urlscan.io logo urlscan.io
SecurityTrails logo

ireq.mbciftyodv.ru Open in urlscan Pro
188.114.97.3  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://link.mail.beehiiv.com/ls/click?upn=u001.viQ-2Bp-2FGxbxSTmtc3W9Pv4ueU7OaK2YsZ4eGJv0F4ZCoRafai3HhJP35HVkcDcj6mqqRHEvUaoc...
Effective URL: https://ireq.mbciftyodv.ru/KmKUIGaB/
Submission: On December 11 via manual from IL — Scanned from IL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 6 IPs in 5 countries across 8 domains to perform 7 HTTP transactions. The main IP is 188.114.97.3, located in Amsterdam, Netherlands and belongs to CLOUDFLARENET, US. The main domain is ireq.mbciftyodv.ru.
TLS certificate: Issued by WE1 on November 21st 2024. Valid for: 3 months.
This is the only time ireq.mbciftyodv.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 104.18.69.40 13335 (CLOUDFLAR...)
1 1 159.65.213.219 14061 (DIGITALOC...)
4 4 54.155.27.215 16509 (AMAZON-02)
1 1 18.244.18.123 16509 (AMAZON-02)
1 104.21.93.211 13335 (CLOUDFLAR...)
2 188.114.97.3 13335 (CLOUDFLAR...)
1 151.101.194.137 54113 (FASTLY)
1 2 104.18.94.41 13335 (CLOUDFLAR...)
1 104.17.24.14 13335 (CLOUDFLAR...)
1 104.18.95.41 13335 (CLOUDFLAR...)
7 6
1    104.18.69.40 (None, )

ASN13335 (CLOUDFLARENET, US)
link.mail.beehiiv.com
1    159.65.213.219 (Slough, United Kingdom)

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: api.transpond.io
api.mailsenderam1.com
4    54.155.27.215 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-155-27-215.eu-west-1.compute.amazonaws.com
click.pstmrk.it
1    18.244.18.123 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-244-18-123.fra56.r.cloudfront.net
o7mewk.fk07.fdske.com
1    104.21.93.211 (None, )

ASN13335 (CLOUDFLARENET, US)
vankeppels.com
2    188.114.97.3 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)
ireq.mbciftyodv.ru
1    151.101.194.137 (San Francisco, United States)

ASN54113 (FASTLY, US)
code.jquery.com
2    104.18.94.41 (None, )

ASN13335 (CLOUDFLARENET, US)
challenges.cloudflare.com
1    104.17.24.14 (None, )

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
1    104.18.95.41 (None, )

ASN13335 (CLOUDFLARENET, US)
challenges.cloudflare.com
Apex Domain
Subdomains		 Transfer
4 cloudflare.com
challenges.cloudflare.com — Cisco Umbrella Rank: 3147
cdnjs.cloudflare.com — Cisco Umbrella Rank: 225
30 KB
4 pstmrk.it
click.pstmrk.it — Cisco Umbrella Rank: 55561
995 B
2 mbciftyodv.ru
ireq.mbciftyodv.ru
8 KB
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 847
31 KB
1 vankeppels.com
vankeppels.com
1 KB
1 fdske.com
o7mewk.fk07.fdske.com
356 B
1 mailsenderam1.com
api.mailsenderam1.com
1 KB
1 beehiiv.com
link.mail.beehiiv.com — Cisco Umbrella Rank: 50513
866 B
7 8
Domain Requested by
4 click.pstmrk.it 4 redirects
3 challenges.cloudflare.com 1 redirects ireq.mbciftyodv.ru
challenges.cloudflare.com
2 ireq.mbciftyodv.ru vankeppels.com
1 cdnjs.cloudflare.com ireq.mbciftyodv.ru
1 code.jquery.com ireq.mbciftyodv.ru
1 vankeppels.com
1 o7mewk.fk07.fdske.com 1 redirects
1 api.mailsenderam1.com 1 redirects
1 link.mail.beehiiv.com 1 redirects
7 9

This site contains no links.

