Cracking

capture

The only capture we hold is a challenge page, not the service. It is kept for evidence but is not shown here as if it were the site. View the raw capture.

what the page says

Just a moment...

cracking.org Performing security verification This website uses a security service to protect against malicious bots. This page is displayed while the website verifies you are not a bot. Ray ID: a2e96e4c0c528755 Performance and Security by Cloudflare Privacy

reachability history

The 5 most recent checks.
When	Status	HTTP	Response	Bytes	Via
4m ago	Responding-403	403	139 ms	5,552	curl
1h ago	Responding-403	403	259 ms	5,552	curl
2h ago	Responding-403	403	238 ms	5,552	curl
4h ago	Responding-403	403	242 ms	5,552	curl
6h ago	Responding-403	403	23 ms	6,064	chrome-stealth

security headers

Csp

Raw

default-src 'none'; script-src 'nonce-XZvsuUtkaMFsDv9La63Lsl' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self'

Directives

Default src: 'none'
Script src: 'nonce-XZvsuUtkaMFsDv9La63Lsl''unsafe-eval'https://challenges.cloudflare.com
Script src attr: 'none'
Style src: 'unsafe-inline'
Img src: 'self'https://challenges.cloudflare.com
Connect src: 'self'https://challenges.cloudflare.com
Frame src: 'self'https://challenges.cloudflare.comblob:
Child src: 'self'https://challenges.cloudflare.comblob:
Worker src: blob:
Form action: http:https:
Base uri: 'self'

Unsafe inline

yes

Unsafe eval

yes

X frame options

SAMEORIGIN

X content type options

nosniff

Referrer policy

same-origin

Permissions policy

Accelerometer: ()
Camera: ()
Clipboard read: ()
Clipboard write: ()
Geolocation: ()
Gyroscope: ()
Hid: ()
Magnetometer: ()
Microphone: ()
Payment: ()
Publickey credentials get: ()
Screen wake lock: ()
Serial: ()
Sync xhr: ()
Usb: ()
Xr spatial tracking: *

Cross origin

Opener: same-origin
Embedder: require-corp
Resource: same-origin

Cookies

Count: 0
Secure: 0
Httponly: 0
Samesite: 0

Score

66

Missing

hsts

tls certificate

Protocol: TLS 1.3
Cipher: AES_128_GCM
Key exchange group: X25519MLKEM768
Signature algorithm: 1027
Subject: cracking.org
Issuer: WE1
San: cracking.org*.cracking.org
San count: 2
Wildcard: yes
Valid from: 2026-07-27 07:11:30
Valid to: 2026-10-25 08:10:10
Days remaining: 64
Self signed: no
Ct compliance: unknown
Ech: no

technology detected

Server

Raw: cloudflare
Name: cloudflare
Family: cloudflare

Frameworks

Name
AngularJS

Js

Name
Turnstile

Cdn

Cloudflare

Protocol

h2

what blocks us

Detected: yes
Kind: cloudflare-interstitial
Vendor: Cloudflare
Label: Cloudflare JS challenge
Confidence: 100
Signals: cf-mitigated: challengeserved through CloudflareCloudflare challenge-platform scriptcf_chl_opt bootstrap objectchallenge-platform asset path_cf_chl_opt bootstraptitle contains "just a moment"document body is almost empty (260 chars)HTTP 403
Self clearing: yes
Cleared: no
Waited ms: 25684
Http code: 403
Via: chrome-stealth

contacts published

Total0

crypto addresses

Total0

forms on the page

Count: 0
Has login: no
Has search: no
Has upload: no

outbound onion links

onion_unique not tracked onion_unique
onion_total not tracked onion_total
clearnet_unique not tracked clearnet_unique 1
internal not tracked internal
external not tracked external 2
total not tracked total 2
truncated not tracked truncated

response headers

Header	Value
`accept-ch`	Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
`alt-svc`	h3=":443"; ma=86400
`cf-mitigated`	challenge
`cf-ray`	a2e96e4c0c528755-CPH
`content-encoding`	zstd
`content-security-policy`	default-src 'none'; script-src 'nonce-XZvsuUtkaMFsDv9La63Lsl' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenges.cloudflare.com blob:; child-src 'self' https://challenges.cloudflare.com blob:; worker-src blob:; form-action http: https:; base-uri 'self'
`content-type`	text/html; charset=UTF-8
`critical-ch`	Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
`cross-origin-embedder-policy`	require-corp
`cross-origin-opener-policy`	same-origin
`cross-origin-resource-policy`	same-origin
`date`	Fri, 21 Aug 2026 11:52:18 GMT
`nel`	{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
`origin-agent-cluster`	?1
`permissions-policy`	accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=(),xr-spatial-tracking=*
`referrer-policy`	same-origin
`report-to`	{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=IDxKjl0O3rK8UojAuwh25fVWLGXkrqlsLt7KzMmAqKVolJICjGjJe8SgLhXGUGjLKR2SVxvAStwhdck6S3UMi73DTObTciqoQ2baKT60d9NMjEUdTxYf%2B0dq7OL8Cl8%3D"}]}
`server`	cloudflare
`server-timing`	chlray;desc="a2e96e4c0c528755"
`x-content-type-options`	nosniff
`x-frame-options`	SAMEORIGIN