flat-shadow-9a77.cadetisjjs.workers.dev Open in urlscan Pro
172.67.170.103  Public Scan

Submitted URL: https://redirect.secureofficepayment.info/
Effective URL: https://flat-shadow-9a77.cadetisjjs.workers.dev/
Submission: On December 24 via manual from CA — Scanned from CA

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 5 HTTP transactions. The main IP is 172.67.170.103, located in United States and belongs to CLOUDFLARENET, US. The main domain is flat-shadow-9a77.cadetisjjs.workers.dev.
TLS certificate: Issued by WE1 on November 21st 2024. Valid for: 3 months.
This is the only time flat-shadow-9a77.cadetisjjs.workers.dev was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 4 172.67.215.137 13335 (CLOUDFLAR...)
2 172.67.170.103 13335 (CLOUDFLAR...)
5 3
Domain Requested by
4 redirect.secureofficepayment.info 1 redirects redirect.secureofficepayment.info
2 flat-shadow-9a77.cadetisjjs.workers.dev
5 2

This site contains no links.

Subject Issuer Validity Valid
secureofficepayment.info
WE1
2024-12-09 -
2025-03-09
3 months crt.sh
cadetisjjs.workers.dev
WE1
2024-11-21 -
2025-02-19
3 months crt.sh

This page contains 2 frames:

Primary Page: https://flat-shadow-9a77.cadetisjjs.workers.dev/
Frame ID: B990304110467464755BFAE163BA1C31
Requests: 8 HTTP requests in this frame

Frame: https://redirect.secureofficepayment.info/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js
Frame ID: B0487BEA236532F6033132C156A91312
Requests: 2 HTTP requests in this frame

Screenshot

Page Title

No Internet Connection

Page URL History Show full URLs

  1. https://redirect.secureofficepayment.info/ Page URL
  2. https://flat-shadow-9a77.cadetisjjs.workers.dev/ Page URL

Page Statistics

5
Requests

80 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

3
IPs

1
Countries

393 kB
Transfer

659 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://redirect.secureofficepayment.info/ Page URL
  2. https://flat-shadow-9a77.cadetisjjs.workers.dev/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 6
  • https://redirect.secureofficepayment.info/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://redirect.secureofficepayment.info/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js

5 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
redirect.secureofficepayment.info/
494 KB
231 KB
Document
General
Full URL
https://redirect.secureofficepayment.info/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.215.137 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b53ad961bdac9b0aa0cfc383636b07a4639b0ad215cc72bb22b8b17745d02c20

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8f72368fde31aabf-YYZ
content-encoding
zstd
content-type
text/html
date
Tue, 24 Dec 2024 17:11:53 GMT
last-modified
Sun, 22 Dec 2024 13:21:27 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority
u=0,i
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9cDJCkGMu8iJrq5byP8QamHLuvhrQa1UZw1N1v7Gqpm7foRu%2FpkfEO9V3JZ8RlXSLJ3KzRsOW0%2B%2BPzBhokdovVYhrE%2FWKP6uLVw%2F%2BYqHIgzMA%2BIo63y6cwSsfbM4fUdjDsMyQHItG6P3NK%2BRc7tS1U4gNgs%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=QUIC&rtt=22552&min_rtt=22395&rtt_var=3651&sent=12&recv=10&lost=0&retrans=0&sent_bytes=4159&recv_bytes=4497&delivery_rate=589&cwnd=12000&unsent_bytes=0&cid=ac6a98de5af2d620&ts=196&x=1" cfExtPri cfHdrFlush;dur=0
vary
accept-encoding
truncated
/
24 KB
24 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d1ba065fe841593a501a70496d94029b0cc6e46be7d6ff44c4014ebd93300d0a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://redirect.secureofficepayment.info
Referer

Response headers

Content-Type
application/font-woff
truncated
/
29 KB
29 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c63a3930ec9dd26c24b4c62b83d8cf778416a0ded1d9aa83e0840a675155b71b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://redirect.secureofficepayment.info
Referer

Response headers

Content-Type
application/font-woff
truncated
/
34 KB
34 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
07ec698b1036cdfbb8892f02d9510f5f671284fca9fa003b883996da040a444b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://redirect.secureofficepayment.info
Referer

Response headers

Content-Type
application/font-woff
truncated
/
31 KB
31 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3711ba98ca34a5bc5ce6b79de62a1a2eee453f413d2123e912d1ae6b0b0c8b33