Subject Issuer Validity Valid
vankeppels.com
WE1		 2024-12-05 -
2025-03-05		 3 months crt.sh
mbciftyodv.ru
WE1		 2024-11-21 -
2025-02-19		 3 months crt.sh
*.jquery.com
Sectigo ECC Domain Validation Secure Server CA		 2024-06-25 -
2025-06-25		 a year crt.sh
cdnjs.cloudflare.com
WE1		 2024-11-26 -
2025-02-24		 3 months crt.sh
challenges.cloudflare.com
WE1		 2024-11-03 -
2025-02-01		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://ireq.mbciftyodv.ru/KmKUIGaB/
Frame ID: 1AF1E9023937781D172A9AAF62E991D4
Requests: 6 HTTP requests in this frame

Frame: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/rflr2/0x4AAAAAAA0rJP79Qu28KGYp/auto/fbE/normal/auto/
Frame ID: BE6E93609BF2B1F1136CF635BFF74FAC
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

​

Page URL History Show full URLs

  1. https://link.mail.beehiiv.com/ls/click?upn=u001.viQ-2Bp-2FGxbxSTmtc3W9Pv4ueU7OaK2YsZ4eGJv0F4ZCoRafai3HhJP3... HTTP 302
    https://api.mailsenderam1.com/c/cc6a53b5355861d65e3fea9238ee4fbe_d194bbe67b951324b2e70e01c99bf369?sid=965c... HTTP 302
    https://click.pstmrk.it/3s/click.pstmrk.it%2F3s%2Fclick.pstmrk.it%252F3s%252Fclick.pstmrk.it%25252F3... HTTP 302
    https://click.pstmrk.it/3s/click.pstmrk.it%2F3s%2Fclick.pstmrk.it%252F3s%252Fo7mewk.fk07.fdske.com%2... HTTP 302
    https://click.pstmrk.it/3s/click.pstmrk.it%2F3s%2Fo7mewk.fk07.fdske.com%252Fe%252Fc%252F01jeb82zm1v0... HTTP 302
    https://click.pstmrk.it/3s/o7mewk.fk07.fdske.com%2Fe%2Fc%2F01jeb82zm1v0rcdx630y2xjvcz%2F01jeb82zm1v0... HTTP 302
    https://o7mewk.fk07.fdske.com/e/c/01jeb82zm1v0rcdx630y2xjvcz/01jeb82zm1v0rcdx6310r83yhc HTTP 302
    https://vankeppels.com/gjfsfsfsfghshfs/xyz.html Page URL
  2. https://ireq.mbciftyodv.ru/KmKUIGaB/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

