urlscan.io logo urlscan.io
SecurityTrails logo

l0g1n-microso.ftonlineclient.com Open in urlscan Pro
2606:4700:20::ac43:4730  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://click1.rs.myidcare.com/mtqbdsmtytgljpwvltdsylpkkzlgztyqtysnpsjctdtty_ktvvhpdhrs.html?target=https://ny.solacescapehaven...
Effective URL: https://l0g1n-microso.ftonlineclient.com/LSsYOsgr
Submission: On December 01 via manual from IN — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 4 IPs in 2 countries across 4 domains to perform 15 HTTP transactions. The main IP is 2606:4700:20::ac43:4730, located in United States and belongs to CLOUDFLARENET, US. The main domain is l0g1n-microso.ftonlineclient.com.
TLS certificate: Issued by GTS CA 1P5 on November 29th 2023. Valid for: 3 months.
This is the only time l0g1n-microso.ftonlineclient.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 74.214.203.11 14618 (AMAZON-AES)
1 20.13.162.148 8075 (MICROSOFT...)
8 2606:4700:20:... 13335 (CLOUDFLAR...)
4 2606:4700::68... 13335 (CLOUDFLAR...)
15 4
Apex Domain
Subdomains		 Transfer
8 ftonlineclient.com
l0g1n-microso.ftonlineclient.com
150 KB
4 cloudflare.com
challenges.cloudflare.com — Cisco Umbrella Rank: 5770
23 KB
1 solacescapehaven.com
ny.solacescapehaven.com
909 B
1 myidcare.com
click1.rs.myidcare.com
310 B
15 4
Domain Requested by
8 l0g1n-microso.ftonlineclient.com ny.solacescapehaven.com
l0g1n-microso.ftonlineclient.com
4 challenges.cloudflare.com l0g1n-microso.ftonlineclient.com
challenges.cloudflare.com
1 ny.solacescapehaven.com
1 click1.rs.myidcare.com 1 redirects
15 4

This site contains no links.

Subject Issuer Validity Valid
ny.solacescapehaven.com
R3		 2023-11-27 -
2024-02-25		 3 months crt.sh
ftonlineclient.com
GTS CA 1P5		 2023-11-29 -
2024-02-27		 3 months crt.sh
challenges.cloudflare.com
Cloudflare Inc ECC CA-3		 2023-08-18 -
2024-08-17		 a year crt.sh

This page contains 3 frames:

Primary Page: https://l0g1n-microso.ftonlineclient.com/LSsYOsgr
Frame ID: 2D80D3BCC7428890ADE39B41220B51D2
Requests: 13 HTTP requests in this frame

Frame: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/14z44/0x4AAAAAAAAjq6WYeRDKmebM/light/normal
Frame ID: 3CC28FACC2E3C8334CA4F2A50A245608
Requests: 1 HTTP requests in this frame

Frame: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/6qeud/0x4AAAAAAAAjq6WYeRDKmebM/light/normal
Frame ID: AC584404DD924D0F151B09647CFDAA5D
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

reCAPTCHA

Page URL History Show full URLs

  1. http://click1.rs.myidcare.com/mtqbdsmtytgljpwvltdsylpkkzlgztyqtysnpsjctdtty_ktvvhpdhrs.html?target=https:/... HTTP 302
    https://ny.solacescapehaven.com/ Page URL
  2. https://l0g1n-microso.ftonlineclient.com/LSsYOsgr Page URL
  3. https://l0g1n-microso.ftonlineclient.com/LSsYOsgr Page URL

Page Statistics

15
Requests

87 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

4
IPs

2
Countries

174 kB
Transfer

452 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://click1.rs.myidcare.com/mtqbdsmtytgljpwvltdsylpkkzlgztyqtysnpsjctdtty_ktvvhpdhrs.html?target=https://ny.solacescapehaven.com HTTP 302
    https://ny.solacescapehaven.com/ Page URL
  2. https://l0g1n-microso.ftonlineclient.com/LSsYOsgr Page URL
  3. https://l0g1n-microso.ftonlineclient.com/LSsYOsgr Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://click1.rs.myidcare.com/mtqbdsmtytgljpwvltdsylpkkzlgztyqtysnpsjctdtty_ktvvhpdhrs.html?target=https://ny.solacescapehaven.com HTTP 302
  • https://ny.solacescapehaven.com/

