Submitted URL: http://mega.foo/
Effective URL: https://mega.555kf7lkmkispiqf.com/captcha
Submission: On June 02 via manual from HK — Scanned from DE

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 13 HTTP transactions. The main IP is 2a06:98c1:3120::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is mega.555kf7lkmkispiqf.com.
TLS certificate: Issued by GTS CA 1P5 on May 30th 2023. Valid for: 3 months.
This is the only time mega.555kf7lkmkispiqf.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 4 2606:4700:303... 13335 (CLOUDFLAR...)
1 5 2a06:98c1:312... 13335 (CLOUDFLAR...)
13 3
Apex Domain
Subdomains
Transfer
5 555kf7lkmkispiqf.com
mega.555kf7lkmkispiqf.com
6 KB
4 mega.foo
mega.foo
9 KB
13 2
Domain Requested by
5 mega.555kf7lkmkispiqf.com 1 redirects mega.foo
mega.555kf7lkmkispiqf.com
4 mega.foo 1 redirects mega.foo
13 2

This site contains no links.

Subject Issuer Validity Valid
mega.foo
E1
2023-05-30 -
2023-08-28
3 months crt.sh
555kf7lkmkispiqf.com
GTS CA 1P5
2023-05-30 -
2023-08-28
3 months crt.sh

This page contains 1 frames:

Primary Page: https://mega.555kf7lkmkispiqf.com/captcha
Frame ID: C4E14476E1ED9CA2FE5CEB8AA3C31749
Requests: 13 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://mega.foo/ HTTP 307
    https://mega.foo/ Page URL
  2. https://mega.foo/ HTTP 302
    https://mega.555kf7lkmkispiqf.com/ Page URL
  3. https://mega.555kf7lkmkispiqf.com/ HTTP 302
    https://mega.555kf7lkmkispiqf.com/captcha Page URL

Page Statistics

13
Requests

54 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

14 kB
Transfer

63 kB
Size

9
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://mega.foo/ HTTP 307
    https://mega.foo/ Page URL
  2. https://mega.foo/ HTTP 302
    https://mega.555kf7lkmkispiqf.com/ Page URL
  3. https://mega.555kf7lkmkispiqf.com/ HTTP 302
    https://mega.555kf7lkmkispiqf.com/captcha Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://mega.foo/ HTTP 307
  • https://mega.foo/
Request Chain 3
  • https://mega.foo/ HTTP 302
  • https://mega.555kf7lkmkispiqf.com/

13 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
mega.foo/
Redirect Chain
  • http://mega.foo/
  • https://mega.foo/
11 KB
6 KB
Document
General
Full URL
https://mega.foo/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::ac43:9b4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
977c67c4180d14fc411be4af3780a1b3a5898026934cf47d47ba12c9e798a260

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7d0e6f83391f9207-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Fri, 02 Jun 2023 08:48:08 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KLZgzyuoah7lLoCape9UKNfy5sBxtVcab5mYXPeiZQpIdSzCLIav6360JKrZgH4bOG1g%2BNt7Xvfzb88S7hoTCI5eadVzPtqNlHLTnwG%2BtyN67yzu3Pse5T%2BCgcnbmHCMtoB%2FLCTcSg%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cross-Origin-Resource-Policy
Cross-Origin
Location
https://mega.foo/
Non-Authoritative-Reason
HSTS
favicon.ico
mega.foo/
15 KB
2 KB
Image
General
Full URL
https://mega.foo/favicon.ico?2
Requested by
Host: mega.foo
URL: https://mega.foo/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::ac43:9b4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0d5fe64c6b9e3e7964e607143d75444a04da4ecd387af1969a485bbf8083118f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://mega.foo/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date
Fri, 02 Jun 2023 08:48:08 GMT
content-encoding
br
cf-cache-status
REVALIDATED
last-modified
Sun, 05 Feb 2023 17:50:43 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"3aee-5f3f78dba833f"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9UQh2%2FcjgH9OmS%2BDPR1K%2B8alcOqameJ969HELk%2FuYY3TjQ7g1ROiNDBacv29qXPdgU9XcIJTgMFXOU0CrdpPokBN4Fwo72JD8A6dN%2FqeCHEDAMVg3%2FBjcykmwQcHZI4VTjm9VO49lg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/vnd.microsoft.icon
cache-control
max-age=14400
cf-ray
7d0e6f8389699207-FRA
alt-svc
h3=":443"; ma=86400
transparent.gif
mega.foo/cdn-cgi/images/trace/managed/nojs/
42 B
259 B
Image
General
Full URL
https://mega.foo/cdn-cgi/images/trace/managed/nojs/transparent.gif?ray=794d630be9c098f7
Requested by
Host: mega.foo
URL: https://mega.foo/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3033::ac43:9b4e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://mega.foo/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date
Fri, 02 Jun 2023 08:48:08 GMT
x-content-type-options
nosniff
last-modified
Thu, 25 May 2023 08:39:03 GMT
server
cloudflare
etag
"646f1ea7-2a"
x-frame-options
DENY
vary
Accept-Encoding
content-type
image/gif
cache-control
max-age=7200, public
accept-ranges
bytes
cf-ray
7d0e6f83aab31c28-FRA
content-length
42
expires
Fri, 02 Jun 2023 10:48:08 GMT
/
mega.555kf7lkmkispiqf.com/
Redirect Chain
  • https://mega.foo/
  • https://mega.555kf7lkmkispiqf.com/
4 KB
2 KB
Document
General
Full URL
https://mega.555kf7lkmkispiqf.com/
Requested by
Host: mega.foo
URL: https://mega.foo/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7fde55410b02e5c426be7160e25157e00095d7217477898b433b4c36e4cf6e34