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://redirect.secureofficepayment.info
Referer

Response headers

Content-Type
application/font-woff
truncated
/
35 KB
35 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
94ef87ee295c67526205d67124f404e246226105e939e14c435a20c29a956f49

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://redirect.secureofficepayment.info
Referer

Response headers

Content-Type
font/woff2
main.js
redirect.secureofficepayment.info/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/ Frame B048
Redirect Chain
  • https://redirect.secureofficepayment.info/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://redirect.secureofficepayment.info/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js?
9 KB
5 KB
Script
General
Full URL
https://redirect.secureofficepayment.info/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js?
Protocol
H3
Server
172.67.215.137 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3f2f5e5d282351c899b3151ab5aa0368454b1769d48c61deee1a56de6056459f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

cache-control
max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
zstd
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5wLa2h%2BDINhxM6%2Bo27GFDe2N0ribWepVkb1f%2FUQp%2FtYwidZygXCNZCoWmi8mmRPnXEp2c69nypG66OkyaOfkWvpW%2BTIlZdzxxxjhk0o2U0EgqBt4YG6stwMoB13LBkflxs0bB84Tg6T43VwCmonJRnEyA9c%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
cf-ray
8f72369449abaabf-YYZ
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=28496&min_rtt=22175&rtt_var=2755&sent=255&recv=130&lost=1&retrans=2&sent_bytes=250583&recv_bytes=10358&delivery_rate=24054&cwnd=24960&unsent_bytes=0&cid=ac6a98de5af2d620&ts=749&x=1", cfExtPri, cfHdrFlush;dur=0
date
Tue, 24 Dec 2024 17:11:54 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
server
cloudflare
priority
u=3,i=?0

Redirect headers

cache-control
max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location
/cdn-cgi/challenge-platform/h/b/scripts/jsd/787bc399e22f/main.js?
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=M0TqU0wSP8VVpNfjJPUUNNEWplh0QcW44lFQrNj7kAxYz%2BBZTrekEKrNY4izwQJwOYnbARt5JPbtCcofBLBx0MTm%2BeQhRTsrwnK1iixzflzBAIsqL7o%2ByCs0uINn8Oh53dNOTCg%2BIgoTM0T9MHX9qxy49O8%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8f7236941985aabf-YYZ
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
0
server-timing
cfL4;desc="?proto=QUIC&rtt=28514&min_rtt=22175&rtt_var=3623&sent=253&recv=129&lost=1&retrans=2&sent_bytes=249813&recv_bytes=10057&delivery_rate=436097&cwnd=24960&unsent_bytes=0&cid=ac6a98de5af2d620&ts=717&x=1", cfExtPri, cfHdrFlush;dur=0
date
Tue, 24 Dec 2024 17:11:54 GMT
vary
Accept-Encoding
server
cloudflare
priority
u=3,i=?0
8f72368fde31aabf
redirect.secureofficepayment.info/cdn-cgi/challenge-platform/h/b/jsd/r/ Frame B048
0
1 KB
XHR
General
Full URL
https://redirect.secureofficepayment.info/cdn-cgi/challenge-platform/h/b/jsd/r/8f72368fde31aabf
Requested by
Host: redirect.secureofficepayment.info
URL: https://redirect.secureofficepayment.info/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.215.137 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
application/json
Referer

Response headers

nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hDLU6vFdh%2FBrC2xQ68z83VaG%2BZKe3FkB6UkBLbohuGNR3OBhrRXyfKAZvCFAQQzDAzAmiabyBdzxsmvHfsO0OAPXTyi3mhcnaATzALVgun5X5ht%2Byl2AA1HruQexKcUVxKkVGogFdq4fHBdHz65edK4vxWA%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8f7236951a6daabf-YYZ
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
0
server-timing
cfL4;desc="?proto=QUIC&rtt=28441&min_rtt=22175&rtt_var=2176&sent=266&recv=148&lost=1&retrans=2&sent_bytes=255790&recv_bytes=27653&delivery_rate=180428&cwnd=24960&unsent_bytes=0&cid=ac6a98de5af2d620&ts=892&x=1", cfExtPri, cfHdrFlush;dur=0
date
Tue, 24 Dec 2024 17:11:54 GMT
content-type
text/plain; charset=UTF-8
server
cloudflare
priority
u=1,i
Primary Request /
flat-shadow-9a77.cadetisjjs.workers.dev/
3 KB
2 KB
Document
General
Full URL
https://flat-shadow-9a77.cadetisjjs.workers.dev/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.170.103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f8274292568bea69fb2f6ce107be41c5269a8ceae52f2e3f6510ac26a5ca1578