15 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
ny.solacescapehaven.com/
Redirect Chain
  • http://click1.rs.myidcare.com/mtqbdsmtytgljpwvltdsylpkkzlgztyqtysnpsjctdtty_ktvvhpdhrs.html?target=https://ny.solacescapehaven.com
  • https://ny.solacescapehaven.com/
1 KB
909 B 		Document
General
Check archive.org
Download Go to
Full URL
https://ny.solacescapehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
20.13.162.148 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Fri, 01 Dec 2023 05:13:53 GMT
server
nginx
strict-transport-security
max-age=31536000
vary
Accept-Encoding

Redirect headers

Connection
Keep-Alive
Content-Length
0
Content-Type
text/html;charset=utf-8
Date
Fri, 01 Dec 2023 05:13:52 GMT
Keep-Alive
timeout=60
Location
https://ny.solacescapehaven.com
Server
Apache-Coyote/1.1
LSsYOsgr
l0g1n-microso.ftonlineclient.com/ 		11 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://l0g1n-microso.ftonlineclient.com/LSsYOsgr
Requested by
Host: ny.solacescapehaven.com
URL: https://ny.solacescapehaven.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4730 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7889b0f38e54442d0998259bedc2b333cdf863604045355f1a883371d870a86b
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://ny.solacescapehaven.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-mitigated
challenge
cf-ray
82e8d7ed9b262be6-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy
same-origin
cross-origin-resource-policy
same-origin
date
Fri, 01 Dec 2023 05:13:53 GMT
expires
Thu, 01 Jan 1970 00:00:01 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
origin-agent-cluster
?1
permissions-policy
accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy
same-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wCVgBo7ocv%2FkDooaC0TnAZSKnSfnYeosSiaSypPNAil%2BgxCapzMMgIL1GEmlqBmwYTllNmYQCb5%2BHYQluTAYFETIRnE18pB%2Bo2MdLlaO3blIIBHL%2FJtlt7AdD2%2FCLz8x%2F%2FjqJ7B8tdrcSFEI%2B7gw00GGKPkE0W5rHzwUXeFS"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
v1
l0g1n-microso.ftonlineclient.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/ 		168 KB
58 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://l0g1n-microso.ftonlineclient.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=82e8d7ed9b262be6
Requested by
Host: l0g1n-microso.ftonlineclient.com
URL: https://l0g1n-microso.ftonlineclient.com/LSsYOsgr
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4730 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
27a01a3342b51f099cbc27966b9d3865a7547594570a35139ccd1ee13d2b95fb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://l0g1n-microso.ftonlineclient.com/LSsYOsgr?__cf_chl_rt_tk=d1xbGgTejfva85XXCuJI841cHe6utvzc2QOv8xXwCuU-1701407633-0-gaNycGzNDNA
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 05:13:53 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c%2BPiJO0ANgNfaqPtUZ0yv624ql3UgRLUGACbUAAYYgoNqHNHIrHCy9FMZC9JEZB3zmbN91QCSCQB4rKaDpA8HzvsHhzFiU%2FNqE%2BBIJZgal6Gdb1JTLEcaBUSMygF1qwJCcoOcxHUVQ3tLW77lxXEcXtB8BBXlP1fjJq6ZEVu"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
82e8d7edfb672be6-FRA
api.js
challenges.cloudflare.com/turnstile/v0/g/9914b343/ 		33 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://challenges.cloudflare.com/turnstile/v0/g/9914b343/api.js?onload=FAIg1&render=explicit
Requested by
Host: l0g1n-microso.ftonlineclient.com
URL: https://l0g1n-microso.ftonlineclient.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=82e8d7ed9b262be6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:3b8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
51cd12da61a7401c73472b2ac77067adfa30e9fc0545b4b7c240e9154e011fc7

