Report - 196.mbvnclickpush2.online/

Report Overview

Submitted URL
196.mbvnclickpush2.online/
IP
136.243.78.223
ASN
#24940 Hetzner Online GmbH
Submitted
2024-05-08 14:21:38
Access
public
Website Title
Would You Make A Great Career Online And Become A Millionaire By 2024?
Final URL
googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf&utm_campaign=2256&utm_medium=6070194&utm_content=zd_public_v2
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
26

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
196.mbvnclickpush2.online	unknown	unknown	No data	No data	480 B	251 B	136.243.78.223
my.rtmark.net	9054	2014-10-29	2015-02-04	2024-05-06	431 B	747 B	139.45.195.8
googrootsurvey.top	unknown	2023-06-28	2023-06-28	2024-04-17	24 kB	629 kB	188.114.96.1
datatechonert.com	46154	2021-12-24	2021-12-24	2024-05-07	542 B	486 B	139.45.195.253
www.gstatic.com	unknown	2008-02-11	2016-07-26	2024-05-07	448 B	207 kB	142.250.74.99
leadhits.media-412.com	unknown	2019-02-26	2023-07-10	2024-03-14	1.0 kB	753 B	34.90.92.78
arleavannya.com	unknown	2024-01-22	2024-01-22	2024-05-03	4.8 kB	7.4 kB	139.45.197.248
offpichuan.com	unknown	2023-03-30	2023-03-31	2024-05-03	1.0 kB	4.8 kB	139.45.197.237
www.google.com	7	1997-09-15	2015-05-10	2024-03-23	394 B	1.3 kB	142.250.74.132
ofklefkian.com	unknown	2024-01-25	2024-01-25	2024-05-06	499 B	531 B	139.45.197.251

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-05-08	medium	arleavannya.com	Sinkholed
2024-05-08	medium	arleavannya.com	Sinkholed
2024-05-08	medium	arleavannya.com	Sinkholed
2024-05-08	medium	offpichuan.com	Sinkholed
2024-05-08	medium	arleavannya.com	Sinkholed
2024-05-08	medium	arleavannya.com	Sinkholed
2024-05-08	medium	arleavannya.com	Sinkholed
2024-05-08	medium	arleavannya.com	Sinkholed
2024-05-08	medium	arleavannya.com	Sinkholed
2024-05-08	medium	offpichuan.com	Sinkholed
2024-05-08	medium	arleavannya.com	Sinkholed
2024-05-08	medium	arleavannya.com	Sinkholed
2024-05-08	medium	ofklefkian.com	Sinkholed

ThreatFox

No alerts detected

JavaScript (32)

	URL	Size	First Seen	Last Seen
	googrootsurvey.top/js/s-checkLocalStorageAvailable.ts.f2fef93d.js	330 B	2024-04-09	2024-05-19
Pretty URL googrootsurvey.top/js/s-checkLocalStorageAvailable.ts.f2fef93d.js IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-09 03:12:49 Last Seen2024-05-19 23:54:01 Times Seen553 Hash f23ca32d86f4a0e4179319172a667c74 a68d98bd989ff8804424b8b38f2104f5b562e4b4 0d92eabc50682ed456954a64fdfad12a54b3da489957e9e70479724f5503752f Loading...

	googrootsurvey.top/pfe/current/micro.tag.min.js?z=6679100&sw=/sw/sw6679100.js&var=6070194&var_3=null&var_4=null&ymid=2256&cdn=1&domain=ofklefkian.com&ab2_ttl=5184000000	27 kB	2024-01-17	2024-05-19
Pretty URL googrootsurvey.top/pfe/current/micro.tag.min.js?z=6679100&sw=/sw/sw6679100.js&var=6070194&var_3=null&var_4=null&ymid=2256&cdn=1&domain=ofklefkian.com&ab2_ttl=5184000000 IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-01-17 10:52:24 Last Seen2024-05-19 23:54:01 Times Seen4180 Hash 75c26ccd65e96e912725399ff3ce66e9 d300939979d2048844dc5ac80c51ed8121126f4e c9db5c92934b273ad485c58710d6fbc2d580c2923a99bb456b18cb5e1465f5cf Loading...

	googrootsurvey.top/js/v-attributes-to-props.js.a2e7cd04.js	702 B	2024-04-09	2024-05-19
Pretty URL googrootsurvey.top/js/v-attributes-to-props.js.a2e7cd04.js IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-09 03:12:48 Last Seen2024-05-19 23:54:01 Times Seen523 Hash eb57bdb06e45aff1918587283bf415aa 27d660f01e5c888c9d38a6f784ee2f4458d7d89f ecdd5f30b2bd16e4aa0274c6fce3d598419837aa257c285f2e6d18ac5df9ce0b Loading...

	googrootsurvey.top/js/v-index.mjs.19622407.js	35 kB	2024-04-09	2024-05-19
Pretty URL googrootsurvey.top/js/v-index.mjs.19622407.js IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-09 03:12:49 Last Seen2024-05-19 23:54:01 Times Seen821 Hash 1de1ec2d8e7940b88970d8fbce40ed6d 510aa24127fb8bc3578d9ca4628b2eea5a84ce01 b473156bef833bcfb2e84658093f1ebc1e64011dcba904e26ccb31f1cad8b762 Loading...

	googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf	135 B	2023-11-23	2024-05-19
Pretty URL googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-11-23 13:28:57 Last Seen2024-05-19 18:05:16 Times Seen5444 Hash 2a09c62ade9bdbd73d5b821d7eb7224a c6a062a7229c27cc653a472936a4233f53378601 7b6f6684bffd8b9b04937cd8fa05b0e46e6b92f65b8695df8dd4265e52b8cd55 Loading...

	googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf	1.8 kB	2024-03-20	2024-05-19
Pretty URL googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2024-03-20 09:12:57 Last Seen2024-05-19 18:05:16 Times Seen341 Hash dc9776ef2bd827ccf727e1e0efd4240d deff6f3a39bd6c08b3abd4e752262170f67a7b52 3ff9b82e8efaffacff6dfb4104abe6b354d851d05fccfebc7b098d6678c7ff6f Loading...

	googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf	807 B	2024-04-26	2024-05-14
Pretty URL googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2024-04-26 14:10:49 Last Seen2024-05-14 09:29:53 Times Seen189 Hash 52c7ff32668b8685300956c75598998c 16832d393862601407238516660e00f75d10b77c b21ec30618d4a9ee4ad4bf9843efbf0a5b2d20f68b6a3b5dcb5ea1da559afca1 Loading...

	googrootsurvey.top/js/s-checkSessionStorageAvailable.ts.e8412d91.js	330 B	2024-04-09	2024-05-19
Pretty URL googrootsurvey.top/js/s-checkSessionStorageAvailable.ts.e8412d91.js IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-09 03:12:49 Last Seen2024-05-19 23:54:01 Times Seen535 Hash a1707fb484c103f2351843fcfb7028c4 43d3d0c0563335d6a9ba13a8920bdf7b70cea7bd bec32703d77fa5a512dd84399bdd43cb32735e483476e66d0eeb957a403c790c Loading...

	googrootsurvey.top/js/survey.1ad1decb.js	6.7 kB	2024-02-16	2024-05-19
Pretty URL googrootsurvey.top/js/survey.1ad1decb.js IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-02-16 00:18:04 Last Seen2024-05-19 18:05:16 Times Seen945 Hash bba1de3477ddd7745304c697ddbe0f84 efacfcf33e090080956f14bf80ca220d09f3f9a4 92e2749dea98798c3452496b4544fd9cd5fe259017c53fb5c2e5785b61cf7ecf Loading...

	googrootsurvey.top/js/v-domparser.js.97173b2e.js	1.7 kB	2024-04-09	2024-05-19
Pretty URL googrootsurvey.top/js/v-domparser.js.97173b2e.js IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-09 03:12:48 Last Seen2024-05-19 23:54:01 Times Seen526 Hash 52ca18eed5d7b4a88f79e075608522fb 8332ab1afc8d9c23d127cbc785fb41af81563732 ce352016d1e917abce6b5552ae2fdc941a8998300566b138d04383ae461f0a9d Loading...

	www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__en.js	518 kB	2024-04-24	2024-05-15
Pretty URL www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__en.js IP 142.250.74.99 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-24 09:18:30 Last Seen2024-05-15 19:10:18 Times Seen9003 Hash e2e79d6b927169d9e0e57e3baecc0993 1299473950b2999ba0b7f39bd5e4a60eafd1819d 231336ed913a5ebd4445b85486e053caf2b81cab91318241375f3f7a245b6c6b Loading...

	googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf	2.2 kB	2024-04-18	2024-05-19
Pretty URL googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2024-04-18 08:10:55 Last Seen2024-05-19 18:05:16 Times Seen293 Hash 0d4422ba028191efc55c61747d4c6fd7 a094d746c497a943ca11297fde4a77901fc76347 35edc7d3301ec86e20e1b95ce89bedc232e893e5cfc5e6c07dccaaf33ccf96d5 Loading...

	googrootsurvey.top/js/v-react-dom.production.min.js.c3329619.js	129 kB	2024-04-10	2024-05-19
Pretty URL googrootsurvey.top/js/v-react-dom.production.min.js.c3329619.js IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-10 11:10:51 Last Seen2024-05-19 23:54:02 Times Seen629 Hash c53e5e3d8c5ca5f1c4edbce65426edfc 36cc2e7e0b893d82bf5f457c7a62374019d0f7aa ed83bf6bc001bd6f841c76b67aedfd3bc02cb28fb5537a1d55804f5ad0515e39 Loading...

	googrootsurvey.top/js/_core-survey.1b09882a.js	170 kB	2024-04-11	2024-05-19
Pretty URL googrootsurvey.top/js/_core-survey.1b09882a.js IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-11 19:19:07 Last Seen2024-05-19 23:54:01 Times Seen380 Hash 0190c361e1a4f2f7239f497544c5e616 27a6eae98d28880bd36f9024c7bdae0f41623a5c de932ff55d7e505890689d887ac80b2ca7bcfbd491f49445d0314c982bcb99a4 Loading...

	googrootsurvey.top/pfe/current/stattag.js	19 kB	2024-01-17	2024-05-19
Pretty URL googrootsurvey.top/pfe/current/stattag.js IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-01-17 11:23:44 Last Seen2024-05-19 23:54:02 Times Seen4683 Hash 3a74216e872211a9c770302bb7d4a63f 7e63556174a7d66eee407218e503ec0aae2c0f9e 03405209d89a927b81d53eb13968663069760776389c5400bb79d11bd9f78f78 Loading...

	googrootsurvey.top/js/s-storageService.js.bb9f7a22.js	2.2 kB	2024-04-09	2024-05-19
Pretty URL googrootsurvey.top/js/s-storageService.js.bb9f7a22.js IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-09 03:12:49 Last Seen2024-05-19 23:54:01 Times Seen555 Hash a804db09269d602a8a7a50877b60fc86 7aa84eb6c94037c3bfabdf407060ba7b9ca73ff3 f5e3a988f32cdcd8ccdff165e33a1807acdde6426cecbb464c315306ff5e6f6f Loading...

	googrootsurvey.top/js/_each-land-config.3299fec3.js	72 kB	2024-04-10	2024-05-14
Pretty URL googrootsurvey.top/js/_each-land-config.3299fec3.js IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-10 11:10:52 Last Seen2024-05-14 09:55:39 Times Seen473 Hash 0ba3468fb169d838d511e11b5b33eaef fb53785cd4dcc6e5cf0fcebfcafed46a3968cbe9 6de414b4180a6f11c4f5a9ba570d5e97ac8e596b1f9c1bb86872a11ecd416384 Loading...

	googrootsurvey.top/js/v-utilities.js.d1112fc4.js	2.6 kB	2024-04-09	2024-05-19
Pretty URL googrootsurvey.top/js/v-utilities.js.d1112fc4.js IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-09 03:12:49 Last Seen2024-05-19 23:54:01 Times Seen538 Hash 18cb151303391373ec2138ce7f10bd7f c3d6fdc026a675d23ac14beebd3a46e3e72e9dc4 93cc28fc75a9cbc865ed918e1a8d139ecf52c3a7d9a2caef63ed7092f69ee142 Loading...

	googrootsurvey.top/js/v-dom-to-react.js.26fdf751.js	1.1 kB	2024-04-09	2024-05-19
Pretty URL googrootsurvey.top/js/v-dom-to-react.js.26fdf751.js IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-09 03:12:49 Last Seen2024-05-19 23:54:01 Times Seen532 Hash b9187a6f31bd6c7c0cfe0bcb37ecf60a 1150c33a65703059e43c0d85b1680aa04d4d60e6 a5f216a4ea67c8f005b6cededba525ee330a2d4f8caedc8232f44e4e163e5ebd Loading...

	googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf	96 B	2023-10-08	2024-05-19
Pretty URL googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-10-08 13:44:02 Last Seen2024-05-19 23:54:01 Times Seen9446 Hash 1c21f8c6a7c78b7e67c5272c65c97f91 1a2eb15ee36a8f8b7160358a304ccf575b571074 0af800d9d96b01d9183737d36c4e01792913fdcd393bc56727f1e9be39730fc2 Loading...

	googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf	250 B	2023-04-11	2024-05-19
Pretty URL googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-04-11 14:49:40 Last Seen2024-05-19 18:05:16 Times Seen11431 Hash 9d9b48d49f88bc3e71b52a408295effa ca122790003cf5d50f71165ed81d120d8a91199e e7427cfeefd59822deeb50274e744da9ce4173ab34ba825aff2d79f1dbc7be76 Loading...

	googrootsurvey.top/js/config/sd/sd-9540-en.js?v=10	8.0 kB	2024-01-25	2024-05-19
Pretty URL googrootsurvey.top/js/config/sd/sd-9540-en.js?v=10 IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-01-25 17:30:45 Last Seen2024-05-19 18:05:16 Times Seen329 Hash 8ab509e5faf8beaa7205e4d2852e5eca c35e95ed5b6bb71a5cdf0eb2e349fae42685dac1 6a3ff31d913496a3eee3a8e0d9a544ba3399dde26b393187e24d33c27d2c63be Loading...

	googrootsurvey.top/js/_rtc.f86a36d7.js	12 kB	2024-04-09	2024-05-19
Pretty URL googrootsurvey.top/js/_rtc.f86a36d7.js IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-09 03:12:49 Last Seen2024-05-19 23:54:01 Times Seen828 Hash 128d6eec0793a7e02c314d2f6245f260 c9f09311c3f229b770f38d0cc69b422430f1c748 bf1606ac64db254cc565a094e7162a96f31f7e48ddece56fc92c654559e5abb8 Loading...

	googrootsurvey.top/js/v-possibleStandardNamesOptimized.js.205abacb.js	7.6 kB	2024-04-09	2024-05-19
Pretty URL googrootsurvey.top/js/v-possibleStandardNamesOptimized.js.205abacb.js IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-09 03:12:48 Last Seen2024-05-19 23:54:01 Times Seen524 Hash 754d15b064e9a8ceb8a31b38b1d81c9a 54ebff161ad4bfdabcff1771c25f945f8b39907e 948a15cf425885066c4d071b20d8920f6439a0e3e6684b200f68db637fdc7f8d Loading...

	googrootsurvey.top/js/v-html-to-dom.js.ff1ae7e0.js	364 B	2024-04-09	2024-05-19
Pretty URL googrootsurvey.top/js/v-html-to-dom.js.ff1ae7e0.js IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-09 03:12:49 Last Seen2024-05-19 23:54:01 Times Seen524 Hash e7384582d95265db33b2a41c0a31f41b b609bec5a8718ab1c9c27a197a15e9a434c36dde c631c08f52c7380fc8f8f0247d68f9171ff8e63d41d7885b992f1374af5a995a Loading...

	googrootsurvey.top/js/v-constants.js.49317f47.js	600 B	2024-04-09	2024-05-19
Pretty URL googrootsurvey.top/js/v-constants.js.49317f47.js IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-09 03:12:48 Last Seen2024-05-19 23:54:01 Times Seen551 Hash 973e735a355fd5b10428c250e8fd7236 bd3fb14c90e2700400c69b15a84e317d52493bd9 16f1d5ca604ad59b9e5b484b1a0cf2d43eebda055ecee80ac847fbcc4437f0b2 Loading...

	googrootsurvey.top/js/v-node.js.28d8082c.js	6.3 kB	2024-04-09	2024-05-19
Pretty URL googrootsurvey.top/js/v-node.js.28d8082c.js IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-09 03:12:49 Last Seen2024-05-19 23:54:01 Times Seen531 Hash f61d0e9af048cd71962dcb945f405c63 aefdc99a8057ced201da8aba0640905dd05375d8 1d383bb00e9e3a4d2f58354b41bc0ffc60516bcdcf4486516b8638236b0aeb9d Loading...

	googrootsurvey.top/js/rating.b794a6e6.js	5.3 kB	2024-04-13	2024-05-19
Pretty URL googrootsurvey.top/js/rating.b794a6e6.js IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-13 13:46:53 Last Seen2024-05-19 18:05:16 Times Seen146 Hash c2fd16111e38ac82c6b26d522cbd4ea1 94265266aa6b2172e2cf1686e5bcac87ba52d550 f3eaf70b5485ab87e30aa1ac6b4c9a3e822c9d3fe45f6a18f5891fe7d00ef3c5 Loading...

	googrootsurvey.top/js/v-index.js.da9f7529.js	41 kB	2024-04-10	2024-05-19
Pretty URL googrootsurvey.top/js/v-index.js.da9f7529.js IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-10 11:10:52 Last Seen2024-05-19 16:59:42 Times Seen596 Hash 47a5b821c80a532b5e989cf87d451283 c0f9e87128e1d7d634649fb3c7b6c08f714e79bc 2526538666fe9c7811b9afaf71794b4f8cb4f0751f62872e1a0d8c3a6c131f07 Loading...

	googrootsurvey.top/js/v-redux-toolkit.esm.js.fe3487ca.js	11 kB	2024-04-09	2024-05-19
Pretty URL googrootsurvey.top/js/v-redux-toolkit.esm.js.fe3487ca.js IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-09 03:12:49 Last Seen2024-05-19 23:54:02 Times Seen824 Hash 5aa3676547abc9a38889c09e69ca968d d19ea919192e86f97c34c0a5959ad05c52299aec 21648e7ba668a077e403b6bd1a38f05d55d987737b959d57e3b3c53787107eb7 Loading...

	googrootsurvey.top/js/SurveyContainer.e2959212.js	57 kB	2024-04-13	2024-05-19
Pretty URL googrootsurvey.top/js/SurveyContainer.e2959212.js IP 188.114.96.1 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-13 13:46:53 Last Seen2024-05-19 23:54:02 Times Seen578 Hash 0df7a0f05192a1af311ce45d48639a89 df29dce5914578a52af5f516ccd18d289d808951 4cde10689c1ef6c2f58585483fae6d656ccfa1d16cc282dcfbe6cb89700ae2dc Loading...

	www.google.com/recaptcha/api.js?render=explicit&hl=en	852 B	2024-04-24	2024-05-08
Pretty URL www.google.com/recaptcha/api.js?render=explicit&hl=en IP 142.250.74.132 ASN #15169 GOOGLE Introduced by scriptElement Embedded in HTML false Observations First Seen2024-04-24 10:38:46 Last Seen2024-05-08 16:21:45 Times Seen354 Hash 5b87fe9817f32cb6b6073b19e560883e b10dec390b303c27147ff5585d37d4f43f80e072 0ddbe69535c7d98745100dacb5b79d12052d9731fe06a05f8e5b5bbaa60d1023 Loading...

HTTP Transactions (72)

URL IP Response Size

196.mbvnclickpush2.online/

136.243.78.223

302 Found

0 B

URL User Request GET HTTP/1.1
196.mbvnclickpush2.online/
IP
136.243.78.223:443
ASN
#24940 Hetzner Online GmbH

Certificate
IssuerLet's Encrypt
Subject*.ch.mbvnclickpush2.online
Fingerprint30:72:AC:22:0F:32:4A:57:4D:6D:56:DD:18:B4:8C:E6:1A:F1:5C:AC
ValidityThu, 25 Apr 2024 11:23:27 GMT - Wed, 24 Jul 2024 11:23:26 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET / HTTP/1.1
Host: 196.mbvnclickpush2.online
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 302 Found
Server: nginx
Date: Wed, 08 May 2024 14:21:10 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Location: https://leadhits.media-412.com/click?pid=2233&offer_id=6142&sub1={CLICK_ID}

leadhits.media-412.com/click?pid=2233&offer_id=6142&sub1={CLICK_ID}

34.90.92.78

302 Found

0 B

URL User Request GET HTTP/2
leadhits.media-412.com/click?pid=2233&offer_id=6142&sub1={CLICK_ID}
IP
34.90.92.78:443
ASN
#396982 GOOGLE-CLOUD-PLATFORM

Certificate
IssuerGoDaddy.com, Inc.
Subject*.media-412.com
Fingerprint16:AB:3B:E7:5C:01:8D:17:4C:E5:2A:16:CE:5F:3B:FB:DE:12:ED:4C
ValiditySun, 09 Jul 2023 20:53:14 GMT - Fri, 09 Aug 2024 20:53:14 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /click?pid=2233&offer_id=6142&sub1={CLICK_ID} HTTP/1.1
Host: leadhits.media-412.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
server: nginx
date: Wed, 08 May 2024 14:21:10 GMT
content-length: 0
location: https://leadhits.media-412.com/click?pid=2256&offer_id=6167
x-adjust-use-original-forwarded-for: 1
access-control-allow-origin: *
X-Firefox-Spdy: h2

leadhits.media-412.com/click?pid=2256&offer_id=6167

34.90.92.78

302 Found

0 B

URL User Request GET HTTP/2
leadhits.media-412.com/click?pid=2256&offer_id=6167
IP
34.90.92.78:443
ASN
#396982 GOOGLE-CLOUD-PLATFORM

Certificate
IssuerGoDaddy.com, Inc.
Subject*.media-412.com
Fingerprint16:AB:3B:E7:5C:01:8D:17:4C:E5:2A:16:CE:5F:3B:FB:DE:12:ED:4C
ValiditySun, 09 Jul 2023 20:53:14 GMT - Fri, 09 Aug 2024 20:53:14 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /click?pid=2256&offer_id=6167 HTTP/1.1
Host: leadhits.media-412.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 302 Found
server: nginx
date: Wed, 08 May 2024 14:21:10 GMT
content-length: 0
location: https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
x-adjust-use-original-forwarded-for: 1
set-cookie: afclick=663b8a56de68ab0001f5d0bf; expires=Thu, 08 May 2025 14:21:10 GMT; secure; SameSite=None
afoffers={"6167":1715178070}; expires=Thu, 08 May 2025 14:21:10 GMT; secure; SameSite=None
access-control-allow-origin: *
X-Firefox-Spdy: h2

my.rtmark.net/gid.js?userId=szfj4yn35287veq1gbgvqd2xuzj1ipk3

139.45.195.8

200 OK

65 B

URL GET HTTP/2
my.rtmark.net/gid.js?userId=szfj4yn35287veq1gbgvqd2xuzj1ipk3
IP
139.45.195.8:443
ASN
#9002 RETN Limited

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectrtmark.net
FingerprintDB:C0:8B:64:1C:E3:2A:9C:B9:04:0D:F3:6F:5A:E0:35:F4:C7:75:CC
ValiditySat, 02 Mar 2024 21:53:43 GMT - Fri, 31 May 2024 21:53:42 GMT

File type
JSON text data
Size
65 B (65 bytes)
Hash
4b19c2c6b7cc98ff245618fa177d99d6
b353a154ab429e8880d694172284a11d470bce28
2d4a60765fd997fa6c7af4751d34d8dd2838ea333e1621f19341a7575dea0f8f

HTTP Headers

GET /gid.js?userId=szfj4yn35287veq1gbgvqd2xuzj1ipk3 HTTP/1.1
Host: my.rtmark.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://googrootsurvey.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 08 May 2024 14:21:11 GMT
content-type: application/json; charset=utf-8
content-length: 65
access-control-allow-origin: https://googrootsurvey.top
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, Authorization,X-CSRF-Token
access-control-expose-headers: Authorization
access-control-allow-credentials: true
set-cookie: ID=szfj4yn35287veq1gbgvqd2xuzj1ipk3; expires=Thu, 08 May 2025 14:21:11 GMT; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2

googrootsurvey.top/js/rating.b794a6e6.js

188.114.96.1

200 OK

2.2 kB

URL GET HTTP/3
googrootsurvey.top/js/rating.b794a6e6.js
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
JavaScript source, ASCII text, with very long lines (5309), with no line terminators
Size
2.2 kB (2183 bytes)
Hash
c2fd16111e38ac82c6b26d522cbd4ea1
94265266aa6b2172e2cf1686e5bcac87ba52d550
f3eaf70b5485ab87e30aa1ac6b4c9a3e822c9d3fe45f6a18f5891fe7d00ef3c5

HTTP Headers

GET /js/rating.b794a6e6.js HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=szfj4yn35287veq1gbgvqd2xuzj1ipk3; syncedCookie=true; oaidts=1715178071; ID=szfj4yn35287veq1gbgvqd2xuzj1ipk3
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: application/javascript
cf-bgj: minify
etag: W/"662b7650-14bd"
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 5985
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AmvFzsvY3e7uMY3KFLN%2F%2BnnWv6qqaLUirRgiMhyWC0g6aL%2B4s5ApHWxF5azw%2FuP7YlJzZbylgrkkNeg2jPzIPElWGVu0ISbQ7DlNRgnyPbhVaPvPGqeQHVTejXIAuS5d8DCWRxU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a18429bb956c7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/img/comments/unnamed.webp

188.114.96.1

200 OK

264 B

URL GET HTTP/3
googrootsurvey.top/img/comments/unnamed.webp
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 100x100, Scaling: [none]x[none], YUV color, decoders should clamp
Size
264 B (264 bytes)
Hash
606085e7a74fd169da34f9fcb43ad12d
77226a50488fb48256d36f1810a136b69d635f74
df20f4c1d87cb10514a6d526dde70759334705d90a909df0e6cb130061ce1ea5