Request headers

Referer
https://mega.foo/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7d0e6f91f887bb95-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Fri, 02 Jun 2023 08:48:10 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=660eaSUyMaKOwPdr4FBBbC%2BNJIVWUYuAAo0jcdd4HcSmtM14pYNAKfwYFkp0gNygfcA17LqAYCLJLRO8oCNyTJwhM0fDL23nDtVWHwj5HAS6g2us5%2F6DvFfbaygTTqxPeN6Y5brrwjv1fzlB1OUCqmSAoHOQGZ36"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding

Redirect headers

access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7d0e6f902abe1c28-FRA
content-type
text/html; charset=UTF-8
date
Fri, 02 Jun 2023 08:48:10 GMT
location
https://mega.555kf7lkmkispiqf.com
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=934MUGx6lFsmxGYXIYtMSkAkNOUSEEsQKrQ0lJQEQ8XntO3jcT6lxqKyflSfaFStEsFHkSIwRC6JdfKeO%2BU3LId7wf7NSwGl22%2ByMgL0MMu3p9aT03YjsvItp53dHUOc3ShUJa4%2BXw%3D%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
connect.min.js
mega.555kf7lkmkispiqf.com/js/
11 KB
3 KB
Script
General
Full URL
https://mega.555kf7lkmkispiqf.com/js/connect.min.js?1
Requested by
Host: mega.555kf7lkmkispiqf.com
URL: https://mega.555kf7lkmkispiqf.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9fa0fd5b129cc1062500cf31c6be66f6617d829c3e4ccf0dc7cdba46f992632e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://mega.555kf7lkmkispiqf.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date
Fri, 02 Jun 2023 08:48:10 GMT
content-encoding
br
cf-cache-status
EXPIRED
last-modified
Sun, 27 Nov 2022 17:39:02 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"2c0a-5ee773b0dc3c6-gzip"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2F5%2BzBn7m0wcStjl2MlBgSZIAX5DqCbZVYeuh6Kyj3kMf6i0nRDcgLv1mtxQ9qBPAfw0iCOI5H4Vz5uyihQBtMXfOSarBkiUh63ATDutip%2BOBG0C%2FaKTNgIjllUCkFFxB9EsiHQBPon%2F3JEEQJRVNpvAn01X7yh8G"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7d0e6f9248f2bb95-FRA
alt-svc
h3=":443"; ma=86400
take_server.php
mega.555kf7lkmkispiqf.com/modules/onion_servers/
0
524 B
XHR
General
Full URL
https://mega.555kf7lkmkispiqf.com/modules/onion_servers/take_server.php
Requested by
Host: mega.555kf7lkmkispiqf.com
URL: https://mega.555kf7lkmkispiqf.com/js/connect.min.js?1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date
Fri, 02 Jun 2023 08:48:10 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BSn6TRjmERhV07htA%2Fi%2FO%2Fg9uY9F5qLTgRf9AJvjCcS1G4nHTBNLg43QLan9lSk3ebjleJq99A03ZrGAjd1QqK57vuLwx2tDK6sjG%2FhAc2o7Dx4fkMrV%2Fwdxy%2BylKq37fmVVOO9YJFEUcWNAOkjWgcJg6XfyvJSJ"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=UTF-8
cf-ray
7d0e6f92ada40410-FRA
alt-svc
h3=":443"; ma=86400
Primary Request captcha
mega.555kf7lkmkispiqf.com/
Redirect Chain
  • https://mega.555kf7lkmkispiqf.com/
  • https://mega.555kf7lkmkispiqf.com/captcha
22 KB
0
Document
General
Full URL
https://mega.555kf7lkmkispiqf.com/captcha
Requested by
Host: mega.555kf7lkmkispiqf.com
URL: https://mega.555kf7lkmkispiqf.com/js/connect.min.js?1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Referer
https://mega.555kf7lkmkispiqf.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7d0e6fa0bf480410-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
date
Fri, 02 Jun 2023 08:48:14 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xSgQDGPgnaotFVCaT4uZjQj6KyGYWyjl%2BCBjxn%2BP2IQ1Ay1f%2Fk24RWSkdFSkfRZpUKtd18EHaaMm72LmC8BLLm7AI%2BYSyRJ7g0pBwWR7r1JYoQI0g8G9sgUphJIME54yOmAwlnKCCUUyF8JKlDJne97oU0TciklX"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding

Redirect headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7d0e6f92fdfd0410-FRA
content-type
text/html; charset=UTF-8
date
Fri, 02 Jun 2023 08:48:12 GMT
location
/captcha
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8KqNh%2BzcNrY3f0I21ZLZ7BNKFh5ycw7U8D2o9%2BuKrTqp2aDlU%2BmzA%2BLBlgEImEE6vSDq7lgDWe4AIdRg868V5omMq7FNf7r0%2FyWaB088wg0I22xNZp95bUEnAJ1uLjLBxb8kJdaW4ilwLH3lCmY7e3Hfw9kRrSjI"}],"group":"cf-nel","max_age":604800}
server
cloudflare
challenge.css
mega.555kf7lkmkispiqf.com/captcha/
0
0

1-min.svg
mega.555kf7lkmkispiqf.com/captcha/svgs/
0
0

3-min.svg
mega.555kf7lkmkispiqf.com/captcha/svgs/
0
0

7-min.svg
mega.555kf7lkmkispiqf.com/captcha/svgs/
0
0

11-min.svg
mega.555kf7lkmkispiqf.com/captcha/svgs/
0
0

5-min.svg
mega.555kf7lkmkispiqf.com/captcha/svgs/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
mega.555kf7lkmkispiqf.com
URL
https://mega.555kf7lkmkispiqf.com/captcha/challenge.css?v=3.3
Domain
mega.555kf7lkmkispiqf.com
URL
https://mega.555kf7lkmkispiqf.com/captcha/svgs/1-min.svg
Domain
mega.555kf7lkmkispiqf.com
URL
https://mega.555kf7lkmkispiqf.com/captcha/svgs/3-min.svg
Domain
mega.555kf7lkmkispiqf.com
URL
https://mega.555kf7lkmkispiqf.com/captcha/svgs/7-min.svg
Domain
mega.555kf7lkmkispiqf.com
URL
https://mega.555kf7lkmkispiqf.com/captcha/svgs/11-min.svg
Domain
mega.555kf7lkmkispiqf.com
URL
https://mega.555kf7lkmkispiqf.com/captcha/svgs/5-min.svg

Verdicts & Comments Add Verdict or Comment

3 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend

9 Cookies

Domain/Path Name / Value
mega.foo/ Name: cf_check
Value: 1
mega.foo/ Name: go
Value: 1
mega.555kf7lkmkispiqf.com/ Name: tor_scheme_id
Value: 1685909552
mega.555kf7lkmkispiqf.com/ Name: tor_port
Value: 9151
mega.555kf7lkmkispiqf.com/ Name: session_id
Value: ca10ed2ca52b0c557077ebefc45bf870
mega.555kf7lkmkispiqf.com/ Name: unique_user_id
Value: 3657c26398751b4e8c829c007043c3a1
mega.555kf7lkmkispiqf.com/ Name: connecting_hash_lite_version
Value: 1685695690
mega.555kf7lkmkispiqf.com/ Name: connecting_hash
Value: abb3727b6ca85aa7be98c1ee7a1df436
mega.555kf7lkmkispiqf.com/ Name: onion_server_id
Value: 8