hCaptcha - Stop bots and human abuse.

technology software

corporate

English

__cf_bm

The domain name 'api.hcaptcha.com' uses the commercial generic top-level domain (.com) and includes subdomain 'api'. The registrable portion 'hcaptcha' spans 8 characters split between two vowels and 6 consonants. Splitting it apart reveals two words: h, captcha. Average segment length settles at four characters. No strong language cues emerged from the frequency lists.

html/c0/49/c0498afc-f501-4c6f-818f-adbb7d58c868_fallback.html.gz

default-src 'self'; script-src 'self' analytics.hcaptcha.com a.hcaptcha.com js.hcaptcha.com newassets.hcaptcha.com hcaptcha.com static.cloudflareinsights.com intuitionmachines.widget.insent.ai embed.typeform.com 'unsafe-inline'; style-src 'self' 'unsafe-inline' embed.typeform.com 'unsafe-hashes'; object-src 'self' uploads-ssl.webflow.com; base-uri 'self'; connect-src 'self' website-i18n.hcaptcha.com analytics.hcaptcha.com a.hcaptcha.com a2.hcaptcha.com accounts.hcaptcha.com newassets.hcaptcha.com assets.hcaptcha.com sentry.hcaptcha.com webflow.com cloudflareinsights.com; font-src 'self' embed.typeform.com data:; frame-src 'self' newassets.hcaptcha.com assets.hcaptcha.com intuitionmachines.widget.insent.ai embed.typeform.com form.typeform.com; img-src 'self' embed.typeform.com; manifest-src 'self'; media-src 'self'; worker-src 'none'; frame-ancestors 'self' newassets.hcaptcha.com assets.hcaptcha.com a.hcaptcha.com dashboard.hcaptcha.com intuitionmachines.widget.insent.ai embed.typeform.com; upgrade-insecure-requests; report-uri https://sentry.hcaptcha.com/api/6/security/?sentry_key=30910f52569b4c17b1081ead2dae43b4&sentry_environment=prod&sentry_release=hcaptcha-csp1;

default-src 'self'; script-src 'self' analytics.hcaptcha.com a.hcaptcha.com js.hcaptcha.com newassets.hcaptcha.com hcaptcha.com static.cloudflareinsights.com intuitionmachines.widget.insent.ai embed.typeform.com 'unsafe-inline'; style-src 'self' 'unsafe-inline' embed.typeform.com 'unsafe-hashes'; object-src 'self' uploads-ssl.webflow.com; base-uri 'self'; connect-src 'self' website-i18n.hcaptcha.com analytics.hcaptcha.com a.hcaptcha.com a2.hcaptcha.com accounts.hcaptcha.com newassets.hcaptcha.com assets.hcaptcha.com webflow.com cloudflareinsights.com; font-src 'self' embed.typeform.com data:; frame-src 'self' newassets.hcaptcha.com assets.hcaptcha.com intuitionmachines.widget.insent.ai embed.typeform.com form.typeform.com; img-src 'self' embed.typeform.com; manifest-src 'self'; media-src 'self'; worker-src 'none'; frame-ancestors 'self' newassets.hcaptcha.com assets.hcaptcha.com a.hcaptcha.com dashboard.hcaptcha.com intuitionmachines.widget.insent.ai embed.typeform.com; upgrade-insecure-requests; report-uri https://sentry.hcaptcha.com/api/6/security/?sentry_key=30910f52569b4c17b1081ead2dae43b4&sentry_environment=prod&sentry_release=hcaptcha-csp1;

report-uri https://sentry.hcaptcha.com/api/6/security/?sentry_key=30910f52569b4c17b1081ead2dae43b4&sentry_environment=prod&sentry_release=csp1;

