monietarysalabeneeefit.zg5c3y99bp.free.hr/Newmlcft/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:400d:c0c::5f Morganton, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
fb121c45f498cba0f88de6e2235d95cf3307bb9ed5376f6a793b8253a520592f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://monietarysalabeneeefit.zg5c3y99bp.free.hr/

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Fri, 11 Oct 2024 19:17:37 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 11 Oct 2024 19:17:37 GMT
content-type
text/css; charset=utf-8
last-modified
Fri, 11 Oct 2024 18:23:02 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
favicon_a_eupayfgghqiai7k9sol6lg2.ico
aadcdn.msftauth.net/shared/1.0/content/images/ 		17 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Requested by
Host: monietarysalabeneeefit.zg5c3y99bp.free.hr
URL: https://monietarysalabeneeefit.zg5c3y99bp.free.hr/Newmlcft/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:11f:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (nyd/D13A) /
Resource Hash
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://monietarysalabeneeefit.zg5c3y99bp.free.hr/

Response headers

content-md5
EuPayFgGHQiAI7K9SOL6lg==
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-lease-status
unlocked
x-ms-version
2009-09-19
etag
0x8D8731240E548EB
age
17321254
x-cache
HIT
date
Fri, 11 Oct 2024 19:17:37 GMT
content-type
image/x-icon
last-modified
Sun, 18 Oct 2020 03:02:30 GMT
cache-control
public, max-age=31536000
x-ms-request-id
a3f02d27-f01e-0034-1e89-7ed73f000000
accept-ranges
bytes
access-control-allow-origin
*
content-length
17174
x-ms-blob-type
BlockBlob
server
ECAcc (nyd/D13A)
truncated
/ 		586 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
truncated
/ 		187 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
main.js
monietarysalabeneeefit.zg5c3y99bp.free.hr/cdn-cgi/challenge-platform/h/b/scripts/jsd/62ec4f065604/ Frame 7F34
Redirect Chain
  • https://monietarysalabeneeefit.zg5c3y99bp.free.hr/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://monietarysalabeneeefit.zg5c3y99bp.free.hr/cdn-cgi/challenge-platform/h/b/scripts/jsd/62ec4f065604/main.js?
8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://monietarysalabeneeefit.zg5c3y99bp.free.hr/cdn-cgi/challenge-platform/h/b/scripts/jsd/62ec4f065604/main.js?
Protocol
H3
Server
2606:4700:3030::6815:4291 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

cache-control
max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
zstd
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A3otgDPiMgMeU86MX12V4bvoV39a9m0j3sp1coQx9v%2FhspNnd7A4v7XIl5dq%2BW1%2BcxbL6q24Vks%2BepkU%2FHZsDNZah0HdRX0CVJ0JxXqtMce9a%2FGi6GPR71wu75dEygHo4WRA7jE3RgZfIKidpsDHEavV3Dxn2yeWQC3aCeuO4BWeV7w5uyPBkQ%3D%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8d1130fe8a3343c2-EWR
alt-svc
h3=":443"; ma=86400
date
Fri, 11 Oct 2024 19:17:37 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
server
cloudflare

Redirect headers

cache-control
max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location
/cdn-cgi/challenge-platform/h/b/scripts/jsd/62ec4f065604/main.js?
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9y0AVXs8zZZk4I1N4xNax4hBzrd8EIK8sgGxefR%2B%2BWMSYv8dp8UQpIhZO0oOtlE26FBK6D%2BPdnOPRsxskn6VJdYWe%2F2h6bOwJbXLfHglglN1KLC4I7Q66mB7C%2Fn%2B%2F7RLmEc55Fo2ZbdIoq1wQNXrFHThCMK77eSxdBy%2FMnNCxha9g9gJEkl30w%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8d1130fe49f343c2-EWR
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
0
date
Fri, 11 Oct 2024 19:17:37 GMT
vary
Accept-Encoding
server
cloudflare
arull.php
iotaflow.com/ 		289 B
374 B 		Document
General
Check archive.org
Download Go to
Full URL
https://iotaflow.com/arull.php?7096797967704b536932307465337445777479457775794d677679532f575336374d4c3955504363397a444e594841413d3d
Requested by
Host: monietarysalabeneeefit.zg5c3y99bp.free.hr
URL: https://monietarysalabeneeefit.zg5c3y99bp.free.hr/Newmlcft/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
173.255.129.123 , United States, ASN13213 (UK2NET-AS, GB),
Reverse DNS
iotaflow.com
Software
Apache /
Resource Hash

Request headers

Referer
https://monietarysalabeneeefit.zg5c3y99bp.free.hr/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-origin
*
content-type
text/html; charset=utf-8
date
Fri, 11 Oct 2024 19:17:38 GMT
server
Apache
8d1130f71df81825
monietarysalabeneeefit.zg5c3y99bp.free.hr/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame 7F34 		0
1006 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://monietarysalabeneeefit.zg5c3y99bp.free.hr/cdn-cgi/challenge-platform/h/b/jsd/r/8d1130f71df81825
Requested by
Host: monietarysalabeneeefit.zg5c3y99bp.free.hr
URL: https://monietarysalabeneeefit.zg5c3y99bp.free.hr/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3030::6815:4291 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type
application/json
Referer

