goforrewards.info/RM/Arg?devicemodel=Apple%20Macintosh&browser=Chrome&ip=2600:1900:2000:1b:400::25&bemobdata=c=599a3f32-1ac2-41f1-a38a-1ba4f66986c0..l=6837f517-6906-45dc-a9aa-589163cdc1e2..a=0..b=0..r=cn47e.bemobtrk.com
104.26.15.73301 Moved Permanently 0 B URL HTTP/1.1 goforrewards.info/RM/Arg?devicemodel=Apple%20Macintosh&browser=Chrome&ip=2600:1900:2000:1b:400::25&bemobdata=c=599a3f32-1ac2-41f1-a38a-1ba4f66986c0..l=6837f517-6906-45dc-a9aa-589163cdc1e2..a=0..b=0..r=cn47e.bemobtrk.com
IP 104.26.15.73:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /RM/Arg?devicemodel=Apple%20Macintosh&browser=Chrome&ip=2600:1900:2000:1b:400::25&bemobdata=c=599a3f32-1ac2-41f1-a38a-1ba4f66986c0..l=6837f517-6906-45dc-a9aa-589163cdc1e2..a=0..b=0..r=cn47e.bemobtrk.com HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 301 Moved Permanently
Date: Thu, 08 Dec 2022 20:07:07 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Thu, 08 Dec 2022 21:07:07 GMT
Location: https://goforrewards.info/RM/Arg?devicemodel=Apple%20Macintosh&browser=Chrome&ip=2600:1900:2000:1b:400::25&bemobdata=c=599a3f32-1ac2-41f1-a38a-1ba4f66986c0..l=6837f517-6906-45dc-a9aa-589163cdc1e2..a=0..b=0..r=cn47e.bemobtrk.com
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Bwa7nSiM3ATSTvbpXQU%2Bu0wOgxbU%2FJVetDmdy7jkG23CGfxu6LRQ1jSZfRAmhOZBbkdoF%2BEMT9Kqbrf1xZ93z2o5s9JljwY6dgF3JQUwZ5E4EQHiB0R%2Fyl7EpozJGGxbBC%2FT"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7768201e9bcfb4f3-OSL
alt-svc: h2=":443"; ma=60
r3.o.lencr.org/
23.33.119.27200 OK 503 B IP 23.33.119.27:0
ASN #20940 Akamai International B.V.
Hash f2acd891dc6eb1f09f57a2b086791781
1e2088306501a61edcca1ade62c4d54f23b3b083
51148fed95cc00d60dc3640350f135b1b2763ff0e3cfbffc40f0948317894be9
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "51148FED95CC00D60DC3640350F135B1B2763FF0E3CFBFFC40F0948317894BE9"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11858
Expires: Thu, 08 Dec 2022 23:24:45 GMT
Date: Thu, 08 Dec 2022 20:07:07 GMT
Connection: keep-alive
r3.o.lencr.org/
23.33.119.27200 OK 503 B IP 23.33.119.27:0
ASN #20940 Akamai International B.V.
Hash 388f6fea5bafa378266622b72311a6ee
447f102dc12172ce1ba44c5e94e1d7bb49d43372
a597afb4d4f7f3c82f0f2857322226fc69dc92e099bfd0605f7a0cd562be9d21
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A597AFB4D4F7F3C82F0F2857322226FC69DC92E099BFD0605F7A0CD562BE9D21"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6105
Expires: Thu, 08 Dec 2022 21:48:52 GMT
Date: Thu, 08 Dec 2022 20:07:07 GMT
Connection: keep-alive
r3.o.lencr.org/
23.33.119.27200 OK 503 B IP 23.33.119.27:0
ASN #20940 Akamai International B.V.
Hash 00e7703bd74975689fc9050356aaca6b
9788fe6a36d6f278e8da329ebc5dd87bcd212317
593bc437ff8a8233516c62613d50220fcb25b9f967ed5fb384c253f0db135103
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "593BC437FF8A8233516C62613D50220FCB25B9F967ED5FB384C253F0DB135103"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5183
Expires: Thu, 08 Dec 2022 21:33:30 GMT
Date: Thu, 08 Dec 2022 20:07:07 GMT
Connection: keep-alive
firefox.settings.services.mozilla.com/v1/
35.241.9.150200 OK 939 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/
IP 35.241.9.150:0
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash 14cd9a0afb6ba9a763651d5112760d1e
75d7b104ab9ab11fbb73c3f348b43b0119b5adfa
4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Retry-After, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Thu, 08 Dec 2022 19:08:13 GMT
content-type: application/json
age: 3534
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
e1.o.lencr.org/
95.101.11.115200 OK 346 B IP 95.101.11.115:0
ASN #20940 Akamai International B.V.
Hash faec6573e7a1d367680316ddef5c8a15
c108d0b60128b787b2f898c7c38b8735335ba6f3
cbeaee18a1f621d6c1353a9852992755adde5b9721d256d4a56a091fdad773a8
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 346
ETag: "CBEAEE18A1F621D6C1353A9852992755ADDE5B9721D256D4A56A091FDAD773A8"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21587
Expires: Fri, 09 Dec 2022 02:06:54 GMT
Date: Thu, 08 Dec 2022 20:07:07 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain
34.160.144.191200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain
IP 34.160.144.191:0
File type PEM certificate\012- , ASCII text
Hash 53341dea33f4f3d9b4966f80589f429a
20f7b07c686c986d2ed1e3e9ad1bb2aef8edaf0d
651683e52cdbc96b289f8f123155f0b96d9f67432689e89156fa56f5a346c6a0
GET /chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: QqvjCT4kafNk4hTHj38oEA1dJWrI9JNNp6cvcqm3PVQDSC0DjwNiNzlZvRGgMVQcGsr+C8vrp5s=
x-amz-request-id: Y4JZXV0ABR946D19
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Thu, 08 Dec 2022 19:48:02 GMT
age: 1145
last-modified: Wed, 30 Nov 2022 10:06:34 GMT
etag: "53341dea33f4f3d9b4966f80589f429a"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
contile.services.mozilla.com/v1/tiles
34.117.237.239200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP 34.117.237.239:0
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Thu, 08 Dec 2022 20:07:07 GMT
content-type: application/json
content-length: 12
access-control-expose-headers: content-type
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
goforrewards.info/RM/Arg?devicemodel=Apple%20Macintosh&browser=Chrome&ip=2600:1900:2000:1b:400::25&bemobdata=c=599a3f32-1ac2-41f1-a38a-1ba4f66986c0..l=6837f517-6906-45dc-a9aa-589163cdc1e2..a=0..b=0..r=cn47e.bemobtrk.com
172.67.75.176301 Moved Permanently 169 B URL HTTP/2 goforrewards.info/RM/Arg?devicemodel=Apple%20Macintosh&browser=Chrome&ip=2600:1900:2000:1b:400::25&bemobdata=c=599a3f32-1ac2-41f1-a38a-1ba4f66986c0..l=6837f517-6906-45dc-a9aa-589163cdc1e2..a=0..b=0..r=cn47e.bemobtrk.com
IP 172.67.75.176:0
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 0f952b73d3f5586637ea9a5a789d48f4
b29aff4ffa1d4decd77db5160f920e1c6417e5e9
69d11528ee32902d0c47ed215877f0610399536f755db03ed02a77ecedd74751
GET /RM/Arg?devicemodel=Apple%20Macintosh&browser=Chrome&ip=2600:1900:2000:1b:400::25&bemobdata=c=599a3f32-1ac2-41f1-a38a-1ba4f66986c0..l=6837f517-6906-45dc-a9aa-589163cdc1e2..a=0..b=0..r=cn47e.bemobtrk.com HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 301 Moved Permanently