HTTP Headers

GET /img/comments/unnamed.webp HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=szfj4yn35287veq1gbgvqd2xuzj1ipk3; syncedCookie=true; oaidts=1715178071; ID=szfj4yn35287veq1gbgvqd2xuzj1ipk3
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: image/webp
content-length: 264
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: "662b7650-108"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2g6qfhBVL3MQ4mR1DXHGlfxGXZLdAqSMDOnYif8WY616PXGq1ePL88Vq%2Fzt7mPJPWsxFsMBjpRG1WMRPfMwcXJI8cAZcMpxEGsB2wbl9fq2AjfEX%2FFxD15xMx9rNVJWWBWWTk4Q%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a18432c6056c7-OSL
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/img/comments/person-14.webp

188.114.96.1

200 OK

1.7 kB

URL GET HTTP/3
googrootsurvey.top/img/comments/person-14.webp
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 100x100, Scaling: [none]x[none], YUV color, decoders should clamp
Size
1.7 kB (1672 bytes)
Hash
7dc8c2c56e77f2a329230f677b6e5bf8
23b56b25ef6370e93d6c070c212684ba99612fcc
49ce3d1aa6533e2c9715cdc971939ba08f7072b87d7f60dd1dc3f0ef892e44fc

HTTP Headers

GET /img/comments/person-14.webp HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=szfj4yn35287veq1gbgvqd2xuzj1ipk3; syncedCookie=true; oaidts=1715178071; ID=szfj4yn35287veq1gbgvqd2xuzj1ipk3
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: image/webp
content-length: 1672
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: "662b7650-688"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s0v5B1pGuRasKHnU863%2FQ%2FzYd9Q2fOAbIAp2KRKN9eVY%2B%2BawBGO3XNdH%2FmTHb67TeAKvfCOB4xO7hRyQy4yhWG9HZuUK3lzXUeDqhHlL0wDU9THv15uD3Vz22KBthWc1V05IFWw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a18432c6256c7-OSL
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/pfe/current/micro.tag.min.js?z=6679100&sw=/sw/sw6679100.js&var=6070194&var_3=null&var_4=null&ymid=2256&cdn=1&domain=ofklefkian.com&ab2_ttl=5184000000

188.114.96.1

200 OK

12 kB

URL GET HTTP/3
googrootsurvey.top/pfe/current/micro.tag.min.js?z=6679100&sw=/sw/sw6679100.js&var=6070194&var_3=null&var_4=null&ymid=2256&cdn=1&domain=ofklefkian.com&ab2_ttl=5184000000
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
JavaScript source, ASCII text, with very long lines (27174), with no line terminators
Size
12 kB (11476 bytes)
Hash
75c26ccd65e96e912725399ff3ce66e9
d300939979d2048844dc5ac80c51ed8121126f4e
c9db5c92934b273ad485c58710d6fbc2d580c2923a99bb456b18cb5e1465f5cf

HTTP Headers

GET /pfe/current/micro.tag.min.js?z=6679100&sw=/sw/sw6679100.js&var=6070194&var_3=null&var_4=null&ymid=2256&cdn=1&domain=ofklefkian.com&ab2_ttl=5184000000 HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: application/javascript
last-modified: Fri, 26 Apr 2024 09:39:29 GMT
vary: Accept-Encoding
etag: W/"662b7651-6a26"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 913
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gkFBk1JQhEq%2BsK3Xpbv9nsaEa9VZ%2B4DIg4bJ%2FCgRvVS8FX%2Fn6woLprXNR0yO%2Fn7hRnJM%2FOdRxjDJldl4LstIGESGAT0f5bSk26200eKUoaKLwK1F1i1Q18FH0XHxwMYBAT%2FhLp4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a18420af556c7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/js/config/comments/en.json

188.114.96.1

200 OK

2.2 kB

URL GET HTTP/3
googrootsurvey.top/js/config/comments/en.json
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
JSON text data
Size
2.2 kB (2213 bytes)
Hash
78839fd14b7a4af467f2af5e01fa3e78
6caef62470c7af62bff2f68158df90ff3d7944b0
e7c39794bf2d944828bebc5f9cb494b6377a69e40d506918ee52a7582794fefa

HTTP Headers

GET /js/config/comments/en.json HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: application/json
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: W/"662b7650-11aa"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kA9PnABU4Cxt%2F5va6eT3eRMla6RmSVK9dIc0IWukL77SGbnWToAMcnkw2YZ6SdhACE3Mr%2BJikYIHbsX5AB1i%2F7KQkQSOTy3VF5zp%2BaKXKunoCsdgAHDbjSmp1ZBCLVsxXEOhyj4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a18421b0856c7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/js/v-react-dom.production.min.js.c3329619.js

188.114.96.1

200 OK

43 kB

URL GET HTTP/3
googrootsurvey.top/js/v-react-dom.production.min.js.c3329619.js
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
JavaScript source, ASCII text, with very long lines (65536), with no line terminators
Size
43 kB (43163 bytes)
Hash
c53e5e3d8c5ca5f1c4edbce65426edfc
36cc2e7e0b893d82bf5f457c7a62374019d0f7aa
ed83bf6bc001bd6f841c76b67aedfd3bc02cb28fb5537a1d55804f5ad0515e39

HTTP Headers

GET /js/v-react-dom.production.min.js.c3329619.js HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: application/javascript
cf-bgj: minify
cf-polished: origSize=129359
etag: W/"662b7650-1f94f"
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OjfuLnF5YUMVAv%2FHg8ZtNVWSjWeNTsybeREmRTrNoCSAKzQh7tfraGS7YLzGw6XOgc53MJ3Z1fGRUaI3pwFE09gGeRC6021ES%2BDvh5iMJbIj%2BNw51jS9LRwPExGuZldJkcLbR3I%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a1840d97b56c7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/js/v-node.js.28d8082c.js

188.114.96.1

200 OK

3.1 kB

URL GET HTTP/3
googrootsurvey.top/js/v-node.js.28d8082c.js
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
JavaScript source, ASCII text, with very long lines (6251), with no line terminators
Size
3.1 kB (3083 bytes)
Hash
f61d0e9af048cd71962dcb945f405c63
aefdc99a8057ced201da8aba0640905dd05375d8
1d383bb00e9e3a4d2f58354b41bc0ffc60516bcdcf4486516b8638236b0aeb9d

HTTP Headers

GET /js/v-node.js.28d8082c.js HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: application/javascript
cf-bgj: minify
etag: W/"662b7650-186b"
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G36aEzIYZjYB61Hmv4A6a4k9ULdf6mhXVsiTAupu8CQqbsAPDSOc%2BHY6r%2FrGM0bWEnsUPjr%2B6uzqBAOKFIYFgsv5b8h%2FwYEGFJzNUnmGGZ8FdkIsTF%2BszA1slN17QuoYRZCB6x4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a18421b0d56c7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/img/comments/person-6.webp

188.114.96.1

200 OK

1.9 kB

URL GET HTTP/3
googrootsurvey.top/img/comments/person-6.webp
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 100x100, Scaling: [none]x[none], YUV color, decoders should clamp
Size
1.9 kB (1854 bytes)
Hash
0f174a9245ed9f2a0660204a8320880f
fd36dc7b39c675bff5d4dff0b331d70b57f0ec7d
1cfb6cdf94c080825e93d4bff72079fdca2d8f3d9f7d2e75badf48c29d4e31c4

HTTP Headers

GET /img/comments/person-6.webp HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=szfj4yn35287veq1gbgvqd2xuzj1ipk3; syncedCookie=true; oaidts=1715178071; ID=szfj4yn35287veq1gbgvqd2xuzj1ipk3
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: image/webp
content-length: 1854
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: "662b7650-73e"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=goyMFb3NrjxulnOORHvgevzOsNC1yM9RizwOtowDnf%2BuLGdYmjpibm2WafItldQEt5TK5rUaOlmHnbpyoZkLsbUtlHr%2FRBSfzCRFdVnnmI%2Fk8lSSO5DR609zkZ%2BBw6Y8u8BczEU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a18434c7e56c7-OSL
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/js/s-storageService.js.bb9f7a22.js

188.114.96.1

200 OK

3.8 kB

URL GET HTTP/3
googrootsurvey.top/js/s-storageService.js.bb9f7a22.js
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
JavaScript source, ASCII text, with very long lines (2170), with no line terminators
Size
3.8 kB (3804 bytes)
Hash
a804db09269d602a8a7a50877b60fc86
7aa84eb6c94037c3bfabdf407060ba7b9ca73ff3
f5e3a988f32cdcd8ccdff165e33a1807acdde6426cecbb464c315306ff5e6f6f

HTTP Headers

GET /js/s-storageService.js.bb9f7a22.js HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: application/javascript
cf-bgj: minify
etag: W/"662b7652-87a"
last-modified: Fri, 26 Apr 2024 09:39:30 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZMX2M1%2FwJURL%2Fs5lwkh%2FOnkf7xMn28pGDfdBTiPx2EK0CFZxIfqp8dCqmZ5n69PQBhOU9TZmEjYPbVSS6SvXSpiJimgEkd7wkgnjbawB%2BXrhL4PB7mnciSmEVlxaow4cyeMDHjg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a1840d97056c7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/js/v-index.js.da9f7529.js

188.114.96.1

200 OK

19 kB

URL GET HTTP/3
googrootsurvey.top/js/v-index.js.da9f7529.js
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
JavaScript source, ASCII text, with very long lines (40985), with no line terminators
Size
19 kB (19011 bytes)
Hash
47a5b821c80a532b5e989cf87d451283
c0f9e87128e1d7d634649fb3c7b6c08f714e79bc
2526538666fe9c7811b9afaf71794b4f8cb4f0751f62872e1a0d8c3a6c131f07

HTTP Headers

GET /js/v-index.js.da9f7529.js HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: application/javascript
cf-bgj: minify
cf-polished: origSize=40988
etag: W/"662b7651-a01c"
last-modified: Fri, 26 Apr 2024 09:39:29 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hrEhtOVHflYQbu7JEh35yWEodvck%2BaV1%2F6tvnzY1HCGNAP0yUGBDMPxbO7P0EQdH8L30NUqx1uFrEc6ugwLLNP6nUgBY%2BDqPDbbu08YP955CJaeS01QTQ1uFkyyfCazL4A%2FHOwI%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a1840d96e56c7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/img/comments/person-8.webp

188.114.96.1

200 OK

1.8 kB

URL GET HTTP/3
googrootsurvey.top/img/comments/person-8.webp
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 100x100, Scaling: [none]x[none], YUV color, decoders should clamp
Size
1.8 kB (1802 bytes)
Hash
2ad9296fef7cd1f60823b80098d31c1f
145b3a66be3deb658a453963cef39a018b6f0928
82bcaa459e3d55b1f99c7154b506f5f5f464f04c5873a3e66ebaf5d064c4de6d

HTTP Headers

GET /img/comments/person-8.webp HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=szfj4yn35287veq1gbgvqd2xuzj1ipk3; syncedCookie=true; oaidts=1715178071; ID=szfj4yn35287veq1gbgvqd2xuzj1ipk3
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: image/webp
content-length: 1802
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: "662b7650-70a"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TLXBA19w9XDMRlzWNu5uhHnKHFtBZTRBBFyJo82vRDW1EAOCf4lAbxzgRKmnvt5cjbSkKmO%2BmDqxsvUQU836IiTByIihMJfgPL0hKrf16%2F6cZR9%2FEEIbI65KoYVFo1pt6vUaAhM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a18434c7f56c7-OSL
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/img/comments/person-13.webp

188.114.96.1

200 OK

1.9 kB

URL GET HTTP/3
googrootsurvey.top/img/comments/person-13.webp
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 100x100, Scaling: [none]x[none], YUV color, decoders should clamp
Size
1.9 kB (1888 bytes)
Hash
ad1e0d431ec5fcb9a1e7ba8680d14a21
0f30fc9c7a5460458fb1e01acff03df4d5809950
45f8553b96fbe562a88e1366e8986d14b4d51f7d069604f8d29675844a19b204

HTTP Headers

GET /img/comments/person-13.webp HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=szfj4yn35287veq1gbgvqd2xuzj1ipk3; syncedCookie=true; oaidts=1715178071; ID=szfj4yn35287veq1gbgvqd2xuzj1ipk3
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: image/webp
content-length: 1888
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: "662b7650-760"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GS5yE30hC0XLyde9Q5lrAfOaAPDC2ds5FrqQjNQwS7YNHeod5eBpq0FUmIl%2BHGbl9geAkFZVh1cbYbeOU50mOPaMWXY%2BScS5rS%2FX1ThOyX0AGyOB9IijlqoBMPUwFIV%2BTeWWBrY%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a18434c8856c7-OSL
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/js/s-checkSessionStorageAvailable.ts.e8412d91.js

188.114.96.1

200 OK

2.4 kB

URL GET HTTP/3
googrootsurvey.top/js/s-checkSessionStorageAvailable.ts.e8412d91.js
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
JavaScript source, ASCII text, with very long lines (330), with no line terminators
Size
2.4 kB (2431 bytes)
Hash
a1707fb484c103f2351843fcfb7028c4
43d3d0c0563335d6a9ba13a8920bdf7b70cea7bd
bec32703d77fa5a512dd84399bdd43cb32735e483476e66d0eeb957a403c790c