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cBmco%2FuuOmzop9JkeKBBc%2F3cXdSwR0BzYyis%2FxQ1wXMVvJI90o%2Bb3bM28TK6W%2BahWqk%2BqxJ%2FrcBSaK60a0IT%2Bas3xSCE%2FWPg3Dn1zJ9PeVb7GyEG6Ltmx5ncRkI%2FcDxiyT1o6KgZWuNrQWj1hDkOT%2BoZOTJG2zYQ%2F%2Fw4SltrYkfDUFlXLN1r9w%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8d1130ff6b8443c2-EWR
alt-svc
h3=":443"; ma=86400
content-length
0
date
Fri, 11 Oct 2024 19:17:37 GMT
content-type
text/plain; charset=UTF-8
server
cloudflare
arull.php
iotaflow.com/ 		2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://iotaflow.com/arull.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
173.255.129.123 , United States, ASN13213 (UK2NET-AS, GB),
Reverse DNS
iotaflow.com
Software
Apache /
Resource Hash
80b8642f0bef364a5846ecaa92520ab7ed7c92c69d585e5248816bf0faf75c2d

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://iotaflow.com
Referer
https://iotaflow.com/arull.php?7096797967704b536932307465337445777479457775794d677679532f575336374d4c3955504363397a444e594841413d3d
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-origin
*
content-type
text/html; charset=UTF-8
date
Fri, 11 Oct 2024 19:17:38 GMT
server
Apache
favicon.ico
iotaflow.com/ 		0
40 B 		Other
General
Check archive.org
Download Go to
Full URL
https://iotaflow.com/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
173.255.129.123 , United States, ASN13213 (UK2NET-AS, GB),
Reverse DNS
iotaflow.com
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://iotaflow.com/arull.php

Response headers

date
Fri, 11 Oct 2024 19:17:38 GMT
content-type
image/vnd.microsoft.icon
server
Apache
arull.php
iotaflow.com/ 		81 B
136 B 		Document
General
Check archive.org
Download Go to
Full URL
https://iotaflow.com/arull.php
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
173.255.129.123 , United States, ASN13213 (UK2NET-AS, GB),
Reverse DNS
iotaflow.com
Software
Apache /
Resource Hash

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://iotaflow.com
Referer
https://iotaflow.com/arull.php
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-origin
*
content-type
text/html; charset=UTF-8
date
Fri, 11 Oct 2024 19:17:39 GMT
server
Apache
Primary Request /
99epicphotos.cyou/TWnAS/ 		2 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://99epicphotos.cyou/TWnAS/
Requested by
Host: iotaflow.com
URL: https://iotaflow.com/arull.php
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::ac43:9e45 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/7.3.33
Resource Hash
4fc3d8f428bb09db925398d4890e1671de17df726ceea6a34e908d77cd3b877a

Request headers

Referer
https://iotaflow.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
cache-control
no-store, no-cache, must-revalidate
cf-cache-status
DYNAMIC
cf-ray
8d11310e28654368-EWR
content-encoding
zstd
content-type
text/html; charset=UTF-8
date
Fri, 11 Oct 2024 19:17:40 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma
no-cache
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=89iw1oudPUVhHoTay3T6ImUIEGm4rmH8SjBzUQFrf3PtiUzGZquT63qArG9xgEusJVCXq21K%2FxNbsplgDnkbjT3CB8Fj%2FeEy0fvAg4AJj7jMn3kW8pIOonKY60E1f5Jc1lu06nlhCfsOMvqRaZDCvA%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
speculation-rules
"/cdn-cgi/speculation"
vary
Accept-Encoding
x-powered-by
PHP/7.3.33
speculation
99epicphotos.cyou/cdn-cgi/ 		128 B
580 B 		Other
General
Check archive.org
Download Go to
Full URL
https://99epicphotos.cyou/cdn-cgi/speculation
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::ac43:9e45 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin
https://99epicphotos.cyou
Referer
https://99epicphotos.cyou/TWnAS/

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tiDX%2FHe5GzXBOvHHAmgFwA%2FmZcdEYG%2FBc3qAxrDrrWHnptFTB0Jcnm3kdadPod7u3idVfnx%2FFEXvVXHJYxFfoDRn4%2BlQyFCVsEEBVOsjn6LA20oHcDxcPsu0zFuHJ4Dj0MCREPg7dMXepW5TZFLvGQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8d1131103aec4368-EWR
access-control-allow-origin
https://99epicphotos.cyou
alt-svc
h3=":443"; ma=86400
content-length
128
date
Fri, 11 Oct 2024 19:17:40 GMT
content-type
application/speculationrules+json
vary
Origin, Accept-Encoding
server
cloudflare
api.js
challenges.cloudflare.com/turnstile/v0/b/62ec4f065604/
Redirect Chain
  • https://challenges.cloudflare.com/turnstile/v0/api.js
  • https://challenges.cloudflare.com/turnstile/v0/b/62ec4f065604/api.js
46 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://challenges.cloudflare.com/turnstile/v0/b/62ec4f065604/api.js
Requested by
Host: 99epicphotos.cyou
URL: https://99epicphotos.cyou/TWnAS/
Protocol
H3
Server
2606:4700::6812:5f29 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2ea786910282df7ae154a0011375cd1254adbd8ef0e75eb62177ada67daf9611