7
Requests

86 %
HTTPS

0 %
IPv6

8
Domains

9
Subdomains

6
IPs

5
Countries

69 kB
Transfer

202 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://link.mail.beehiiv.com/ls/click?upn=u001.viQ-2Bp-2FGxbxSTmtc3W9Pv4ueU7OaK2YsZ4eGJv0F4ZCoRafai3HhJP35HVkcDcj6mqqRHEvUaocpADVWMH2mgeyHExS5WyufaY-2F8HhCK3mRvWP5gfxggutHwYWIvYCZvZodFQa2LPldQKS0JTKCmCGWKsT-2FRtgSmmJIrtynE42u083Sjy3xKWT6IobU6vIXb0byifY1q3s6DiHEVqBaj7TAc-2BLuZxlFV-2By1AwnxHnO-2FhDwthzVzpgX2aVQL7g7VLzyKyYWO-2BoziHRKLDDrudlaRcV2ZUxVLHc8e5A3f3-2Bm6DFTjMnmZyUzGJ8Evssl3YLzowjhJjz0iqA2FHVP-2FGw9r2z4COAstJcffMXYwNyZq5d4HVgpuv0eQCqsLwZ7K1ThdGC_zbv2vD5DXrAqdowK1HhrRUVQoiiMykGgshFnQ1F-2BibJOi5uUEJybHxzFljTlKTy6yD0KU9nDwp8bV1H56yR9HvnK8-2FyihQLwi8QRJFXE80ZcfgggFsUJY2a2xHTUnYLH724YDvDmquHZ0GB2KD1AR7AYcsnrFIaFeIlNrW7PDoHCSUPrjrDIVtQwFuxZ41xCFGd6af6ARJx5qls0n6orolhyUcgqkMeqexNP6WsdK7oJsYka5jbLWN50SdpKHPC3DxqNEYnJk1weQ-2BwXwtRfmgKgHBYuPYhRa3XwTyauGB5Nrx4yqxh340KSPW4CGRQzDag5xnsijvZgg-2BmCj-2F-2Fx7a0hUdHrDMz7TsuyOMh6NREJLOSxCk2m8vlLTMH0dZaIGY593F2rElM6DTYkqB-2FqgQUh0k6rUCp1MtWNmCVJiHISZYsMlwR-2BgBNAuk8ksHGP HTTP 302
    https://api.mailsenderam1.com/c/cc6a53b5355861d65e3fea9238ee4fbe_d194bbe67b951324b2e70e01c99bf369?sid=965c900099f9ba56195af92f540c29a8_ff241de84aa772af84779774d5143ad2&aid=ZqOV&utm_source=donalds-newsletter-9672d8.beehiiv.com&utm_medium=newsletter&utm_campaign=showing-today HTTP 302
    https://click.pstmrk.it/3s/click.pstmrk.it%2F3s%2Fclick.pstmrk.it%252F3s%252Fclick.pstmrk.it%25252F3s%25252Fo7mewk.fk07.fdske.com%2525252Fe%2525252Fc%2525252F01jeb82zm1v0rcdx630y2xjvcz%2525252F01jeb82zm1v0rcdx6310r83yhc%25252FGxTg%25252FgNC5AQ%25252FAQ%25252Fa8cde84c-e9f4-40ad-973b-d32cde0539c8%25252F1%25252F7VWTgbMksq%252FGxTg%252FgtC5AQ%252FAQ%252F1e4dea63-0a18-4f4d-a713-95f7b20fbbbd%252F1%252FpHOXyDHAXA%2FGxTg%2Fg9C5AQ%2FAQ%2F00d1d2b2-75fb-46b8-a26c-1fdd24bbadae%2F1%2FhiwoXA2f-j/GxTg/hNC5AQ/AQ/e163c7b8-c99e-4c13-92ec-789b61df7a7c/1/MN2Y9RimwB HTTP 302
    https://click.pstmrk.it/3s/click.pstmrk.it%2F3s%2Fclick.pstmrk.it%252F3s%252Fo7mewk.fk07.fdske.com%25252Fe%25252Fc%25252F01jeb82zm1v0rcdx630y2xjvcz%25252F01jeb82zm1v0rcdx6310r83yhc%252FGxTg%252FgNC5AQ%252FAQ%252Fa8cde84c-e9f4-40ad-973b-d32cde0539c8%252F1%252F7VWTgbMksq%2FGxTg%2FgtC5AQ%2FAQ%2F1e4dea63-0a18-4f4d-a713-95f7b20fbbbd%2F1%2FpHOXyDHAXA/GxTg/g9C5AQ/AQ/00d1d2b2-75fb-46b8-a26c-1fdd24bbadae/1/hiwoXA2f-j HTTP 302
    https://click.pstmrk.it/3s/click.pstmrk.it%2F3s%2Fo7mewk.fk07.fdske.com%252Fe%252Fc%252F01jeb82zm1v0rcdx630y2xjvcz%252F01jeb82zm1v0rcdx6310r83yhc%2FGxTg%2FgNC5AQ%2FAQ%2Fa8cde84c-e9f4-40ad-973b-d32cde0539c8%2F1%2F7VWTgbMksq/GxTg/gtC5AQ/AQ/1e4dea63-0a18-4f4d-a713-95f7b20fbbbd/1/pHOXyDHAXA HTTP 302
    https://click.pstmrk.it/3s/o7mewk.fk07.fdske.com%2Fe%2Fc%2F01jeb82zm1v0rcdx630y2xjvcz%2F01jeb82zm1v0rcdx6310r83yhc/GxTg/gNC5AQ/AQ/a8cde84c-e9f4-40ad-973b-d32cde0539c8/1/7VWTgbMksq HTTP 302
    https://o7mewk.fk07.fdske.com/e/c/01jeb82zm1v0rcdx630y2xjvcz/01jeb82zm1v0rcdx6310r83yhc HTTP 302
    https://vankeppels.com/gjfsfsfsfghshfs/xyz.html Page URL
