zklp.denfiles.ru Open in urlscan Pro
2a06:98c1:3121::3 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.zigo.com/clickOutI?userID=4209882&url=https%3A%2F%2Fplagueremedies.com%2Femail%2Fverification%2Felrte0%2F...
Effective URL:
https://zklp.denfiles.ru/Msimon.jones@thebunker.net
Submission: On May 02 via api (May 2nd 2023, 10:54:51 am UTC) from GB — Scanned from GB

Summary HTTP 15 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 1 countries across 4 domains to perform 15 HTTP transactions. The main IP is 2a06:98c1:3121::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is zklp.denfiles.ru.
TLS certificate: Issued by GTS CA 1P5 on April 24th 2023. Valid for: 3 months.

This is the only time zklp.denfiles.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 2	50.28.79.140 50.28.79.140	32244 (LIQUIDWEB) (LIQUIDWEB)
1	83.150.216.10 83.150.216.10	60558 (SECUREDSE...) (SECUREDSERVERS-EU)
7	2a06:98c1:312... 2a06:98c1:3121::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2606:4700::68... 2606:4700::6812:7b9	13335 (CLOUDFLAR...) (CLOUDFLARENET)
15	5

2 50.28.79.140 (United States) 1 redirects

ASN32244 (LIQUIDWEB, US)
PTR: jobplacements.com

www.zigo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 83.150.216.10 (Ashburn, United States)

ASN60558 (SECUREDSERVERS-EU, US)

plagueremedies.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a06:98c1:3121::3 (United States)

ASN13335 (CLOUDFLARENET, US)

zklp.denfiles.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6812:7b9 (United States)

ASN13335 (CLOUDFLARENET, US)

challenges.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	denfiles.ru zklp.denfiles.ru	218 KB
3	cloudflare.com challenges.cloudflare.com — Cisco Umbrella Rank: 4009	68 KB
2	zigo.com 1 redirects www.zigo.com	572 B
1	plagueremedies.com plagueremedies.com	255 B
15	4

	Domain	Requested by
7	zklp.denfiles.ru	zklp.denfiles.ru
3	challenges.cloudflare.com	zklp.denfiles.ru challenges.cloudflare.com
2	www.zigo.com	1 redirects
1	plagueremedies.com	www.zigo.com
15	4

This site contains no links.

Subject Issuer	Validity	Valid
zigo.com R3	`2023-04-11` - `2023-07-10`	3 months	crt.sh
plagueremedies.com R3	`2023-04-30` - `2023-07-29`	3 months	crt.sh
denfiles.ru GTS CA 1P5	`2023-04-24` - `2023-07-23`	3 months	crt.sh
challenges.cloudflare.com Cloudflare Inc ECC CA-3	`2022-09-18` - `2023-09-17`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://zklp.denfiles.ru/Msimon.jones@thebunker.net
Frame ID: 14256C67941DA23E6C4BE3E6FAA833C7
Requests: 12 HTTP requests in this frame

Frame: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/041e4/0x4AAAAAAAAjq6WYeRDKmebM/light/normal
Frame ID: CB23E45DC98A092A48B21EEAA7934EE3
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Loading...

Page URL History Show full URLs

https://www.zigo.com/clickOutI?userID=4209882&url=https%3A%2F%2Fplagueremedies.com%2Femail%2Fveri... Page URL
https://zklp.denfiles.ru/Msimon.jones@thebunker.net Page URL

Page Statistics

15
Requests

80 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

5
IPs

1
Countries

287 kB
Transfer

563 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.zigo.com/clickOutI?userID=4209882&url=https%3A%2F%2Fplagueremedies.com%2Femail%2Fverification%2Felrte0%2F%2F%2F%2Fc2ltb24uam9uZXNAdGhlYnVua2VyLm5ldA== Page URL
https://zklp.denfiles.ru/Msimon.jones@thebunker.net Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 1

https://www.zigo.com/clickout2I.php/?source=&userID=4209882&emailClickID=&url=https%3A%2F%2Fplagueremedies.com%2Femail%2Fverification%2Felrte0%2F%2F%2F%2Fc2ltb24uam9uZXNAdGhlYnVua2VyLm5ldA%3D%3D HTTP 302
https://plagueremedies.com/email/verification/elrte0////c2ltb24uam9uZXNAdGhlYnVua2VyLm5ldA==

15 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 clickOutI Show response
www.zigo.com/ 381 B
461 B 569ms
156ms Document
text/html 50.28.79.140
LIQUIDWEB

General

Check archive.org

Show headers Download Go to

Full URL: https://www.zigo.com/clickOutI?userID=4209882&url=https%3A%2F%2Fplagueremedies.com%2Femail%2Fverification%2Felrte0%2F%2F%2F%2Fc2ltb24uam9uZXNAdGhlYnVua2VyLm5ldA==
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 50.28.79.140 , United States, ASN32244 (LIQUIDWEB, US),
Reverse DNS: jobplacements.com
Software: Microsoft-IIS/10.0 /
Resource Hash: 8e5583d0e15efc625e4ca8420c5063dcabee2eaf49b345ec7a291f95dcaf0265

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

content-encoding: br
content-length: 349
content-type: text/html; charset=UTF-8
date: Tue, 02 May 2023 10:54:46 GMT
server: Microsoft-IIS/10.0
vary: Accept-Encoding

GET
H/1.1

200
OK

c2ltb24uam9uZXNAdGhlYnVua2VyLm5ldA== Show response
plagueremedies.com/email/verification/elrte0////
Redirect Chain

https://www.zigo.com/clickout2I.php/?source=&userID=4209882&emailClickID=&url=https%3A%2F%2Fplagueremedies.com%2Femail%2Fverification%2Felrte0%2F%2F%2F%2Fc2ltb24uam9uZXNAdGhlYnVua2VyLm5ldA%3D%3D
https://plagueremedies.com/email/verification/elrte0////c2ltb24uam9uZXNAdGhlYnVua2VyLm5ldA==

0
255 B

168ms
51ms

Document
text/html

83.150.216.10
SECUREDSERVERS-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://plagueremedies.com/email/verification/elrte0////c2ltb24uam9uZXNAdGhlYnVua2VyLm5ldA==
Requested by: Host: www.zigo.com
URL: https://www.zigo.com/clickOutI?userID=4209882&url=https%3A%2F%2Fplagueremedies.com%2Femail%2Fverification%2Felrte0%2F%2F%2F%2Fc2ltb24uam9uZXNAdGhlYnVua2VyLm5ldA==
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 83.150.216.10 Ashburn, United States, ASN60558 (SECUREDSERVERS-EU, US),
Reverse DNS
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.zigo.com/clickOutI?userID=4209882&url=https%3A%2F%2Fplagueremedies.com%2Femail%2Fverification%2Felrte0%2F%2F%2F%2Fc2ltb24uam9uZXNAdGhlYnVua2VyLm5ldA==
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

Connection: Keep-Alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8
Date: Tue, 02 May 2023 10:54:47 GMT
Keep-Alive: timeout=5, max=100
Server: Apache
refresh: 0;url=https://zklp.denfiles.ru/Msimon.jones@thebunker.net

Redirect headers

content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 02 May 2023 10:54:47 GMT
location: https://plagueremedies.com/email/verification/elrte0////c2ltb24uam9uZXNAdGhlYnVua2VyLm5ldA==
server: Microsoft-IIS/10.0

GET
H2 403 Primary Request Msimon.jones@thebunker.net Show response
zklp.denfiles.ru/ 8 KB
5 KB 213ms
99ms Document
text/html 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://zklp.denfiles.ru/Msimon.jones@thebunker.net

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

872ae626da96184205bd895d97c10b14d93f237165a2d8bbb5639494d3026114

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://plagueremedies.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-mitigated: challenge
cf-ray: 7c0fba6dbf8a7443-LHR
content-encoding: br
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
date: Tue, 02 May 2023 10:54:47 GMT
expires: Thu, 01 Jan 1970 00:00:01 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
permissions-policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DfwKXP3rWLAvOwwv4Kj3xC4tqvCcmeCoxZVz2KcuP4wIih2fPJ%2FLQC2WFBx2sNe%2FFw%2B6rz%2FNQUWevoTC6OYvBG5cR0vk60R2EtVtPcTPWkDU7M0206Zm%2FwQdrdR4xeRIoCTPbynATj8bOX%2BaXSov"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-frame-options: SAMEORIGIN

GET
H2 200 v1 Show response
zklp.denfiles.ru/cdn-cgi/challenge-platform/h/g/orchestrate/managed/ 149 KB
54 KB 55ms
54ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://zklp.denfiles.ru/cdn-cgi/challenge-platform/h/g/orchestrate/managed/v1?ray=7c0fba6dbf8a7443
Requested by: Host: zklp.denfiles.ru
URL: https://zklp.denfiles.ru/Msimon.jones@thebunker.net
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cbad462ffb720ce9741deda312d60a3fb0634db325207027b3826ce149cc2a0c

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://zklp.denfiles.ru/Msimon.jones@thebunker.net?__cf_chl_rt_tk=HtJtH5D2cEVigZGGuNPGo5nbDkzNGg7Kgb4D1TTz544-1683024887-0-gaNycGzNC7s
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Tue, 02 May 2023 10:54:48 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jKvv5yWOfTXiuArPx51wgQrfkQfVkY3VOQVggLALYWGaKgrsPFPrzDbN%2BzI7eDZFkWvxLELtq3UoNfjmrlbnJ%2Bt9PnSwiA59jRsGEtBKaBhg7t%2FmrBV4Dlh7J3sDj8G6bNJ%2BVDMFMDOlcrm%2BAK71"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
cache-control: max-age=0, must-revalidate
cf-ray: 7c0fba6e888e7443-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 transparent.gif
zklp.denfiles.ru/cdn-cgi/images/trace/managed/js/ 42 B
243 B 50ms
50ms Image
image/gif 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://zklp.denfiles.ru/cdn-cgi/images/trace/managed/js/transparent.gif?ray=7c0fba6dbf8a7443

Requested by

Host: zklp.denfiles.ru
URL: https://zklp.denfiles.ru/Msimon.jones@thebunker.net?__cf_chl_rt_tk=HtJtH5D2cEVigZGGuNPGo5nbDkzNGg7Kgb4D1TTz544-1683024887-0-gaNycGzNC7s

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://zklp.denfiles.ru/Msimon.jones@thebunker.net?__cf_chl_rt_tk=HtJtH5D2cEVigZGGuNPGo5nbDkzNGg7Kgb4D1TTz544-1683024887-0-gaNycGzNC7s
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Tue, 02 May 2023 10:54:48 GMT
x-content-type-options: nosniff
last-modified: Tue, 25 Apr 2023 11:28:50 GMT
server: cloudflare
etag: "6447b972-2a"
x-frame-options: DENY
vary: Accept-Encoding
content-type: image/gif
cache-control: max-age=7200, public
accept-ranges: bytes
cf-ray: 7c0fba6e88887443-LHR
content-length: 42
expires: Tue, 02 May 2023 12:54:48 GMT

GET
H2 200 api.js Show response
challenges.cloudflare.com/turnstile/v0/g/b5e45436/ 15 KB
5 KB 164ms
73ms Script
application/javascript 2606:4700::6812:7b9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://challenges.cloudflare.com/turnstile/v0/g/b5e45436/api.js?onload=_cf_chl_turnstile_l&render=explicit
Requested by: Host: zklp.denfiles.ru
URL: https://zklp.denfiles.ru/cdn-cgi/challenge-platform/h/g/orchestrate/managed/v1?ray=7c0fba6dbf8a7443
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:7b9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5205e201bbd649a3a4af0ecb9b1e8a80f73aa8ea4aee1740302b1b8f7435b27f

Request headers

Referer
Origin: https://zklp.denfiles.ru
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Tue, 02 May 2023 10:54:48 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=31536000
cf-ray: 7c0fba6fdfa27525-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

POST
H3 200 1394e2e5a5e507e Show response
zklp.denfiles.ru/cdn-cgi/challenge-platform/h/g/flow/ov1/1869090841:1683022907:8_L92zH1y8mrOOmnaoka1SJ0m3Yo6n-04ZAZ0_EUXkE/7c0fba6dbf8a7443/ 205 KB
151 KB 156ms
156ms XHR
text/plain 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://zklp.denfiles.ru/cdn-cgi/challenge-platform/h/g/flow/ov1/1869090841:1683022907:8_L92zH1y8mrOOmnaoka1SJ0m3Yo6n-04ZAZ0_EUXkE/7c0fba6dbf8a7443/1394e2e5a5e507e
Requested by: Host: zklp.denfiles.ru
URL: https://zklp.denfiles.ru/cdn-cgi/challenge-platform/h/g/orchestrate/managed/v1?ray=7c0fba6dbf8a7443
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 45d68987c5ee236a608c055a1e8a3dc63edc0de2350ce69cb04b34b8fc53fecd

Request headers

Referer: https://zklp.denfiles.ru/Msimon.jones@thebunker.net
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
CF-Challenge: 1394e2e5a5e507e
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 02 May 2023 10:54:48 GMT
content-encoding: br
cf_chl_gen: /nNH/QeTCDWLBUR+UR3Z99oZTL+pqeiadp4N5wJkFsuvaBqpLYnGkxu9R2T2VTMVrSXRwOO9P6r5C9D0fpTJEmvql98lA8woHSOzhxvsJ6zn5saPk3ys8n5DFcsRjlEI8zjMtWWH1LGiBLTeX2tA29Py34ud6AJpbM0QHzIcIMraUikBxTVsOrFO+f+UcyWiiTnzJDPYTJIkiIbipBZUSPJYd2N3x73wDo687QuFSgaGj193kjon6UR/E226v5tOO1nNuosTJMsiZ1g3IsUvExMkigTTbeQj7foaymJk+6vLf3fY6YbPLxnjGEuGWJwqicgGUdJK4MA7lk+soLVCh5801cUra+NhFLaliiOHCxLslhpvKb8SpuCgVUIs8Bg+gUfAtRdhr79YtCOjz9fF5hsIqurY/KvNxSoZcjpl7uCoJEheqh/nSTgA1X6r99W69pjaT20r+lLho7BMblvogtWZ7mQ9GXcqIOaZkk7b56kXeRVG9rXpSa+0LBrBszyuYx13kF5/7Y2wDb6i17PiThBGwBvSu7ZRIRBL9w99QlU=$Vc8WqzPyJrqZ1b2aOxOEGA==
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jxs9ltkIvMmm2c9IGOSGgN0jhKyyeaKx4v8IEJ5mj%2F4q7Jh9XlxRV29JmSzxbn7Gto7LrPnUH2xNuKiM4A5DR%2BnmK6skYqFRHHUFqCwBm%2BUFLUeqynTsOrt3UET79fqgpzmXdYIQxwDkgT0rZiI1"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=UTF-8
cf-ray: 7c0fba6ff8f575a9-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
BLOB 200
OK 11f04357-6392-4c2f-82ab-3f15fc705d38
https://zklp.denfiles.ru/ 656 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://zklp.denfiles.ru/11f04357-6392-4c2f-82ab-3f15fc705d38
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e41277bd48cc271455c85a90d1458c60265604cb04fcd58fc06436741d3d8c7c

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://zklp.denfiles.ru/Msimon.jones@thebunker.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Length: 656
Content-Type: text/javascript

GET
H3 401 ZShUvkuOy2cY03N Show response
zklp.denfiles.ru/cdn-cgi/challenge-platform/h/g/pat/7c0fba6dbf8a7443/1683024888322/4bdeb09157c223a1581e9f9d09fd60e446141ae9ebdbb3d4a8a9264e31ff5b30/ 1 B
929 B 52ms
51ms Fetch
text/plain 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://zklp.denfiles.ru/cdn-cgi/challenge-platform/h/g/pat/7c0fba6dbf8a7443/1683024888322/4bdeb09157c223a1581e9f9d09fd60e446141ae9ebdbb3d4a8a9264e31ff5b30/ZShUvkuOy2cY03N
Requested by: Host: zklp.denfiles.ru
URL: https://zklp.denfiles.ru/cdn-cgi/challenge-platform/h/g/orchestrate/managed/v1?ray=7c0fba6dbf8a7443
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6da43b944e494e885e69af021f93c6d9331c78aa228084711429160a5bbd15b5

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://zklp.denfiles.ru/Msimon.jones@thebunker.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Tue, 02 May 2023 10:54:48 GMT
www-authenticate: PrivateToken challenge=AAIAGXBhdC1pc3N1ZXIuY2xvdWRmbGFyZS5jb20gS96wkVfCI6FYHp-dCf1g5EYUGunr27PUqKkmTjH_WzAAEHprbHAuZGVuZmlsZXMucnU=, token-key=MIIBUjA9BgkqhkiG9w0BAQowMKANMAsGCWCGSAFlAwQCAqEaMBgGCSqGSIb3DQEBCDALBglghkgBZQMEAgKiAwIBMAOCAQ8AMIIBCgKCAQEAmSYx82S-vjLRtQnwDoTUWfs-F-Hi-DRaYWzsCX96xyDJBsiM44vH3e84_i0ylmG4wHPdbDqOs-9hxtq2yC-5Ays-nZPHMmj-BATD7eCP8tff3gbELIvHB6suJ0Ov8j598aYWGzlna7KdXhdjuo7vVMUK7_2hoSO327Ph7hwZYODpPq8hQD9-EsghYZ5k13WxlZzx2DyqqVWBfUoJukkmuZwGW_nA2_uYwUwmOBoFmNSQh1FJD0MRRTrQrjvopK7mhVZL6y8Lt2cNdLdqEe4hxb_DiKlAzIpZIFpcG-VTmlREKGxQJEde4bCwTo6imlDb72prF9QxT6-cyS3FKFhdLwIDAQAB, max-age=20
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rZNmw0YA12P%2FQ6HbyTqzC8gBpVNjRmck3cVA%2BRo1A7ziJvWEd8go7ZvbfyC20y%2FDGbkOTIfy5K9H5m8XWFqCCXQ9OkG%2F2QOXcwB1sfqZ2wUXLsyyuye4UcVPw1%2F15IESP%2F8KbwwV%2Bo7D4HeQ4Mu6"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=UTF-8
cf-ray: 7c0fba724c0775a9-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 TqMhrP_0tjVFekA
zklp.denfiles.ru/cdn-cgi/challenge-platform/h/g/img/7c0fba6dbf8a7443/1683024888328/ 61 B
457 B 52ms
52ms Image
image/png 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://zklp.denfiles.ru/cdn-cgi/challenge-platform/h/g/img/7c0fba6dbf8a7443/1683024888328/TqMhrP_0tjVFekA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 011c8cf8008f1e5a32ce4e6046561b1b0999a164cd382a929849162e6d1bd751

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://zklp.denfiles.ru/Msimon.jones@thebunker.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Tue, 02 May 2023 10:54:50 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7c0fba7d4bfb75a9-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4iRnI%2FH4Pk%2FYPJ9zMDfqI3KJFxcmxAKEdjeqeWtCRNjHswP92Cyal01pFJQl8j%2BY8qMIEQ3rf9r2os98sFpq8HzF%2B3vK37O9w44G8d%2FxsCw5qIzT%2Fx4pUGg%2Be9G49KGgjraYZ8HnVbSuW2U8%2Bm4R"}],"group":"cf-nel","max_age":604800}
content-type: image/png

GET
BLOB 200
OK 90d88729-7057-40b0-a256-98e883bc5056
https://zklp.denfiles.ru/ 539 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://zklp.denfiles.ru/90d88729-7057-40b0-a256-98e883bc5056
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 08c91791d18c8b35509f8951ba53b3868ebc91a142f78fb1294aadad03f537c8

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://zklp.denfiles.ru/Msimon.jones@thebunker.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Length: 539
Content-Type: text/javascript

POST
H3 200 1394e2e5a5e507e Show response
zklp.denfiles.ru/cdn-cgi/challenge-platform/h/g/flow/ov1/1869090841:1683022907:8_L92zH1y8mrOOmnaoka1SJ0m3Yo6n-04ZAZ0_EUXkE/7c0fba6dbf8a7443/ 7 KB
6 KB 118ms
113ms XHR
text/plain 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://zklp.denfiles.ru/cdn-cgi/challenge-platform/h/g/flow/ov1/1869090841:1683022907:8_L92zH1y8mrOOmnaoka1SJ0m3Yo6n-04ZAZ0_EUXkE/7c0fba6dbf8a7443/1394e2e5a5e507e
Requested by: Host: zklp.denfiles.ru
URL: https://zklp.denfiles.ru/cdn-cgi/challenge-platform/h/g/orchestrate/managed/v1?ray=7c0fba6dbf8a7443
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e11bd8f57a3278c5f5dafed75a57e7113f7037bb7b1a0a66e6e568f26aa5f38a

Request headers

Referer: https://zklp.denfiles.ru/Msimon.jones@thebunker.net
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
CF-Challenge: 1394e2e5a5e507e
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 02 May 2023 10:54:50 GMT
content-encoding: br
cf_chl_gen: AhsmPu4E2QYYdFhmWa/JE/WvPUBHCN0r1l8fQTEpQMSlS2kC7aNgsnCFi9q1oVi+$mX16KaxtFqYcm18i9mIutg==
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e%2BXf7ZKAktHDf58i6rqXOkTd8xunZ54H0l%2FoKCjCuF87anEY1nAQNSmMSygEPcZx%2FBPafEKIRZKe%2Bos%2F4Y7d64a3b0stYGT9y42m%2Bj6yob66KdxI0b703KWW6slrqkVV38RD3LKawaGEaeT%2B%2Bdps"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=UTF-8
cf-ray: 7c0fba7e0d2275a9-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H3 200 normal Show response
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/041e4/0x4AAAAAAAAjq6WYeRDKmebM/light/ Frame CB23 22 KB
7 KB 105ms
57ms Document
text/html 2606:4700::6812:7b9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/041e4/0x4AAAAAAAAjq6WYeRDKmebM/light/normal
Requested by: Host: challenges.cloudflare.com
URL: https://challenges.cloudflare.com/turnstile/v0/g/b5e45436/api.js?onload=_cf_chl_turnstile_l&render=explicit
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:7b9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9be989dc35e0665b0d49440c9d7950b1c545d201bb6c4d5be52b9ab51afab74d

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=0, must-revalidate
cf-ray: 7c0fba7f18ee48bc-LHR
content-encoding: br
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
date: Tue, 02 May 2023 10:54:50 GMT
document-policy: js-profiling
permissions-policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
server: cloudflare

GET
H3 200 v1 Show response
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/ Frame CB23 155 KB
56 KB 56ms
56ms Script
application/javascript 2606:4700::6812:7b9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=7c0fba7f18ee48bc
Requested by: Host: challenges.cloudflare.com
URL: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/041e4/0x4AAAAAAAAjq6WYeRDKmebM/light/normal
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:7b9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c4509f697d23d628f84371874ba38c256c6c959631c6fa1cd190a1fad0e488fe

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/041e4/0x4AAAAAAAAjq6WYeRDKmebM/light/normal
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date: Tue, 02 May 2023 10:54:50 GMT
cache-control: max-age=0, must-revalidate
content-encoding: br
server: cloudflare
cf-ray: 7c0fba7fc9db48bc-LHR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-type: application/javascript; charset=UTF-8

POST cfc974aa90bf15c
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1534080576:1683022895:dgcZXB7UMQj1p_5XAGaV2T4B6W6alv8-pfh9FNpbYaA/7c0fba7f18ee48bc/ Frame CB23 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: challenges.cloudflare.com
URL: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1534080576:1683022895:dgcZXB7UMQj1p_5XAGaV2T4B6W6alv8-pfh9FNpbYaA/7c0fba7f18ee48bc/cfc974aa90bf15c

Verdicts & Comments Add Verdict or Comment

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	Message: Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.
network	error	URL: https://zklp.denfiles.ru/Msimon.jones@thebunker.net Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://zklp.denfiles.ru/cdn-cgi/challenge-platform/h/g/pat/7c0fba6dbf8a7443/1683024888322/4bdeb09157c223a1581e9f9d09fd60e446141ae9ebdbb3d4a8a9264e31ff5b30/ZShUvkuOy2cY03N Message: Failed to load resource: the server responded with a status of 401 ()
security	warning	Message: Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

challenges.cloudflare.com
plagueremedies.com
www.zigo.com
zklp.denfiles.ru
challenges.cloudflare.com
2606:4700::6812:7b9
2a06:98c1:3121::3
50.28.79.140
83.150.216.10
011c8cf8008f1e5a32ce4e6046561b1b0999a164cd382a929849162e6d1bd751
08c91791d18c8b35509f8951ba53b3868ebc91a142f78fb1294aadad03f537c8
45d68987c5ee236a608c055a1e8a3dc63edc0de2350ce69cb04b34b8fc53fecd
5205e201bbd649a3a4af0ecb9b1e8a80f73aa8ea4aee1740302b1b8f7435b27f
6da43b944e494e885e69af021f93c6d9331c78aa228084711429160a5bbd15b5
872ae626da96184205bd895d97c10b14d93f237165a2d8bbb5639494d3026114
8e5583d0e15efc625e4ca8420c5063dcabee2eaf49b345ec7a291f95dcaf0265
9be989dc35e0665b0d49440c9d7950b1c545d201bb6c4d5be52b9ab51afab74d
c4509f697d23d628f84371874ba38c256c6c959631c6fa1cd190a1fad0e488fe
cbad462ffb720ce9741deda312d60a3fb0634db325207027b3826ce149cc2a0c
e11bd8f57a3278c5f5dafed75a57e7113f7037bb7b1a0a66e6e568f26aa5f38a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e41277bd48cc271455c85a90d1458c60265604cb04fcd58fc06436741d3d8c7c
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

zklp.denfiles.ru Open in urlscan Pro 2a06:98c1:3121::3 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

15 Requests

80 %HTTPS

50 %IPv6

4 Domains

4 Subdomains

5 IPs

1 Countries

287 kBTransfer

563 kBSize

0 Cookies

0 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

14 JavaScript Global Variables

0 Cookies

4 Console Messages

Indicators

zklp.denfiles.ru Open in urlscan Pro
2a06:98c1:3121::3 Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

80 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

5
IPs

1
Countries

287 kB
Transfer

563 kB
Size

0
Cookies

15 HTTP transactions
0 data transactions