xleet

capture

The only capture we hold is a challenge page, not the service. It is kept for evidence but is not shown here as if it were the site. View the raw capture.

what the page says

xLeet

xLeet Shop Tools, Xleet, Xleet.pw, Shells, Xleet.Is, Xleet.cc store,Xleet Cheap RDP, Xleet RDPs, SSH, Xleet cPanel,Xleet Mailer,Xleet SMTPs,xleet Webmail Shop

xLeet Welcome Back ! We ‘re so excited to see you again ! Email Password Login Forgot password? - Need an account? Register

reachability history

The 4 most recent checks.
When	Status	HTTP	Response	Bytes	Via
1h ago	Alive	200	411 ms	6,377	chrome-stealth
2h ago	Alive	200	381 ms	6,377	chrome-stealth
3h ago	Alive	200	585 ms	6,377	chrome-stealth
5h ago	Alive	200	907 ms	6,377	chrome-stealth

security headers

Csp

Raw

default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';

Directives

Default src: 'self'http:https:data:blob:'unsafe-inline'
Frame ancestors: 'self'

Unsafe inline

yes

Unsafe eval

Hsts

Max age: 31536000
Include subdomains: yes
Preload: no

X content type options

nosniff

Referrer policy

no-referrer-when-downgrade

Cross origin

X xss protection

1; mode=block

Cookies

Count: 0
Secure: 0
Httponly: 0
Samesite: 0

Score

57

Missing

x_frame_optionspermissions_policycoopcoepcorp

technology detected

Server

Raw: nginx
Name: nginx
Family: nginx

Js

Name
jQuery
Version
3.3.1
Name
Bootstrap
Version
4.1.3
Name
Turnstile
Name
Font Awesome

Protocol

http/1.1

what blocks us

Detected: yes
Kind: cloudflare-turnstile
Vendor: Cloudflare
Label: Cloudflare Turnstile
Confidence: 100
Signals: Turnstile widget origincf-turnstile widget containerwidget sitekey attributedocument body is almost empty (128 chars)
Self clearing: yes
Cleared: no
Waited ms: 20048
Http code: 200
Via: chrome-stealth

contacts published

Total0

crypto addresses

Total0

forms on the page

Count

1

Kinds

Register: 1

Has login

Has search

Has upload

Forms

Kind
register
Method
post
Action
http://xleetg4krpki4irlaelwacpfhfxnhpizuipxc7f3aztu7265fqvinfad.onion/log-in
Inputs
4
Types
emailpasswordhiddensubmit
Password
yes
File
no

outbound onion links

onion_unique not tracked onion_unique
onion_total not tracked onion_total
clearnet_unique not tracked clearnet_unique
internal not tracked internal 2
external not tracked external
total not tracked total 2
truncated not tracked truncated

response headers

Header	Value
`cache-control`	no-cache, private
`connection`	keep-alive
`content-encoding`	gzip
`content-security-policy`	default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';
`content-type`	text/html; charset=UTF-8
`date`	Fri, 21 Aug 2026 17:47:07 GMT
`referrer-policy`	no-referrer-when-downgrade
`server`	nginx
`strict-transport-security`	max-age=31536000; includeSubDomains
`transfer-encoding`	chunked
`vary`	Accept-Encoding
`x-content-type-options`	nosniff
`x-xss-protection`	1; mode=block