  2. https://ireq.mbciftyodv.ru/KmKUIGaB/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://link.mail.beehiiv.com/ls/click?upn=u001.viQ-2Bp-2FGxbxSTmtc3W9Pv4ueU7OaK2YsZ4eGJv0F4ZCoRafai3HhJP35HVkcDcj6mqqRHEvUaocpADVWMH2mgeyHExS5WyufaY-2F8HhCK3mRvWP5gfxggutHwYWIvYCZvZodFQa2LPldQKS0JTKCmCGWKsT-2FRtgSmmJIrtynE42u083Sjy3xKWT6IobU6vIXb0byifY1q3s6DiHEVqBaj7TAc-2BLuZxlFV-2By1AwnxHnO-2FhDwthzVzpgX2aVQL7g7VLzyKyYWO-2BoziHRKLDDrudlaRcV2ZUxVLHc8e5A3f3-2Bm6DFTjMnmZyUzGJ8Evssl3YLzowjhJjz0iqA2FHVP-2FGw9r2z4COAstJcffMXYwNyZq5d4HVgpuv0eQCqsLwZ7K1ThdGC_zbv2vD5DXrAqdowK1HhrRUVQoiiMykGgshFnQ1F-2BibJOi5uUEJybHxzFljTlKTy6yD0KU9nDwp8bV1H56yR9HvnK8-2FyihQLwi8QRJFXE80ZcfgggFsUJY2a2xHTUnYLH724YDvDmquHZ0GB2KD1AR7AYcsnrFIaFeIlNrW7PDoHCSUPrjrDIVtQwFuxZ41xCFGd6af6ARJx5qls0n6orolhyUcgqkMeqexNP6WsdK7oJsYka5jbLWN50SdpKHPC3DxqNEYnJk1weQ-2BwXwtRfmgKgHBYuPYhRa3XwTyauGB5Nrx4yqxh340KSPW4CGRQzDag5xnsijvZgg-2BmCj-2F-2Fx7a0hUdHrDMz7TsuyOMh6NREJLOSxCk2m8vlLTMH0dZaIGY593F2rElM6DTYkqB-2FqgQUh0k6rUCp1MtWNmCVJiHISZYsMlwR-2BgBNAuk8ksHGP HTTP 302
  • https://api.mailsenderam1.com/c/cc6a53b5355861d65e3fea9238ee4fbe_d194bbe67b951324b2e70e01c99bf369?sid=965c900099f9ba56195af92f540c29a8_ff241de84aa772af84779774d5143ad2&aid=ZqOV&utm_source=donalds-newsletter-9672d8.beehiiv.com&utm_medium=newsletter&utm_campaign=showing-today HTTP 302
  • https://click.pstmrk.it/3s/click.pstmrk.it%2F3s%2Fclick.pstmrk.it%252F3s%252Fclick.pstmrk.it%25252F3s%25252Fo7mewk.fk07.fdske.com%2525252Fe%2525252Fc%2525252F01jeb82zm1v0rcdx630y2xjvcz%2525252F01jeb82zm1v0rcdx6310r83yhc%25252FGxTg%25252FgNC5AQ%25252FAQ%25252Fa8cde84c-e9f4-40ad-973b-d32cde0539c8%25252F1%25252F7VWTgbMksq%252FGxTg%252FgtC5AQ%252FAQ%252F1e4dea63-0a18-4f4d-a713-95f7b20fbbbd%252F1%252FpHOXyDHAXA%2FGxTg%2Fg9C5AQ%2FAQ%2F00d1d2b2-75fb-46b8-a26c-1fdd24bbadae%2F1%2FhiwoXA2f-j/GxTg/hNC5AQ/AQ/e163c7b8-c99e-4c13-92ec-789b61df7a7c/1/MN2Y9RimwB HTTP 302
  • https://click.pstmrk.it/3s/click.pstmrk.it%2F3s%2Fclick.pstmrk.it%252F3s%252Fo7mewk.fk07.fdske.com%25252Fe%25252Fc%25252F01jeb82zm1v0rcdx630y2xjvcz%25252F01jeb82zm1v0rcdx6310r83yhc%252FGxTg%252FgNC5AQ%252FAQ%252Fa8cde84c-e9f4-40ad-973b-d32cde0539c8%252F1%252F7VWTgbMksq%2FGxTg%2FgtC5AQ%2FAQ%2F1e4dea63-0a18-4f4d-a713-95f7b20fbbbd%2F1%2FpHOXyDHAXA/GxTg/g9C5AQ/AQ/00d1d2b2-75fb-46b8-a26c-1fdd24bbadae/1/hiwoXA2f-j HTTP 302
  • https://click.pstmrk.it/3s/click.pstmrk.it%2F3s%2Fo7mewk.fk07.fdske.com%252Fe%252Fc%252F01jeb82zm1v0rcdx630y2xjvcz%252F01jeb82zm1v0rcdx6310r83yhc%2FGxTg%2FgNC5AQ%2FAQ%2Fa8cde84c-e9f4-40ad-973b-d32cde0539c8%2F1%2F7VWTgbMksq/GxTg/gtC5AQ/AQ/1e4dea63-0a18-4f4d-a713-95f7b20fbbbd/1/pHOXyDHAXA HTTP 302
  • https://click.pstmrk.it/3s/o7mewk.fk07.fdske.com%2Fe%2Fc%2F01jeb82zm1v0rcdx630y2xjvcz%2F01jeb82zm1v0rcdx6310r83yhc/GxTg/gNC5AQ/AQ/a8cde84c-e9f4-40ad-973b-d32cde0539c8/1/7VWTgbMksq HTTP 302
  • https://o7mewk.fk07.fdske.com/e/c/01jeb82zm1v0rcdx630y2xjvcz/01jeb82zm1v0rcdx6310r83yhc HTTP 302
  • https://vankeppels.com/gjfsfsfsfghshfs/xyz.html
Request Chain 2
  • https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit HTTP 302
  • https://challenges.cloudflare.com/turnstile/v0/g/f9063374b04d/api.js