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://99epicphotos.cyou/

Response headers

cache-control
max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public
content-encoding
br
cross-origin-resource-policy
cross-origin
cf-ray
8d1131114a507cac-EWR
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
date
Fri, 11 Oct 2024 19:17:40 GMT
content-type
application/javascript; charset=UTF-8
last-modified
Tue, 01 Oct 2024 14:19:56 GMT
server
cloudflare
vary
Accept-Encoding

Redirect headers

cache-control
max-age=300, stale-if-error=10800, stale-while-revalidate=300, public
location
/turnstile/v0/b/62ec4f065604/api.js
cross-origin-resource-policy
cross-origin
cf-ray
8d1131110a057cac-EWR
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
0
date
Fri, 11 Oct 2024 19:17:40 GMT
vary
Accept-Encoding
server
cloudflare
/
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/64zg6/0x4AAAAAAAxOgBC5mpQiqiK6/auto/fbE/normal/auto/ Frame CBAA 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/64zg6/0x4AAAAAAAxOgBC5mpQiqiK6/auto/fbE/normal/auto/
Requested by
Host: challenges.cloudflare.com
URL: https://challenges.cloudflare.com/turnstile/v0/api.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6812:5f29 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy frame-src https://challenges.cloudflare.com/ blob:; base-uri 'self'

Request headers

Referer
https://99epicphotos.cyou/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
alt-svc
h3=":443"; ma=86400
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
8d1131121fa5236a-EWR
content-encoding
br
content-security-policy
frame-src https://challenges.cloudflare.com/ blob:; base-uri 'self'
content-type
text/html; charset=UTF-8
critical-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy
same-origin
cross-origin-resource-policy
cross-origin
date
Fri, 11 Oct 2024 19:17:40 GMT
document-policy
js-profiling
origin-agent-cluster
?1
permissions-policy
accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy
same-origin
server
cloudflare
favicon.ico
99epicphotos.cyou/ 		1 KB
1 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://99epicphotos.cyou/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3031::ac43:9e45 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
679e7e62b81267c93d0778083ae0fd0efe24172ff0ac581835b54165b3d9ed43

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer
https://99epicphotos.cyou/TWnAS/

Response headers

cache-control
private, no-cache, max-age=0
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
zstd
cf-cache-status
BYPASS
pragma
no-cache
speculation-rules
"/cdn-cgi/speculation"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FCf%2FgKVjT%2B5P3EGmT2v5F0rAPvVewd6XAAEajAZ9YNuWroVew3uJS4g1lECowqvvpihiEc9zD5dEJ8FWhbqHKTo4Ref54jkwD1JDiPDxaibDalQKH%2FZxR%2FiGlpkFLcT9Y4FPRtqCiKaalsm7xBW1rw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8d1131134e4c4368-EWR
alt-svc
h3=":443"; ma=86400
date
Fri, 11 Oct 2024 19:17:41 GMT
content-type
text/html
vary
Accept-Encoding
server
cloudflare

Verdicts & Comments Add Verdict or Comment

2 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| turnstile function| abrasiveness

2 Cookies

Domain/Path Name / Value
.zg5c3y99bp.free.hr/ Name: cf_clearance
Value: dkr0k2RxsCkkOTKFEBLd2rJP_tvj_QwGMAwbMizgaT0-1728674257-1.2.1.1-UhHVgZLYDFoM3P7ulodV53VHqV74QqNVS4dG1u4mazUXu0FcRH0tv8BrVMABI7fg6_H3Km5q085RPkyM6J7kR_8yvBWNltfFCcE4sffjqvxY7jsqkD6Xqf.rCslD7X.ZSCFpKT6l33gceB72SRtjzSM.xsZ9jqth1mf301khNDvWIYKP6NDbQiZb4KHqIi312TAF4Joi_YXDbfQW1.MaHJFxdbe9gYZY1GS7hM0vKrGxALYGIWndvSFHXEULM0zES3JQ.JrsPrN_JVHhlL3eJn9xzsuUvqgZxTyh9AmZ5f7SmBBlet7DpcIcue1kd4L1PrC_2ITaZXSI1.P2DOlfPyj3xiq612NvBcooksKf2lfhquLdzPu81gvyQ5FMK8bl
99epicphotos.cyou/ Name: PHPSESSID
Value: e77d5p6eq4g76qku2vl4cqnk8b

1 Console Messages

Source Level URL
Text
network error URL: https://99epicphotos.cyou/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 ()