Main content of the hCaptcha challenge

9a37601d1f5a5f2fba3b000694d4bf5e035c606d5485dd94e2997cbe2efe5c26

a23dc0ba74605fd2a10926c5039c1bfc4bab120787be213a54bc2fd6326a3835

eacc91529a068f26b2efbc016b6a3ba468afaacf8877d0591e5121c8933d225a

561abc55482f79c49a783ca893baf9195cafeb9b67990758b69ac78b47d704fd

ffa4813ea5be196fbfff89e55d7e98d6747d756961d20b1027a28aef57631fa0

cfd1e496d0f3d1e46823f4961c716d98b37077373ac7d9958eead370ecc98255

d5d043e1f9ebf5b6574668fd43d3d5d0cd5452f8d17e6890746a2b86866b5bbe

30af9039234cfb75f328ff92d880e330baa4b06983cad55270c00c80cf0aae17

ea1c7bec8b32f6d42f5b27141c92da7f1d878368e7b39ef9079b021cc7added3

b489837128bebf11f71b76db4bc001ac3b655cb45e1e0b6d55efaf4332459d04

22877df4d2083894108981d6775b58d397fb52807fce7d2488561f68e80edc6b

8a18d13015336bc184819a5a768447462202ef3105ec511bf42ed8304a7ed94f

92aa7dc08289f31a88b429aa75aea84f4b056f1e2af7ad71ae86858a979a076d

1ff29e47ee539b42b1067b2b2cde0fa4a0ac1a61a3d85d2b713d77588978df68

f2e1f02d60621218990f6e9426ca08346d067abc5e50450abfd7d2e3d4b7362c

Browser Agent Safety is an Afterthought for Vendors →

Enterprise grade AI security platform with a privacy focus. Replace reCAPTCHA v2, v3, or Enterprise with next generation tech at better value. Used by millions.

description

twitter:card

viewport

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;worker-src blob: 'self';frame-ancestors 'none';

child-src https:  chrome-untrusted://new-tab-page/ chrome-untrusted://ntp-microsoft-auth/;connect-src chrome://resources chrome://theme 'self';default-src 'self';font-src chrome://resources 'self';img-src chrome://resources chrome://theme chrome://image chrome://favicon2 chrome://app-icon chrome://extension-icon chrome://fileicon blob: data: 'self';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources chrome://webui-test 'self';style-src chrome://resources chrome://theme 'self' 'unsafe-inline';trusted-types parse-html-subset sanitize-inner-html static-types webui-test-script webui-test-html polymer-html-literal polymer-template-event-attribute-policy lit-html-desktop;frame-ancestors 'none';

base-uri 'none';child-src https:;form-action https://ogs.google.com https://*.corp.google.com;object-src 'none';script-src 'self' 'unsafe-inline' https:;frame-ancestors chrome://new-tab-page/

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;frame-ancestors 'none';

NameCheap, Inc.

HCAPTCHA.COM

Abuse

Admin

Cloudflare-NOC

Cloudflare, Inc.

CLOUDFLARENET

!function(o,c){var n=c.documentElement,t=" w-mod-";n.className+=t+"js",("ontouchstart"in o||o.DocumentTouch&&c instanceof DocumentTouch)&&(n.className+=t+"touch")}(window,document);


  function getqvar(varName){
    var qs = unescape(window.location.search) + '&';
    var regex = new RegExp('.*?[&\\?]' + varName + '=(.*?)&.*');
    val = qs.replace(regex, "$1");
    return val == qs ? false : val;
  }

  window.referrer = getqvar('r');
  if (window.referrer) {
    document.cookie = "r=" + window.referrer + ';path=/;domain=.hcaptcha.com';
  }


window.plausible = window.plausible || function() { (window.plausible.q = window.plausible.q || []).push(arguments) }


  function onLoad() {
    hcaptcha.render("h-captcha", {
      sitekey: "bff2db2a-931a-42e0-a13e-12746ada9366",
      size: "invisible",
    });

    hcaptcha.execute();
  }



/**
 * Include on static page to enable translations.
 *
 * Loads only necessary dict files.
 *
 */

/**
 * @module Language
 * @desc
 * Language Translation Module used to process text and covert a string based on user defined language.
 * Language can be defined by Client's browser or API
 * @requires module:utils
 */
var Language =  {

    /**
     * @name module:Language#getLocale
     * @return {string} Defined ISO 639-1 Language Codes
     * @see https://www.w3schools.com/tags/ref_language_codes.asp
     * @example
     * en-us
     */
    getLocale: function(override) {
        var locale = override || window.navigator.userLanguage || window.navigator.language;

        // Get short locale for remapping purposes
        var short_locale = Language.getShortLocale(locale);

        // Remap known locales
        if (short_locale === "in") {
            short_locale = "id";
        }
        if (short_locale === "he") {
            short_locale = "iw";
        }
        if (short_locale === "nb") {
            short_locale = "no";
        }

        // need multiple versions for Chinese
        if (locale.includes("zh-CN")) {
            short_locale = locale;
        }

        return short_locale;
    },


    /**
     * @name module:Language#getShortLocale
     * @return {string} Restricts the ISO 639-1 Language Code to two chracters
     * @example
     * en-us > en
     */
    getShortLocale: function(locale) {
        return locale.substring(0, 2);
    }

};

// find manually data-tagged but missing translation class
var textM = $('body *').contents().filter(function() {
    return ($(this).parent().data("vavilon") != null) && (!$(this).parent().hasClass("vavilon"));
});

// tag with class
textM.each(function( index ) {
  $(this).parent().addClass("vavilon");
});

// tag all elements based on content for ease of translation
// MurmurHash 3, MIT license. https://github.com/jensyt/imurmurhash-js/blob/master/imurmurhash.min.js
!function(){function t(h,r){var s=this instanceof t?this:e;return s.reset(r),"string"==typeof h&&h.length>0&&s.hash(h),s!==this?s:void 0}var e;t.prototype.hash=function(t){var e,h,r,s,i;switch(i=t.length,this.len+=i,h=this.k1,r=0,this.rem){case 0:h^=i>r?65535&t.charCodeAt(r++):0;case 1:h^=i>r?(65535&t.charCodeAt(r++))<<8:0;case 2:h^=i>r?(65535&t.charCodeAt(r++))<<16:0;case 3:h^=i>r?(255&t.charCodeAt(r))<<24:0,h^=i>r?(65280&t.charCodeAt(r++))>>8:0}if(this.rem=3&i+this.rem,i-=this.rem,i>0){for(e=this.h1;;){if(h=4294967295&11601*h+3432906752*(65535&h),h=h<<15|h>>>17,h=4294967295&13715*h+461832192*(65535&h),e^=h,e=e<<13|e>>>19,e=4294967295&5*e+3864292196,r>=i)break;h=65535&t.charCodeAt(r++)^(65535&t.charCodeAt(r++))<<8^(65535&t.charCodeAt(r++))<<16,s=t.charCodeAt(r++),h^=(255&s)<<24^(65280&s)>>8}switch(h=0,this.rem){case 3:h^=(65535&t.charCodeAt(r+2))<<16;case 2:h^=(65535&t.charCodeAt(r+1))<<8;case 1:h^=65535&t.charCodeAt(r)}this.h1=e}return this.k1=h,this},t.prototype.result=function(){var t,e;return t=this.k1,e=this.h1,t>0&&(t=4294967295&11601*t+3432906752*(65535&t),t=t<<15|t>>>17,t=4294967295&13715*t+461832192*(65535&t),e^=t),e^=this.len,e^=e>>>16,e=4294967295&51819*e+2246770688*(65535&e),e^=e>>>13,e=4294967295&44597*e+3266445312*(65535&e),e^=e>>>16,e>>>0},t.prototype.reset=function(t){return this.h1="number"==typeof t?t:0,this.rem=this.k1=this.len=0,this},e=new t,"undefined"!=typeof module?module.exports=t:this.MurmurHash3=t}();

// find untagged strings
var textS = $('body *').contents().filter(function() {
    return (this.nodeType == 3) && (this.nodeValue.length > 3) && this.nodeValue.match(/[a-z]/) && (! this.nodeValue.match(/\@|©/)) && ($(this).parent().data("vavilon") == null || typeof $(this).parent().data("vavilon") === 'number') && (!$(this).parent().is("script")) && $(this).parents('.code-snippet').length === 0;
});

tKeys = {}
// tag with hash
textS.each(function( index ) {
  var h = MurmurHash3(this.nodeValue).result();
  $(this).parent().attr("data-vavilon", h).addClass("vavilon");
  // hack to preserve insertion order: V8 re-sorts "string" ints.
  tKeys['XXXHHH' + h] = $(this).text().trim();
  // tKeys[h] = $(this).text().trim();
});

// output for key file
// console.log(JSON.stringify(tKeys));


// check if vavilon cookie is set
var c = document.cookie.split(";");
var lang;
for (var i=0; i < c.length; i++)
    if (c[i].indexOf("vavilon") >= 0)
        lang = c[i].split("=")[1]

var urlParams = new URLSearchParams(window.location.search);
var hl_lang = urlParams.get('hl');

if (hl_lang && (hl_lang.length > 5 || ! /^[a-zA-Z0-9\-]+$/.test(hl_lang))) {
    // reject invalid hl param: too long or unexpected chars
    hl_lang = null;
}

var browser_lang = Language.getLocale(hl_lang);
var pathname = window.location.pathname;

// var asset_root = "https://assets.hcaptcha.com/website-i18n";
if (browser_lang.indexOf("zh") >= 0) {
  var asset_root = "https://website-i18n.hcaptcha.com";
} else {
  var asset_root = "https://newassets.hcaptcha.com/website-i18n";
}

var page = "main";
var tr_path = asset_root + "/" + browser_lang + "/" + page + ".json";
var en_path = asset_root + "/" + "en" + "/" + page + ".json";

function updateOpt(lang) {
  $("#switch-to-english").text("Switch to " + lang.toUpperCase());
  var finalStr = "javascript:setLang('" + lang + "'); $('html').attr('lang', '" + lang + "');"
  if (lang != "en") {
    finalStr += "updateOpt('en');";
  } else {
    finalStr += "updateOpt('" + browser_lang + "');";
  }
  document.getElementById("switch-to-english").href = finalStr;
}

function switchToEnglish() {
  $("html").attr("lang", "en");
  setLang('en');
  updateOpt(browser_lang);
}


if ((hl_lang && hl_lang  !== "en") || (browser_lang !== "en" && lang !== 'en')) {
        $("html").attr("lang", browser_lang);
        // unhide switch to english part on block
        $('#switch-to-english').show();
        // load correct lang JSON
        var element = document.createElement("script");
        element.src = tr_path;
        element.setAttribute("type", "application/json");
        element.setAttribute("data-vavilon-dict", browser_lang);
        document.body.appendChild(element);

        var haveEn = $('script').filter(function() {
            return $(this).attr("data-vavilon-dict") === 'en';
        }).length > 0;

        // do we need to load en?
        if (! haveEn) {
          // load en lang JSON to switch
          var element2 = document.createElement("script");
          element2.src = en_path;
          element2.setAttribute("type", "application/json");
          element2.setAttribute("data-vavilon-dict", "en");
          document.body.appendChild(element2);
        }

        // due to element race
        setTimeout(function() {
            // load vavilon JS
            // var element2 = document.createElement("script");
            // element2.src = "https://newassets.hcaptcha.com/website-tr/js/vavilon_mod.min.js";
            //"https://assets.hcaptcha.com/website-tr-js/vavilon.min.js";
            // document.body.appendChild(element2);
            // setLang(browser_lang)
            // once more, just in case