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
xyz.html
vankeppels.com/gjfsfsfsfghshfs/
Redirect Chain
  • https://link.mail.beehiiv.com/ls/click?upn=u001.viQ-2Bp-2FGxbxSTmtc3W9Pv4ueU7OaK2YsZ4eGJv0F4ZCoRafai3HhJP35HVkcDcj6mqqRHEvUaocpADVWMH2mgeyHExS5WyufaY-2F8HhCK3mRvWP5gfxggutHwYWIvYCZvZodFQa2LPldQKS0J...
  • https://api.mailsenderam1.com/c/cc6a53b5355861d65e3fea9238ee4fbe_d194bbe67b951324b2e70e01c99bf369?sid=965c900099f9ba56195af92f540c29a8_ff241de84aa772af84779774d5143ad2&aid=ZqOV&utm_source=donalds-n...
  • https://click.pstmrk.it/3s/click.pstmrk.it%2F3s%2Fclick.pstmrk.it%252F3s%252Fclick.pstmrk.it%25252F3s%25252Fo7mewk.fk07.fdske.com%2525252Fe%2525252Fc%2525252F01jeb82zm1v0rcdx630y2xjvcz%2525252F01je...
  • https://click.pstmrk.it/3s/click.pstmrk.it%2F3s%2Fclick.pstmrk.it%252F3s%252Fo7mewk.fk07.fdske.com%25252Fe%25252Fc%25252F01jeb82zm1v0rcdx630y2xjvcz%25252F01jeb82zm1v0rcdx6310r83yhc%252FGxTg%252FgNC...
  • https://click.pstmrk.it/3s/click.pstmrk.it%2F3s%2Fo7mewk.fk07.fdske.com%252Fe%252Fc%252F01jeb82zm1v0rcdx630y2xjvcz%252F01jeb82zm1v0rcdx6310r83yhc%2FGxTg%2FgNC5AQ%2FAQ%2Fa8cde84c-e9f4-40ad-973b-d32c...
  • https://click.pstmrk.it/3s/o7mewk.fk07.fdske.com%2Fe%2Fc%2F01jeb82zm1v0rcdx630y2xjvcz%2F01jeb82zm1v0rcdx6310r83yhc/GxTg/gNC5AQ/AQ/a8cde84c-e9f4-40ad-973b-d32cde0539c8/1/7VWTgbMksq
  • https://o7mewk.fk07.fdske.com/e/c/01jeb82zm1v0rcdx630y2xjvcz/01jeb82zm1v0rcdx6310r83yhc
  • https://vankeppels.com/gjfsfsfsfghshfs/xyz.html
915 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://vankeppels.com/gjfsfsfsfghshfs/xyz.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.21.93.211 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8f0427f8d817e18d-MRS
content-encoding
zstd
content-type
text/html; charset=utf-8
date
Wed, 11 Dec 2024 08:38:02 GMT
last-modified
Tue, 10 Dec 2024 13:21:21 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority
u=0,i
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rZo6iGneO6cII8h5NSJ%2FyseZOsFK1xIv43OHo071KR6dRxhrPnXdaQD6Fm2fDPfSuHTyo%2Bh89Vra4e0wJGprWvGTkz8zL0nL9TEhahGiqoJAhyEouhHkIKMgQr8VplR%2B8A%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=QUIC&rtt=101603&min_rtt=100387&rtt_var=17949&sent=13&recv=10&lost=0&retrans=0&sent_bytes=4187&recv_bytes=4506&delivery_rate=211&cwnd=12000&unsent_bytes=0&cid=c29731ec316e38b9&ts=406&x=1" cfExtPri cfHdrFlush;dur=0