Request headers

Referer
https://redirect.secureofficepayment.info/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cf-ray
8f7236a0ee25ab06-YYZ
content-encoding
zstd
content-type
text/html
date
Tue, 24 Dec 2024 17:11:56 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority
u=0,i
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WQ0qdG5l0WuhGWt%2Bka0pKidalk4Xahvo4O3a0EG5VGrNKi%2FtLkGH7BauCeujeZyZvMrEHB%2Bh2lPTq0Si2RhwyLETV1e0AND%2FOIgCDPZVcMYDoYB5pO8N%2BJjJwfmQlX4MtOjZy2KffOd%2Fnta%2FJ6anhhYp33TUf14oKis%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
server-timing
cfL4;desc="?proto=QUIC&rtt=22558&min_rtt=22398&rtt_var=8513&sent=11&recv=7&lost=0&retrans=0&sent_bytes=4139&recv_bytes=4389&delivery_rate=129923&cwnd=12000&unsent_bytes=0&cid=071bab301eda5c4a&ts=40&x=1" cfExtPri cfHdrFlush;dur=0
vary
Accept-Encoding
favicon.ico
flat-shadow-9a77.cadetisjjs.workers.dev/
0
803 B
Other
General
Full URL
https://flat-shadow-9a77.cadetisjjs.workers.dev/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.170.103 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://flat-shadow-9a77.cadetisjjs.workers.dev/

Response headers

x-ms-ests-server
2.1.19683.6 - WUS3 ProdSlices
cf-cache-status
BYPASS
report-to
{"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+san"}]}
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=QUIC&rtt=23560&min_rtt=22336&rtt_var=4859&sent=16&recv=12&lost=0&retrans=0&sent_bytes=5935&recv_bytes=4943&delivery_rate=78668&cwnd=12000&unsent_bytes=0&cid=071bab301eda5c4a&ts=391&x=1", cfExtPri, cfHdrFlush;dur=0
p3p
CP="DSP CUR OTPi IND OTRi ONL FIN"
date
Tue, 24 Dec 2024 17:11:56 GMT
content-type
text/plain;charset=UTF-8
vary
Accept-Encoding
priority
u=1,i
x-ms-srs
1.P
cache-control
private
nel
{"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
access-control-allow-credentials
true
x-ms-request-id
92724129-0840-43ee-a7e1-2b3275347d00
cf-ray
8f7236a15e70ab06-YYZ
access-control-allow-origin
*
content-length
0
x-xss-protection
0
server
cloudflare

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| tryAgain

2 Cookies

Domain/Path Name / Value
.secureofficepayment.info/ Name: cf_clearance
Value: kraX42K9DjpoguQ91q8eS6oZRPLuzbVxfihD6wasXEQ-1735060314-1.2.1.1-2_Dp82RS_7MEIPrnN.cgnX24ttONhvfAxZetMnOSyD_XVrJ9UcUO5Rv5.Iwhw8Fc..e5DLEaMQaFDGmXKE3xdFpQ4Uyd3U4_b1.rXHIrWmcYbIWaDDh8rLPFHkB50Ppfo8NsaeTGTvbRD1ZczRQGe0.J6850VMZtrfO1v4MbAWscX42GBZ9eRRSsTrcrbetqGk2HvSwj1PxWUFjGuUP.i3b1Av8H3tKbDOWoRewnOwLj3fVNSuJJWz3U2h946tnuRmPlvFnMhVRvOCgM5ZzL7TEvBD6jT6EyXsjGmF9Lf9nk8HvY1GMIceK0gY6mhfiqWEfHL5hNMb50HdVEvI3k0SBhgmFnNHNF1rXz7vlnrDcqCcspbFR6OEjuSzKFoNC2
flat-shadow-9a77.cadetisjjs.workers.dev/ Name: x-ms-gateway-slice
Value: estsfd

1 Console Messages

Source Level URL
Text
network error URL: https://flat-shadow-9a77.cadetisjjs.workers.dev/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 ()