date: Thu, 08 Dec 2022 20:07:07 GMT
content-type: text/html
location: http://goforrewards.info/RM/Arg/?devicemodel=Apple%20Macintosh&browser=Chrome&ip=2600:1900:2000:1b:400::25&bemobdata=c=599a3f32-1ac2-41f1-a38a-1ba4f66986c0..l=6837f517-6906-45dc-a9aa-589163cdc1e2..a=0..b=0..r=cn47e.bemobtrk.com
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XedoyH%2FkHlyE5%2FJw8EsaaiS2NBngMG5Qu9rE9pcrKRMRvtjs2xNumxdosrYjcGvLzOX5KJRWNXzxB9%2FkdnZrZ0E%2Ft7UXlwSgYjiWHwHI8ZerSrceclk05GyHQsUFeM1h7Uc%2B"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7768201ffaeffac8-OSL
X-Firefox-Spdy: h2
goforrewards.info/RM/Arg/img/flag.jpg
172.67.75.176200 OK 11 kB URL HTTP/2 goforrewards.info/RM/Arg/img/flag.jpg
IP 172.67.75.176:0
File type JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=15, height=480, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=480], progressive, precision 8, 50x50, components 3\012- data
Hash 3da6f6ab99d6d33120443b819142dba5
243dfe1309f7ef5b5c646dfeb99f71c6656af7d4
76af28d5b349334ab752a1e30499a9b2da88f057aa0ca4fa7f65a9ba2b320725
GET /RM/Arg/img/flag.jpg HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/?devicemodel=Apple%20Macintosh&browser=Chrome&ip=2600:1900:2000:1b:400::25&bemobdata=c=599a3f32-1ac2-41f1-a38a-1ba4f66986c0..l=6837f517-6906-45dc-a9aa-589163cdc1e2..a=0..b=0..r=cn47e.bemobtrk.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:07:07 GMT
content-type: image/jpeg
content-length: 11245
cache-control: max-age=2592000
cf-bgj: h2pri
etag: "638e1974-2bed"
expires: Sat, 07 Jan 2023 18:06:01 GMT
last-modified: Mon, 05 Dec 2022 16:16:52 GMT
cf-cache-status: HIT
age: 7266
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9avykPVr6L7IetT2I3HYHPPsQrwbmjmYcUcPTjYXomMam8zrCwM0ZrrWexA%2BPZCDbLswSKNysBlxVkPNOT7nB3bUMueZNSZKTn441k6WGOBap7O3Mx2HEwnkqwQiuqvIdElf"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77682021abf9fac8-OSL
X-Firefox-Spdy: h2
goforrewards.info/RM/Arg/img/image1.png
172.67.75.176200 OK 62 kB URL HTTP/2 goforrewards.info/RM/Arg/img/image1.png
IP 172.67.75.176:0
File type PNG image data, 448 x 327, 8-bit/color RGBA, non-interlaced\012- data
Hash 666d53ee287e91e9be9eeb4250241936
91b8e454152d65368f8ea33826f856dd8718d94d
8439533d3e3f027fa1bd09ba2038ada51c6e0f0f3ff1100786e57762e685555f
GET /RM/Arg/img/image1.png HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/?devicemodel=Apple%20Macintosh&browser=Chrome&ip=2600:1900:2000:1b:400::25&bemobdata=c=599a3f32-1ac2-41f1-a38a-1ba4f66986c0..l=6837f517-6906-45dc-a9aa-589163cdc1e2..a=0..b=0..r=cn47e.bemobtrk.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:07:07 GMT
content-type: image/png
content-length: 62125
last-modified: Mon, 05 Dec 2022 16:16:52 GMT
etag: "638e1974-f2ad"
expires: Sat, 07 Jan 2023 18:06:01 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 7266
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=i5EDkfIIhtJFqGrJrQ9lGmViEz%2FHKmGH1f8slujY7wj07RlF5RJwiKCJ3bV9OjDiU6efyy20B%2F6W9aJj50nFX80i9M417y1ISfqlCdrWyw4Z%2F3khH9QRJM6yk8fHdBkNhUI7"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77682021abf8fac8-OSL
X-Firefox-Spdy: h2
goforrewards.info/RM/Arg/img/lg.png
172.67.75.176200 OK 11 kB URL HTTP/2 goforrewards.info/RM/Arg/img/lg.png
IP 172.67.75.176:0
File type PNG image data, 150 x 56, 8-bit/color RGBA, non-interlaced\012- data
Hash fb30ca654c9272d51ee91cc03bb283b3
e7a0d3d0884fbbb279905a53008aa66925080bf9
f56047b304ea124b4d473858686fa5c63eb3e84226e5aab01733ccc8d24e2f99
GET /RM/Arg/img/lg.png HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/?devicemodel=Apple%20Macintosh&browser=Chrome&ip=2600:1900:2000:1b:400::25&bemobdata=c=599a3f32-1ac2-41f1-a38a-1ba4f66986c0..l=6837f517-6906-45dc-a9aa-589163cdc1e2..a=0..b=0..r=cn47e.bemobtrk.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:07:07 GMT
content-type: image/png
content-length: 10807
last-modified: Mon, 05 Dec 2022 16:16:53 GMT
etag: "638e1975-2a37"
expires: Sat, 07 Jan 2023 18:06:01 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 7266
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6epGaClv9Ta2NICv0onwsqDVUcm5r%2B%2BPydEJIRkNeycswnmr29IrzIp4fLbKg%2FEx%2BUKRyr2o4GlvbGgq%2BP1j6723WEttXR2vIl94AHD9rjdfDpMeA5B5qrp0%2BJVLuGrrkx6M"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77682021abf5fac8-OSL
X-Firefox-Spdy: h2
goforrewards.info/RM/Arg/img/5555.jpg
172.67.75.176200 OK 35 kB URL HTTP/2 goforrewards.info/RM/Arg/img/5555.jpg
IP 172.67.75.176:0
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2021:09:21 17:53:11], baseline, precision 8, 300x142, components 3\012- data
Hash 273b586bec0ef2dcb80627b2efde3832
3398fd84101aefa491ef8950180a67f514eb4dab
db4d54ef2df3c7dc42d194747982b34186ab84beacdc650221abd0121df2a9fd
GET /RM/Arg/img/5555.jpg HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/?devicemodel=Apple%20Macintosh&browser=Chrome&ip=2600:1900:2000:1b:400::25&bemobdata=c=599a3f32-1ac2-41f1-a38a-1ba4f66986c0..l=6837f517-6906-45dc-a9aa-589163cdc1e2..a=0..b=0..r=cn47e.bemobtrk.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:07:07 GMT
content-type: image/jpeg
content-length: 34891
cache-control: max-age=2592000
cf-bgj: h2pri
etag: "638e1973-884b"
expires: Sat, 07 Jan 2023 18:06:01 GMT
last-modified: Mon, 05 Dec 2022 16:16:51 GMT
cf-cache-status: HIT
age: 7266
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=La0bE3tzto4h2R8%2F1N0fSbOgSJr7j1uQ3WlQGP4iTMa6PHLbzD%2BcgKLjVl%2BY5THaG9Fdrx40esiNSj2Ld7ZduhGRW1BkAPfCsL0O%2BaOfCsYHwz49MIjicpiX5dAeOME2q%2Fwx"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77682021abfcfac8-OSL
X-Firefox-Spdy: h2
goforrewards.info/RM/Arg/img/ld.gif
172.67.75.176200 OK 122 kB URL HTTP/2 goforrewards.info/RM/Arg/img/ld.gif
IP 172.67.75.176:0
File type GIF image data, version 89a, 246 x 246\012- data
Size 122 kB (121587 bytes)
Hash 1f32223b3bcbe23d6efe15d914206440
1faa0c1e65002ca3880cb764be63abef5a3efac5
c0f27622e1c77dfe225b6e2637211c61861471c39e585461a5dc55017950e92a