Redirect headers

content-length
70
content-type
text/html; charset=utf-8
date
Wed, 11 Dec 2024 08:38:01 GMT
location
https://vankeppels.com/gjfsfsfsfghshfs/xyz.html
vary
Origin
via
1.1 9a614f9e49eb2bcefba1d54afaaf7f80.cloudfront.net (CloudFront)
x-amz-cf-id
IRonJITbssv3vrtUSV3wVqh9SV2HxWtUoGqDqsZF5Xgr1K2_IxT3CA==
x-amz-cf-pop
FRA56-P11
x-cache
Miss from cloudfront
Primary Request /
ireq.mbciftyodv.ru/KmKUIGaB/ 		20 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://ireq.mbciftyodv.ru/KmKUIGaB/
Requested by
Host: vankeppels.com
URL: https://vankeppels.com/gjfsfsfsfghshfs/xyz.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c7dbd5b06e59bee19e4af825f053681c02adfa2405c9e3a9c0873fc40e3b100d

Request headers

Referer
https://vankeppels.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-cache, private
cf-cache-status
DYNAMIC
cf-ray
8f0427fd4a9ce183-MRS
content-encoding
zstd
content-type
text/html; charset=UTF-8
date
Wed, 11 Dec 2024 08:38:03 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority
u=0,i
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qfOrYHgp6S%2FKkwCA8PFBDS%2Bsc7hNi7gaxPaq%2F8aTPp9cP%2FBnUZ1YVTCvvuJeYXW%2B4l8mPl57F4%2FjPgZdCPxBzvtGolSe3iYsZ6xekdxkHUBfuyyY5pPKAr%2Ftm80NTw%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=TCP&rtt=4978&min_rtt=4950&rtt_var=1411&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2824&recv_bytes=1472&delivery_rate=570056&cwnd=239&unsent_bytes=0&cid=dcbcea2be857d8f5&ts=198&x=0" cfL4;desc="?proto=QUIC&rtt=101870&min_rtt=100428&rtt_var=18414&sent=13&recv=10&lost=0&retrans=0&sent_bytes=4179&recv_bytes=4505&delivery_rate=214&cwnd=12000&unsent_bytes=0&cid=789cd5aa7754554b&ts=416&x=1" cfExtPri cfHdrFlush;dur=0
jquery-3.6.0.min.js
code.jquery.com/ 		87 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.6.0.min.js
Requested by
Host: ireq.mbciftyodv.ru
URL: https://ireq.mbciftyodv.ru/KmKUIGaB/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer
https://ireq.mbciftyodv.ru/