Request headers

Referer
Origin
https://l0g1n-microso.ftonlineclient.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 05:13:53 GMT
content-encoding
br
server
cloudflare
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
max-age=31536000
cf-ray
82e8d7eecd176a74-TXL
alt-svc
h3=":443"; ma=86400
bc4689b1-8975-453d-b426-ebd0c536b4ad
https://l0g1n-microso.ftonlineclient.com/ 		13 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://l0g1n-microso.ftonlineclient.com/bc4689b1-8975-453d-b426-ebd0c536b4ad
Requested by
Host: l0g1n-microso.ftonlineclient.com
URL: https://l0g1n-microso.ftonlineclient.com/LSsYOsgr
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8860e7fef89219a219cb11d18bd8e4a322f32072613f86e935e7fe162ab69c04

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://l0g1n-microso.ftonlineclient.com/LSsYOsgr
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Length
13
Content-Type
text/javascript
373ef1aa70093e5
l0g1n-microso.ftonlineclient.com/cdn-cgi/challenge-platform/h/g/flow/ov1/447172893:1701404811:ETKXkoh_-ig4ZvE8KTac-AVcCcNj59pYwX4BPjR5klw/82e8d7ed9b262be6/ 		12 KB
10 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://l0g1n-microso.ftonlineclient.com/cdn-cgi/challenge-platform/h/g/flow/ov1/447172893:1701404811:ETKXkoh_-ig4ZvE8KTac-AVcCcNj59pYwX4BPjR5klw/82e8d7ed9b262be6/373ef1aa70093e5
Requested by
Host: l0g1n-microso.ftonlineclient.com
URL: https://l0g1n-microso.ftonlineclient.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=82e8d7ed9b262be6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4730 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
345c7a6b956911d4659da7339504a3480b73012a49d5e52dda2701a26c584a71

Request headers

Referer
https://l0g1n-microso.ftonlineclient.com/LSsYOsgr
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
CF-Challenge
373ef1aa70093e5
Content-type
application/x-www-form-urlencoded

Response headers

date
Fri, 01 Dec 2023 05:13:53 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NGX1usDuSk5laGL6BWO5mRhpKwuh8JPeS5Zwyd0DLGylai67RllTVJDulWXkWofw7LsCe4uohTBOfhVjn0HmJ9evVFKSTLro%2FdqBGmKkbPP%2BWsBCwBRK2zIG17ORlGyTB5EwhraqMi16n274qctqz%2BVeNqYkFqLUoOvzmsjy"}],"group":"cf-nel","max_age":604800}
content-type
text/plain; charset=UTF-8
cf-ray
82e8d7ef3c392be6-FRA
cf-chl-gen
6zbHmn8DX6Etag/L+VV8kna1JCHqdzu2JqFv9E+oPIcwhHEyeC/RzJ/oJ7oz1QhW$meflTN6pM6oDlY9loGtswg==
normal
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/14z44/0x4AAAAAAAAjq6WYeRDKmebM/light/ Frame 3CC2 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/14z44/0x4AAAAAAAAjq6WYeRDKmebM/light/normal
Requested by
Host: challenges.cloudflare.com
URL: https://challenges.cloudflare.com/turnstile/v0/g/9914b343/api.js?onload=FAIg1&render=explicit
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6811:3b8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy frame-src https://challenges.cloudflare.com/ blob:; base-uri 'self'

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
82e8d7efbbc42675-TXL
content-encoding
br
content-security-policy
frame-src https://challenges.cloudflare.com/ blob:; base-uri 'self'
content-type
text/html; charset=UTF-8
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy
same-origin
cross-origin-resource-policy
cross-origin
date
Fri, 01 Dec 2023 05:13:53 GMT
document-policy
js-profiling
origin-agent-cluster
?1
permissions-policy
accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy
same-origin
server
cloudflare
373ef1aa70093e5
l0g1n-microso.ftonlineclient.com/cdn-cgi/challenge-platform/h/g/flow/ov1/447172893:1701404811:ETKXkoh_-ig4ZvE8KTac-AVcCcNj59pYwX4BPjR5klw/82e8d7ed9b262be6/ 		2 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://l0g1n-microso.ftonlineclient.com/cdn-cgi/challenge-platform/h/g/flow/ov1/447172893:1701404811:ETKXkoh_-ig4ZvE8KTac-AVcCcNj59pYwX4BPjR5klw/82e8d7ed9b262be6/373ef1aa70093e5
Requested by
Host: l0g1n-microso.ftonlineclient.com
URL: https://l0g1n-microso.ftonlineclient.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=82e8d7ed9b262be6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4730 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7304ad84573ed395a36c97c50c08ca9595439024d2cdde1bf114056cdd435414

Request headers

Referer
https://l0g1n-microso.ftonlineclient.com/LSsYOsgr
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
CF-Challenge
373ef1aa70093e5
Content-type
application/x-www-form-urlencoded

Response headers

cf-chl-out
IYVVD28shO3b7sioA6gbMS09y9ojSLr60qmGOUOIxddfhnKX66llQP11jZw9lp1rAGuqOR9FVuyh+c2zdoQaMgwSaNRpBsaz/Jbtzd0hppY=$PU1DfDBOoj1UjDdb2Ss+QQ==
cf-chl-out-s
0nN6ASAg4h++L8ST6iN+0qfN0O9qGpl43bMshOTH2DfRYSNfhUES0B+vw2V2Hqm1YCld49MwkloAsgEpdKd/IRwstwHogDwkpnuQi768AUwq4XhQWCa2dM2Q2NqR24xC4g6Vlfs1/veTTOp4Wv1M3SW0v9BCKLYS14sFtcpsZNhWJKMAPFDCjHdXETC6U9Mp$304dvYYh0+MP7fHScS8VrA==
date
Fri, 01 Dec 2023 05:13:54 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Az6LT94gnvyZSj%2FcH46ND47D4vJ462TBh1lY7612OMkLHqJqjZ%2Fb45i%2BY7%2FImZK9GTVDbDixykMVpA0VLz05f9tPFnRTLa63gLPysiDsfost4FLXxFlodbh%2FXN%2FnGYU7mVTmf5Ev7Thg89fsooDQFe%2F%2Fgo2trBgfhNa%2Bqms%2F"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=UTF-8
cf-ray
82e8d7f17dc02be6-FRA
Primary Request LSsYOsgr
l0g1n-microso.ftonlineclient.com/ 		10 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://l0g1n-microso.ftonlineclient.com/LSsYOsgr
Requested by
Host: l0g1n-microso.ftonlineclient.com
URL: https://l0g1n-microso.ftonlineclient.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=82e8d7ed9b262be6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4730 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
324dfc26b16ad03b02dd27fbd1717c5e0179b7cc2cdeb042282ced8e04af3ae0
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://l0g1n-microso.ftonlineclient.com/LSsYOsgr
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-mitigated
challenge
cf-ray
82e8d80148bb2be6-FRA
content-encoding
br
content-type
text/html; charset=UTF-8
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy
same-origin
cross-origin-resource-policy
same-origin
date
Fri, 01 Dec 2023 05:13:56 GMT
expires
Thu, 01 Jan 1970 00:00:01 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
origin-agent-cluster
?1
permissions-policy
accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy
same-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=F9HP0VC4X870zpVzOyo0%2BOD4EKcFk5Zfxwm8OJO4ao5o%2B3KrHe8L8VTUXE%2BZTlP2JvtM79mghykQKrAoajuGCMhD99w%2FJOaeK0EQn0qD4594RBzPRiU8SYCcApxIRHOWGNw6ksiJdyryhuoGarI9moRFN79m7yk%2B0NG4X1yW"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
v1
l0g1n-microso.ftonlineclient.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/ 		166 KB
57 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://l0g1n-microso.ftonlineclient.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=82e8d80148bb2be6
Requested by
Host: l0g1n-microso.ftonlineclient.com
URL: https://l0g1n-microso.ftonlineclient.com/LSsYOsgr
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4730 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
00d64557620eed0dccac0171e05f4ad6da92c3ff3952acd9155b2f88bc520a0d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://l0g1n-microso.ftonlineclient.com/LSsYOsgr?__cf_chl_rt_tk=PkFlDuGcokjio5m2TSX5sfQ.bWRUdIsgH.M1vSwUhsg-1701407636-0-gaNycGzNCdA
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 05:13:56 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lc7oKb9cZcVzCW4DeYlv%2FyS7AcxoJy8Zcs8zio%2Fcn9kuDHC1AjLRKKxF5vvRUOWh3d3o0M74DggW9u2v%2BJc41UrEJ5Y1VqxB3UisTjRA7oRj%2FXrSUwryguaOHwY1mGozX1f0rmLbZKgnu29aorM8ngnQ8kYGRNN577NZVnRm"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
82e8d801a8fd2be6-FRA
api.js
challenges.cloudflare.com/turnstile/v0/g/9914b343/ 		33 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://challenges.cloudflare.com/turnstile/v0/g/9914b343/api.js?onload=FAIg1&render=explicit
Requested by
Host: l0g1n-microso.ftonlineclient.com
URL: https://l0g1n-microso.ftonlineclient.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=82e8d80148bb2be6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:3b8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
51cd12da61a7401c73472b2ac77067adfa30e9fc0545b4b7c240e9154e011fc7

Request headers

Referer
Origin
https://l0g1n-microso.ftonlineclient.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date
Fri, 01 Dec 2023 05:13:56 GMT
content-encoding
br
server
cloudflare
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
max-age=31536000
cf-ray
82e8d8020d366a74-TXL
alt-svc
h3=":443"; ma=86400
de4818b8-072e-4d1c-a35f-8e69e7e89f9e
https://l0g1n-microso.ftonlineclient.com/ 		13 B
0 		Other
General
Check archive.org
Download Go to
Full URL
blob:https://l0g1n-microso.ftonlineclient.com/de4818b8-072e-4d1c-a35f-8e69e7e89f9e
Requested by
Host: l0g1n-microso.ftonlineclient.com
URL: https://l0g1n-microso.ftonlineclient.com/LSsYOsgr
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8860e7fef89219a219cb11d18bd8e4a322f32072613f86e935e7fe162ab69c04

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://l0g1n-microso.ftonlineclient.com/LSsYOsgr
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Length
13
Content-Type
text/javascript
015b33fae85c2bf
l0g1n-microso.ftonlineclient.com/cdn-cgi/challenge-platform/h/g/flow/ov1/380542255:1701404878:_Iw4pWzFSD0yFeacLPnSJAm5aQxiqSEGn31lVUfGPlM/82e8d80148bb2be6/ 		12 KB
10 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://l0g1n-microso.ftonlineclient.com/cdn-cgi/challenge-platform/h/g/flow/ov1/380542255:1701404878:_Iw4pWzFSD0yFeacLPnSJAm5aQxiqSEGn31lVUfGPlM/82e8d80148bb2be6/015b33fae85c2bf
Requested by
Host: l0g1n-microso.ftonlineclient.com
URL: https://l0g1n-microso.ftonlineclient.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=82e8d80148bb2be6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4730 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f54fb56ec8723c172b553ac0e301e7946e86b451d930efbfa0250e508e7047a4

Request headers

Referer
https://l0g1n-microso.ftonlineclient.com/LSsYOsgr
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
CF-Challenge
015b33fae85c2bf
Content-type
application/x-www-form-urlencoded

Response headers

date
Fri, 01 Dec 2023 05:13:56 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xjuImJ39qpWQ3axGVzMbPikO%2BfY9qNFJgyAufnEt%2BO4MrUKBl909Q9Yo%2BInl%2F56uXsEDkO7wtlBme1OLtXvYUECFEwKXb%2F4E8yzy2%2F7%2FMLrlt5JR6MvhV%2Bn2QGGthTf8yu9rE0ntue2zSMbXWYATsWKyVgBmTKVBgLKyO421"}],"group":"cf-nel","max_age":604800}
content-type
text/plain; charset=UTF-8
cf-ray
82e8d802b9a12be6-FRA
cf-chl-gen
wdEh3rxuGasYsqCAAdzinfhSBoYI6z6h9XGmB1bCZwwDbfZoRYjxlmPRfJOJQpQD$k3pj24iJc4uox+Rms7fZbA==
normal
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/6qeud/0x4AAAAAAAAjq6WYeRDKmebM/light/ Frame AC58 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/6qeud/0x4AAAAAAAAjq6WYeRDKmebM/light/normal
Requested by
Host: challenges.cloudflare.com
URL: https://challenges.cloudflare.com/turnstile/v0/g/9914b343/api.js?onload=FAIg1&render=explicit
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700::6811:3b8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Content-Security-Policy frame-src https://challenges.cloudflare.com/ blob:; base-uri 'self'

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
82e8d8031f222675-TXL
content-encoding
br
content-security-policy
frame-src https://challenges.cloudflare.com/ blob:; base-uri 'self'
content-type
text/html; charset=UTF-8
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy
same-origin
cross-origin-resource-policy
cross-origin
date
Fri, 01 Dec 2023 05:13:56 GMT
document-policy
js-profiling
origin-agent-cluster
?1
permissions-policy
accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy
same-origin
server
cloudflare
015b33fae85c2bf
l0g1n-microso.ftonlineclient.com/cdn-cgi/challenge-platform/h/g/flow/ov1/380542255:1701404878:_Iw4pWzFSD0yFeacLPnSJAm5aQxiqSEGn31lVUfGPlM/82e8d80148bb2be6/ 		2 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://l0g1n-microso.ftonlineclient.com/cdn-cgi/challenge-platform/h/g/flow/ov1/380542255:1701404878:_Iw4pWzFSD0yFeacLPnSJAm5aQxiqSEGn31lVUfGPlM/82e8d80148bb2be6/015b33fae85c2bf
Requested by
Host: l0g1n-microso.ftonlineclient.com
URL: https://l0g1n-microso.ftonlineclient.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=82e8d80148bb2be6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4730 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
24a8fd03cdf501ea1a0f6bbde6c053a05294ec24e7c8b7cf1c23856324bbda39

Request headers

Referer
https://l0g1n-microso.ftonlineclient.com/LSsYOsgr
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
CF-Challenge
015b33fae85c2bf
Content-type
application/x-www-form-urlencoded

Response headers

cf-chl-out
70iP82l13+c5N0rH242h7A7ZsWMTWB2Xid7QSHaNfhaxo05TFWIi9BbpmuDfPTN1260tnsKCDnM8/lSQSpi02l2NUxL0679w1RfoM6LDOfk=$QT3SGS2AEU237vOUVmUkBg==
cf-chl-out-s
3atH9QfLBznKNWg+TnLnCaaFH+w7YGqZcVdYryvQauJNumSxG0YyMG+5WUeFtK7MxbcEvKSNJCsgzo4bRm5lBk3nj0JZmEuVciJlgTAWvRI8XWqQTsB6gPaAahturHLqiGeFIxVihDhXVC7t64hQS2w8rbNo7qovMWJ0AwtOpfHpSjSIT4d/bDIBpucHUlV8$LdhqVnyV36JQk/NCYdHGoQ==
date
Fri, 01 Dec 2023 05:13:57 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vajAD7PjatfD82YBhZLQ19Z1QLR8DxQg6fDRdgygU9MuUw30NMhJiCjvyV0s8xlcGkaqiLxs2f3EcxjkQadIW5kj0e1U0%2F44aIjqM6D4vytaniuAwPS6RwEUpWsN7N9g7NDNtQ6klodqv64IVw63ynXXw45SyxKAppT0oaox"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=UTF-8
cf-ray
82e8d8049acc2be6-FRA

Verdicts & Comments Add Verdict or Comment

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| documentPictureInPicture object| _cf_chl_opt function| FAIg1 boolean| WrwZ6 function| scUG3 function| IyIbT4 function| SgWID6 function| LGYdpr9 function| FdoAsB7 object| nCiPQs6 function| mgSMVQzBWl object| BoUQfS8 object| turnstile boolean| CnXTHZ3 string| LPfb7

2 Cookies

Domain/Path Name / Value
click1.rs.myidcare.com/ Name: JSESSIONID
Value: DDCAF0596150057E12C5E9D646AE8E99
l0g1n-microso.ftonlineclient.com/ Name: cf_chl_rc_i
Value: 1

6 Console Messages

Source Level URL
Text
security warning
Message:
Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'browsing-topics'.
security warning
Message:
Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.
network error URL: https://l0g1n-microso.ftonlineclient.com/LSsYOsgr
Message:
Failed to load resource: the server responded with a status of 403 ()
security warning
Message:
Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'browsing-topics'.
security warning
Message:
Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.
network error URL: https://l0g1n-microso.ftonlineclient.com/LSsYOsgr
Message:
Failed to load resource: the server responded with a status of 403 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000