GET /RM/Arg/img/ld.gif HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/?devicemodel=Apple%20Macintosh&browser=Chrome&ip=2600:1900:2000:1b:400::25&bemobdata=c=599a3f32-1ac2-41f1-a38a-1ba4f66986c0..l=6837f517-6906-45dc-a9aa-589163cdc1e2..a=0..b=0..r=cn47e.bemobtrk.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:07:07 GMT
content-type: image/gif
content-length: 121587
last-modified: Mon, 05 Dec 2022 16:16:55 GMT
etag: "638e1977-1daf3"
expires: Fri, 06 Jan 2023 05:17:48 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 139759
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cM0%2FnReH3lckY1hoY2Huxr%2BRFvOVmkocGXpiZCCapG1xTVxv6fyL4zKAFwrvpes5avyaFGsUITeScnUor7ilzveWTokr30vrEk9HGHKHcgGYkB0iGp5ZufPFc2JUy9RDt%2BYp"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77682021abfafac8-OSL
X-Firefox-Spdy: h2
goforrewards.info/RM/Arg/img/chk2.jpg
172.67.75.176200 OK 36 kB URL HTTP/2 goforrewards.info/RM/Arg/img/chk2.jpg
IP 172.67.75.176:0
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2021:09:21 17:53:11], baseline, precision 8, 300x142, components 3\012- data
Hash b470f64d686c16fc5b943d5214e08cd4
e95197030e48189cf0a2cae4e185d867378055bb
b252efeddacee63748a47ad45e49574ac73ac80ecc27fe1eabe5dafbbbd0e751
GET /RM/Arg/img/chk2.jpg HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/?devicemodel=Apple%20Macintosh&browser=Chrome&ip=2600:1900:2000:1b:400::25&bemobdata=c=599a3f32-1ac2-41f1-a38a-1ba4f66986c0..l=6837f517-6906-45dc-a9aa-589163cdc1e2..a=0..b=0..r=cn47e.bemobtrk.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:07:07 GMT
content-type: image/jpeg
content-length: 35766
cache-control: max-age=2592000
cf-bgj: h2pri
etag: "638e1973-8bb6"
expires: Sat, 07 Jan 2023 18:06:01 GMT
last-modified: Mon, 05 Dec 2022 16:16:51 GMT
cf-cache-status: HIT
age: 7266
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SOBY5hE%2BAsgID2kt7gd5giZ3y0VLfjklxewIHIIERL%2FMTfKWoFoB%2B3lONib7%2B1Fg0FstIL5QNrGW9pSxZvjZ9A12h5aDHaEh8vKCN92fSHjLUOCWSVJavx6xEsulxw0WFZqJ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77682021bc06fac8-OSL
X-Firefox-Spdy: h2
goforrewards.info/RM/Arg/?devicemodel=Apple%20Macintosh&browser=Chrome&ip=2600:1900:2000:1b:400::25&bemobdata=c=599a3f32-1ac2-41f1-a38a-1ba4f66986c0..l=6837f517-6906-45dc-a9aa-589163cdc1e2..a=0..b=0..r=cn47e.bemobtrk.com
172.67.75.176200 OK 18 kB URL HTTP/2 goforrewards.info/RM/Arg/?devicemodel=Apple%20Macintosh&browser=Chrome&ip=2600:1900:2000:1b:400::25&bemobdata=c=599a3f32-1ac2-41f1-a38a-1ba4f66986c0..l=6837f517-6906-45dc-a9aa-589163cdc1e2..a=0..b=0..r=cn47e.bemobtrk.com
IP 172.67.75.176:0
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (741)
Hash 887e70439548dfde37bdb335872ff45e
4746029fcfea29fd03127c6ed7888d7ed46983ae
f779ff0aa4e0c3b30e0cb1993756bd31a453cfd19e2681180b9b822407b7b9e9
GET /RM/Arg/?devicemodel=Apple%20Macintosh&browser=Chrome&ip=2600:1900:2000:1b:400::25&bemobdata=c=599a3f32-1ac2-41f1-a38a-1ba4f66986c0..l=6837f517-6906-45dc-a9aa-589163cdc1e2..a=0..b=0..r=cn47e.bemobtrk.com HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:07:07 GMT
content-type: text/html
last-modified: Mon, 05 Dec 2022 16:16:46 GMT
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AYqxwzk%2BjqDM75UvkabPEQgcSABxDOT5RrmIuK5E%2FwG%2FORNUlZMaYElJEDmvOnbe%2BJ0AWn%2F2OjJ6h3azz3LKcvevEuRAs9Zymc1Bfjo9rz8p1nykp2csk1leom0yQcuv8lnR"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77682020db89fac8-OSL
content-encoding: br
X-Firefox-Spdy: h2
goforrewards.info/RM/Arg/img/prof1.jpg
172.67.75.176200 OK 12 kB URL HTTP/2 goforrewards.info/RM/Arg/img/prof1.jpg
IP 172.67.75.176:0
File type JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=643, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=640], progressive, precision 8, 50x50, components 3\012- data
Hash 5691166cda59d447955372faf6eb9077
b753c5fc483b22fe11348d5eefa666c35743e3d2
10f9cee806b62c1c1c115dc47d2ac735ad565d1f0d53a73c36d0aa10211b4941
GET /RM/Arg/img/prof1.jpg HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/?devicemodel=Apple%20Macintosh&browser=Chrome&ip=2600:1900:2000:1b:400::25&bemobdata=c=599a3f32-1ac2-41f1-a38a-1ba4f66986c0..l=6837f517-6906-45dc-a9aa-589163cdc1e2..a=0..b=0..r=cn47e.bemobtrk.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:07:07 GMT
content-type: image/jpeg
content-length: 11922
cache-control: max-age=2592000
cf-bgj: h2pri
etag: "638e1976-2e92"
expires: Fri, 06 Jan 2023 05:17:48 GMT
last-modified: Mon, 05 Dec 2022 16:16:54 GMT
cf-cache-status: HIT
age: 139759
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kmBzqrmjVKfz2L0nUJFi2G%2FlhR2MVc05B%2FwrA9PjLn8k3NHnOYUKPXmMrTlTIVhtc06sgGL1yMWAci1mrxQMxFJ7J5nmYdRe%2FZsZkoLPxDf3n2et9%2Ft%2BYiR%2FeCA3b%2F%2FDDQ6z"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77682021abfffac8-OSL
X-Firefox-Spdy: h2
goforrewards.info/RM/Arg/img/prof5.jpg
172.67.75.176200 OK 11 kB URL HTTP/2 goforrewards.info/RM/Arg/img/prof5.jpg
IP 172.67.75.176:0
File type JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=238, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=211], progressive, precision 8, 50x56, components 3\012- data
Hash 87b448b012b880cfa014f09826557897
3f5b22cc8f998cef6ecf9a493bc19871352ed377
1a26eecccc51f9e2eee0432d4921070b3339bb2d9c87fb2e98eea4399a8cda51
GET /RM/Arg/img/prof5.jpg HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/?devicemodel=Apple%20Macintosh&browser=Chrome&ip=2600:1900:2000:1b:400::25&bemobdata=c=599a3f32-1ac2-41f1-a38a-1ba4f66986c0..l=6837f517-6906-45dc-a9aa-589163cdc1e2..a=0..b=0..r=cn47e.bemobtrk.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:07:07 GMT
content-type: image/jpeg
content-length: 11210
cache-control: max-age=2592000
cf-bgj: h2pri
etag: "638e1977-2bca"
expires: Fri, 06 Jan 2023 05:17:48 GMT
last-modified: Mon, 05 Dec 2022 16:16:55 GMT
cf-cache-status: HIT
age: 139759
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PxlNvtpEOIu6vaYzGOOh42gtkSiZLLCo08A%2BQ0mu5GQ0wdaoUE1o4To95K7jq4jso8h2Mujay1kdd2l4eOT2t2%2BeO%2FoqIvreQjmmBa2ZjWZJ6bObmIgpgkg6deXA5Gzva51Q"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77682021ac05fac8-OSL
X-Firefox-Spdy: h2
goforrewards.info/RM/Arg/img/prof3.jpg
