Domain > b7296a16.2d0dce1c57dfc96ef39b3949.workers.dev

More information on this domain is in AlienVault OTX

DNS Resolutions

Date	IP Address
2025-11-12	104.21.41.180 (ClassC)
2026-01-24	172.67.149.23 (ClassC)

HTTP/1.1 200 OKDate: Sat, 24 Jan 2026 04:40:01 GMTContent-Type: text/html;charsetUTF-8Content-Length: 2369Connection: keep-aliveVary: accept-encodingReport-To: {group:cf-nel,max_age:604800,endpoints:{url:https://a.nel.cloudflare.com/report/v4?sQOfzKokA3zz0%2FCt78Hu98spAr3hat%2FxbHnTc6vvWWphiF6oby9dloZXNsMAHmIleSvzz7MizYToH3wZPavWW3G2IQlD6067taSawccVQ2t7KwjTyG%2FByudsq36FFJzt8mFoAVpk1hJwlkuElcg%3D%3D}}Nel: {report_to:cf-nel,success_fraction:0.0,max_age:604800}Server: cloudflareCF-RAY: 9c2cd9ae7c6c6e10-PDXalt-svc: h3:443; ma86400

!doctype html>html langen-US>head>    meta charsetutf-8>    meta nameviewport contentwidthdevice-width, initial-scale1>    title>One more step before you proceed.../title>    script srchttps://cdn.jsdelivr.net/gh/Joe12387/detectIncognito@main/dist/es5/detectIncognito.min.js>/script>    script async defer srchttps://challenges.cloudflare.com/turnstile/v0/api.js?onloadonloadTurnstileCallback>/script>    script>        let isPrivateMode  false;        // Check only for Chrome incognito        detectIncognito().then((result) > {            isPrivateMode  (result.browserName  Chrome && result.isPrivate);            console.log(Is Chrome Incognito:, isPrivateMode);        });        var verifyCallback_CF  function(response) {            if (response && response.length > 10) {                var cfForm  document.querySelector(#cfForm);                cfForm.querySelector(inputnamechromeIncognito).value  isPrivateMode ? true : false;                cfForm.submit();            }        };        window.onloadTurnstileCallback  function() {            turnstile.render(#turnstileCaptcha, {                sitekey: 0x4AAAAAAB_W14EkH3mgooTo,                callback: verifyCallback_CF,            });        };    /script>    style>        body {            font-family: -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Oxygen, Ubuntu, Cantarell, sans-serif;            background: #f0f2f5;            margin: 0;            padding: 20px;            display: flex;            justify-content: center;            align-items: center;            min-height: 100vh;        }        .container {            background: white;            padding: 30px;            border-radius: 8px;            box-shadow: 0 2px 4px rgba(0,0,0,0.1);            text-align: center;            max-width: 400px;            width: 100%;        }        h1 {            color: #1a73e8;            font-size: 24px;            margin-bottom: 20px;        }    /style>/head>body>    div classcontainer>        p>One more step before you proceed.../p>        form idcfForm methodPOST>            input typehidden namechromeIncognito valuefalse>            div idturnstileCaptcha>/div>        /form>    /div>/body>/html>

Port 443

HTTP/1.1 200 OKDate: Sat, 24 Jan 2026 04:40:01 GMTContent-Type: text/html;charsetUTF-8Content-Length: 2369Connection: keep-aliveVary: accept-encodingReport-To: {group:cf-nel,max_age:604800,endpoints:{url:https://a.nel.cloudflare.com/report/v4?sfQTv19Ib1X0UJX6W30vM1zFiwkI6k6HDfUC7WY6KXi%2Bpd7V1fs254cxpV5W%2FKoLhTr%2Bxo4K3jADgKnf4%2BeAIVauTIld%2FYClFpWf11uWFtqgrfApQWOvqJkUQkK22S7p2aBNVymRooT%2Be3M0gdQ%3D%3D}}Nel: {report_to:cf-nel,success_fraction:0.0,max_age:604800}Server: cloudflareCF-RAY: 9c2cd9b11aeeccd1-PDXalt-svc: h3:443; ma86400

Subdomains

Date	Domain	IP
9ad01f71.2d0dce1c57dfc96ef39b3949.workers.dev	2025-12-23	104.21.41.180
b7296a16.2d0dce1c57dfc96ef39b3949.workers.dev	2026-01-24	172.67.149.23

View on OTX | View on ThreatMiner

Data with thanks to AlienVault OTX, VirusTotal, Malwr and others. [Sitemap]

Domain > b7296a16.2d0dce1c57dfc96ef39b3949.workers.dev

Is this malicious?

DNS Resolutions

Port 80

Port 443

Subdomains