HTTP Headers

GET /js/s-checkSessionStorageAvailable.ts.e8412d91.js HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: application/javascript
cf-bgj: minify
etag: W/"662b7650-14a"
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=C3fte2JfhMKdR%2FdTR3N55%2BMSeOtMvKFcABDZa0TAtmXj05HPw%2BrNyVNl3Vx5zwZovfjF62P7BV66Tqf8Fm7GE4glxWKChTFzNqCMJVvcTVljJMi0sjZA6pBxyYRyoyzydpoS3To%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a1840d97356c7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/img/comments/person-5.webp

188.114.96.1

200 OK

1.8 kB

URL GET HTTP/3
googrootsurvey.top/img/comments/person-5.webp
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 100x100, Scaling: [none]x[none], YUV color, decoders should clamp
Size
1.8 kB (1846 bytes)
Hash
10f4b15b0a471e17ef598de73ffb319b
e3fd3478fa27f2cce0a9b945c50d640832594594
21411e70dfd7d12a4180188a1ccf3797df346cf6cb6f477f5ecbfb505d6fa378

HTTP Headers

GET /img/comments/person-5.webp HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=szfj4yn35287veq1gbgvqd2xuzj1ipk3; syncedCookie=true; oaidts=1715178071; ID=szfj4yn35287veq1gbgvqd2xuzj1ipk3
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: image/webp
content-length: 1846
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: "662b7650-736"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=axsaesxYYF3bjk6mv3qmGr9fEgmUqGvfhrqvceriYA5Jk72ERQxuVvOAFoCzVhZrtu%2B3w%2Fg735IBsl0VxCn%2FyroKhirUzQ4%2BarBlW3VaDXQYChVyn1GGgPPo3j0JF4Z9J0SPRYc%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a18434c7d56c7-OSL
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/js/_rtc.f86a36d7.js

188.114.96.1

200 OK

6.2 kB

URL GET HTTP/3
googrootsurvey.top/js/_rtc.f86a36d7.js
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
JavaScript source, ASCII text, with very long lines (12222), with no line terminators
Size
6.2 kB (6204 bytes)
Hash
128d6eec0793a7e02c314d2f6245f260
c9f09311c3f229b770f38d0cc69b422430f1c748
bf1606ac64db254cc565a094e7162a96f31f7e48ddece56fc92c654559e5abb8

HTTP Headers

GET /js/_rtc.f86a36d7.js HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: application/javascript
cf-bgj: minify
etag: W/"662b7651-2fbe"
last-modified: Fri, 26 Apr 2024 09:39:29 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wskbcGkxgVd%2BKvcxiuCR0FDLkHsJKHlQcjWiO3ys%2FgRC8QZY6IHeWBymFlBOHixgZgzOW2htttMbSgDCrCbZsn5DMOIrEskk2KqtsSWub1yjnHlsFJ%2FNXjlQQzs9HLNnXzWExaA%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a1840c96c56c7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

arleavannya.com/sync-metrics

139.45.197.248

200 OK

0 B

URL POST HTTP/2
arleavannya.com/sync-metrics
IP
139.45.197.248:443
ASN
#9002 RETN Limited

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectarleavannya.com
Fingerprint8A:67:B7:06:5F:61:ED:52:C0:9B:58:C2:64:98:7D:1B:64:03:3F:47
ValidityThu, 18 Apr 2024 17:09:05 GMT - Wed, 17 Jul 2024 17:09:04 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

OPTIONS /sync-metrics HTTP/1.1
Host: arleavannya.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://googrootsurvey.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 08 May 2024 14:21:11 GMT
content-length: 0
access-control-allow-origin: https://googrootsurvey.top
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2

googrootsurvey.top/img/rain/dollars-3.webp

188.114.96.1

200 OK

5.9 kB

URL GET HTTP/3
googrootsurvey.top/img/rain/dollars-3.webp
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
RIFF (little-endian) data, Web/P image
Size
5.9 kB (5938 bytes)
Hash
51ea76ff382bff8ef58a9943f7fd21d1
5c3d6ad6620fbde5ce3dddc88604e6d54621eba2
0240f30fc542fb5c2d532f33bc793b797199adaea75e22a7d9f04674b80d9a32

HTTP Headers

GET /img/rain/dollars-3.webp HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://googrootsurvey.top/css/survey.3b7d0b23.css
Cookie: OAID=szfj4yn35287veq1gbgvqd2xuzj1ipk3; syncedCookie=true; oaidts=1715178071; ID=szfj4yn35287veq1gbgvqd2xuzj1ipk3
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: image/webp
content-length: 5938
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: "662b7650-1732"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cjzq0dCzwnhNEZvR5EnilKuiX4US7hJkS4Gtv8p3YLpH04GB3jZXYQCH2%2BjEMDHQSGg4RBA8MA9yrWqsk27NApJoqF7YwOLvCLYni6PZKyZjdPWqVpsshigZzamkpvK6nQGuM9Q%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a18439ce556c7-OSL
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/img/betting/sport-betting/star.webp

188.114.96.1

200 OK

246 B

URL GET HTTP/3
googrootsurvey.top/img/betting/sport-betting/star.webp
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
RIFF (little-endian) data, Web/P image
Size
246 B (246 bytes)
Hash
01caf8f85cfefbebbb8cd3fde3f6d973
f47df1411899076e0856c75114597168e2afd8d0
7bae9821e9132aee43121502a061a55671dbc660966e0c5c3e2a88a6d48b9a84

HTTP Headers

GET /img/betting/sport-betting/star.webp HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=szfj4yn35287veq1gbgvqd2xuzj1ipk3; syncedCookie=true; oaidts=1715178071; ID=szfj4yn35287veq1gbgvqd2xuzj1ipk3
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: image/webp
content-length: 246
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: "662b7650-f6"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s3JAb5uygTH6hBXwAOhm%2BKwmo7zrrMKh8rZXDRpnZMms5%2FZI%2B9%2FJdTXnPcpX0DD8uRGs9ZZF%2FKzwCndfUPlOss2i0euAp5oEEBWuHNSKIru%2FMHfiVOcwG74QQPNXKaAERrkyePg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a18439ce656c7-OSL
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/img/rain/dollars-1.webp

188.114.96.1

200 OK

10 kB

URL GET HTTP/3
googrootsurvey.top/img/rain/dollars-1.webp
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
RIFF (little-endian) data, Web/P image
Size
10 kB (10546 bytes)
Hash
a5bef813a0113d018592091106451c8b
59365e96c4abca5eb98a0c56db0af0bb5cbffebb
036beb7de9c9d450e1442d593ff70ad392ca4be6754e7feaec249c0009e1bd83

HTTP Headers

GET /img/rain/dollars-1.webp HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://googrootsurvey.top/css/survey.3b7d0b23.css
Cookie: OAID=szfj4yn35287veq1gbgvqd2xuzj1ipk3; syncedCookie=true; oaidts=1715178071; ID=szfj4yn35287veq1gbgvqd2xuzj1ipk3
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: image/webp
content-length: 10546
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: "662b7650-2932"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Efu4yUtlxxwMQecu4lMBbf9GEOQKW1TkyXbYd%2FK9IDdW64IXr33bnOBNS2ISxoaCCnKevwrhcsh8TePjinU%2Bc%2BTbObFfUKDxJvtHolXKqjbjdYT4Gbch6PBSb8Z1WGUi5DczTx4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a18439ce256c7-OSL
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/img/rain/dollars-2.webp

188.114.96.1

200 OK

8.1 kB

URL GET HTTP/3
googrootsurvey.top/img/rain/dollars-2.webp
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
RIFF (little-endian) data, Web/P image
Size
8.1 kB (8140 bytes)
Hash
8b4203d496c3f52b116af082a0cd4017
de5369e9459e240950bb7eb5261eaac1db26907f
8dd1f04088c25e20d15e1bc23129604830aab2b4d3d0a408a5f047f9768f39a4

HTTP Headers

GET /img/rain/dollars-2.webp HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://googrootsurvey.top/css/survey.3b7d0b23.css
Cookie: OAID=szfj4yn35287veq1gbgvqd2xuzj1ipk3; syncedCookie=true; oaidts=1715178071; ID=szfj4yn35287veq1gbgvqd2xuzj1ipk3
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: image/webp
content-length: 8140
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: "662b7650-1fcc"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7viYsVMy6zfZco47UGJFz2c7ZgNXT1MayvUmk02BZB9Wpfwp3b2u2HbscRls6J1oZdf%2FLl%2BTTFy2jd%2BnAqnevM1KKogJ9kcYNtAXALpfo44D6cAM8JezBH3TkcBfWqy4hBheNKw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a18439ce456c7-OSL
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/img/icon/finance/woman.webp

188.114.96.1

200 OK

2.4 kB

URL GET HTTP/3
googrootsurvey.top/img/icon/finance/woman.webp
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
RIFF (little-endian) data, Web/P image
Size
2.4 kB (2356 bytes)
Hash
590fd4a60be002011c4d09a32b3dee9e
45dbb90f6edd9dd9b777e5b3fc98b82ca18eaaf2
12f0bfe3db63dff3314b64cb12871681258a87bfcec40db1bc7712d4a32620e7

HTTP Headers

GET /img/icon/finance/woman.webp HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=szfj4yn35287veq1gbgvqd2xuzj1ipk3; syncedCookie=true; oaidts=1715178071; ID=szfj4yn35287veq1gbgvqd2xuzj1ipk3
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: image/webp
content-length: 2356
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: "662b7650-934"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=loqhesP7wVt6SCJcIGgrL3eaDl92iwGsKepEW4aMXsFfl%2BOkXHkcA4DxMQugsuQuqMN0Hgq%2FLJwB42Gnkb6dpWHvNkVO3VQmY1E0o%2FJfBoiJ8lmt%2BNaAPsAayws1DM6fOIcE9UU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a1843acea56c7-OSL
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/img/icon/finance/man.webp

188.114.96.1

200 OK

590 B

URL GET HTTP/3
googrootsurvey.top/img/icon/finance/man.webp
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
RIFF (little-endian) data, Web/P image
Size
590 B (590 bytes)
Hash
d729db2f101fe611a5a74cec2fa7a7d7
5a13312a8723c57605804f07f064b5f233ea9595
929f7c5d50d2bea65039de8cf572e24c1957209c92b983eebe4c322a93ccfe87

HTTP Headers

GET /img/icon/finance/man.webp HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=szfj4yn35287veq1gbgvqd2xuzj1ipk3; syncedCookie=true; oaidts=1715178071; ID=szfj4yn35287veq1gbgvqd2xuzj1ipk3
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: image/webp
content-length: 590
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: "662b7650-24e"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u%2BuhQXS4PcCSpfKCTm%2BuBrkNzaIM5%2FxzN4%2BRZpmGaOAwfqMnW655pwOg3iytuQFllWhlpoZy5%2B23Xb7%2BQi5T%2BQJZEy%2F2Tzt3LUnUotEvquwvfbSqXHZS%2BKTCk4xqIkL2qXLr%2FKE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a1843ace756c7-OSL
alt-svc: h3=":443"; ma=86400

arleavannya.com/sync-do

139.45.197.248

200 OK

0 B

URL POST HTTP/2
arleavannya.com/sync-do
IP
139.45.197.248:443
ASN
#9002 RETN Limited

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectarleavannya.com
Fingerprint8A:67:B7:06:5F:61:ED:52:C0:9B:58:C2:64:98:7D:1B:64:03:3F:47
ValidityThu, 18 Apr 2024 17:09:05 GMT - Wed, 17 Jul 2024 17:09:04 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

OPTIONS /sync-do HTTP/1.1
Host: arleavannya.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://googrootsurvey.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Wed, 08 May 2024 14:21:11 GMT
content-length: 0
access-control-allow-origin: https://googrootsurvey.top
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2

googrootsurvey.top/js/v-html-to-dom.js.ff1ae7e0.js

188.114.96.1

200 OK

260 B

URL GET HTTP/3
googrootsurvey.top/js/v-html-to-dom.js.ff1ae7e0.js
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
JavaScript source, ASCII text, with very long lines (364), with no line terminators
Size
260 B (260 bytes)
Hash
e7384582d95265db33b2a41c0a31f41b
b609bec5a8718ab1c9c27a197a15e9a434c36dde
c631c08f52c7380fc8f8f0247d68f9171ff8e63d41d7885b992f1374af5a995a

HTTP Headers

GET /js/v-html-to-dom.js.ff1ae7e0.js HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: application/javascript
cf-bgj: minify
etag: W/"662b7652-16c"
last-modified: Fri, 26 Apr 2024 09:39:30 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 5985
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0NjN5bemzlwNrnIH2Khcm19cifVficPNIFXQPI5mH1FCPu8KIs1I2oEEtfOioLWlmMTeN%2Bkc49d0J2DqmOhp7pdhdDFxUupU8pJOIP6Jpn2HNUdw30eOiaq2ksrET3hkSp4DaeA%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a18421b1856c7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

arleavannya.com/sync-metrics

139.45.197.248

200 OK

17 B

URL POST HTTP/2
arleavannya.com/sync-metrics
IP
139.45.197.248:443
ASN
#9002 RETN Limited

