sayige.lecistum.ru Open in urlscan Pro
2a06:98c1:3120::3 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://de1u1.r.sp1-brevo.net/mk/cl/f/sh/OycZvHuFo1eQsnbUZqZlxMRT/kiF2sNEEvvCr
Effective URL:
https://sayige.lecistum.ru/AFiiYYKW/
Submission: On May 13 via manual (May 13th 2024, 5:55:45 pm UTC) from CA — Scanned from FR

Summary HTTP 7 Redirects Behaviour Indicators

Summary

This website contacted 7 IPs in 4 countries across 8 domains to perform 7 HTTP transactions. The main IP is 2a06:98c1:3120::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is sayige.lecistum.ru.
TLS certificate: Issued by GTS CA 1P5 on April 29th 2024. Valid for: 3 months.

This is the only time sayige.lecistum.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	1.179.112.196 1.179.112.196	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2606:4700:440... 2606:4700:4400::ac40:96ba	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	76.223.34.124 76.223.34.124	16509 (AMAZON-02) (AMAZON-02)
1 1	2a02:26f0:350... 2a02:26f0:3500:1b::1724:a389	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 2	172.67.217.15 172.67.217.15	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a06:98c1:312... 2a06:98c1:3120::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a04:4e42:400... 2a04:4e42:400::649	54113 (FASTLY) (FASTLY)
1 2	2606:4700::68... 2606:4700::6811:2b8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.17.2.184 104.17.2.184	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	7

1 1.179.112.196 (France)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: m1179112196.mailinblue.me

de1u1.r.sp1-brevo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:96ba (United States)

ASN13335 (CLOUDFLARENET, US)

sibautomation.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 76.223.34.124 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: aa089eb6179d1ae2b.awsglobalaccelerator.com

heavenlyapartment.store	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:1b::1724:a389 (Frankfurt am Main, Germany) 1 redirects

ASN20940 (AKAMAI-ASN1, NL)

www.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.67.217.15 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

www.xrpaowa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a06:98c1:3120::3 (United States)

ASN13335 (CLOUDFLARENET, US)

sayige.lecistum.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:400::649 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:2b8 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

challenges.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.2.184 (None, )

ASN13335 (CLOUDFLARENET, US)

challenges.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	cloudflare.com 1 redirects challenges.cloudflare.com — Cisco Umbrella Rank: 4500	14 KB
2	xrpaowa.com 1 redirects www.xrpaowa.com	2 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 776	30 KB
1	lecistum.ru sayige.lecistum.ru	4 KB
1	bing.com 1 redirects www.bing.com — Cisco Umbrella Rank: 52	407 B
1	heavenlyapartment.store 1 redirects heavenlyapartment.store	463 B
1	sibautomation.com sibautomation.com — Cisco Umbrella Rank: 22316
1	sp1-brevo.net de1u1.r.sp1-brevo.net	989 B
7	8

	Domain	Requested by
3	challenges.cloudflare.com	1 redirects sayige.lecistum.ru challenges.cloudflare.com
2	www.xrpaowa.com	1 redirects de1u1.r.sp1-brevo.net
1	code.jquery.com	sayige.lecistum.ru
1	sayige.lecistum.ru	de1u1.r.sp1-brevo.net
1	www.bing.com	1 redirects
1	heavenlyapartment.store	1 redirects
1	sibautomation.com	de1u1.r.sp1-brevo.net
1	de1u1.r.sp1-brevo.net
7	8

This site contains no links.

Subject Issuer	Validity	Valid
*.r.sp1-brevo.net R3	`2024-05-10` - `2024-08-08`	3 months	crt.sh
sibautomation.com GTS CA 1P5	`2024-04-09` - `2024-07-08`	3 months	crt.sh
xrpaowa.com E1	`2024-05-05` - `2024-08-03`	3 months	crt.sh
lecistum.ru GTS CA 1P5	`2024-04-29` - `2024-07-28`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh
challenges.cloudflare.com Cloudflare Inc ECC CA-3	`2023-08-18` - `2024-08-17`	a year	crt.sh

This page contains 3 frames:

Primary Page: https://sayige.lecistum.ru/AFiiYYKW/
Frame ID: C8489E90B7FBE1BFCC04DA4B0E270A03
Requests: 5 HTTP requests in this frame

Frame: https://sibautomation.com/cm.html?id=7647461
Frame ID: 813D8C4AB01FD23160F2273CE24238D6
Requests: 1 HTTP requests in this frame

Frame: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/plvcb/0x4AAAAAAAZvT6hXWF4UUr00/auto/normal
Frame ID: D54F72DA865D99F70209A89308AC650A
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

6xibPJTxwm

Page URL History Show full URLs

https://de1u1.r.sp1-brevo.net/mk/cl/f/sh/OycZvHuFo1eQsnbUZqZlxMRT/kiF2sNEEvvCr Page URL
https://heavenlyapartment.store/?utm_source=brevo&utm_campaign=active&utm_medium=email&utm_id=2 HTTP 301
https://www.bing.com/ck/a?!&&p=dd61571133356afdJmltdHM9MTcwNDU4NTYwMCZpZ3VpZD0xMmEwMDcwMS0yNjEzLT... HTTP 302
https://www.xrpaowa.com/PRODUCT HTTP 301
http://www.xrpaowa.com/PRODUCT/ HTTP 307
https://www.xrpaowa.com/PRODUCT/ Page URL
https://sayige.lecistum.ru/AFiiYYKW/ Page URL

Detected technologies

Laravel (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

7
Requests

86 %
HTTPS

56 %
IPv6

8
Domains

8
Subdomains

7
IPs

4
Countries

51 kB
Transfer

138 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://de1u1.r.sp1-brevo.net/mk/cl/f/sh/OycZvHuFo1eQsnbUZqZlxMRT/kiF2sNEEvvCr Page URL
https://heavenlyapartment.store/?utm_source=brevo&utm_campaign=active&utm_medium=email&utm_id=2 HTTP 301
https://www.bing.com/ck/a?!&&p=dd61571133356afdJmltdHM9MTcwNDU4NTYwMCZpZ3VpZD0xMmEwMDcwMS0yNjEzLTZjOTQtM2FhMS0xNGIxMjc3OTZkZGYmaW5zaWQ9NTE1OQ&ptn=3&ver=2&hsh=3&fclid=12a00701-2613-6c94-3aa1-14b127796ddf&u=a1aHR0cHM6Ly93d3cueHJwYW93YS5jb20vUFJPRFVDVA HTTP 302
https://www.xrpaowa.com/PRODUCT HTTP 301
http://www.xrpaowa.com/PRODUCT/ HTTP 307
https://www.xrpaowa.com/PRODUCT/ Page URL
https://sayige.lecistum.ru/AFiiYYKW/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 2

https://heavenlyapartment.store/?utm_source=brevo&utm_campaign=active&utm_medium=email&utm_id=2 HTTP 301
https://www.bing.com/ck/a?!&&p=dd61571133356afdJmltdHM9MTcwNDU4NTYwMCZpZ3VpZD0xMmEwMDcwMS0yNjEzLTZjOTQtM2FhMS0xNGIxMjc3OTZkZGYmaW5zaWQ9NTE1OQ&ptn=3&ver=2&hsh=3&fclid=12a00701-2613-6c94-3aa1-14b127796ddf&u=a1aHR0cHM6Ly93d3cueHJwYW93YS5jb20vUFJPRFVDVA HTTP 302
https://www.xrpaowa.com/PRODUCT HTTP 301
http://www.xrpaowa.com/PRODUCT/ HTTP 307
https://www.xrpaowa.com/PRODUCT/

Request Chain 4

https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit HTTP 302
https://challenges.cloudflare.com/turnstile/v0/g/1b3559406bc8/api.js

7 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 kiF2sNEEvvCr Show response
de1u1.r.sp1-brevo.net/mk/cl/f/sh/OycZvHuFo1eQsnbUZqZlxMRT/ 842 B
989 B 148ms
65ms Document
text/html 1.179.112.196
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://de1u1.r.sp1-brevo.net/mk/cl/f/sh/OycZvHuFo1eQsnbUZqZlxMRT/kiF2sNEEvvCr