            // direct insertion
            !function(){"use strict";var o=(n.prototype.hasString=function(n){return this.strings.hasOwnProperty(n)},n.prototype.load=function(t){var i=this;!function(n,t){var i=new XMLHttpRequest;i.onload=function(){this.status<300&&200<=this.status&&t&&t(i.responseText)},i.open("GET",n,!0),i.send()}(this.url,function(n){i.strings=JSON.parse(n),t&&t()})},n);function n(n,t){void 0===t&&(t={}),this.url=n,this.strings=t}function t(n){var t=new Date;t.setTime(t.getTime()+31536e7);var i="; expires="+t.toUTCString();document.cookie="vavilon-locale="+(n||"")+i+"; path=/"}function i(){return(function(){var n=("; "+document.cookie).split("; vavilon-locale=");return 2===n.length?n[1].split(";")[0]:null}()||window.navigator.language||window.browserLanguage||window.userLanguage).toLowerCase()}function u(){this.n=i(),this.t=document.documentElement.lang.toLowerCase(),this.i=null,this.o={},this.u=null}var c=new(u.prototype.find=function(){this.i=document.getElementsByClassName("vavilon")},u.prototype.replace=function(){var i=this;this.i&&this.u&&(this.o[this.t]||(this.o[this.t]=new o(null)),Array.from(this.i).forEach(function(n){var t=n.dataset.vavilon;i.o[i.u].hasString(t)&&(i.o[i.t].hasString(t)||(i.o[i.t].strings[t]=n.innerText.trim()),n.innerHTML=i.o[i.u].strings[t])}))},u.prototype.addDicts=function(){var i=this;Array.from(document.scripts).filter(function(n){return n.dataset.hasOwnProperty("vavilonDict")}).forEach(function(n){var t=n.dataset.vavilonDict.toLowerCase();i.o[t]=new o(n.src)})},u.prototype.loadDicts=function(t){var i=this;Object.keys(this.o).forEach(function(n){n===i.n||n.slice(0,2)===i.n.slice(0,2)&&!i.u?(i.u=n,i.o[n].load(function(){i.pageDictLoaded=!0,t()})):i.o[n].load()})},u.prototype.setLocale=function(n){return this.o[n]?(this.u=n,t(this.u),!0):!!this.o[n.slice(0,2)]&&(this.u=n.slice(0,2),t(this.u),!0)},u),s=!1;c.addDicts(),c.loadDicts(function(){s&&c.replace()}),window.onload=function(){c.find(),s=!0,c.pageDictLoaded&&c.replace()},window.setLang=function(n){n=n.toLowerCase(),c.setLocale(n)&&c.replace()}}();
            // make sure we translate
            window.onload()

            // double up for manual override
            if (hl_lang !== null) {
                // console.log("lang", hl_lang)
                setLang(hl_lang);
                setTimeout(function() {
                    setLang(hl_lang);
                }, 300);
            } else {
                // console.log("browser_lang", browser_lang)
                setLang(browser_lang);
                setTimeout(function() {
                    setLang(browser_lang);
                }, 300);

            }

            // race
            document.getElementById("switch-to-english").href = "javascript:switchToEnglish();";
        }, 300);
} else {
        // if (browser_lang == "en") {
        //   $('#switch-to-english').hide();
        // }
            // we show the block on main page always page because of the link to /accessibility
        // but the block is not visible by default on accessibility page as it only contains
        // switch language option
        if (window.location.pathname === '/accessibility') {
            $('#acc-switch-block').hide();
        }
};


Requests	IP Address	Location	AS Autonomous System
56	104.19.229.21	United States	AS13335CLOUDFLARENET
6	104.19.230.21	United States	AS13335CLOUDFLARENET
6	104.16.80.73	United States	AS13335CLOUDFLARENET
6	2606:4700::6812:ccd	United States	AS13335CLOUDFLARENET
6	2606:4700::6810:4f49	United States	AS13335CLOUDFLARENET
6	104.18.13.205	United States	AS13335CLOUDFLARENET
6	2606:4700::6810:5049	United States	AS13335CLOUDFLARENET
6	2606:4700::6812:dcd	United States	AS13335CLOUDFLARENET
3	104.16.79.73	United States	AS13335CLOUDFLARENET
1	104.18.12.205	United States	AS13335CLOUDFLARENET
60	10	-	-

Security Scan Report: api.hcaptcha.com

Summary

AI Security Verdict

Safe Website

Safety Factors

Details

Bot Protection Detected

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History