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectarleavannya.com
Fingerprint8A:67:B7:06:5F:61:ED:52:C0:9B:58:C2:64:98:7D:1B:64:03:3F:47
ValidityThu, 18 Apr 2024 17:09:05 GMT - Wed, 17 Jul 2024 17:09:04 GMT

File type
JSON text data
Size
17 B (17 bytes)
Hash
5b64e8b89092b2e3dfd448b10700627f
484b3032619fa1acd135d114565b0a5166281c22
f1ea07a1e51a389c8de07120ae5c2e432e9dd8f4fbd6f92489f185b0523a3fd4

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /sync-metrics HTTP/1.1
Host: arleavannya.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 749
Origin: https://googrootsurvey.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Wed, 08 May 2024 14:21:11 GMT
content-type: application/json; charset=utf-8
content-length: 17
x-trace-id: a4e006f74e9f2e7fbe9ed0e124beb812
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-origin: https://googrootsurvey.top
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2

offpichuan.com/track?offer_id=9540&z=6070194&request_var=2256&variable2=663b8a56de68ab0001f5d0bf&oaid=szfj4yn35287veq1gbgvqd2xuzj1ipk3

139.45.197.237

200 OK

182 B

URL GET HTTP/2
offpichuan.com/track?offer_id=9540&z=6070194&request_var=2256&variable2=663b8a56de68ab0001f5d0bf&oaid=szfj4yn35287veq1gbgvqd2xuzj1ipk3
IP
139.45.197.237:443
ASN
#9002 RETN Limited

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectoffpichuan.com
Fingerprint8B:DE:51:B7:81:9E:EA:DE:73:A4:3D:67:F9:5E:6F:7B:F4:D6:77:5A
ValidityMon, 15 Apr 2024 21:54:27 GMT - Sun, 14 Jul 2024 21:54:26 GMT

File type
JSON text data
Size
182 B (182 bytes)
Hash
518fbbd5a95951cd6212498955368d69
f6b781a48dee7d09f5b29745c4ced1397642bbe1
f8c19e1cf3423fb386d154c3effb94bc2774d81de6af91588f731e2ce2b6a4f8

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /track?offer_id=9540&z=6070194&request_var=2256&variable2=663b8a56de68ab0001f5d0bf&oaid=szfj4yn35287veq1gbgvqd2xuzj1ipk3 HTTP/1.1
Host: offpichuan.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://googrootsurvey.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 08 May 2024 14:21:11 GMT
content-type: application/json
content-length: 182
x-trace-id: 9c97d78e40d0637e2bdf6abb5e59f32e
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-origin: https://googrootsurvey.top
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2

googrootsurvey.top/img/comments/person-12.webp

188.114.96.1

200 OK

1.4 kB

URL GET HTTP/3
googrootsurvey.top/img/comments/person-12.webp
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 100x100, Scaling: [none]x[none], YUV color, decoders should clamp
Size
1.4 kB (1390 bytes)
Hash
a2a75db01afaab639bcc0c6c76a14c09
2c773be63192164745f2a42c2fde74812c6e905d
f22ac207c07f65a697682c466b4e87364c43a720b4e240df2d418ffbd8070e5e

HTTP Headers

GET /img/comments/person-12.webp HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=szfj4yn35287veq1gbgvqd2xuzj1ipk3; syncedCookie=true; oaidts=1715178071; ID=szfj4yn35287veq1gbgvqd2xuzj1ipk3
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: image/webp
content-length: 1390
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: "662b7650-56e"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1zDU2tdQ6A1fztVKIeZQfygXFEqqlloxFSOAoFli9KLTU9x6HGnj0ZlJneTcrT3cuxj74WqFNPVXT5yXf2ekG%2BfW8lPwSnPUA47wUX4QHFFDFB21ixHijxkOO8NMYyhoBe5fZbk%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a18434c8756c7-OSL
alt-svc: h3=":443"; ma=86400

arleavannya.com/sync-do

139.45.197.248

200 OK

179 B

URL POST HTTP/2
arleavannya.com/sync-do
IP
139.45.197.248:443
ASN
#9002 RETN Limited

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectarleavannya.com
Fingerprint8A:67:B7:06:5F:61:ED:52:C0:9B:58:C2:64:98:7D:1B:64:03:3F:47
ValidityThu, 18 Apr 2024 17:09:05 GMT - Wed, 17 Jul 2024 17:09:04 GMT

File type
JSON text data
Size
179 B (179 bytes)
Hash
081142aa1c9267422ee7fd25ac457579
cf8a223610da412aab4cc9aec68f6f304258b3ce
58084d495376ed2e41f026c352cabb187129c58109f2b15caeb1a539deb2cd19

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /sync-do HTTP/1.1
Host: arleavannya.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 157
Origin: https://googrootsurvey.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Wed, 08 May 2024 14:21:11 GMT
content-type: application/json; charset=utf-8
content-length: 179
x-trace-id: 0519e6f41d3a0a8bde51d1c9c976cad1
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-origin: https://googrootsurvey.top
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2

arleavannya.com/sync-metrics

139.45.197.248

200 OK

0 B

URL POST HTTP/2
arleavannya.com/sync-metrics
IP
139.45.197.248:443
ASN
#9002 RETN Limited

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectarleavannya.com
Fingerprint8A:67:B7:06:5F:61:ED:52:C0:9B:58:C2:64:98:7D:1B:64:03:3F:47
ValidityThu, 18 Apr 2024 17:09:05 GMT - Wed, 17 Jul 2024 17:09:04 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

OPTIONS /sync-metrics HTTP/1.1
Host: arleavannya.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://googrootsurvey.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Wed, 08 May 2024 14:21:11 GMT
content-length: 0
access-control-allow-origin: https://googrootsurvey.top
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2

arleavannya.com/sync-metrics

139.45.197.248

200 OK

0 B

URL POST HTTP/2
arleavannya.com/sync-metrics
IP
139.45.197.248:443
ASN
#9002 RETN Limited

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectarleavannya.com
Fingerprint8A:67:B7:06:5F:61:ED:52:C0:9B:58:C2:64:98:7D:1B:64:03:3F:47
ValidityThu, 18 Apr 2024 17:09:05 GMT - Wed, 17 Jul 2024 17:09:04 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

OPTIONS /sync-metrics HTTP/1.1
Host: arleavannya.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://googrootsurvey.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Wed, 08 May 2024 14:21:11 GMT
content-length: 0
access-control-allow-origin: https://googrootsurvey.top
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2

arleavannya.com/sync-metrics

139.45.197.248

200 OK

17 B

URL POST HTTP/2
arleavannya.com/sync-metrics
IP
139.45.197.248:443
ASN
#9002 RETN Limited

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectarleavannya.com
Fingerprint8A:67:B7:06:5F:61:ED:52:C0:9B:58:C2:64:98:7D:1B:64:03:3F:47
ValidityThu, 18 Apr 2024 17:09:05 GMT - Wed, 17 Jul 2024 17:09:04 GMT

File type
JSON text data
Size
17 B (17 bytes)
Hash
5b64e8b89092b2e3dfd448b10700627f
484b3032619fa1acd135d114565b0a5166281c22
f1ea07a1e51a389c8de07120ae5c2e432e9dd8f4fbd6f92489f185b0523a3fd4

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /sync-metrics HTTP/1.1
Host: arleavannya.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 830
Origin: https://googrootsurvey.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Wed, 08 May 2024 14:21:11 GMT
content-type: application/json; charset=utf-8
content-length: 17
x-trace-id: 41411d8062f879af05609be734a798cf
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-origin: https://googrootsurvey.top
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2

arleavannya.com/sync-metrics

139.45.197.248

200 OK

17 B

URL POST HTTP/2
arleavannya.com/sync-metrics
IP
139.45.197.248:443
ASN
#9002 RETN Limited

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectarleavannya.com
Fingerprint8A:67:B7:06:5F:61:ED:52:C0:9B:58:C2:64:98:7D:1B:64:03:3F:47
ValidityThu, 18 Apr 2024 17:09:05 GMT - Wed, 17 Jul 2024 17:09:04 GMT

File type
JSON text data
Size
17 B (17 bytes)
Hash
5b64e8b89092b2e3dfd448b10700627f
484b3032619fa1acd135d114565b0a5166281c22
f1ea07a1e51a389c8de07120ae5c2e432e9dd8f4fbd6f92489f185b0523a3fd4

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /sync-metrics HTTP/1.1
Host: arleavannya.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 1774
Origin: https://googrootsurvey.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Wed, 08 May 2024 14:21:11 GMT
content-type: application/json; charset=utf-8
content-length: 17
x-trace-id: 24a6810fa955206eb0585f50f2d8d392
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-origin: https://googrootsurvey.top
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2

datatechonert.com/log/add?cid=eacf36da-c06d-4d71-90cc-88e30cd4240a&ruid=7ff71ca5-f027-467d-a010-a94d38a1ac1b

139.45.195.253

200 OK

12 B

URL POST HTTP/1.1
datatechonert.com/log/add?cid=eacf36da-c06d-4d71-90cc-88e30cd4240a&ruid=7ff71ca5-f027-467d-a010-a94d38a1ac1b
IP
139.45.195.253:443
ASN
#9002 RETN Limited

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerSectigo Limited
Subjectdatatechonert.com
Fingerprint3F:E1:50:2C:9F:FC:F9:37:03:E3:B6:34:00:06:89:69:01:E7:C3:27
ValiditySun, 10 Dec 2023 00:00:00 GMT - Mon, 23 Dec 2024 23:59:59 GMT

File type
JSON text data
Size
12 B (12 bytes)
Hash
adb4650bfc9d2a73d4dd69583b0ceb14
1ce399d6e936232aaf2192cd7903a279c5015f22
21c1f682de27109caabcca9016511974defcec217c0441fd3f1b50ecdf8247ed

HTTP Headers

POST /log/add?cid=eacf36da-c06d-4d71-90cc-88e30cd4240a&ruid=7ff71ca5-f027-467d-a010-a94d38a1ac1b HTTP/1.1
Host: datatechonert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 1486
Origin: https://googrootsurvey.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.19.10
Date: Wed, 08 May 2024 14:21:12 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 12
Connection: keep-alive
Access-Control-Allow-Origin: https://googrootsurvey.top
Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE
Access-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Forwarded-For, If-None-Match
Access-Control-Allow-Credentials: true

offpichuan.com/rotate?zz=6543018;6543082;5128285;4949467;5381235;5381316;5381339;5381307&var=6070194&ymid=2256&uid=szfj4yn35287veq1gbgvqd2xuzj1ipk3

139.45.197.237

200 OK

2.8 kB

URL GET HTTP/2
offpichuan.com/rotate?zz=6543018;6543082;5128285;4949467;5381235;5381316;5381339;5381307&var=6070194&ymid=2256&uid=szfj4yn35287veq1gbgvqd2xuzj1ipk3
IP
139.45.197.237:443
ASN
#9002 RETN Limited

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectoffpichuan.com
Fingerprint8B:DE:51:B7:81:9E:EA:DE:73:A4:3D:67:F9:5E:6F:7B:F4:D6:77:5A
ValidityMon, 15 Apr 2024 21:54:27 GMT - Sun, 14 Jul 2024 21:54:26 GMT

File type
gzip compressed data, max speed, from Unix
Size
2.8 kB (2796 bytes)
Hash
703f95d95c01e9efd8ce74c95c02de6c
2d20bc07d2b2189f4264469435b34a328e9e4026
184890eb4758ffd0a434cb7b07e7e519ad1aca56ff98d6e9c34c979c06b2a4da

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /rotate?zz=6543018;6543082;5128285;4949467;5381235;5381316;5381339;5381307&var=6070194&ymid=2256&uid=szfj4yn35287veq1gbgvqd2xuzj1ipk3 HTTP/1.1
Host: offpichuan.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://googrootsurvey.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Wed, 08 May 2024 14:21:12 GMT
content-type: application/javascript
x-trace-id: 46d3e0a86731b142b563fcf0c98cea8e
expires: Tue, 11 Jan 1994 10:00:00 GMT
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
pragma: no-cache
vary: Origin
access-control-allow-origin: https://googrootsurvey.top
access-control-expose-headers: Link
access-control-allow-credentials: true
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
set-cookie: OAID=szfj4yn35287veq1gbgvqd2xuzj1ipk3; expires=Thu, 08 May 2025 14:21:12 GMT; path=/; secure; SameSite=None
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
content-encoding: gzip
X-Firefox-Spdy: h2

googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf

188.114.96.1

200 OK

11 kB

URL User Request GET HTTP/2
googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
HTML document, ASCII text, with very long lines (8090), with no line terminators
Size
11 kB (10708 bytes)
Hash
e743060a8b86bbf98277483d5aa53f4e
9446f41d750b61cf166576ee64e97ac2024c6912
f4c5b44a1061b35d76f673fa979173d7b0bbf2e6e326f7b576a4bd501019a1f9