172.67.75.176200 OK 11 kB URL HTTP/2 goforrewards.info/RM/Arg/img/prof3.jpg
IP 172.67.75.176:0
File type JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=895, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=1080], progressive, precision 8, 50x41, components 3\012- data
Hash 12509849dec0f36c72f0f90e6b437ced
6ce1638407c8dc1cdef4d6ec29094824427cf4e0
2933ebd009740031f0e6ab3cfcd021456828c9d84d4a3ee876d4681eb0dd332e
GET /RM/Arg/img/prof3.jpg HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/?devicemodel=Apple%20Macintosh&browser=Chrome&ip=2600:1900:2000:1b:400::25&bemobdata=c=599a3f32-1ac2-41f1-a38a-1ba4f66986c0..l=6837f517-6906-45dc-a9aa-589163cdc1e2..a=0..b=0..r=cn47e.bemobtrk.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:07:07 GMT
content-type: image/jpeg
content-length: 10640
cache-control: max-age=2592000
cf-bgj: h2pri
etag: "638e1977-2990"
expires: Sat, 07 Jan 2023 18:06:01 GMT
last-modified: Mon, 05 Dec 2022 16:16:55 GMT
cf-cache-status: HIT
age: 7266
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ifz4wgECcD5LQQJoYdixrBq3DmJQC4TQ8TzY1INl3Rx%2B115htMaS9ZwvjdDBUPH0ViHC8TSfqjqtfeU978oXae4j7ZiH8QeJdPtwSaZcvnPzJavPvKkUL1EblkUKZ5%2FpHknt"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77682021ac03fac8-OSL
X-Firefox-Spdy: h2
goforrewards.info/RM/Arg/img/prof4.jpg
172.67.75.176200 OK 9.8 kB URL HTTP/2 goforrewards.info/RM/Arg/img/prof4.jpg
IP 172.67.75.176:0
File type JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=828, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=1012], progressive, precision 8, 50x41, components 3\012- data
Hash 4f30df9680ef2d63c8316a3d8bf245ac
a82b9a9e1ed52f61f1f3b877a71f25f3a9911094
ef37748363082793824c1240d3dd291d79ffe3904163e56fc5613e3bd1a7e3e8
GET /RM/Arg/img/prof4.jpg HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/?devicemodel=Apple%20Macintosh&browser=Chrome&ip=2600:1900:2000:1b:400::25&bemobdata=c=599a3f32-1ac2-41f1-a38a-1ba4f66986c0..l=6837f517-6906-45dc-a9aa-589163cdc1e2..a=0..b=0..r=cn47e.bemobtrk.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:07:07 GMT
content-type: image/jpeg
content-length: 9838
cache-control: max-age=2592000
cf-bgj: h2pri
etag: "638e1977-266e"
expires: Sat, 07 Jan 2023 18:06:01 GMT
last-modified: Mon, 05 Dec 2022 16:16:55 GMT
cf-cache-status: HIT
age: 7266
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=anIMGiDMidDnLNMdJz4%2FAgLdyMPNVLVpq5Cx%2FC%2FHrUZ%2FRjDdWNotnvp9enNeWUf7TH7DbZR3lEz3ZLQEtKK4oFVv8x9RsHP%2FMhPCWu0Zlqa8ILNNfDVcGsx5adjgujI2IShW"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77682021ac04fac8-OSL
X-Firefox-Spdy: h2
goforrewards.info/RM/Arg/img/chk1.jpg
172.67.75.176200 OK 36 kB URL HTTP/2 goforrewards.info/RM/Arg/img/chk1.jpg
IP 172.67.75.176:0
File type JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2021:09:21 17:53:11], baseline, precision 8, 300x142, components 3\012- data
Hash 6712cb146c4a65c93d3a32095714503d
a780fd30fd685508991c103ce7ece4286648460d
7c8bdc0aad64ac9cadd80de326d7e8a704507eeb87ee1c3f3e2a359058b902f5
GET /RM/Arg/img/chk1.jpg HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/?devicemodel=Apple%20Macintosh&browser=Chrome&ip=2600:1900:2000:1b:400::25&bemobdata=c=599a3f32-1ac2-41f1-a38a-1ba4f66986c0..l=6837f517-6906-45dc-a9aa-589163cdc1e2..a=0..b=0..r=cn47e.bemobtrk.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:07:07 GMT
content-type: image/jpeg
content-length: 35904
cache-control: max-age=2592000
cf-bgj: h2pri
etag: "638e1973-8c40"
expires: Fri, 06 Jan 2023 05:17:48 GMT
last-modified: Mon, 05 Dec 2022 16:16:51 GMT
cf-cache-status: HIT
age: 139759
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MNsMIAZDPNYkVdICGAAEQyqLl7JA3afpImmu1vtf616csleo1grZC%2Bl%2B31nWiPG4rLnUIlaXyc%2FMA8QsgAxb8sStP9JLQJjVx6jJw%2Ft5ZT1f7gY5LXEYZrHOUjGTdKc9uQad"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77682021ac00fac8-OSL
X-Firefox-Spdy: h2
goforrewards.info/RM/Arg/img/logo.jpg
172.67.75.176200 OK 10 kB URL HTTP/2 goforrewards.info/RM/Arg/img/logo.jpg
IP 172.67.75.176:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, baseline, precision 8, 240x186, components 3\012- data
Hash f93b62753c8e00162fe994650ab5bcf7
17a79c113808e78250ec99a3e6dd214f3dfbbbea
3e9202da6f25dea0528426ccd8a5811d4aedb29f5ba5fac6e036f820cd9e4985
GET /RM/Arg/img/logo.jpg HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/?devicemodel=Apple%20Macintosh&browser=Chrome&ip=2600:1900:2000:1b:400::25&bemobdata=c=599a3f32-1ac2-41f1-a38a-1ba4f66986c0..l=6837f517-6906-45dc-a9aa-589163cdc1e2..a=0..b=0..r=cn47e.bemobtrk.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:07:07 GMT
content-type: image/jpeg
content-length: 10365
cache-control: max-age=2592000
cf-bgj: h2pri
etag: "638e1975-287d"
expires: Fri, 06 Jan 2023 05:17:48 GMT
last-modified: Mon, 05 Dec 2022 16:16:53 GMT
cf-cache-status: HIT
age: 139759
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FceBI90UFoOIJT88f5e0szWzlJd5QWIXH56FUmF1SBvVxjpA7%2BmXZUrCNR3mznGPGKsUEG1iynNsQv5HUsZQBxx421nG0oOXJEUJTZ9lxRCY3om7l%2FcP%2BSuCwWO%2BWJ8aharO"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77682021bc08fac8-OSL
X-Firefox-Spdy: h2
goforrewards.info/RM/Arg/js/script.js.download
172.67.75.176200 OK 4.0 kB URL HTTP/2 goforrewards.info/RM/Arg/js/script.js.download
IP 172.67.75.176:0
Hash af7eb0685a2dc74d072e84d50f39738f
e8dac0046b0fa00c655ef2b05a292e984d128457
424adf851ef0f98ea1b88589953e95aa27c5cdb746288371b63e253265cc233d
Analyzer Verdict Alert fortinet Phishing
GET /RM/Arg/js/script.js.download HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/?devicemodel=Apple%20Macintosh&browser=Chrome&ip=2600:1900:2000:1b:400::25&bemobdata=c=599a3f32-1ac2-41f1-a38a-1ba4f66986c0..l=6837f517-6906-45dc-a9aa-589163cdc1e2..a=0..b=0..r=cn47e.bemobtrk.com
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:07:07 GMT
content-type: application/octet-stream
content-length: 3977
last-modified: Mon, 05 Dec 2022 16:16:58 GMT
etag: "638e197a-f89"
accept-ranges: bytes
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=b%2FAecVLPuyFJEdwMjjzamFzwhd8ExTsWzcRXhjRzFs%2ByhfenN7s%2FNMM07umDwHU59GuYcr2GEk6e43ZOWXe2tO9Jn5i1PoLTydCyVHX3JGADYTnwhnhPOfzhalLv7urqEFfM"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77682021bc0ffac8-OSL
X-Firefox-Spdy: h2
goforrewards.info/RM/Arg/js/confetti.js.download
172.67.75.176200 OK 5.7 kB URL HTTP/2 goforrewards.info/RM/Arg/js/confetti.js.download
IP 172.67.75.176:0
Hash 0bf680ed10be0fc040015e7e735a4ae3
d02ea58f56584cb59cd2f7799822283032a666ee
f79f02e3e9615682a3fa00c2aee52f2cea0656407ef311f5a0367dccd06186d9
Analyzer Verdict Alert fortinet Phishing
GET /RM/Arg/js/confetti.js.download HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/?devicemodel=Apple%20Macintosh&browser=Chrome&ip=2600:1900:2000:1b:400::25&bemobdata=c=599a3f32-1ac2-41f1-a38a-1ba4f66986c0..l=6837f517-6906-45dc-a9aa-589163cdc1e2..a=0..b=0..r=cn47e.bemobtrk.com
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:07:07 GMT
content-type: application/octet-stream
content-length: 5735
last-modified: Mon, 05 Dec 2022 16:16:57 GMT
etag: "638e1979-1667"
accept-ranges: bytes
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=u7UY5NntNkKXLLiflSn3%2BMsk4V%2F4V10BPigoxIJM25YwS7xapZe6eGlu5XsmB9Rr2CSlP1%2BDewpYToaOoAHVT2HnRssVD0shU9g9cLzWpUlINegTHMQHjvuvnRPQTtTaKwku"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77682021bc11fac8-OSL
X-Firefox-Spdy: h2
goforrewards.info/RM/Arg/js/jquery.min.js.download
172.67.75.176200 OK 84 kB URL HTTP/2 goforrewards.info/RM/Arg/js/jquery.min.js.download
IP 172.67.75.176:0
File type ASCII text, with very long lines (32025)
Hash 4a356126b9573eb7bd1e9a7494737410
8258d046f17dd3c15a5d3984e1868b7b5d1db329
22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5
Analyzer Verdict Alert fortinet Phishing
GET /RM/Arg/js/jquery.min.js.download HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/?devicemodel=Apple%20Macintosh&browser=Chrome&ip=2600:1900:2000:1b:400::25&bemobdata=c=599a3f32-1ac2-41f1-a38a-1ba4f66986c0..l=6837f517-6906-45dc-a9aa-589163cdc1e2..a=0..b=0..r=cn47e.bemobtrk.com
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:07:07 GMT
content-type: application/octet-stream
content-length: 84380
last-modified: Mon, 05 Dec 2022 16:16:58 GMT
etag: "638e197a-1499c"
accept-ranges: bytes
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rWTN6h2pn2GYraEYcoCiIybvvRCl6KcrkECY2A%2FANYVh0yuEPLiDuoMKq9NNjbzxf5IzdBGdyhzdz9MBzaK8j8ZSz%2F0%2Bje1PlYXvk4ZZ17CvOxmlbNx%2FuSSGXEIIomVrLo9b"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77682021bc0bfac8-OSL
X-Firefox-Spdy: h2
goforrewards.info/RM/Arg/new/jquery.min.js.download
172.67.75.176404 Not Found 575 B URL HTTP/2 goforrewards.info/RM/Arg/new/jquery.min.js.download
IP 172.67.75.176:0
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 4bbd2fb25cb5fbaa25e980cf020fba34
328d1f8d88675d19c0f4532e60ee0ee3181d0fd7
03b33120d9ccc3a606463e21c884d0d4541ab55f82819ea07e2a19666fd7c8db
Analyzer Verdict Alert fortinet Phishing
GET /RM/Arg/new/jquery.min.js.download HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/?devicemodel=Apple%20Macintosh&browser=Chrome&ip=2600:1900:2000:1b:400::25&bemobdata=c=599a3f32-1ac2-41f1-a38a-1ba4f66986c0..l=6837f517-6906-45dc-a9aa-589163cdc1e2..a=0..b=0..r=cn47e.bemobtrk.com
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
date: Thu, 08 Dec 2022 20:07:07 GMT
content-type: text/html
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ENJwW96TPa2ihzXpvRcN65lp38ExnBrMrvoHKfbgoDnYqUQKNGismjhxayDn1oWhkyrGNy3nxSqOkLpF242jppbkoOUhsna83Oa8%2FMFvXUKD8UGq0PkbLx5iOBweE4711yT%2F"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77682021bc10fac8-OSL
content-encoding: br
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.131200 OK 472 B IP 142.250.74.131:0
Hash 6ec5f6261a8262e9f94b29627f54cefe
7ac766cf2ac8c2d960ec033388a767ff8a7d45e2
5f6ee11d840909fc5272c2c32f7874d55f49d831abc88d527e35562d218890f9
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 20:07:07 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
fonts.googleapis.com/css?family=Cairo:700
142.250.74.106200 OK 2.0 kB URL HTTP/2 fonts.googleapis.com/css?family=Cairo:700
IP 142.250.74.106:0
Hash ae77babd9c8e067716d89b1ac105553a
d85278a83a80116edd0cc20068fc9811b402336d
b9f39159fa27ff289029ea6d840bba5bdd6f287180f9e538150ae8da0534a021
GET /css?family=Cairo:700 HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Thu, 08 Dec 2022 20:07:07 GMT
date: Thu, 08 Dec 2022 20:07:07 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.131200 OK 472 B IP 142.250.74.131:0
Hash 6ec5f6261a8262e9f94b29627f54cefe
7ac766cf2ac8c2d960ec033388a767ff8a7d45e2
5f6ee11d840909fc5272c2c32f7874d55f49d831abc88d527e35562d218890f9
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 20:07:08 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
35.241.9.150200 OK 329 B URL HTTP/2 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP 35.241.9.150:0
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Pragma, Last-Modified, ETag, Alert, Expires, Retry-After, Cache-Control, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Thu, 08 Dec 2022 19:07:58 GMT
age: 3550
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
142.250.74.131200 OK 472 B IP 142.250.74.131:0
Hash 0e9eef4ed41ef94e9ea175ad243e294e
b6f83e508270413dabe55e2884b5409ca7978e24
0e741ca8d92717128bca7aed937bca43519a8d20a9d3dd8670da656ad51a695e
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 20:07:08 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
fonts.gstatic.com/s/changa/v20/2-c79JNi2YuVOUcOarRPgnNGooxCZ62xcjfj9w.woff2
142.250.74.35200 OK 9.1 kB URL HTTP/2 fonts.gstatic.com/s/changa/v20/2-c79JNi2YuVOUcOarRPgnNGooxCZ62xcjfj9w.woff2
IP 142.250.74.35:0
File type Web Open Font Format (Version 2), TrueType, length 9120, version 1.0\012- data
Hash 18ad880aaa4e28b6cd1ef0d30ac95573
da6a33a1ecc296aa481432e2727b273140b78543
f2c5710634752d1a156adf5ac961c8400e3a577c90f97a6a293a07f4a28957fd
GET /s/changa/v20/2-c79JNi2YuVOUcOarRPgnNGooxCZ62xcjfj9w.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://goforrewards.info
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 9120
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 08 Dec 2022 05:51:30 GMT
expires: Fri, 08 Dec 2023 05:51:30 GMT
cache-control: public, max-age=31536000
age: 51338
last-modified: Fri, 24 Jun 2022 18:40:48 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.digicert.com/
93.184.220.29200 OK 471 B IP 93.184.220.29:0
Hash fd55f4aaaab6ec40bc7dc10252cd819a
a72523f60be265a391fa9edc43e0a93418ad1fd0
bae354b3db14f4fd115311a0c412c9b5e436dd9e0a151afd8b9c18831dd8c2dd
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2089
Cache-Control: max-age=135273
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 20:07:08 GMT
Etag: "6391a92c-1d7"
Expires: Sat, 10 Dec 2022 09:41:41 GMT
Last-Modified: Thu, 08 Dec 2022 09:06:52 GMT
Server: ECS (ska/F6FC)
X-Cache: HIT
Content-Length: 471
ocsp.pki.goog/gts1c3
142.250.74.131200 OK 472 B IP 142.250.74.131:0
Hash 0e9eef4ed41ef94e9ea175ad243e294e
b6f83e508270413dabe55e2884b5409ca7978e24
0e741ca8d92717128bca7aed937bca43519a8d20a9d3dd8670da656ad51a695e
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 20:07:08 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
r3.o.lencr.org/
23.33.119.27200 OK 503 B IP 23.33.119.27:0
ASN #20940 Akamai International B.V.
Hash 603f73fcfa1cc5debe925bda211db3d4
035a372a47ad11c3d8964875479383ee92060cc0
11f926d38625ca53da090423f4f073147f43086debd45b2baebd22f92439a84c
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "11F926D38625CA53DA090423F4F073147F43086DEBD45B2BAEBD22F92439A84C"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21584
Expires: Fri, 09 Dec 2022 02:06:52 GMT
Date: Thu, 08 Dec 2022 20:07:08 GMT
Connection: keep-alive
push.services.mozilla.com/
35.160.51.228101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP 35.160.51.228:0
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: 6J7A3PByE1uii+vP0ci3TA==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: H53tMOjp8uKGwON2zchY74RMMtM=
r3.o.lencr.org/
23.33.119.27200 OK 503 B IP 23.33.119.27:0
ASN #20940 Akamai International B.V.
Hash 48c90992f0837a58e0a36118a27dae6a
3d238fed35e6d247bddbba92864e6b92e6aed9b6
cacc53ed285e96dcd5ba7609823922a253bc0623999b8716f430632d2c0e7dac
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "CACC53ED285E96DCD5BA7609823922A253BC0623999B8716F430632D2C0E7DAC"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3543
Expires: Thu, 08 Dec 2022 21:06:12 GMT
Date: Thu, 08 Dec 2022 20:07:09 GMT
Connection: keep-alive
r3.o.lencr.org/
23.33.119.27200 OK 503 B IP 23.33.119.27:0
ASN #20940 Akamai International B.V.
Hash 48c90992f0837a58e0a36118a27dae6a
3d238fed35e6d247bddbba92864e6b92e6aed9b6
cacc53ed285e96dcd5ba7609823922a253bc0623999b8716f430632d2c0e7dac
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "CACC53ED285E96DCD5BA7609823922A253BC0623999B8716F430632D2C0E7DAC"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3543
Expires: Thu, 08 Dec 2022 21:06:12 GMT
Date: Thu, 08 Dec 2022 20:07:09 GMT
Connection: keep-alive
r3.o.lencr.org/
23.33.119.27200 OK 503 B IP 23.33.119.27:0
ASN #20940 Akamai International B.V.
Hash 48c90992f0837a58e0a36118a27dae6a
3d238fed35e6d247bddbba92864e6b92e6aed9b6
cacc53ed285e96dcd5ba7609823922a253bc0623999b8716f430632d2c0e7dac
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "CACC53ED285E96DCD5BA7609823922A253BC0623999B8716F430632D2C0E7DAC"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3543
Expires: Thu, 08 Dec 2022 21:06:12 GMT
Date: Thu, 08 Dec 2022 20:07:09 GMT
Connection: keep-alive
r3.o.lencr.org/
23.33.119.27200 OK 503 B IP 23.33.119.27:0
ASN #20940 Akamai International B.V.
Hash 48c90992f0837a58e0a36118a27dae6a
3d238fed35e6d247bddbba92864e6b92e6aed9b6
cacc53ed285e96dcd5ba7609823922a253bc0623999b8716f430632d2c0e7dac
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "CACC53ED285E96DCD5BA7609823922A253BC0623999B8716F430632D2C0E7DAC"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3543
Expires: Thu, 08 Dec 2022 21:06:12 GMT
Date: Thu, 08 Dec 2022 20:07:09 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9519925e-95b7-4e66-b317-84c1708c7f84.jpeg
34.120.237.76200 OK 8.7 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9519925e-95b7-4e66-b317-84c1708c7f84.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash b87d6543345f73653ed4a49b37d7c959
c4f26846b8b72293368ff16915d49297cf12bbb9
aee6aa42e4b5b83b81f74801ff8f0039fc6d38036f42ee81875813c856cf5eef
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9519925e-95b7-4e66-b317-84c1708c7f84.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8659
x-amzn-requestid: 6f420d07-65d5-4bb2-9f1f-e56025de497b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: czFSYFArIAMF46w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63911c0f-0a295e5c48228d5806b4f107;Sampled=0
x-amzn-remapped-date: Wed, 07 Dec 2022 23:04:47 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: TSh1BNzzIPhWCfYEiqvQJckSPAyhHobe-HK6msEVeEJ1ruX-_rMSSA==
via: 1.1 2dc111aa3ead15d061e41a423155a53a.cloudfront.net (CloudFront), 1.1 591683988172c7980c4ebb318cbf18a8.cloudfront.net (CloudFront), 1.1 google
date: Wed, 07 Dec 2022 23:35:32 GMT
age: 73897
etag: "c4f26846b8b72293368ff16915d49297cf12bbb9"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbbba0eea-a6f1-4374-a9c7-dab84270023b.jpeg
34.120.237.76200 OK 7.3 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbbba0eea-a6f1-4374-a9c7-dab84270023b.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 24d89b69ba37bf23c5d576aff4063caf
3d46a21b4da571d7e4962e335c18a28ca5f81ecf
09b52cdab278805c6e7282f469a02768ee62fc9ef09a6623a337e3d3aaa446fd
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbbba0eea-a6f1-4374-a9c7-dab84270023b.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7268
x-amzn-requestid: ae5c231c-b1be-498a-a242-e8d641f3fe8e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: czFDgEzUoAMFgyQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63911baf-10f06dc37cac69631c823fd9;Sampled=0
x-amzn-remapped-date: Wed, 07 Dec 2022 23:03:11 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: wFqXeAYHSBcj85PiuqhV790clAMWg_NHMCO5Q5WARXDaohFWZdeCig==
via: 1.1 2afae0d44e2540f472c0635ab62c232a.cloudfront.net (CloudFront), 1.1 fda3b2797d2719576f6b916583a28e52.cloudfront.net (CloudFront), 1.1 google
date: Wed, 07 Dec 2022 23:19:17 GMT
age: 74872
etag: "3d46a21b4da571d7e4962e335c18a28ca5f81ecf"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F079bc299-d390-4250-a91a-db3c535c9ca3.jpeg
34.120.237.76200 OK 8.4 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F079bc299-d390-4250-a91a-db3c535c9ca3.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 98d2cf29c710d25bd2f03ff216fdd369
b8eb2e11f9655f19334befc036f21489a6473827
614c9b4a7ace908c1ef807964709cb292b33b48ce1d81ccbd2959c2c0ee156ac
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F079bc299-d390-4250-a91a-db3c535c9ca3.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8351
x-amzn-requestid: 607d07ab-6833-4001-82ed-699ea91f84c9
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cvlitFk9oAMFakQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638fb611-3e5f14f833b332647ef7358d;Sampled=0
x-amzn-remapped-date: Tue, 06 Dec 2022 21:37:21 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: 0w5Usq-LJMNHxw9UrwUqSslSVROXVHTmY_UhSHNaGh4k4xqh-FSa0A==
via: 1.1 030fe0607711293dda988e571617a9f2.cloudfront.net (CloudFront), 1.1 e4d3d5aafc7d7d582423c073065ab562.cloudfront.net (CloudFront), 1.1 google
date: Wed, 07 Dec 2022 20:33:10 GMT
age: 84839
etag: "b8eb2e11f9655f19334befc036f21489a6473827"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
goforrewards.info/RM/Arg/new/confetti.js.download
172.67.75.176404 Not Found 13 kB URL HTTP/2 goforrewards.info/RM/Arg/new/confetti.js.download
IP 172.67.75.176:0
File type HTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators
Hash 1774e3d378e1d8c3a32daaa733229797
73efc565dd6e4146fc3660ec07cc7476341ded93
72a7eab96f78a4ab07d78a149b4a39df0192f7053d3d4b5c349c4b9b065b8812
Analyzer Verdict Alert fortinet Phishing
GET /RM/Arg/new/confetti.js.download HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/?devicemodel=Apple%20Macintosh&browser=Chrome&ip=2600:1900:2000:1b:400::25&bemobdata=c=599a3f32-1ac2-41f1-a38a-1ba4f66986c0..l=6837f517-6906-45dc-a9aa-589163cdc1e2..a=0..b=0..r=cn47e.bemobtrk.com
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
date: Thu, 08 Dec 2022 20:07:08 GMT
content-type: text/html
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wJZqRebP9l1QBsR7AyKyfcwc7Tcz360fEUFucPIBnzPO1TTF5n5oC5eUj9g%2FAlhhjj3zClR%2Bz7ca8ZXizVDa0Rot9ShaaABjgbEODDY0YYzFhhZKMhmatfJHRIFthB8ZV5WK"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77682024ae98fac8-OSL
content-encoding: br
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F74e98e03-fa9f-4e56-a8ba-5411568d88c8.jpeg
34.120.237.76200 OK 9.6 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F74e98e03-fa9f-4e56-a8ba-5411568d88c8.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash c408efaa98ac2ce63bb1618368d10c15
a51bbb49ebd862d04eaee465d0a35b22dcd21391
077eb8c8739f527828c71c25a1c3aaae46afead3aac093ec11a6d5488ef2f0ec
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F74e98e03-fa9f-4e56-a8ba-5411568d88c8.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9596
x-amzn-requestid: e5e6ceb2-5bad-4146-a9de-92a859716029
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cy3_qH63oAMFfLg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-639106ca-678bed1b7729b8aa2645688d;Sampled=0
x-amzn-remapped-date: Wed, 07 Dec 2022 21:34:02 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: dcHU93cetsY4-vWHpT2xXozH1T7J3_1X8n6Yjd6lOuF8HbkpTQDerg==
via: 1.1 49b94a8674d6e86a841d6523f7dbaf14.cloudfront.net (CloudFront), 1.1 98aedae6661e3904540676966998ed88.cloudfront.net (CloudFront), 1.1 google
date: Wed, 07 Dec 2022 22:13:24 GMT
etag: "a51bbb49ebd862d04eaee465d0a35b22dcd21391"
content-type: image/jpeg
age: 78825
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
r3.o.lencr.org/
23.33.119.27200 OK 503 B IP 23.33.119.27:0
ASN #20940 Akamai International B.V.
Hash 48c90992f0837a58e0a36118a27dae6a
3d238fed35e6d247bddbba92864e6b92e6aed9b6
cacc53ed285e96dcd5ba7609823922a253bc0623999b8716f430632d2c0e7dac
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "CACC53ED285E96DCD5BA7609823922A253BC0623999B8716F430632D2C0E7DAC"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3543
Expires: Thu, 08 Dec 2022 21:06:12 GMT
Date: Thu, 08 Dec 2022 20:07:09 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4119e239-0c3b-4175-bfe0-f5d42729d743.jpeg
34.120.237.76200 OK 7.8 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4119e239-0c3b-4175-bfe0-f5d42729d743.jpeg
IP 34.120.237.76:0
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 8c94003641bb5a7595e7004f80f95d22
3446450df60d732f9021d5bfd5f5f7c6c870d9ec
4d782dbf94b2163e9bc18028cd0c1a391fdcfcb019f23c4c26ea0b44432039ff
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4119e239-0c3b-4175-bfe0-f5d42729d743.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7801
x-amzn-requestid: cb8d5aab-409f-4b39-b498-b1ba84f34e06
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: czFRNHX4oAMFvoQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63911c07-7c6e3bfa3f81082b48f43fa9;Sampled=0
x-amzn-remapped-date: Wed, 07 Dec 2022 23:04:39 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: 8QHhEAFHTHd-5UqS1S5qwJj_h4WNfix2CgS4MO4zR_psrzgMP3SZ5g==
via: 1.1 98e601970ea59f4d5f56a752787ff9fc.cloudfront.net (CloudFront), 1.1 57a21088b36c69a83578b5a5579df58e.cloudfront.net (CloudFront), 1.1 google
date: Wed, 07 Dec 2022 23:16:35 GMT
age: 75034
etag: "3446450df60d732f9021d5bfd5f5f7c6c870d9ec"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
goforrewards.info/RM/Arg/new/confetti.js.download
172.67.75.176404 Not Found 0 B URL HTTP/2 goforrewards.info/RM/Arg/new/confetti.js.download
IP 172.67.75.176:0
Analyzer Verdict Alert fortinet Phishing
GET /RM/Arg/new/confetti.js.download HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/?devicemodel=Apple%20Macintosh&browser=Chrome&ip=2600:1900:2000:1b:400::25&bemobdata=c=599a3f32-1ac2-41f1-a38a-1ba4f66986c0..l=6837f517-6906-45dc-a9aa-589163cdc1e2..a=0..b=0..r=cn47e.bemobtrk.com
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
date: Thu, 08 Dec 2022 20:07:07 GMT
content-type: text/html
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BVgJ7Z1DtVG806ug%2BpsIYZnC0UonvQ39mqdMDPRlYbfEu8U7SLiQ%2BhPsylpLmniDKjjPcFwyOjgm%2BX8WbdUIOa8FYMF7UChk5OMTSt1qenPdhBczL6xlK36Mhw7PDVwGIQ%2Fu"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77682021bc14fac8-OSL
content-encoding: br
X-Firefox-Spdy: h2
goforrewards.info/RM/Arg/css/style.css
172.67.75.176200 OK 0 B URL HTTP/2 goforrewards.info/RM/Arg/css/style.css
IP 172.67.75.176:0
GET /RM/Arg/css/style.css HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/?devicemodel=Apple%20Macintosh&browser=Chrome&ip=2600:1900:2000:1b:400::25&bemobdata=c=599a3f32-1ac2-41f1-a38a-1ba4f66986c0..l=6837f517-6906-45dc-a9aa-589163cdc1e2..a=0..b=0..r=cn47e.bemobtrk.com
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:07:07 GMT
content-type: text/css
last-modified: Mon, 05 Dec 2022 16:16:48 GMT
etag: W/"638e1970-e3a"
expires: Sat, 07 Jan 2023 18:06:01 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 7266
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kXpDAmvIGE%2FxYJLnThhr9CDa%2BEhBFIHq%2FDk1wTjp7Syzu5wH9fWpHLYjVEYuoJGJmtyT8b1ULY5A8yVHGS6%2BjOCCCaMcoZQV%2FZ9UxZ7jTszLYZxGXfdc6%2BiI0f1%2FNVfC6SUR"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 776820219bf1fac8-OSL
content-encoding: br
X-Firefox-Spdy: h2
fonts.googleapis.com/css?family=Changa
142.250.74.106200 OK 0 B URL HTTP/2 fonts.googleapis.com/css?family=Changa
IP 142.250.74.106:0
GET /css?family=Changa HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Thu, 08 Dec 2022 20:07:07 GMT
date: Thu, 08 Dec 2022 20:07:07 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
psothoms.com/pfe/current/micro.tag.min.js?z=5579263&sw=/sw-check-permissions-41f6b.js
139.45.197.251200 OK 0 B URL HTTP/2 psothoms.com/pfe/current/micro.tag.min.js?z=5579263&sw=/sw-check-permissions-41f6b.js
IP 139.45.197.251:0
Analyzer Verdict Alert quad9 Sinkholed
GET /pfe/current/micro.tag.min.js?z=5579263&sw=/sw-check-permissions-41f6b.js HTTP/1.1
Host: psothoms.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Thu, 08 Dec 2022 20:07:08 GMT
content-type: application/javascript
last-modified: Thu, 01 Dec 2022 15:42:46 GMT
etag: W/"6388cb76-9a87"
access-control-allow-credentials: true
cache-control: no-cache
pragma: no-cache
content-encoding: gzip
X-Firefox-Spdy: h2
goforrewards.info/RM/Arg/css/main.css
172.67.75.176200 OK 0 B URL HTTP/2 goforrewards.info/RM/Arg/css/main.css
IP 172.67.75.176:0
GET /RM/Arg/css/main.css HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/?devicemodel=Apple%20Macintosh&browser=Chrome&ip=2600:1900:2000:1b:400::25&bemobdata=c=599a3f32-1ac2-41f1-a38a-1ba4f66986c0..l=6837f517-6906-45dc-a9aa-589163cdc1e2..a=0..b=0..r=cn47e.bemobtrk.com
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:07:07 GMT
content-type: text/css
last-modified: Mon, 05 Dec 2022 16:16:48 GMT
etag: W/"638e1970-2adc"
expires: Sat, 07 Jan 2023 18:06:01 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 7266
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e6Vyoc8haRtRx4IiXy4zAiXC6oTfSpW%2FX1RFg0CjhOPdI1ZarytG0dzCKYY9MG%2FiKzf9h6bUp5qn89UEWgtrmmLWNErXfHI%2FVyTYBXJZBK5OAaTdG4twDXl0LSDTyiwiwat3"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77682021abf2fac8-OSL
content-encoding: br
X-Firefox-Spdy: h2
goforrewards.info/RM/Arg/js/count_down.js
172.67.75.176200 OK 0 B URL HTTP/2 goforrewards.info/RM/Arg/js/count_down.js
IP 172.67.75.176:0
Analyzer Verdict Alert fortinet Phishing
GET /RM/Arg/js/count_down.js HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/?devicemodel=Apple%20Macintosh&browser=Chrome&ip=2600:1900:2000:1b:400::25&bemobdata=c=599a3f32-1ac2-41f1-a38a-1ba4f66986c0..l=6837f517-6906-45dc-a9aa-589163cdc1e2..a=0..b=0..r=cn47e.bemobtrk.com
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:07:07 GMT
content-type: application/javascript
last-modified: Mon, 05 Dec 2022 16:16:57 GMT
etag: W/"638e1979-4cd"
expires: Sat, 07 Jan 2023 18:06:01 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 7266
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rS%2BLFAQRUMP24p0Z5xSANlcXSPUxqWQlKrLddj7kIWR9BA82RY0L%2BgC4Vr2V18UvrtsGYNJvXsc3691gsj5iYLWmX%2FhhNQyBfqf4mjCQZY951lctSzoUtNykQ4i%2FKrIIDkUb"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77682021abf3fac8-OSL
content-encoding: br
X-Firefox-Spdy: h2
goforrewards.info/RM/Arg/new/jquery.min.js.download
172.67.75.176404 Not Found 0 B URL HTTP/2 goforrewards.info/RM/Arg/new/jquery.min.js.download
IP 172.67.75.176:0
Analyzer Verdict Alert fortinet Phishing
GET /RM/Arg/new/jquery.min.js.download HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/?devicemodel=Apple%20Macintosh&browser=Chrome&ip=2600:1900:2000:1b:400::25&bemobdata=c=599a3f32-1ac2-41f1-a38a-1ba4f66986c0..l=6837f517-6906-45dc-a9aa-589163cdc1e2..a=0..b=0..r=cn47e.bemobtrk.com
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
date: Thu, 08 Dec 2022 20:07:08 GMT
content-type: text/html
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3PuGTeyeUfEh8Cp9EPqK9n63zWfhBgTcyIUX%2FH7xgasLL4F2F8ORT4SlnxHiu%2F8yseWm995cksl3LesPhq0V0PN92R06fAW%2FdKJmVoB1KF5MXLWRJIPofJQJ%2BQF2Id4SKmj3"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 776820241e48fac8-OSL
content-encoding: br
X-Firefox-Spdy: h2
goforrewards.info/favicon.ico
172.67.75.176404 Not Found 0 B URL HTTP/2 goforrewards.info/favicon.ico
IP 172.67.75.176:0
GET /favicon.ico HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/?devicemodel=Apple%20Macintosh&browser=Chrome&ip=2600:1900:2000:1b:400::25&bemobdata=c=599a3f32-1ac2-41f1-a38a-1ba4f66986c0..l=6837f517-6906-45dc-a9aa-589163cdc1e2..a=0..b=0..r=cn47e.bemobtrk.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
date: Thu, 08 Dec 2022 20:07:08 GMT
content-type: text/html
cache-control: max-age=14400
cf-cache-status: HIT
age: 13
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wEuL0NcY3Y4v%2FNRjVr8QY9x59JU81Yx%2Fej0rOskmZbSPC9dp3euYpvvitxAnGM3f1jk3w5S7yH4QTXmwPm4Qa55FbdkO5hKC8myukXthaflnQI7PQGCxhC%2FtubDXKY9oZazq"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77682025cf21fac8-OSL
content-encoding: br
X-Firefox-Spdy: h2