Response headers

content-encoding
gzip
etag
W/"28feccc0-15d9d"
age
2429574
x-cache
HIT, HIT
date
Wed, 11 Dec 2024 08:38:04 GMT
content-type
application/javascript; charset=utf-8
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
x-cache-hits
8, 314954
x-served-by
cache-lga21931-LGA, cache-fra-eddf8230090-FRA
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=604800
x-timer
S1733906284.163797,VS0,VE0
cross-origin-resource-policy
cross-origin
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
30875
server
nginx
api.js
challenges.cloudflare.com/turnstile/v0/g/f9063374b04d/
Redirect Chain
  • https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit
  • https://challenges.cloudflare.com/turnstile/v0/g/f9063374b04d/api.js
47 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://challenges.cloudflare.com/turnstile/v0/g/f9063374b04d/api.js
Requested by
Host: ireq.mbciftyodv.ru
URL: https://ireq.mbciftyodv.ru/KmKUIGaB/
Protocol
H3
Server
104.18.94.41 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a9f0787e39291d7bcb873d0d514f1d2c8db0256fd741c2abc4d46a809254e141

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://ireq.mbciftyodv.ru/

Response headers

server
cloudflare
cache-control
max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public
content-encoding
br
cross-origin-resource-policy
cross-origin
cf-ray
8f0428030850c227-TLV
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 11 Dec 2024 08:38:04 GMT
content-type
application/javascript; charset=UTF-8
last-modified
Tue, 03 Dec 2024 18:31:41 GMT
vary
Accept-Encoding
priority
u=1,i=?0

Redirect headers

cache-control
max-age=300, stale-if-error=10800, stale-while-revalidate=300, public
location
/turnstile/v0/g/f9063374b04d/api.js
cross-origin-resource-policy
cross-origin
cf-ray
8f0428027fbec227-TLV
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
0
server-timing
cfExtPri
date
Wed, 11 Dec 2024 08:38:03 GMT
vary
Accept-Encoding
server
cloudflare
priority
u=1,i=?0
crypto-js.min.js
cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/ 		47 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js
Requested by
Host: ireq.mbciftyodv.ru
URL: https://ireq.mbciftyodv.ru/KmKUIGaB/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8e3b0117f4df4be452c0b6af5b8f0a0acf9d4ade23d08d55d7e312af22077762
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer
https://ireq.mbciftyodv.ru/

Response headers

cf-cdnjs-via
cfworker/kv
content-encoding
br
cf-cache-status
HIT
etag
"61182885-3694"
age
405880
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ngbes09sCk6grL%2F1ir%2Fuacu6%2BZ96QPTOrqcufX7g31CDN1OwbudAkns46FYcE6yYUJ4TYhGizckkMG8EDriT8VZuL8xSM9t9Z6R9tvh%2BbWFWL%2B0lydGrWWQvATwEL8jhF5a0GU%2Fv"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
expires
Mon, 01 Dec 2025 08:38:03 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 11 Dec 2024 08:38:03 GMT
content-type
application/javascript; charset=utf-8
last-modified
Sat, 14 Aug 2021 20:33:09 GMT
vary
Accept-Encoding
priority
u=1,i=?0
strict-transport-security
max-age=15780000
cache-control
public, max-age=30672000
timing-allow-origin
*
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
8f0428027c1c7da4-TLV
accept-ranges
bytes
access-control-allow-origin
*
content-length
13972
server
cloudflare
/
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/rflr2/0x4AAAAAAA0rJP79Qu28KGYp/auto/fbE/normal/auto/ Frame BE6E 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv/rflr2/0x4AAAAAAA0rJP79Qu28KGYp/auto/fbE/normal/auto/
Requested by
Host: challenges.cloudflare.com
URL: https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.95.41 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy frame-src https://challenges.cloudflare.com/; base-uri 'self'

Request headers

Referer
https://ireq.mbciftyodv.ru/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
alt-svc
h3=":443"; ma=86400
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
8f042805dddec224-TLV
content-encoding
br
content-security-policy
frame-src https://challenges.cloudflare.com/; base-uri 'self'
content-type
text/html; charset=UTF-8
critical-ch
Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy
same-origin
cross-origin-resource-policy
cross-origin
date
Wed, 11 Dec 2024 08:38:04 GMT
document-policy
js-profiling
origin-agent-cluster
?1
permissions-policy
accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
priority
u=0,i
referrer-policy
same-origin
server
cloudflare
server-timing
cfExtPri
favicon.ico
ireq.mbciftyodv.ru/ 		0
825 B 		Other
General
Check archive.org
Download Go to
Full URL
https://ireq.mbciftyodv.ru/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://ireq.mbciftyodv.ru/KmKUIGaB/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
zstd
cf-cache-status
MISS
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nVtbCT1uKnxpx9lC7NJHvmlnx2B4ntBsOE5s1%2FC70HNb4uMwuFciwpKqZmQ0yE%2B98cIUnVHIAnUS5GqvV%2By6KTHTRslFBJgyHLkTnmlAFC86UXXFGJfbRdan%2BggsRg%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8f042808c974e183-MRS
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=TCP&rtt=5017&min_rtt=4923&rtt_var=1450&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2825&recv_bytes=2115&delivery_rate=572347&cwnd=242&unsent_bytes=0&cid=ac645d279f0bf007&ts=165&x=0", cfL4;desc="?proto=QUIC&rtt=101887&min_rtt=100428&rtt_var=6610&sent=23&recv=16&lost=0&retrans=0&sent_bytes=11277&recv_bytes=6567&delivery_rate=70063&cwnd=12000&unsent_bytes=0&cid=789cd5aa7754554b&ts=2199&x=1", cfExtPri, cfHdrFlush;dur=0
date
Wed, 11 Dec 2024 08:38:05 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
server
cloudflare
priority
u=1,i

Verdicts & Comments Add Verdict or Comment

7 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| UMToTFbvuA function| $ function| jQuery object| turnstile object| CryptoJS function| huzkbPfPmD function| azbpEKBQnr

3 Cookies

Domain/Path Name / Value
.beehiiv.com/ Name: __cf_bm
Value: ff306EotAOsq_FpbFjbMn7a6RjN9EpfIMx7WbpOFOSE-1733906279-1.0.1.1-F8V3Dwsbj6.PBgz4fGZLBMHYv_pmw2ditc6vHKv6RFJDBuBAgJ_X6LR6bAvgqV6eVY45GA0wF.yp6cDYJ0e94Q
ireq.mbciftyodv.ru/ Name: XSRF-TOKEN
Value: eyJpdiI6ImFOYUdWZDV1b01KckJYdVRRQldoblE9PSIsInZhbHVlIjoiK0ZqTjFGN3lDbEFGSnRkd1ljNUtjdkM4QWNSUEhwT2ZFcGc2VmhaSFNHQzYrL1NpN3FOUlg1eGhVNmd1Z29Fd3VwQTBveCt0YmxvRXZSWU55QVRHUkd5TmNNbVMxNGkyRmtDMElnaExhRldKUEdDVU5VdW9Eakwyby8vQmhacnEiLCJtYWMiOiI3MTc5NjNmMzI5NWE4YmRhMjQ3YjkxZmRkOWVjNzJjZmQyMjgyZTRlZDE3YTExZDgxZjgxY2M0YzhlMjI5ZmNlIiwidGFnIjoiIn0%3D
ireq.mbciftyodv.ru/ Name: laravel_session
Value: eyJpdiI6InpDVDVadFN3cHR4ZTc5S0xTK0FKY3c9PSIsInZhbHVlIjoiVlNOc1dSUGIvY1J6R1RzWnB4eXhpdEdvNGtYTHNGWUgzeUZmRzVSUVNMdTcwakdBeTFORTViUVkyODFZUWFIblpNSm9ER1l3NkpJVk50N1JrZmhWNVA4QkhUS28rZWtOSFRBRkRzbm02TzQ1WUVvMTFITFQ0SEhqV25qOVBLalEiLCJtYWMiOiI3NzU1NGZiNTY3OGU5MzU0YWQzN2ZkZjBhMjA1NTA4Y2E2ZmIxNWQyODk5NWI2YTFmMThmMzRiODE4ZGFhYzIwIiwidGFnIjoiIn0%3D

5 Console Messages

Source Level URL
Text
javascript warning URL: https://ireq.mbciftyodv.ru/KmKUIGaB/(Line 23)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.6.0.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://ireq.mbciftyodv.ru/KmKUIGaB/(Line 23)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.6.0.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://ireq.mbciftyodv.ru/KmKUIGaB/(Line 23)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://ireq.mbciftyodv.ru/KmKUIGaB/(Line 23)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdnjs.cloudflare.com/ajax/libs/crypto-js/4.1.1/crypto-js.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://ireq.mbciftyodv.ru/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 ()