HTTP Headers

GET /finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Wed, 08 May 2024 14:21:10 GMT
content-type: text/html
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nAt0ungRiEYlfSK%2Foqo94o7n83YkgoDFX7xDzrREJVZIFv4dpXzdDpBEE4ybZAhkBGD68%2FcOk%2FCJ0WF6yKiTfEKTZhvdFpgBQd0XV2y1V0R9c2fDs6BsEiYzokdK0ix9VxKF%2Bp8%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a183e7b1756c4-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__en.js

142.250.74.99

200 OK

206 kB

URL GET HTTP/2
www.gstatic.com/recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__en.js
IP
142.250.74.99:443
ASN
#15169 GOOGLE

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint15:DD:05:B3:2F:D8:E3:54:C9:B4:FA:E4:AC:01:ED:C8:E1:EA:A7:AD
ValidityTue, 16 Apr 2024 04:17:07 GMT - Tue, 09 Jul 2024 04:17:06 GMT

File type
JavaScript source, ASCII text, with very long lines (631)
Size
206 kB (205803 bytes)
Hash
e2e79d6b927169d9e0e57e3baecc0993
1299473950b2999ba0b7f39bd5e4a60eafd1819d
231336ed913a5ebd4445b85486e053caf2b81cab91318241375f3f7a245b6c6b

HTTP Headers

GET /recaptcha/releases/V6_85qpc2Xf2sbe3xTnRte7m/recaptcha__en.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://googrootsurvey.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 205803
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Tue, 07 May 2024 13:33:10 GMT
expires: Wed, 07 May 2025 13:33:10 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 22 Apr 2024 21:03:35 GMT
content-type: text/javascript
vary: Accept-Encoding
age: 89282
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

arleavannya.com/sync-metrics

139.45.197.248

200 OK

0 B

URL POST HTTP/2
arleavannya.com/sync-metrics
IP
139.45.197.248:443
ASN
#9002 RETN Limited

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectarleavannya.com
Fingerprint8A:67:B7:06:5F:61:ED:52:C0:9B:58:C2:64:98:7D:1B:64:03:3F:47
ValidityThu, 18 Apr 2024 17:09:05 GMT - Wed, 17 Jul 2024 17:09:04 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

OPTIONS /sync-metrics HTTP/1.1
Host: arleavannya.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://googrootsurvey.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Wed, 08 May 2024 14:21:12 GMT
content-length: 0
access-control-allow-origin: https://googrootsurvey.top
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2

arleavannya.com/sync-metrics

139.45.197.248

200 OK

17 B

URL POST HTTP/2
arleavannya.com/sync-metrics
IP
139.45.197.248:443
ASN
#9002 RETN Limited

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectarleavannya.com
Fingerprint8A:67:B7:06:5F:61:ED:52:C0:9B:58:C2:64:98:7D:1B:64:03:3F:47
ValidityThu, 18 Apr 2024 17:09:05 GMT - Wed, 17 Jul 2024 17:09:04 GMT

File type
JSON text data
Size
17 B (17 bytes)
Hash
5b64e8b89092b2e3dfd448b10700627f
484b3032619fa1acd135d114565b0a5166281c22
f1ea07a1e51a389c8de07120ae5c2e432e9dd8f4fbd6f92489f185b0523a3fd4

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /sync-metrics HTTP/1.1
Host: arleavannya.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 850
Origin: https://googrootsurvey.top
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Wed, 08 May 2024 14:21:12 GMT
content-type: application/json; charset=utf-8
content-length: 17
x-trace-id: a01882c563e10ab73a35e6fa11d9eecb
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-origin: https://googrootsurvey.top
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2

googrootsurvey.top/js/_each-land-config.3299fec3.js

188.114.96.1

200 OK

30 kB

URL GET HTTP/3
googrootsurvey.top/js/_each-land-config.3299fec3.js
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
JavaScript source, ASCII text, with very long lines (65536), with no line terminators
Size
30 kB (29953 bytes)
Hash
0ba3468fb169d838d511e11b5b33eaef
fb53785cd4dcc6e5cf0fcebfcafed46a3968cbe9
6de414b4180a6f11c4f5a9ba570d5e97ac8e596b1f9c1bb86872a11ecd416384

HTTP Headers

GET /js/_each-land-config.3299fec3.js HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: application/javascript
cf-bgj: minify
cf-polished: origSize=72043
etag: W/"662b7651-1196b"
last-modified: Fri, 26 Apr 2024 09:39:29 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P0FWJ55LM4X1MI3Dy1hACy9LjOaA64077tF70c%2BuvRtvp0k826iIVkizXXmBRysVqSeZrLYGsAuYKPLKyMj5htpi5YPQY9E0i%2BMavrpFNJRqdr3vi6XjDnbifgS1IV7ZbyeR4FA%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a1840d97756c7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/img/icon-survey.svg

188.114.96.1

200 OK

4.1 kB

URL GET HTTP/3
googrootsurvey.top/img/icon-survey.svg
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
SVG Scalable Vector Graphics image
Size
4.1 kB (4058 bytes)
Hash
9a8ba19b913810bd358e5caf3a7c2a75
6eff5e84f2b82772bb6029088ed852a8161b3252
58b0a3aa24ef605d4b812bcf92cbaa2e7f78bd43f929ca6362bc259da610399a

HTTP Headers

GET /img/icon-survey.svg HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: image/svg+xml
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: W/"662b7650-a72"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DUHuy6aZ9tlgX4L3hCZtP8ktjZf2rSQw7DU9iu7wPy4x91s7eapj4MszMKMsAMHuEkq%2FRNxO5K21PRfPAARMqUTIuGGNOAETPbP2FSsHGdHPBTUshckHNMHemhRdDUc4D06E%2Bss%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a1840e98656c7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/js/v-redux-toolkit.esm.js.fe3487ca.js

188.114.96.1

200 OK

11 kB

URL GET HTTP/3
googrootsurvey.top/js/v-redux-toolkit.esm.js.fe3487ca.js
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
JavaScript source, ASCII text, with very long lines (11319), with no line terminators
Size
11 kB (11319 bytes)
Hash
5aa3676547abc9a38889c09e69ca968d
d19ea919192e86f97c34c0a5959ad05c52299aec
21648e7ba668a077e403b6bd1a38f05d55d987737b959d57e3b3c53787107eb7

HTTP Headers

GET /js/v-redux-toolkit.esm.js.fe3487ca.js HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: application/javascript
cf-bgj: minify
etag: W/"662b7651-2c37"
last-modified: Fri, 26 Apr 2024 09:39:29 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=we6bcsLOSVPdYX0iWHDLXadHAlUNVc1jvw2DffOiBNIjUAyD9ZoW35uV3uwu60AKKyot8eXLUkTWlRa8hHI9HXZtH9x34GJPhRVv7bx4obRgvbk5nlCnUMY4UZ1uvmCTE9dyDqE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a1840d97556c7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/js/v-attributes-to-props.js.a2e7cd04.js

188.114.96.1

200 OK

702 B

URL GET HTTP/3
googrootsurvey.top/js/v-attributes-to-props.js.a2e7cd04.js
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
ASCII text, with very long lines (718), with no line terminators
Size
702 B (702 bytes)
Hash
4f868b7a0330d32e1450766a54886355
4b5952301185e7b02e2cdcba80f4aea3de700c47
2435c4b396d0b35fca9f618a201479cdcd64e84d43a386eec071a4082d7a781f

HTTP Headers

GET /js/v-attributes-to-props.js.a2e7cd04.js HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: application/javascript
cf-bgj: minify
etag: W/"662b7651-2be"
last-modified: Fri, 26 Apr 2024 09:39:29 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c8LPug05UlhqANc6JYPidxTt38ELUwFDjKMOGa7%2BfNri3H0m1kvx2S8FIQGtojuxJN6Gl%2B0vDk83AY4nIZj0ke2uxtBEORbKXzcmkw9ab6PHHwjZkdzHrR0zfoHhHqUMzlNY9%2F8%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a18421b1656c7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/img/comments/person-10.webp

188.114.96.1

200 OK

2.2 kB

URL GET HTTP/3
googrootsurvey.top/img/comments/person-10.webp
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 100x100, Scaling: [none]x[none], YUV color, decoders should clamp
Size
2.2 kB (2222 bytes)
Hash
9dd9074774147c349c8a5bd4760c3cfb
99675a91391516dee57d557728a8cc96257429a3
318ecbca5e7cedf56bad3a556b5c8a8fd14b22a3d536c85f0e4a646e40d8d332

HTTP Headers

GET /img/comments/person-10.webp HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=szfj4yn35287veq1gbgvqd2xuzj1ipk3; syncedCookie=true; oaidts=1715178071; ID=szfj4yn35287veq1gbgvqd2xuzj1ipk3
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: image/webp
content-length: 2222
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: "662b7650-8ae"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KMaeBu7eMtp%2FIOZFioV%2FduQdxpP89ro6egr0WXRNrr5TwSIbmlM4Mt338IE%2FrfDn7BN0Av1ly4jho3A1LcdBPxJJe%2BQaaIrfllPvclFpOJOlJNW0zY52R9ZjNzIwi2%2BJ01YsDbA%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a18434c8356c7-OSL
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/js/s-checkLocalStorageAvailable.ts.f2fef93d.js

188.114.96.1

200 OK

330 B

URL GET HTTP/3
googrootsurvey.top/js/s-checkLocalStorageAvailable.ts.f2fef93d.js
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
troff or preprocessor input, ASCII text, with very long lines (338), with no line terminators
Size
330 B (330 bytes)
Hash
9a78659da737fccc89546e61f0eb6213
84e705584bdbc81715e0326742f426c2f472d3a9
bb46fe2e65cc91e5a01a8e731754fdc9b8f30813835a673bd96b48672ac82d60

HTTP Headers

GET /js/s-checkLocalStorageAvailable.ts.f2fef93d.js HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: application/javascript
cf-bgj: minify
etag: W/"662b7651-14a"
last-modified: Fri, 26 Apr 2024 09:39:29 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UB6LpZVYaOd9uGV1CQPlgu10YaVJwIvdrTK8syFphvBBtpnDgCeaPkeP1yPgcsC%2Fq6%2BOBPO3K3xivqcpPLf6zRReuUlwwor0ovmBkO91yShVCgtaVIA%2BkAoRvoijRBZvRy3IVPo%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a1840d97456c7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/js/v-domparser.js.97173b2e.js

188.114.96.1

200 OK

1.7 kB

URL GET HTTP/3
googrootsurvey.top/js/v-domparser.js.97173b2e.js
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
JavaScript source, ASCII text, with very long lines (1772), with no line terminators
Size
1.7 kB (1720 bytes)
Hash
46dd2964e007bc585a8f72ed695089e8
d02de9abf34cf05d707899e2562c067a8e5326bc
96d95d967e2f5ca4a1be19cf0d21f756ba2d0295ad5f4e967048054e85f6072f

HTTP Headers

GET /js/v-domparser.js.97173b2e.js HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: application/javascript
cf-bgj: minify
etag: W/"662b7650-6b8"
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o5YVm5qEv%2FjgaO6G2rX0rA1337ct5PHTvbwFGj0QTJhPEY3FQvxqbiVWnHREoe4fQydMAjbg3R5aFqLyu9J1zlROWvG5GlFt6d0AbezSooz%2FAVlekrRT4r3vP1MTNl%2F9YM00reQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a18421b1056c7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

www.google.com/recaptcha/api.js?render=explicit&hl=en

142.250.74.132

200 OK

852 B

URL GET HTTP/2
www.google.com/recaptcha/api.js?render=explicit&hl=en
IP
142.250.74.132:443
ASN
#15169 GOOGLE

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerGoogle Trust Services LLC
Subjectwww.google.com
FingerprintC6:A2:DC:31:5A:53:FA:DD:55:71:A3:F4:DD:43:3D:16:71:B8:B3:99
ValidityTue, 16 Apr 2024 04:20:32 GMT - Tue, 09 Jul 2024 04:20:31 GMT

File type
JavaScript source, ASCII text, with very long lines (852), with no line terminators
Size
852 B (852 bytes)
Hash
5b87fe9817f32cb6b6073b19e560883e
b10dec390b303c27147ff5585d37d4f43f80e072
0ddbe69535c7d98745100dacb5b79d12052d9731fe06a05f8e5b5bbaa60d1023

HTTP Headers

GET /recaptcha/api.js?render=explicit&hl=en HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/javascript; charset=utf-8
expires: Wed, 08 May 2024 14:21:11 GMT
date: Wed, 08 May 2024 14:21:11 GMT
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-encoding: gzip
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

googrootsurvey.top/js/survey.1ad1decb.js

188.114.96.1

200 OK

6.7 kB

URL GET HTTP/3
googrootsurvey.top/js/survey.1ad1decb.js
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
JavaScript source, ASCII text, with very long lines (6885), with no line terminators
Size
6.7 kB (6667 bytes)
Hash
57f91299803086e8f6423e2eab698843
e4ce738ef3f77e882c6064d86acf96099b1a955a
96f55c89bc96f23f53a8b1b730734649a63862359a02ddcc88c58392c8015d36