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

1.179.112.196 , France, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

m1179112196.mailinblue.me

Software

Resource Hash

3904199d136f42a8bf2117b2a8670940b8b024f8cead25cd19e39059231c74be

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

Accept-Language: fr-FR,fr;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

content-length: 842
content-type: text/html; charset=utf-8
date: Mon, 13 May 2024 17:55:41 GMT
x-content-type-options: nosniff
x-sib-server: srv-rke-core-wkr-007-prd-rbx-ovh
x-xss-protection: 1

GET
H2 200 cm.html
sibautomation.com/ Frame 813D 0
0 87ms
35ms Document
text/html 2606:4700:4400::ac40:96ba
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sibautomation.com/cm.html?id=7647461
Requested by: Host: de1u1.r.sp1-brevo.net
URL: https://de1u1.r.sp1-brevo.net/mk/cl/f/sh/OycZvHuFo1eQsnbUZqZlxMRT/kiF2sNEEvvCr
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:96ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Sails <sailsjs.com>
Resource Hash

Request headers

Accept-Language: fr-FR,fr;q=0.9;q=0.9
Referer: https://de1u1.r.sp1-brevo.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-origin: *
age: 13897
cache-control: public, max-age=7200
cf-cache-status: HIT
cf-ray: 883485581e34d706-CDG
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Mon, 13 May 2024 17:55:41 GMT
expires: Mon, 13 May 2024 19:55:41 GMT
server: cloudflare
vary: Accept-Encoding
x-powered-by: Sails <sailsjs.com>

GET
H3

200

/ Show response
www.xrpaowa.com/PRODUCT/
Redirect Chain

https://heavenlyapartment.store/?utm_source=brevo&utm_campaign=active&utm_medium=email&utm_id=2
https://www.bing.com/ck/a?!&&p=dd61571133356afdJmltdHM9MTcwNDU4NTYwMCZpZ3VpZD0xMmEwMDcwMS0yNjEzLTZjOTQtM2FhMS0xNGIxMjc3OTZkZGYmaW5zaWQ9NTE1OQ&ptn=3&ver=2&hsh=3&fclid=12a00701-2613-6c94-3aa1-14b1277...
https://www.xrpaowa.com/PRODUCT
http://www.xrpaowa.com/PRODUCT/
https://www.xrpaowa.com/PRODUCT/

3 KB
1 KB

118ms
118ms

Document
text/html

172.67.217.15
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.xrpaowa.com/PRODUCT/
Requested by: Host: de1u1.r.sp1-brevo.net
URL: https://de1u1.r.sp1-brevo.net/mk/cl/f/sh/OycZvHuFo1eQsnbUZqZlxMRT/kiF2sNEEvvCr
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.217.15 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4b4e6aeccac1dd73c4e4b28655f0c01b8164fb3bdeaee8d934cfaf285a420f4e

Request headers

Accept-Language: fr-FR,fr;q=0.9;q=0.9
Referer: https://de1u1.r.sp1-brevo.net/mk/cl/f/sh/OycZvHuFo1eQsnbUZqZlxMRT/kiF2sNEEvvCr
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8834855ecd3c2a50-CDG
content-encoding: br
content-type: text/html; charset=UTF-8
date: Mon, 13 May 2024 17:55:42 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b6zauJewBORRW7LJ29YM2Wl%2FpYpQ3nj8K4bWXE08Tc%2FukE0Lkb0oIZLkJ7cXUV%2BqcdD%2FB1AReG%2BAG75lm%2F%2Bu1tMAyBe9c9Dpuk2VgIKlEV4xsFgMrPqkloO%2FDixAogiv66w%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

Redirect headers

Location: https://www.xrpaowa.com/PRODUCT/#aHR0cHM6Ly9zYXlpZ2UubGVjaXN0dW0ucnUvQUZpaVlZS1cv
Non-Authoritative-Reason: HttpsUpgrades

GET
H2 200 Primary Request / Show response
sayige.lecistum.ru/AFiiYYKW/ 5 KB
4 KB 1169ms
1038ms Document
text/html 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://sayige.lecistum.ru/AFiiYYKW/
Requested by: Host: de1u1.r.sp1-brevo.net
URL: https://de1u1.r.sp1-brevo.net/mk/cl/f/sh/OycZvHuFo1eQsnbUZqZlxMRT/kiF2sNEEvvCr
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d711b01fb3443fa85ace4745c17fe9b771def89f036edd5c95a73991be2862ab

Request headers

Accept-Language: fr-FR,fr;q=0.9;q=0.9
Referer: https://www.xrpaowa.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache, private
cf-cache-status: DYNAMIC
cf-ray: 883485607be202a5-CDG
content-encoding: br
content-type: text/html; charset=UTF-8
date: Mon, 13 May 2024 17:55:43 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sIY2vFnvSdDyhw4iXc7kX534c1C9PQ5VP44fDu5mPdkVaaUGWIy2bIT1rQCS6%2ByDbfNNfTPhBLwPAx03VbPjb5sBNG2rgedLcF1AAuY%2FSS2FsfAWBhsmSE1VapyCEw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2 200 jquery-3.6.0.min.js Show response
code.jquery.com/ 87 KB
30 KB 81ms
26ms Script
application/javascript 2a04:4e42:400::649
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.6.0.min.js
Requested by: Host: sayige.lecistum.ru
URL: https://sayige.lecistum.ru/AFiiYYKW/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a04:4e42:400::649 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://sayige.lecistum.ru/
Accept-Language: fr-FR,fr;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 13 May 2024 17:55:43 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 1479124
x-cache: HIT, HIT
content-length: 30875
x-served-by: cache-lga21931-LGA, cache-ams21038-AMS
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1715622944.906540,VS0,VE0
etag: W/"28feccc0-15d9d"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 45, 814173

GET
H2

200

api.js Show response
challenges.cloudflare.com/turnstile/v0/g/1b3559406bc8/
Redirect Chain

https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit
https://challenges.cloudflare.com/turnstile/v0/g/1b3559406bc8/api.js

42 KB
14 KB

33ms
32ms

Script
application/javascript

2606:4700::6811:2b8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://challenges.cloudflare.com/turnstile/v0/g/1b3559406bc8/api.js
Requested by: Host: sayige.lecistum.ru
URL: https://sayige.lecistum.ru/AFiiYYKW/
Protocol: H2
Server: 2606:4700::6811:2b8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ae0e2e45f84d7d3d06526aafc20d4a95b486e8747bf80895f3aeb8c4aebee7f4

Request headers

Accept-Language: fr-FR,fr;q=0.9;q=0.9
Referer: https://sayige.lecistum.ru/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

date: Mon, 13 May 2024 17:55:43 GMT
content-encoding: br
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=604800, public
cross-origin-resource-policy: cross-origin
cf-ray: 883485679ad3d706-CDG
alt-svc: h3=":443"; ma=86400

Redirect headers

date: Mon, 13 May 2024 17:55:43 GMT
server: cloudflare
vary: Accept-Encoding
location: /turnstile/v0/g/1b3559406bc8/api.js
access-control-allow-origin: *
cache-control: max-age=300, public
cross-origin-resource-policy: cross-origin
cf-ray: 883485676a7ed706-CDG
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H3 200 normal
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/plvcb/0x4AAAAAAAZvT6hXWF4UUr00/auto/ Frame D54F 0
0 57ms
37ms Document
text/html 104.17.2.184
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/plvcb/0x4AAAAAAAZvT6hXWF4UUr00/auto/normal

Requested by

Host: challenges.cloudflare.com
URL: https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.2.184 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-src https://challenges.cloudflare.com/; base-uri 'self'

Request headers

Accept-Language: fr-FR,fr;q=0.9;q=0.9
Referer: https://sayige.lecistum.ru/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
alt-svc: h3=":443"; ma=86400
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 88348567fae8d686-CDG
content-encoding: br
content-security-policy: frame-src https://challenges.cloudflare.com/; base-uri 'self'
content-type: text/html; charset=UTF-8
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
date: Mon, 13 May 2024 17:55:44 GMT
document-policy: js-profiling
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
server: cloudflare

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
sibautomation.com/	1970-01-21 00:54:46	Name: uuid Value: 75e13b0e-780c-4159-a2e3-e8342f3fc631
sayige.lecistum.ru/	1970-01-20 20:33:50	Name: XSRF-TOKEN Value: eyJpdiI6IktIalE1THZFOHp5KzBvUmUxM3p5V2c9PSIsInZhbHVlIjoiOWcyeDNiUktYUThnUnZWRFVJenNYUWhURHVpWStQSlFXVmc2S1hnOHhISUJLcmUwRmFqNTN2TFgrby9MRFh3M2RNcXloVXdWNFB1cGUvNTU3dTB2R2pVWm1sZjZ3YzJRRFRTbHNqa0JXVVo2Qkd0L2NnSDVIT0dFSXNFdHA4M0EiLCJtYWMiOiJjNzMwNWQ4ZDJhNGJjZTJkYTc0NGExYWRiNTlmYzhhMmNjMTkzOWU5NWUxODE3MTYxMDMzZjQ4MmUxNWE2OGQ2IiwidGFnIjoiIn0%3D
sayige.lecistum.ru/	1970-01-20 20:33:50	Name: laravel_session Value: eyJpdiI6InRtM09iYmVhUVNvTDJDb2djYUhCNlE9PSIsInZhbHVlIjoiblF4WXp1anJJU0VUV2toVUd1dkRUYWtPLzlKdVk1eFNvRDBNbC8vdXhhOWZPcW44RGhsL1laSVhZSmphelYrZ3pNbSs3K0IvdXhIbnY3QWZDbHpzVnZSa3ovWVY4ZmFmb01mQWI4dzV1UFdYejhnQzdTbmdJY3lJN1FjT1dNUXoiLCJtYWMiOiJiOTNmOWQ0OGVhMDNjN2JkNDQ3MmZlMDFiMmE4ZDI3NjQ5NDBiODMwMzNlNGI5ZjFkZGYxMjliOTYzODU3ZTA1IiwidGFnIjoiIn0%3D

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://de1u1.r.sp1-brevo.net/mk/cl/f/sh/OycZvHuFo1eQsnbUZqZlxMRT/kiF2sNEEvvCr Message: Third-party cookie will be blocked. Learn more in the Issues tab.
javascript	warning	URL: https://sayige.lecistum.ru/AFiiYYKW/ Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.6.0.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://sayige.lecistum.ru/AFiiYYKW/ Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://code.jquery.com/jquery-3.6.0.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://sayige.lecistum.ru/AFiiYYKW/ Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

challenges.cloudflare.com
code.jquery.com
de1u1.r.sp1-brevo.net
heavenlyapartment.store
sayige.lecistum.ru
sibautomation.com
www.bing.com
www.xrpaowa.com
1.179.112.196
104.17.2.184
172.67.217.15
2606:4700:4400::ac40:96ba
2606:4700::6811:2b8
2a02:26f0:3500:1b::1724:a389
2a04:4e42:400::649
2a06:98c1:3120::3
76.223.34.124
3904199d136f42a8bf2117b2a8670940b8b024f8cead25cd19e39059231c74be
4b4e6aeccac1dd73c4e4b28655f0c01b8164fb3bdeaee8d934cfaf285a420f4e
ae0e2e45f84d7d3d06526aafc20d4a95b486e8747bf80895f3aeb8c4aebee7f4
d711b01fb3443fa85ace4745c17fe9b771def89f036edd5c95a73991be2862ab
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

sayige.lecistum.ru Open in urlscan Pro 2a06:98c1:3120::3 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

7 Requests

86 %HTTPS

56 %IPv6

8 Domains

8 Subdomains

7 IPs

4 Countries

51 kBTransfer

138 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

7 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

6 JavaScript Global Variables

3 Cookies

4 Console Messages

Security Headers

Indicators

sayige.lecistum.ru Open in urlscan Pro
2a06:98c1:3120::3 Public Scan

Screenshot
Live screenshot

Full Image

7
Requests

86 %
HTTPS

56 %
IPv6

8
Domains

8
Subdomains

7
IPs

4
Countries

51 kB
Transfer

138 kB
Size

3
Cookies

7 HTTP transactions
0 data transactions