URL: https://inchword.com/
Submission: On May 28 via api from US — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 4 HTTP transactions. The main IP is 8.9.8.112, located in Piscataway, United States and belongs to AS-CHOOPA, US. The main domain is inchword.com.
TLS certificate: Issued by R3 on April 10th 2024. Valid for: 3 months.
This is the only time inchword.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
4 8.9.8.112 20473 (AS-CHOOPA)
4 1
Apex Domain
Subdomains
Transfer
4 inchword.com
inchword.com
12 KB
4 1
Domain Requested by
4 inchword.com inchword.com
4 1

This site contains links to these domains. Also see Links.

Domain
q9z9.com
Subject Issuer Validity Valid
inchword.com
R3
2024-04-10 -
2024-07-09
3 months crt.sh

This page contains 1 frames:

Primary Page: https://inchword.com/
Frame ID: 7381CC121F8BFB8F2A8E456D306B5C11
Requests: 4 HTTP requests in this frame

Screenshot

Page Title

inchword : translation tools to help people translate books

Page Statistics

4
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

12 kB
Transfer

11 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
inchword.com/
2 KB
1 KB
Document
General
Full URL
https://inchword.com/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305
Server
8.9.8.112 Piscataway, United States, ASN20473 (AS-CHOOPA, US),
Reverse DNS
sive.rs
Software
nginx/1.24.0 /
Resource Hash
d749bd22a7e64dfb5fe4a11773b53609637c917c8ed767ece043fb40fd68fdd1
Security Headers
Name Value
Content-Security-Policy script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' https://js.stripe.com https://cdn.jsdelivr.net; img-src 'self' data: https://www.gravatar.com https://secure.gravatar.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; connect-src 'self'; frame-src https://www.youtube-nocookie.com https://js.stripe.com; object-src 'none'
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

content-encoding
gzip
content-security-policy
script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' https://js.stripe.com https://cdn.jsdelivr.net; img-src 'self' data: https://www.gravatar.com https://secure.gravatar.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; connect-src 'self'; frame-src https://www.youtube-nocookie.com https://js.stripe.com; object-src 'none'
content-type
text/html; charset=utf-8
date
Tue, 28 May 2024 21:11:44 GMT
etag
W/"658b5436-65f"
feature-policy
geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;camera none;magnetometer none;gyroscope none;speaker self;vibrate none;fullscreen self;payment none;
last-modified
Tue, 26 Dec 2023 22:31:18 GMT
referrer-policy
strict-origin
server
nginx/1.24.0
strict-transport-security
max-age=31536000
vary
Accept-Encoding
x-content-type-options
nosniff
x-frame-options
DENY
x-permitted-cross-domain-policies
master-only
x-xss-protection
1; mode=block
style.css
inchword.com/
2 KB
1 KB
Stylesheet
General
Full URL
https://inchword.com/style.css
Requested by
Host: inchword.com
URL: https://inchword.com/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305
Server
8.9.8.112 Piscataway, United States, ASN20473 (AS-CHOOPA, US),
Reverse DNS
sive.rs
Software
nginx/1.24.0 /
Resource Hash
e35c67f505c1397cd9dec958787fc9154fd7e49d075f350dc44e63d93edf7081
Security Headers
Name Value
Content-Security-Policy script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' https://js.stripe.com https://cdn.jsdelivr.net; img-src 'self' data: https://www.gravatar.com https://secure.gravatar.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; connect-src 'self'; frame-src https://www.youtube-nocookie.com https://js.stripe.com; object-src 'none'
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://inchword.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 28 May 2024 21:11:44 GMT
strict-transport-security
max-age=31536000
referrer-policy
strict-origin
x-content-type-options
nosniff
last-modified
Tue, 26 Dec 2023 22:31:18 GMT
server
nginx/1.24.0
x-permitted-cross-domain-policies
master-only
content-encoding
gzip
etag
W/"658b5436-6e9"
content-security-policy
script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' https://js.stripe.com https://cdn.jsdelivr.net; img-src 'self' data: https://www.gravatar.com https://secure.gravatar.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; connect-src 'self'; frame-src https://www.youtube-nocookie.com https://js.stripe.com; object-src 'none'
vary
Accept-Encoding
x-frame-options
DENY
content-type
text/css
feature-policy
geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;camera none;magnetometer none;gyroscope none;speaker self;vibrate none;fullscreen self;payment none;
x-xss-protection
1; mode=block
inchword-350.png
inchword.com/
5 KB
5 KB
Image
General
Full URL
https://inchword.com/inchword-350.png
Requested by
Host: inchword.com
URL: https://inchword.com/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305
Server
8.9.8.112 Piscataway, United States, ASN20473 (AS-CHOOPA, US),
Reverse DNS
sive.rs
Software
nginx/1.24.0 /
Resource Hash
993750a9b28cbd7ae9525b86b106dd4148ce17e6315e1790c94a9eb502eeb20d
Security Headers
Name Value
Content-Security-Policy script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' https://js.stripe.com https://cdn.jsdelivr.net; img-src 'self' data: https://www.gravatar.com https://secure.gravatar.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; connect-src 'self'; frame-src https://www.youtube-nocookie.com https://js.stripe.com; object-src 'none'
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://inchword.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 28 May 2024 21:11:44 GMT
strict-transport-security
max-age=31536000
referrer-policy
strict-origin
x-content-type-options
nosniff
last-modified
Tue, 26 Dec 2023 22:31:18 GMT
server
nginx/1.24.0
x-permitted-cross-domain-policies
master-only
etag
"658b5436-12cd"
content-security-policy
script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' https://js.stripe.com https://cdn.jsdelivr.net; img-src 'self' data: https://www.gravatar.com https://secure.gravatar.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; connect-src 'self'; frame-src https://www.youtube-nocookie.com https://js.stripe.com; object-src 'none'
x-frame-options
DENY
content-type
image/png
feature-policy
geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;camera none;magnetometer none;gyroscope none;speaker self;vibrate none;fullscreen self;payment none;
accept-ranges
bytes
content-length
4813
x-xss-protection
1; mode=block
favicon.svg
inchword.com/
3 KB
4 KB
Other
General
Full URL
https://inchword.com/favicon.svg
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, CHACHA20_POLY1305
Server
8.9.8.112 Piscataway, United States, ASN20473 (AS-CHOOPA, US),
Reverse DNS
sive.rs
Software
nginx/1.24.0 /
Resource Hash
333c1421db4f06752f0f2cb8378f8531a7e4876dfed99846f262209bd5b967bf
Security Headers
Name Value
Content-Security-Policy script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' https://js.stripe.com https://cdn.jsdelivr.net; img-src 'self' data: https://www.gravatar.com https://secure.gravatar.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; connect-src 'self'; frame-src https://www.youtube-nocookie.com https://js.stripe.com; object-src 'none'
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://inchword.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 28 May 2024 21:11:44 GMT
strict-transport-security
max-age=31536000
referrer-policy
strict-origin
x-content-type-options
nosniff
last-modified
Tue, 26 Dec 2023 22:31:18 GMT
server
nginx/1.24.0
x-permitted-cross-domain-policies
master-only
etag
"658b5436-db0"
content-security-policy
script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' https://js.stripe.com https://cdn.jsdelivr.net; img-src 'self' data: https://www.gravatar.com https://secure.gravatar.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; connect-src 'self'; frame-src https://www.youtube-nocookie.com https://js.stripe.com; object-src 'none'
x-frame-options
DENY
content-type
image/svg+xml
feature-policy
geolocation none;midi none;notifications none;push none;sync-xhr none;microphone none;camera none;magnetometer none;gyroscope none;speaker self;vibrate none;fullscreen self;payment none;
accept-ranges
bytes
content-length
3504
x-xss-protection
1; mode=block

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

13 Console Messages

Source Level URL
Text
security warning
Message:
Error with Feature-Policy header: Unrecognized origin: 'none'.
security warning
Message:
Error with Feature-Policy header: Unrecognized origin: 'none'.
security warning
Message:
Error with Feature-Policy header: Unrecognized feature: 'notifications'.
security warning
Message:
Error with Feature-Policy header: Unrecognized feature: 'push'.
security warning
Message:
Error with Feature-Policy header: Unrecognized origin: 'none'.
security warning
Message:
Error with Feature-Policy header: Unrecognized origin: 'none'.
security warning
Message:
Error with Feature-Policy header: Unrecognized origin: 'none'.
security warning
Message:
Error with Feature-Policy header: Unrecognized origin: 'none'.
security warning
Message:
Error with Feature-Policy header: Unrecognized origin: 'none'.
security warning
Message:
Error with Feature-Policy header: Unrecognized feature: 'speaker'.
security warning
Message:
Error with Feature-Policy header: Unrecognized feature: 'vibrate'.
security warning
Message:
Error with Feature-Policy header: Unrecognized origin: 'self'.
security warning
Message:
Error with Feature-Policy header: Unrecognized origin: 'none'.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' https://js.stripe.com https://cdn.jsdelivr.net; img-src 'self' data: https://www.gravatar.com https://secure.gravatar.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; connect-src 'self'; frame-src https://www.youtube-nocookie.com https://js.stripe.com; object-src 'none'
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block