HTTP Headers

GET /js/survey.1ad1decb.js HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: application/javascript
cf-bgj: minify
etag: W/"662b7652-1a0b"
last-modified: Fri, 26 Apr 2024 09:39:30 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fql751ntqJeNl78Rj2lCacc2WrA1mDVpzCsgga75TFgM%2BJFYvT8YlXPwlPS8msQtyeqHWXzdwKwp1bSJvWngTRV4ckoZrrUGTmpLxmH9BWltV8Y8YssM7gmmk66OfyEEsQsdN3c%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a1840d98056c7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/img/comments/person-4.webp

188.114.96.1

200 OK

1.4 kB

URL GET HTTP/3
googrootsurvey.top/img/comments/person-4.webp
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 100x100, Scaling: [none]x[none], YUV color, decoders should clamp
Size
1.4 kB (1356 bytes)
Hash
a78233e0cf1abbb3c5c98ef32a087d96
5ac6cdfb7f9e7be828a4d01e57f10379ef173889
3854114bf0acf8bc190e93893a80429d611c1d16b61d6cde07af182c232a30d7

HTTP Headers

GET /img/comments/person-4.webp HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=szfj4yn35287veq1gbgvqd2xuzj1ipk3; syncedCookie=true; oaidts=1715178071; ID=szfj4yn35287veq1gbgvqd2xuzj1ipk3
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: image/webp
content-length: 1356
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: "662b7650-54c"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3yfOVyI%2FtIbS3kCz3YdoKdrW0eiHQYXYtZnalohc6uyZJ%2Bz4MpS9PD3IiNi3jjyaVZ9JdxRgIFTNEkhMWR8LoLPEmHb2XSS1vfDB%2Fv%2FN3jgOa%2FGU%2BGy1jqkSJsM%2FLMmNSN9nJ6E%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a18434c7c56c7-OSL
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/pfe/current/stattag.js

188.114.96.1

200 OK

19 kB

URL GET HTTP/3
googrootsurvey.top/pfe/current/stattag.js
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
JavaScript source, ASCII text, with very long lines (19053), with no line terminators
Size
19 kB (19053 bytes)
Hash
3a74216e872211a9c770302bb7d4a63f
7e63556174a7d66eee407218e503ec0aae2c0f9e
03405209d89a927b81d53eb13968663069760776389c5400bb79d11bd9f78f78

HTTP Headers

GET /pfe/current/stattag.js HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=szfj4yn35287veq1gbgvqd2xuzj1ipk3; syncedCookie=true; oaidts=1715178071; ID=szfj4yn35287veq1gbgvqd2xuzj1ipk3
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: application/javascript
cf-bgj: minify
etag: W/"662b7651-4a6d"
last-modified: Fri, 26 Apr 2024 09:39:29 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nkJ88nIuM7CmI0WwVm8M8mPTRf6VWdtIJBvGiUkG3iXOmYftS0Ebo4R2l78ahmQIBm4K%2BxMIDHYee40QflZa%2Bcyu12NT9KZ03iWBxnVDBuqZ9ailRbJqBsip0q9kStGiiGQWknI%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a18445df056c7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/sw/sw6679100.js?var=6070194&var_3=null&var_4=null&ymid=2256&ab2_ttl=5184000000

188.114.96.1

200 OK

1.0 kB

URL GET HTTP/3
googrootsurvey.top/sw/sw6679100.js?var=6070194&var_3=null&var_4=null&ymid=2256&ab2_ttl=5184000000
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
ASCII text, with very long lines (1013), with no line terminators
Size
1.0 kB (1001 bytes)
Hash
28503ab5d148bc5800ec55ccc3b593a1
946a2af39727373ee459c57dd1388bd14624028d
103af73f648240aa788e87a8d27650fe6a19577ebae5e543e36764f04f84f3db

HTTP Headers

GET /sw/sw6679100.js?var=6070194&var_3=null&var_4=null&ymid=2256&ab2_ttl=5184000000 HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Moz: prefetch
DNT: 1
Connection: keep-alive
Cookie: OAID=szfj4yn35287veq1gbgvqd2xuzj1ipk3; syncedCookie=true; oaidts=1715178071; ID=szfj4yn35287veq1gbgvqd2xuzj1ipk3
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:12 GMT
content-type: application/javascript
cf-bgj: minify
cf-polished: origSize=1321
etag: W/"662b7650-529"
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: REVALIDATED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2%2Bxw%2BqAC5L5eYdJL4gu4TUZsmeTB6isJFH%2BAMvlY2gV4OzjjkYX4WWfcsQu0YcKIU1xAwAydPDTZBECyidqg1BhXhz%2FCKRWqsOiw69XyQvKX%2BlyXEoxE3TcaYuQyTecNI%2BxijzU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a18489b7456c7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/js/v-possibleStandardNamesOptimized.js.205abacb.js

188.114.96.1

200 OK

7.6 kB

URL GET HTTP/3
googrootsurvey.top/js/v-possibleStandardNamesOptimized.js.205abacb.js
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
ASCII text, with very long lines (7923), with no line terminators
Size
7.6 kB (7577 bytes)
Hash
f80cb2aef29b4a80d135d1a598ce1dfa
0653306df1fd8d8591f84661643825e41684d3f6
43c16ae11cea687efa4ca55dec516b23257c3fcb22c9d3541041f1816aaa7b5b

HTTP Headers

GET /js/v-possibleStandardNamesOptimized.js.205abacb.js HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: application/javascript
cf-bgj: minify
etag: W/"662b7651-1d99"
last-modified: Fri, 26 Apr 2024 09:39:29 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Dzqp9w0biyGmv9llXwExlie6pOyImQWPFvNx%2Bq0sVlEiqSWKFsxC7xJo1lXVjrftTSSvDUteTaTdCZjce0Gr6AubZmSr1BufjoF1yB4OmyKANVj8zH6QkBYvpukQKNIcHt%2B%2FAEc%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a18421b0e56c7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/js/v-constants.js.49317f47.js

188.114.96.1

200 OK

600 B

URL GET HTTP/3
googrootsurvey.top/js/v-constants.js.49317f47.js
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
ASCII text, with very long lines (664), with no line terminators
Size
600 B (600 bytes)
Hash
cf8c486ed295e4a6a30f4fb155bf9fd3
9942a3d40672242af15f2d5cc95df2c06872914f
83c4b13e336b66f673d082c8b9b2b20fb98772916cb5da52f9e48c929cafc9cb

HTTP Headers

GET /js/v-constants.js.49317f47.js HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: application/javascript
cf-bgj: minify
etag: W/"662b7651-258"
last-modified: Fri, 26 Apr 2024 09:39:29 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Kcj%2BK1yIH80iFl5xgJpx1d4c52G9HxkSj9n1ARBuwea%2FUIzw26xp7jrLWllGVCwhstStyZpEwwSTkpRvBmOlUpgSsQVN8mK4p7ZcMrnz4f%2F4xV9NcUJSKIuE7s5CUG6YDcQNN6k%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a18422b1a56c7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/css/_core-survey.d3ac2ee0.css

188.114.96.1

200 OK

83 B

URL GET HTTP/3
googrootsurvey.top/css/_core-survey.d3ac2ee0.css
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
ASCII text, with no line terminators
Size
83 B (83 bytes)
Hash
30d726a40ffe74d794b282ca1795b44c
b43155653a1b9cc8d257687df9a75e0f204db348
4916da6d6e00e0e6681cccaf9107eb45fdfc78fe2e476444623c30a64959b5e4

HTTP Headers

GET /css/_core-survey.d3ac2ee0.css HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: text/css
cf-bgj: minify
cf-polished: origSize=84
etag: W/"662b7650-54"
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AhxZQJpfUQFfUJx2LghtRg5y1htDWZu6OBdG0135q5m%2FD8ow2o%2FP1R%2BbkXwT1neAk2zanIUchGJs%2BU19TBlIkLbuQd57xJ1HRFp%2FDghD7sGKx6OphFXdpLeJRShV6t3tIDUh0q0%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a1840d98156c7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/js/config/sd/sd-9540-en.js?v=10

188.114.96.1

200 OK

8.0 kB

URL GET HTTP/3
googrootsurvey.top/js/config/sd/sd-9540-en.js?v=10
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
Unicode text, UTF-8 text, with very long lines (8359), with no line terminators
Size
8.0 kB (7963 bytes)
Hash
979517482417bab72a87fcb46bb96ed7
f6b50889f9e61c0cd733ee8e0a7d4e5019e655aa
f151d790cd58c035bfcc7068cc75a49d194eb7bcdd77dd0b92a340c86c380b82

HTTP Headers

GET /js/config/sd/sd-9540-en.js?v=10 HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: application/javascript
cf-bgj: minify
etag: W/"662b7651-1f1b"
last-modified: Fri, 26 Apr 2024 09:39:29 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oDzc2xtnWxI9M1%2BnYgK5979OB%2BXFh7b5liPUr6oopkIqYBtjQ%2FtMkEQzSy4WuVvHjYJp24V0yAZ7i9wJZCckocIz14pXtIRW7XGiEX1mSWqzI%2BQkwoIxSVlvmv%2BtafFOtbblyyA%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a18418a7756c7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/img/comments/person-11.webp

188.114.96.1

200 OK

1.5 kB

URL GET HTTP/3
googrootsurvey.top/img/comments/person-11.webp
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 100x100, Scaling: [none]x[none], YUV color, decoders should clamp
Size
1.5 kB (1526 bytes)
Hash
0100f949c3302195d906e13bc199399d
2b39580485f3e9ca81a8a2ead4747f89731800f4
10df37a82d90b2225e19460cbe7403726591fbd02caabfdf6a2884db631d8511

HTTP Headers

GET /img/comments/person-11.webp HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=szfj4yn35287veq1gbgvqd2xuzj1ipk3; syncedCookie=true; oaidts=1715178071; ID=szfj4yn35287veq1gbgvqd2xuzj1ipk3
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: image/webp
content-length: 1526
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: "662b7650-5f6"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y5PHeemvkowmhaCvzjOyfR%2Bk63IT8oypwK6r%2B0%2Bsg3n9T4j%2F7%2BZ9SzOo3lxufRP2KXQCxcPE0OtlqxI7Km1zhMdkwws3MxlnZKJdu4VFRSqJ03PHlA0MgcKY7E%2BG%2FFFhidVyl8Q%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a18434c8456c7-OSL
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/js/_core-survey.1b09882a.js

188.114.96.1

200 OK

170 kB

URL GET HTTP/3
googrootsurvey.top/js/_core-survey.1b09882a.js
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type

Size
170 kB (169673 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /js/_core-survey.1b09882a.js HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: application/javascript
cf-bgj: minify
cf-polished: origSize=169676
etag: W/"662b7652-296cc"
last-modified: Fri, 26 Apr 2024 09:39:30 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iG7A0DRbFErMtCHbj0Y0fnQvYKk6Q2W7uWHzkjSoqN7y0rkL2D831eFz2z2yW10mT9nBxKX2sMwY1MlTyeyM74Kyj1k8siMCVvUtW1aVgo7A%2BA0ExnNthj1kBmR%2FrKJlpXbUqCg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a1840d97f56c7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

ofklefkian.com/zone?&pub=0&zone_id=6679100&is_mobile=false&domain=googrootsurvey.top&var=6070194&ymid=2256&var_3=null&var_4=null&dsig=&tg=1&sw=3.1.472&action=prerequest

139.45.197.251

200 OK

0 B

URL POST HTTP/2
ofklefkian.com/zone?&pub=0&zone_id=6679100&is_mobile=false&domain=googrootsurvey.top&var=6070194&ymid=2256&var_3=null&var_4=null&dsig=&tg=1&sw=3.1.472&action=prerequest
IP
139.45.197.251:443
ASN
#9002 RETN Limited

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectofklefkian.com
Fingerprint04:A9:FE:8D:C9:B9:EE:6F:3A:C4:29:EA:19:AD:C3:1D:7D:3E:14:02
ValiditySun, 14 Apr 2024 05:38:05 GMT - Sat, 13 Jul 2024 05:38:04 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /zone?&pub=0&zone_id=6679100&is_mobile=false&domain=googrootsurvey.top&var=6070194&ymid=2256&var_3=null&var_4=null&dsig=&tg=1&sw=3.1.472&action=prerequest HTTP/1.1
Host: ofklefkian.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0

HTTP/2 200 OK
server: nginx
date: Wed, 08 May 2024 14:21:11 GMT
content-length: 0
x-trace-id: 17f8261930e21a603c6747d7f63866fb
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-origin: null
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, X-Oaid, Content-Type, Accept
strict-transport-security: max-age=1
x-content-type-options: nosniff
X-Firefox-Spdy: h2

googrootsurvey.top/js/v-utilities.js.d1112fc4.js

188.114.96.1

200 OK

2.6 kB

URL GET HTTP/3
googrootsurvey.top/js/v-utilities.js.d1112fc4.js
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
JavaScript source, ASCII text, with very long lines (2645), with no line terminators
Size
2.6 kB (2577 bytes)
Hash
3f45699a0edf3555d230727e3e1ba866
f30b9f52153e77b9ce60a30ecb15f36657792908
1b312ac32a5c37ffe1c4bf861a048a76d807155fe494adf5dd356d067367f488

HTTP Headers

GET /js/v-utilities.js.d1112fc4.js HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: application/javascript
cf-bgj: minify
etag: W/"662b7651-a11"
last-modified: Fri, 26 Apr 2024 09:39:29 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IOJWi6XBYryAfRYezXUaYHBWYNgWNyE%2FcONWDRD8Xm3rBcejCvN0mN124EtzGE%2FUiuOpMIprch6444AVcBdJCaJDKgcPSMW2ZKwX%2BhidZwginPo8UlpdgN6vMJcPwp3kraSSCD0%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a18421b0f56c7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/favicon.ico

188.114.96.1

200 OK

1.2 kB

URL GET HTTP/3
googrootsurvey.top/favicon.ico
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Size
1.2 kB (1150 bytes)
Hash
668ba1a9fa1890ba16cb8adc28d3dad8
5e35223b2541265114eaf61b9da2556c812fea17
7746cf1b553433822522f2dc432f55fe64eee1f1cf823ef6adfde02e58e1d7e2

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=szfj4yn35287veq1gbgvqd2xuzj1ipk3; syncedCookie=true; oaidts=1715178071; ID=szfj4yn35287veq1gbgvqd2xuzj1ipk3
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:12 GMT
content-type: image/x-icon
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: W/"662b7650-47e"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bfK60DHAbxX0G0I7JFq5SxSQEcJN4CsktXJ4lB2SvfjbAuh5oC8JPWcFNdKTrzVZ5NqvdhpHnE%2BQdqYo2LAN4y63zK8CdKBboOZNT8wvIUvkbYr546XZMOyjSQJWYChi9Pl4JwI%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a1847090d56c7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/js/SurveyContainer.e2959212.js

188.114.96.1

200 OK

57 kB

URL GET HTTP/3
googrootsurvey.top/js/SurveyContainer.e2959212.js
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
JavaScript source, ASCII text, with very long lines (57082), with no line terminators
Size
57 kB (57082 bytes)
Hash
0df7a0f05192a1af311ce45d48639a89
df29dce5914578a52af5f516ccd18d289d808951
4cde10689c1ef6c2f58585483fae6d656ccfa1d16cc282dcfbe6cb89700ae2dc

HTTP Headers

GET /js/SurveyContainer.e2959212.js HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: application/javascript
cf-bgj: minify
cf-polished: origSize=57085
etag: W/"662b7651-defd"
last-modified: Fri, 26 Apr 2024 09:39:29 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rLltWD7hcL4JFRIZQOHLSyiez4NRaxy2OuW07YVlCnILFZRjhf6Jdk5JoFN%2FKPqYhhbisEvmDpQoPZXOubcmXvGIdiifXG9wzE1Z3a1SIhmrE53sEh9HPhuDu0PHG6TF24gHlvY%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a18422b1b56c7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/js/config/dict/cookie-consent-1.json?v=10

188.114.96.1

200 OK

6.8 kB

URL GET HTTP/3
googrootsurvey.top/js/config/dict/cookie-consent-1.json?v=10
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
HTML document, Unicode text, UTF-8 text, with very long lines (6009), with no line terminators
Size
6.8 kB (6757 bytes)
Hash
4b2ff958e811a50d2f641818590b443d
6abae297812bb55fad869e953e7fdf7469cbe1ae
9c77a5f3d0028d9ba122ed15728ee7b144619431f8302503a19c5785ddaa06b8

HTTP Headers

GET /js/config/dict/cookie-consent-1.json?v=10 HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: application/json
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: W/"662b7650-1a65"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7ipFLe6a5dXylU4VgnJsCngw81j2x%2BqtMlVeyRAJeclAqXqJByS99A14ysfMClpN3hWjfpB6iXCmzc2W3KjIsWmHoxX4jVHZHCAus8oi3NSOrS5LZ8O8a%2BhVR3fdVCQtt2M8t0A%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a1841cac256c7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/js/v-dom-to-react.js.26fdf751.js

188.114.96.1

200 OK

1.1 kB

URL GET HTTP/3
googrootsurvey.top/js/v-dom-to-react.js.26fdf751.js
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
JavaScript source, ASCII text, with very long lines (1101), with no line terminators
Size
1.1 kB (1085 bytes)
Hash
5693cb2629dd3231ce6fed788c41b150
872d71cae7dddc37389be6bae0fc4a5b611ec9c0
b312636bf1d349d818517865e89c22f8b9ef9e61d1805cf315e44241ccc05d26

HTTP Headers

GET /js/v-dom-to-react.js.26fdf751.js HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: application/javascript
cf-bgj: minify
etag: W/"662b7650-43d"
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XVY%2BlB9vbpBu0okN9XXDHSUltrdkU7%2F5nhUe6siwOTZb4iTSytN6ui26smzR6DqGnK44%2FKAC0Xdb%2FPIFcDkf8Iu%2BPTRUzLJHc5wVUF4obDVQ9PUDHPaP0%2FuUfSGi%2BWHWNpxmSHM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a18421b1456c7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/js/v-index.mjs.19622407.js

188.114.96.1

200 OK

35 kB

URL GET HTTP/3
googrootsurvey.top/js/v-index.mjs.19622407.js
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
JavaScript source, ASCII text, with very long lines (35287), with no line terminators
Size
35 kB (35287 bytes)
Hash
1de1ec2d8e7940b88970d8fbce40ed6d
510aa24127fb8bc3578d9ca4628b2eea5a84ce01
b473156bef833bcfb2e84658093f1ebc1e64011dcba904e26ccb31f1cad8b762

HTTP Headers

GET /js/v-index.mjs.19622407.js HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: application/javascript
cf-bgj: minify
etag: W/"662b7651-89d7"
last-modified: Fri, 26 Apr 2024 09:39:29 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QjuXr%2FHyxIQ4NhL66jGulIJUo0Voc7DQBh5HMfOysDOPSPVnAE2Uci%2BpJE6aIU%2BvsGDH%2F7yj5wjHiw4sLMtQBnqoFg%2BpcUv2uBZX2kwx1zVMFKxa2nu1RO33iBikcGBA8LfZtCo%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a18421b0b56c7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/img/comments/person-1.webp

188.114.96.1

200 OK

1.1 kB

URL GET HTTP/3
googrootsurvey.top/img/comments/person-1.webp
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 100x100, Scaling: [none]x[none], YUV color, decoders should clamp
Size
1.1 kB (1122 bytes)
Hash
56441eb05774cd7ed15d829e06947346
25649e1ed3820d97bd8bcdc737974e0c65adc1aa
5be168d58cf2dc0e41bc5a9b386add0d57fee26848613ca601f0c31378a8ad02

HTTP Headers

GET /img/comments/person-1.webp HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=szfj4yn35287veq1gbgvqd2xuzj1ipk3; syncedCookie=true; oaidts=1715178071; ID=szfj4yn35287veq1gbgvqd2xuzj1ipk3
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: image/webp
content-length: 1122
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: "662b7650-462"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OxUyePeF4NqkLS6FyMgg6%2Fq6xriIFVmMyUhk6ctMwRaC4lxJwUbE3pdPdnUgmlkcN3bbXXc1AjpTb800n%2BHHvhO4NLucWUWRfBofvp5%2BUmr66fJs8kFn%2F%2F3h%2BBvfh0PJrT1MtZo%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a18432c6156c7-OSL
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/css/survey.3b7d0b23.css

188.114.96.1

200 OK

72 kB

URL GET HTTP/3
googrootsurvey.top/css/survey.3b7d0b23.css
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
ASCII text, with very long lines (65536), with no line terminators
Size
72 kB (71461 bytes)
Hash
b73782889f162bcbf6cb45913f540ec3
27cd8e6d8b4159b1a4f3e466b845b7d0a7e61d67
ea6df993a607e008f434e5e950a08da1397044cbc442cb76d25f02cf3499c77b

HTTP Headers

GET /css/survey.3b7d0b23.css HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: text/css
cf-bgj: minify
cf-polished: origSize=71475
etag: W/"662b7650-11733"
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
strict-transport-security: max-age=1
vary: Accept-Encoding
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3EKKE8NELP70yAEpE21Nq7EUVzM3vdBtLF1urxDSuQMLyiw4xl0iT7yPnn2imO%2BIWyoDukOEor5M94FaRnDAlk4pZLjUqRa7Jxie7GffBad2iDg8snd41%2FHJDwVkK7s4tkPQKKM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a1840d98256c7-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/img/comments/person-2.webp

188.114.96.1

200 OK

1.1 kB

URL GET HTTP/3
googrootsurvey.top/img/comments/person-2.webp
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 100x100, Scaling: [none]x[none], YUV color, decoders should clamp
Size
1.1 kB (1104 bytes)
Hash
cd20c1e86fd66d301b6e35a97af461fd
3f92712ef775681d59dfd96bb9b6429227a944e9
0d5556f5acd9a72ca66c6bfab3d813e35f504dcf73e6e6baca816da78a8fbad0

HTTP Headers

GET /img/comments/person-2.webp HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=szfj4yn35287veq1gbgvqd2xuzj1ipk3; syncedCookie=true; oaidts=1715178071; ID=szfj4yn35287veq1gbgvqd2xuzj1ipk3
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: image/webp
content-length: 1104
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: "662b7650-450"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WYiM1jLd6dPJZCHX4uYWNymq3P3mn0arixOpkGWMW7G7NJoIH%2FbjWdv3%2FuvmEBIiNAn3zgmENXIH3rxK9eAMj7gOU2p263n7mqVJ%2FCOPzodPgDjsaRnDMaQWzu7iutc6hR2Ao4M%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a18432c6356c7-OSL
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/img/comments/person-9.webp

188.114.96.1

200 OK

1.7 kB

URL GET HTTP/3
googrootsurvey.top/img/comments/person-9.webp
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 100x100, Scaling: [none]x[none], YUV color, decoders should clamp
Size
1.7 kB (1654 bytes)
Hash
12f578cbef79e63d347e2c8384c03ce6
496afa2132dc6a09052596587de749aefa634975
be233e744893994063c5cc341d9f60ff9ccdaa582da7b05bcfc01a7415b7cffa

HTTP Headers

GET /img/comments/person-9.webp HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=szfj4yn35287veq1gbgvqd2xuzj1ipk3; syncedCookie=true; oaidts=1715178071; ID=szfj4yn35287veq1gbgvqd2xuzj1ipk3
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: image/webp
content-length: 1654
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: "662b7650-676"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xf0TlWzululD%2Fv6%2F%2FQbxcMuFBF%2Fj46PkhChmFgez%2ByJXfqgBZlfogWPoGqVJWCT10M%2Be%2FoG0nH7Gq9ZSLwPThba4NDaTbxMugHnYqkF3UPXMEPJORSOKg4EF4qkN5ipUf3tYTwA%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a18434c8256c7-OSL
alt-svc: h3=":443"; ma=86400

googrootsurvey.top/img/comments/person-3.webp

188.114.96.1

200 OK

982 B

URL GET HTTP/3
googrootsurvey.top/img/comments/person-3.webp
IP
188.114.96.1:443
ASN
#13335 CLOUDFLARENET

Requested by
https://googrootsurvey.top/finance-survey.html?z=6070194&offer_id=9540&var=2256&ymid=663b8a56de68ab0001f5d0bf
Certificate
IssuerLet's Encrypt
Subjectgoogrootsurvey.top
Fingerprint45:9F:A9:15:13:FF:F3:F7:69:62:41:D1:AF:F6:A3:C6:F3:4F:F5:30
ValidityThu, 18 Apr 2024 08:07:48 GMT - Wed, 17 Jul 2024 08:07:47 GMT

File type
RIFF (little-endian) data, Web/P image, VP8 encoding, 100x100, Scaling: [none]x[none], YUV color, decoders should clamp
Size
982 B (982 bytes)
Hash
489a7f64f96c92f3325af92fa2af78b5
098cbcbd7ee329321d2fb7bac74535ab258a1f97
fd84809b70e4186fc2529a7ce54316e51ddf51ff8b2f099dcdb88ea91840be4f

HTTP Headers

GET /img/comments/person-3.webp HTTP/1.1
Host: googrootsurvey.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Cookie: OAID=szfj4yn35287veq1gbgvqd2xuzj1ipk3; syncedCookie=true; oaidts=1715178071; ID=szfj4yn35287veq1gbgvqd2xuzj1ipk3
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Wed, 08 May 2024 14:21:11 GMT
content-type: image/webp
content-length: 982
last-modified: Fri, 26 Apr 2024 09:39:28 GMT
vary: Accept-Encoding
etag: "662b7650-3d6"
strict-transport-security: max-age=1
x-content-type-options: nosniff
cache-control: max-age=1800
cf-cache-status: HIT
age: 2289
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PiInnb7mtNW9S6rsBO%2BS5T52G%2Bm3ks1ymhVjnLhrmBXGTz%2F2zgm5iK6Eb9wNLc2PIzov7gcv9joqFrVJv5rLBpL2x3eYBZEa0JS540pdXIUGPTKNsIb8FvDhEHKWg6X66GpSADo%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 880a18434c8156c7-OSL
alt-svc: h3=":443"; ma=86400

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (32)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML