Report - lsel.pollsandpromotions.site/c/4182ef8a9b09fd89?cid=__SID__&s1=__CAMPAIGN_NAME__&s2=__SID__&s3=__GROUP_NAME__&s4=__AD_ID_

Report Overview

Submitted URL
lsel.pollsandpromotions.site/c/4182ef8a9b09fd89?cid=__SID__&s1=__CAMPAIGN_NAME__&s2=__SID__&s3=__GROUP_NAME__&s4=__AD_ID__
IP
52.19.101.114
ASN
#16509 AMAZON-02
Submitted
2023-06-01 21:01:52
Access
public
Website Title
Final URL
Tags
urlquery detections
No alerts detected

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
2

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
lsel.pollsandpromotions.site	unknown	2023-05-02	2023-05-03	2023-05-25	494 B	2.7 kB	52.19.101.114
ocsp2.globalsign.com	1544	1999-04-19	2012-05-23	2023-05-31	347 B	1.9 kB	104.18.20.226
cdnjs.claudflare.io	unknown	2021-08-09	2021-08-12	2023-05-26	457 B	92 kB	206.189.196.86
cdnjs.cloudflare.com	235	2009-02-17	2015-04-17	2023-05-31	452 B	24 kB	104.17.25.14
api.imotech.video	140520	2019-11-08	2021-01-28	2023-05-30	4.0 kB	9.4 kB	164.90.105.129
cdn-adef.akamaized.net	125719	2014-03-18	2018-02-06	2023-06-01	3.3 kB	159 kB	95.101.10.34
cdn.stfilecamp.com	400667	2021-09-06	2021-09-06	2023-05-31	848 B	40 kB	205.185.216.10
tt.stfilecamp.com	unknown	2021-09-06	2022-03-08	2023-05-29	871 B	6.6 kB	205.185.216.42
route.frest.pro	unknown	2022-10-19	2023-01-02	2023-05-29	526 B	748 B	104.21.77.196
stormtrk.com	289095	2019-05-15	2019-05-17	2023-05-31	630 B	1.0 kB	104.26.4.120

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

OpenPhish

No alerts detected

PhishTank

No alerts detected

Fortinet's Web Filter

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2023-06-01	medium	claudflare.io

ThreatFox

No alerts detected

JavaScript (10)

	URL	Size	First Seen	Last Seen
	cdnjs.claudflare.io/ajax/libs/jquery/3.6.0/d/jquery.min.js?1683207405	92 kB	2023-05-06	2023-06-20
Pretty URL cdnjs.claudflare.io/ajax/libs/jquery/3.6.0/d/jquery.min.js?1683207405 IP 206.189.196.86 ASN #14061 DIGITALOCEAN-ASN Introduced by scriptElement Embedded in HTML false Observations First Seen2023-05-06 12:01:48 Last Seen2023-06-20 06:01:45 Times Seen10 Hash 1b8f799313e9c99c29b8e772090c6584 1295d7b92d351b3a17b061367641313b62b0266d 193381be618f4d1e7c8081a4ee68c3b406ebfc2dee86a704b012c0c88ae6e877 Loading...

	cdnjs.cloudflare.com/ajax/libs/gsap/3.9.1/gsap.min.js?1683207405	64 kB	2023-03-07	2024-05-07
Pretty URL cdnjs.cloudflare.com/ajax/libs/gsap/3.9.1/gsap.min.js?1683207405 IP 104.17.25.14 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 12:08:40 Last Seen2024-05-07 12:05:27 Times Seen385 Hash 6ceffd5b35d350764ce6cb72313190f5 1a8bcae2241d253c1a41050b20c840d29878f3ae 6dbe9c2e13cf06c6633ea3fcf6d7bd30452561202a205c75a035cd1d8b93368f Loading...

	cdn-adef.akamaized.net/landings/279321/1683207405/js/collector.js?1683207405	4.9 kB	2023-04-06	2023-10-30
Pretty URL cdn-adef.akamaized.net/landings/279321/1683207405/js/collector.js?1683207405 IP 95.101.10.34 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-06 21:01:52 Last Seen2023-10-30 05:48:41 Times Seen23 Hash 530a1ee9078c63b05445580074efe74f 17888910ee0abdd5b9d59bfc8b97cb58bb923802 aa6be0b532f192e97e4b097b9c0f62dbc6e4563b8abc249517483ca814285afe Loading...

	cdn.stfilecamp.com/stormtrk.js	6.8 kB	2023-03-12	2024-05-10
Pretty URL cdn.stfilecamp.com/stormtrk.js IP 205.185.216.10 ASN #20446 STACKPATH-CDN Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-12 06:32:38 Last Seen2024-05-10 15:06:15 Times Seen309 Hash 39e5f8ad757fe438c784e8d883e47ab0 6b2905489485100c83605f43186c5843031e1f3b e421906cc3be04e5f6795074c0a91e5a194f218b3f8c57adfed0f4d315dd445a Loading...

	tt.stfilecamp.com/jsfiles/site-protect2.0.js	3.1 kB	2023-03-07	2024-05-02
Pretty URL tt.stfilecamp.com/jsfiles/site-protect2.0.js IP 205.185.216.42 ASN #20446 STACKPATH-CDN Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:03:44 Last Seen2024-05-02 15:00:51 Times Seen273 Hash fc96ab06b0f9fcea6731405215ae5daf 8af9f27d895eb69754919a2fc0d74760fecd3860 9243e166cbcd628fd992eba59544ebf99328fd4db7c0c08c2fb28a7af14d759e Loading...

	cdn.stfilecamp.com/fp.min.js	32 kB	2023-04-06	2024-05-10
Pretty URL cdn.stfilecamp.com/fp.min.js IP 205.185.216.10 ASN #20446 STACKPATH-CDN Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-06 21:01:52 Last Seen2024-05-10 15:06:15 Times Seen839 Hash 198f2f5b0a649f41fe890c59d37319aa f24629687612889bb59f610df3879afcd766fb80 d2bc2cb800679f495a7731c105b2e2047965800515f98008867ab33edc940912 Loading...

	cdn-adef.akamaized.net/landings/279321/1683207405/js/main.js?1683207405	5.1 kB	2023-04-06	2023-10-30
Pretty URL cdn-adef.akamaized.net/landings/279321/1683207405/js/main.js?1683207405 IP 95.101.10.34 ASN #20940 Akamai International B.V. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-04-06 21:01:52 Last Seen2023-10-30 05:48:41 Times Seen43 Hash eb86cde28d0545695ec8823f6617fd6c 37b6641f75ab1b1b1e2bd375b56c40ccbc90f9ec 125d8a743888e128f1cc2cfec48f256aed9c7bb9ea64edb15cbcc04eb245ee19 Loading...

	lsel.pollsandpromotions.site/c/4182ef8a9b09fd89?cid=__SID__&s1=__CAMPAIGN_NAME__&s2=__SID__&s3=__GROUP_NAME__&s4=__AD_ID__	0 B	2023-03-07	2024-05-11
Pretty URL lsel.pollsandpromotions.site/c/4182ef8a9b09fd89?cid=__SID__&s1=__CAMPAIGN_NAME__&s2=__SID__&s3=__GROUP_NAME__&s4=__AD_ID__ IP 52.19.101.114 ASN #16509 AMAZON-02 Introduced by scriptElement Embedded in HTML true Observations First Seen2023-03-07 01:01:59 Last Seen2024-05-11 04:11:11 Times Seen37534549 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	api.imotech.video/ad/events.js?pixel_id=902760083831232256	17 kB	2023-03-08	2024-02-28
Pretty URL api.imotech.video/ad/events.js?pixel_id=902760083831232256 IP 164.90.105.129 ASN #10122 BIGO TECHNOLOGY PTE. LTD. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 19:39:24 Last Seen2024-02-28 09:22:00 Times Seen127 Hash 65e92d1f5cd6a66edd798d8e31a0f5a4 ee20b1d89622bcf1787c29b0480e6547996acadf b047e3cd894e371bc43a81292ba872d0f81fd03a8a9e66aa7e063c7e96f76098 Loading...

	tt.stfilecamp.com/jsfiles/second_back_multi_bigo.js	2.3 kB	2023-03-08	2024-02-28
Pretty URL tt.stfilecamp.com/jsfiles/second_back_multi_bigo.js IP 205.185.216.42 ASN #20446 STACKPATH-CDN Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-08 19:39:24 Last Seen2024-02-28 09:22:10 Times Seen127 Hash 96af925d55cad494665471c73ac01b04 5d2b1c06d2edb1a1ba9a5335c5dbb73c508b879b 1109fbd42583528695ba5995a756fd0fd09a992a85f50e54862e4b13c1cf75c2 Loading...

HTTP Transactions (22)

URL IP Response Size

lsel.pollsandpromotions.site/c/4182ef8a9b09fd89?cid=__SID__&s1=__CAMPAIGN_NAME__&s2=__SID__&s3=__GROUP_NAME__&s4=__AD_ID__

52.19.101.114

2.3 kB

URL User Request GET
lsel.pollsandpromotions.site/c/4182ef8a9b09fd89?cid=__SID__&s1=__CAMPAIGN_NAME__&s2=__SID__&s3=__GROUP_NAME__&s4=__AD_ID__
IP
52.19.101.114:0
ASN
#16509 AMAZON-02

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (1052)
Size
2.3 kB (2279 bytes)
Hash
0eee72f56432fb7d10cd625ec8febdec
1f5c9a02d34b42b2f3b959d5de5f261c8dc7df32
81112690a8a499f440fed9f8a996ed2aadb98aa48f1896987e6216a8c85518ee

HTTP Headers

GET /c/4182ef8a9b09fd89?cid=__SID__&s1=__CAMPAIGN_NAME__&s2=__SID__&s3=__GROUP_NAME__&s4=__AD_ID__ HTTP/1.1
Host: lsel.pollsandpromotions.site
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 01 Jun 2023 21:01:34 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: unique_id=6479072e000aa5fc; Path=/; Expires=Mon, 31 Jul 2023 21:01:34 GMT
unique_id2=6479072e000aad1e; Path=/; Expires=Wed, 30 Aug 2023 21:01:34 GMT
impression=; Path=/; Expires=Thu, 01 Jun 2023 21:01:34 GMT
Content-Encoding: gzip

cdnjs.cloudflare.com/ajax/libs/gsap/3.9.1/gsap.min.js?1683207405

104.17.25.14

200 OK

23 kB

URL GET HTTP/2
cdnjs.cloudflare.com/ajax/libs/gsap/3.9.1/gsap.min.js?1683207405
IP
104.17.25.14:443
ASN
#13335 CLOUDFLARENET

Requested by
http://lsel.pollsandpromotions.site/c/4182ef8a9b09fd89?cid=__SID__&s1=__CAMPAIGN_NAME__&s2=__SID__&s3=__GROUP_NAME__&s4=__AD_ID__
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
FingerprintA9:11:71:07:07:92:48:7E:A9:3C:E8:32:25:3F:EB:AC:7D:51:7E:8F
ValidityWed, 03 Aug 2022 00:00:00 GMT - Wed, 02 Aug 2023 23:59:59 GMT

File type
ASCII text, with very long lines (63851)
Size
23 kB (22890 bytes)
Hash
6ceffd5b35d350764ce6cb72313190f5
1a8bcae2241d253c1a41050b20c840d29878f3ae
6dbe9c2e13cf06c6633ea3fcf6d7bd30452561202a205c75a035cd1d8b93368f

HTTP Headers

GET /ajax/libs/gsap/3.9.1/gsap.min.js?1683207405 HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://lsel.pollsandpromotions.site/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 01 Jun 2023 21:01:35 GMT
content-type: application/javascript; charset=utf-8
content-length: 22890
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "61c68a7c-596a"
last-modified: Sat, 25 Dec 2021 03:05:32 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 2688834
expires: Tue, 21 May 2024 21:01:35 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZtF%2FRr3j%2F8QU42ysJ%2B2QFDaZVKBCuXCVmNfKZrNU7lpVruEm0dXyQQngb2B4BmJchOgYYJreAu0YWJd5JS5%2F1ja7v0Ux%2B%2BUhS58RObkjK6cNY5iwPRa9dqtCZUyYV2lW7qihV7FT"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 7d0a64863cb5b515-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

ocsp2.globalsign.com/gsalphasha2g2

104.18.20.226

1.4 kB

URL
ocsp2.globalsign.com/gsalphasha2g2
IP
104.18.20.226:0
ASN
#13335 CLOUDFLARENET

File type
data
Size
1.4 kB (1423 bytes)
Hash
2d24465b24ee7a5a0d902b72bedda158
9904855d65d75fc67f63b880b2c2581a5ba2cfaf
8d22d5613ad70547ba2a2f920dd7275ba5d1cf15d0eb5b3c3167f2f5de9a765f

HTTP Headers

POST /gsalphasha2g2 HTTP/1.1
Host: ocsp2.globalsign.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Thu, 01 Jun 2023 21:01:35 GMT
Content-Type: application/ocsp-response
Content-Length: 1423
Connection: keep-alive
Expires: Mon, 05 Jun 2023 18:50:05 GMT
ETag: "9904855d65d75fc67f63b880b2c2581a5ba2cfaf"
Last-Modified: Thu, 01 Jun 2023 18:50:06 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 2396
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7d0a648778f7b4fd-OSL

api.imotech.video/ad/events.js?pixel_id=902760083831232256

164.90.105.129

200 OK

6.1 kB

URL GET HTTP/2
api.imotech.video/ad/events.js?pixel_id=902760083831232256
IP
164.90.105.129:443
ASN
#10122 BIGO TECHNOLOGY PTE. LTD.

Requested by
http://lsel.pollsandpromotions.site/c/4182ef8a9b09fd89?cid=__SID__&s1=__CAMPAIGN_NAME__&s2=__SID__&s3=__GROUP_NAME__&s4=__AD_ID__
Certificate
IssuerGlobalSign nv-sa
Subject*.imotech.video
FingerprintA0:67:1C:F6:41:66:7E:FA:52:CC:92:38:EA:B5:88:77:7A:A4:6B:D0
ValidityTue, 05 Jul 2022 02:31:37 GMT - Sun, 06 Aug 2023 02:31:36 GMT

File type
Unicode text, UTF-8 text, with very long lines (17299), with no line terminators
Size
6.1 kB (6084 bytes)
Hash
65e92d1f5cd6a66edd798d8e31a0f5a4
ee20b1d89622bcf1787c29b0480e6547996acadf
b047e3cd894e371bc43a81292ba872d0f81fd03a8a9e66aa7e063c7e96f76098

HTTP Headers

GET /ad/events.js?pixel_id=902760083831232256 HTTP/1.1
Host: api.imotech.video
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://lsel.pollsandpromotions.site/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: openresty/1.13.6.1
date: Thu, 01 Jun 2023 21:01:35 GMT
content-type: application/json,application/javascript;charset=utf-8
content-length: 6084
access-control-allow-origin: *
content-encoding: gzip
cache-control: private, max-age=900
X-Firefox-Spdy: h2

cdn-adef.akamaized.net/landings/279321/1683207405/css/basics.css?1683207405

95.101.10.34

200 OK

2.6 kB

URL GET HTTP/1.1
cdn-adef.akamaized.net/landings/279321/1683207405/css/basics.css?1683207405
IP
95.101.10.34:443
ASN
#20940 Akamai International B.V.

Requested by
http://lsel.pollsandpromotions.site/c/4182ef8a9b09fd89?cid=__SID__&s1=__CAMPAIGN_NAME__&s2=__SID__&s3=__GROUP_NAME__&s4=__AD_ID__
Certificate
IssuerDigiCert Inc
Subjecta248.e.akamai.net
FingerprintA3:C7:B4:95:4E:16:BD:C5:8A:EE:85:53:5D:C1:C2:CD:43:E9:EC:B9
ValidityTue, 16 May 2023 00:00:00 GMT - Wed, 15 May 2024 23:59:59 GMT

File type
ASCII text, with very long lines (402), with CRLF line terminators
Size
2.6 kB (2626 bytes)
Hash
feea073aa0772036f71c27d106669d52
7d8e3e3fcb6d4861a697776e8251ecdda82010b9
b27f84b7f975f53fd584c19c8265031705fdca39c62aa16e1ab88ab3a4f76f35

HTTP Headers

GET /landings/279321/1683207405/css/basics.css?1683207405 HTTP/1.1
Host: cdn-adef.akamaized.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://lsel.pollsandpromotions.site/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
x-amz-id-2: CpnkDFZolM3XjvXV/4p1BqQN9TABjh8HoJb3G5YUb3u6tNVqYlYUKwH6Nn+IDxZtcIiOPOEJ36c=
x-amz-request-id: 3Z0Q9WFVVYPRB3NA
Last-Modified: Thu, 04 May 2023 13:36:47 GMT
ETag: "feea073aa0772036f71c27d106669d52"
x-amz-server-side-encryption: AES256
Accept-Ranges: bytes
Content-Type: text/css
Server: AmazonS3
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Thu, 01 Jun 2023 21:01:35 GMT
Content-Length: 2626
Connection: keep-alive
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"

cdn-adef.akamaized.net/landings/279321/1683207405/js/collector.js?1683207405

95.101.10.34

200 OK

1.1 kB

URL GET HTTP/1.1
cdn-adef.akamaized.net/landings/279321/1683207405/js/collector.js?1683207405
IP
95.101.10.34:443
ASN
#20940 Akamai International B.V.

Requested by
http://lsel.pollsandpromotions.site/c/4182ef8a9b09fd89?cid=__SID__&s1=__CAMPAIGN_NAME__&s2=__SID__&s3=__GROUP_NAME__&s4=__AD_ID__
Certificate
IssuerDigiCert Inc
Subjecta248.e.akamai.net
FingerprintA3:C7:B4:95:4E:16:BD:C5:8A:EE:85:53:5D:C1:C2:CD:43:E9:EC:B9
ValidityTue, 16 May 2023 00:00:00 GMT - Wed, 15 May 2024 23:59:59 GMT

File type
ASCII text, with CRLF line terminators
Size
1.1 kB (1134 bytes)
Hash
530a1ee9078c63b05445580074efe74f
17888910ee0abdd5b9d59bfc8b97cb58bb923802
aa6be0b532f192e97e4b097b9c0f62dbc6e4563b8abc249517483ca814285afe

HTTP Headers

GET /landings/279321/1683207405/js/collector.js?1683207405 HTTP/1.1
Host: cdn-adef.akamaized.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://lsel.pollsandpromotions.site/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
x-amz-id-2: 7uf47weIxPeeMTb/YOsVDqg1PAiqbOrF6+v+lkT0RVXi38SIFb3OSqmMrnl5EM7jjU5de4gSJGY=
x-amz-request-id: 3Z0S3MEBN1KH42HX
Last-Modified: Thu, 04 May 2023 13:36:47 GMT
ETag: "530a1ee9078c63b05445580074efe74f"
x-amz-server-side-encryption: AES256
Accept-Ranges: bytes
Content-Type: text/javascript
Server: AmazonS3
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Thu, 01 Jun 2023 21:01:35 GMT
Content-Length: 1134
Connection: keep-alive
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"

cdn-adef.akamaized.net/landings/279321/1683207405/js/main.js?1683207405

95.101.10.34

200 OK

1.7 kB

URL GET HTTP/1.1
cdn-adef.akamaized.net/landings/279321/1683207405/js/main.js?1683207405
IP
95.101.10.34:443
ASN
#20940 Akamai International B.V.

Requested by
http://lsel.pollsandpromotions.site/c/4182ef8a9b09fd89?cid=__SID__&s1=__CAMPAIGN_NAME__&s2=__SID__&s3=__GROUP_NAME__&s4=__AD_ID__
Certificate
IssuerDigiCert Inc
Subjecta248.e.akamai.net
FingerprintA3:C7:B4:95:4E:16:BD:C5:8A:EE:85:53:5D:C1:C2:CD:43:E9:EC:B9
ValidityTue, 16 May 2023 00:00:00 GMT - Wed, 15 May 2024 23:59:59 GMT

File type
ASCII text
Size
1.7 kB (1741 bytes)
Hash
eb86cde28d0545695ec8823f6617fd6c
37b6641f75ab1b1b1e2bd375b56c40ccbc90f9ec
125d8a743888e128f1cc2cfec48f256aed9c7bb9ea64edb15cbcc04eb245ee19

HTTP Headers

GET /landings/279321/1683207405/js/main.js?1683207405 HTTP/1.1
Host: cdn-adef.akamaized.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://lsel.pollsandpromotions.site/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
x-amz-id-2: kxwZ6fftGnYqo5158Tbfy1M0u9hh01Vs2ULWvD8+waFuK/eDTAw5l3kagWcPkGNz3Zgn7xriiCU=
x-amz-request-id: 3Z0YG5HA1WYJ4RQR
Last-Modified: Thu, 04 May 2023 13:36:47 GMT
ETag: "eb86cde28d0545695ec8823f6617fd6c"
x-amz-server-side-encryption: AES256
Accept-Ranges: bytes
Content-Type: text/javascript
Server: AmazonS3
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Thu, 01 Jun 2023 21:01:35 GMT
Content-Length: 1741
Connection: keep-alive
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"

cdnjs.claudflare.io/ajax/libs/jquery/3.6.0/d/jquery.min.js?1683207405

206.189.196.86

200 OK

92 kB

URL GET HTTP/1.1
cdnjs.claudflare.io/ajax/libs/jquery/3.6.0/d/jquery.min.js?1683207405
IP
206.189.196.86:443
ASN
#14061 DIGITALOCEAN-ASN

Requested by
http://lsel.pollsandpromotions.site/c/4182ef8a9b09fd89?cid=__SID__&s1=__CAMPAIGN_NAME__&s2=__SID__&s3=__GROUP_NAME__&s4=__AD_ID__
Certificate
IssuerLet's Encrypt
Subjectcdnjs.claudflare.io
FingerprintBF:D4:AB:9A:D0:EB:75:E1:A0:33:BA:D0:58:58:99:64:E0:75:B9:0C
ValidityThu, 06 Apr 2023 22:54:27 GMT - Wed, 05 Jul 2023 22:54:26 GMT

File type
ASCII text, with very long lines (65447)
Size
92 kB (92013 bytes)
Hash
1b8f799313e9c99c29b8e772090c6584
1295d7b92d351b3a17b061367641313b62b0266d
193381be618f4d1e7c8081a4ee68c3b406ebfc2dee86a704b012c0c88ae6e877

Detections

Analyzer	Verdict	Alert
quad9	Sinkholed

HTTP Headers

GET /ajax/libs/jquery/3.6.0/d/jquery.min.js?1683207405 HTTP/1.1
Host: cdnjs.claudflare.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://lsel.pollsandpromotions.site/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.22.0 (Ubuntu)
Date: Thu, 01 Jun 2023 21:01:35 GMT
Content-Type: text/javascript; charset=utf-8
Content-Length: 92013
Connection: keep-alive
Cache-Control: public, max-age=43200
Expires: Fri, 02 Jun 2023 09:01:35 GMT

api.imotech.video/ad/pixelfile.html

164.90.105.129

200 OK

1.9 kB

URL GET HTTP/2
api.imotech.video/ad/pixelfile.html
IP
164.90.105.129:443
ASN
#10122 BIGO TECHNOLOGY PTE. LTD.

Requested by
http://lsel.pollsandpromotions.site/c/4182ef8a9b09fd89?cid=__SID__&s1=__CAMPAIGN_NAME__&s2=__SID__&s3=__GROUP_NAME__&s4=__AD_ID__
Certificate
IssuerGlobalSign nv-sa
Subject*.imotech.video
FingerprintA0:67:1C:F6:41:66:7E:FA:52:CC:92:38:EA:B5:88:77:7A:A4:6B:D0
ValidityTue, 05 Jul 2022 02:31:37 GMT - Sun, 06 Aug 2023 02:31:36 GMT

File type
HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text
Size
1.9 kB (1888 bytes)
Hash
276e9f07c55ed5404d2b4118da99c454
f3556fab4dbc2f9dc0ed954685e733466a44cae2
906f6effab44b23ce90ce63d03fea117c7a9346983bd27972b37f4085d561869

HTTP Headers

GET /ad/pixelfile.html HTTP/1.1
Host: api.imotech.video
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://lsel.pollsandpromotions.site/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: openresty/1.13.6.1
date: Thu, 01 Jun 2023 21:01:36 GMT
content-type: application/json,text/html;charset=utf-8
content-length: 1888
X-Firefox-Spdy: h2

cdn.stfilecamp.com/stormtrk.js

205.185.216.10

200 OK

6.8 kB

URL GET HTTP/2
cdn.stfilecamp.com/stormtrk.js
IP
205.185.216.10:443
ASN
#20446 STACKPATH-CDN

Requested by
http://lsel.pollsandpromotions.site/c/4182ef8a9b09fd89?cid=__SID__&s1=__CAMPAIGN_NAME__&s2=__SID__&s3=__GROUP_NAME__&s4=__AD_ID__
Certificate
IssuerLet's Encrypt
Subjectstfilecamp.com
FingerprintAA:B4:C4:9C:3A:FE:EA:21:AC:40:6C:C9:C7:60:1E:86:37:76:CE:92
ValidityMon, 29 May 2023 15:01:16 GMT - Sun, 27 Aug 2023 15:01:15 GMT

File type
ASCII text
Size
6.8 kB (6807 bytes)
Hash
39e5f8ad757fe438c784e8d883e47ab0
6b2905489485100c83605f43186c5843031e1f3b
e421906cc3be04e5f6795074c0a91e5a194f218b3f8c57adfed0f4d315dd445a

HTTP Headers

GET /stormtrk.js HTTP/1.1
Host: cdn.stfilecamp.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://lsel.pollsandpromotions.site/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 01 Jun 2023 21:01:36 GMT
cache-control: max-age=2926
content-length: 6807
content-type: text/javascript
last-modified: Sat, 24 Dec 2022 08:48:24 GMT
accept-ranges: bytes
x-rgw-object-type: Normal
etag: "39e5f8ad757fe438c784e8d883e47ab0"
x-amz-request-id: tx000000000000035449033-006479048e-35e6f1e2-sfo3a
strict-transport-security: max-age=15552000; includeSubDomains; preload
vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin
x-hw: 1685653296.dop067.sk1.t,1685653296.cds017.sk1.hn,1685653296.cds014.sk1.c
X-Firefox-Spdy: h2

api.imotech.video/bigoad/trackingview?it=1685653295798&title=Cash%20App%20%24750%20gift%20card&referer=&resolution=1024*1280&lang=en-US&url=http%3A%2F%2Flsel.pollsandpromotions.site%2Fc%2F4182ef8a9b09fd89%3Fcid%3D__SID__%26s1%3D__CAMPAIGN_NAME__%26s2%3D__SID__%26s3%3D__GROUP_NAME__%26s4%3D__AD_ID__&host=lsel.pollsandpromotions.site&cookie_id=BA1.1.3071558474.1685653296&session_id=BA1.1.4013004096.1685653296&pixel_id=902760083831232256&ts=1685653295803&extra=%7B%22action%22%3A%22init%22%2C%22wst%22%3A112%2C%22drt%22%3A1616%2C%22lgt%22%3A1625%7D

164.90.105.129

200 OK

104 B

URL POST HTTP/2
api.imotech.video/bigoad/trackingview?it=1685653295798&title=Cash%20App%20%24750%20gift%20card&referer=&resolution=1024*1280&lang=en-US&url=http%3A%2F%2Flsel.pollsandpromotions.site%2Fc%2F4182ef8a9b09fd89%3Fcid%3D__SID__%26s1%3D__CAMPAIGN_NAME__%26s2%3D__SID__%26s3%3D__GROUP_NAME__%26s4%3D__AD_ID__&host=lsel.pollsandpromotions.site&cookie_id=BA1.1.3071558474.1685653296&session_id=BA1.1.4013004096.1685653296&pixel_id=902760083831232256&ts=1685653295803&extra=%7B%22action%22%3A%22init%22%2C%22wst%22%3A112%2C%22drt%22%3A1616%2C%22lgt%22%3A1625%7D
IP
164.90.105.129:443
ASN
#10122 BIGO TECHNOLOGY PTE. LTD.

Requested by
http://lsel.pollsandpromotions.site/c/4182ef8a9b09fd89?cid=__SID__&s1=__CAMPAIGN_NAME__&s2=__SID__&s3=__GROUP_NAME__&s4=__AD_ID__
Certificate
IssuerGlobalSign nv-sa
Subject*.imotech.video
FingerprintA0:67:1C:F6:41:66:7E:FA:52:CC:92:38:EA:B5:88:77:7A:A4:6B:D0
ValidityTue, 05 Jul 2022 02:31:37 GMT - Sun, 06 Aug 2023 02:31:36 GMT

File type
ASCII text, with no line terminators
Size
104 B (104 bytes)
Hash
70c2013c652dd5dc6c51c83a2e1874f8
5f8e72d0579690d5e46e2565febb7afc4d9b0cf3
03563a4199bbc09aae7815eb6f500501ddb5c5a99415dcbced31a347cf907262

HTTP Headers

POST /bigoad/trackingview?it=1685653295798&title=Cash%20App%20%24750%20gift%20card&referer=&resolution=1024*1280&lang=en-US&url=http%3A%2F%2Flsel.pollsandpromotions.site%2Fc%2F4182ef8a9b09fd89%3Fcid%3D__SID__%26s1%3D__CAMPAIGN_NAME__%26s2%3D__SID__%26s3%3D__GROUP_NAME__%26s4%3D__AD_ID__&host=lsel.pollsandpromotions.site&cookie_id=BA1.1.3071558474.1685653296&session_id=BA1.1.4013004096.1685653296&pixel_id=902760083831232256&ts=1685653295803&extra=%7B%22action%22%3A%22init%22%2C%22wst%22%3A112%2C%22drt%22%3A1616%2C%22lgt%22%3A1625%7D HTTP/1.1
Host: api.imotech.video
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://lsel.pollsandpromotions.site
DNT: 1
Connection: keep-alive
Referer: http://lsel.pollsandpromotions.site/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
TE: trailers

HTTP/2 200 OK
server: openresty/1.13.6.1
date: Thu, 01 Jun 2023 21:01:36 GMT
content-type: application/json
content-length: 104
bigotraceresponse: 00-0d370c6139151e619ec737a5e0c85152-0-00
X-Firefox-Spdy: h2

api.imotech.video/bigoad/trackingview?it=1685653295798&title=Cash%20App%20%24750%20gift%20card&referer=&resolution=1024*1280&lang=en-US&url=http%3A%2F%2Flsel.pollsandpromotions.site%2Fc%2F4182ef8a9b09fd89%3Fcid%3D__SID__%26s1%3D__CAMPAIGN_NAME__%26s2%3D__SID__%26s3%3D__GROUP_NAME__%26s4%3D__AD_ID__&host=lsel.pollsandpromotions.site&cookie_id=BA1.1.3071558474.1685653296&session_id=BA1.1.4013004096.1685653296&pixel_id=902760083831232256&ts=1685653295803&extra=%7B%22action%22%3A%22page_view%22%2C%22wst%22%3A112%2C%22drt%22%3A1616%2C%22lgt%22%3A1625%7D

164.90.105.129

200 OK

104 B

URL POST HTTP/2
api.imotech.video/bigoad/trackingview?it=1685653295798&title=Cash%20App%20%24750%20gift%20card&referer=&resolution=1024*1280&lang=en-US&url=http%3A%2F%2Flsel.pollsandpromotions.site%2Fc%2F4182ef8a9b09fd89%3Fcid%3D__SID__%26s1%3D__CAMPAIGN_NAME__%26s2%3D__SID__%26s3%3D__GROUP_NAME__%26s4%3D__AD_ID__&host=lsel.pollsandpromotions.site&cookie_id=BA1.1.3071558474.1685653296&session_id=BA1.1.4013004096.1685653296&pixel_id=902760083831232256&ts=1685653295803&extra=%7B%22action%22%3A%22page_view%22%2C%22wst%22%3A112%2C%22drt%22%3A1616%2C%22lgt%22%3A1625%7D
IP
164.90.105.129:443
ASN
#10122 BIGO TECHNOLOGY PTE. LTD.

Requested by
http://lsel.pollsandpromotions.site/c/4182ef8a9b09fd89?cid=__SID__&s1=__CAMPAIGN_NAME__&s2=__SID__&s3=__GROUP_NAME__&s4=__AD_ID__
Certificate
IssuerGlobalSign nv-sa
Subject*.imotech.video
FingerprintA0:67:1C:F6:41:66:7E:FA:52:CC:92:38:EA:B5:88:77:7A:A4:6B:D0
ValidityTue, 05 Jul 2022 02:31:37 GMT - Sun, 06 Aug 2023 02:31:36 GMT

File type
ASCII text, with no line terminators
Size
104 B (104 bytes)
Hash
24f513f21f05ce8c5634bb560c1940e8
f3512770824fbd4bc7a01dde2547416e24f48c09
dc1cea2958c61f495dcd53d847e79becc7fafa41a2616e77bf6bc85ff63ad7ee

HTTP Headers

POST /bigoad/trackingview?it=1685653295798&title=Cash%20App%20%24750%20gift%20card&referer=&resolution=1024*1280&lang=en-US&url=http%3A%2F%2Flsel.pollsandpromotions.site%2Fc%2F4182ef8a9b09fd89%3Fcid%3D__SID__%26s1%3D__CAMPAIGN_NAME__%26s2%3D__SID__%26s3%3D__GROUP_NAME__%26s4%3D__AD_ID__&host=lsel.pollsandpromotions.site&cookie_id=BA1.1.3071558474.1685653296&session_id=BA1.1.4013004096.1685653296&pixel_id=902760083831232256&ts=1685653295803&extra=%7B%22action%22%3A%22page_view%22%2C%22wst%22%3A112%2C%22drt%22%3A1616%2C%22lgt%22%3A1625%7D HTTP/1.1
Host: api.imotech.video
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://lsel.pollsandpromotions.site
DNT: 1
Connection: keep-alive
Referer: http://lsel.pollsandpromotions.site/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
TE: trailers

HTTP/2 200 OK
server: openresty/1.13.6.1
date: Thu, 01 Jun 2023 21:01:36 GMT
content-type: application/json
content-length: 104
bigotraceresponse: 00-9976b02ec0a7317f7333a99a9746d939-0-00
X-Firefox-Spdy: h2

tt.stfilecamp.com/jsfiles/site-protect2.0.js

205.185.216.42

200 OK

3.1 kB

URL GET HTTP/2
tt.stfilecamp.com/jsfiles/site-protect2.0.js
IP
205.185.216.42:443
ASN
#20446 STACKPATH-CDN

Requested by
http://lsel.pollsandpromotions.site/c/4182ef8a9b09fd89?cid=__SID__&s1=__CAMPAIGN_NAME__&s2=__SID__&s3=__GROUP_NAME__&s4=__AD_ID__
Certificate
IssuerLet's Encrypt
Subjectstfilecamp.com
FingerprintD9:D1:1B:D4:61:43:A2:E8:66:78:49:BD:B6:F7:72:58:0A:61:2E:19
ValidityTue, 02 May 2023 07:05:53 GMT - Mon, 31 Jul 2023 07:05:52 GMT

File type
ASCII text
Size
3.1 kB (3137 bytes)
Hash
fc96ab06b0f9fcea6731405215ae5daf
8af9f27d895eb69754919a2fc0d74760fecd3860
9243e166cbcd628fd992eba59544ebf99328fd4db7c0c08c2fb28a7af14d759e

HTTP Headers

GET /jsfiles/site-protect2.0.js HTTP/1.1
Host: tt.stfilecamp.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://lsel.pollsandpromotions.site/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 01 Jun 2023 21:01:36 GMT
cache-control: max-age=1636
content-length: 3137
content-type: text/javascript
last-modified: Mon, 27 Feb 2023 13:49:23 GMT
accept-ranges: bytes
x-rgw-object-type: Normal
etag: "fc96ab06b0f9fcea6731405215ae5daf"
x-amz-request-id: tx0000000000000d377dcf6-006478ff84-652bc218-nyc3c
strict-transport-security: max-age=15552000; includeSubDomains; preload
vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin
x-hw: 1685653296.dop217.sk1.t,1685653296.cds202.sk1.hn,1685653296.cds231.sk1.c
X-Firefox-Spdy: h2

cdn-adef.akamaized.net/landings/279321/1683207405/images/visa-logo-sq.png

95.101.10.34

200 OK

16 kB

URL GET HTTP/1.1
cdn-adef.akamaized.net/landings/279321/1683207405/images/visa-logo-sq.png
IP
95.101.10.34:443
ASN
#20940 Akamai International B.V.

Requested by
http://lsel.pollsandpromotions.site/c/4182ef8a9b09fd89?cid=__SID__&s1=__CAMPAIGN_NAME__&s2=__SID__&s3=__GROUP_NAME__&s4=__AD_ID__
Certificate
IssuerDigiCert Inc
Subjecta248.e.akamai.net
FingerprintA3:C7:B4:95:4E:16:BD:C5:8A:EE:85:53:5D:C1:C2:CD:43:E9:EC:B9
ValidityTue, 16 May 2023 00:00:00 GMT - Wed, 15 May 2024 23:59:59 GMT

File type
PNG image data, 174 x 172, 8-bit/color RGBA, non-interlaced\012- data
Size
16 kB (16103 bytes)
Hash
ddb1a54620ba3a4424cb262e457ddbd9
0b0278f1dab8754cba8f1ab74e333f7a69e6f999
1fcf40f6f008f09af6b9d5e62a611d9b7c9920b37c5cbfb99621ffcc97243c95

HTTP Headers

GET /landings/279321/1683207405/images/visa-logo-sq.png HTTP/1.1
Host: cdn-adef.akamaized.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://lsel.pollsandpromotions.site/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
x-amz-id-2: xVnER4VzGn0zJ9eIZSz6aOjfTdW3KO0BMbyEuyP3XN4mcBZhsIyDYjVa9UFMVd3cTknj9Ln37Kw=
x-amz-request-id: 08GV14HJT35XM4CA
Last-Modified: Thu, 04 May 2023 13:36:47 GMT
ETag: "ddb1a54620ba3a4424cb262e457ddbd9"
x-amz-server-side-encryption: AES256
Accept-Ranges: bytes
Content-Type: image/png
Server: AmazonS3
Content-Length: 16103
Date: Thu, 01 Jun 2023 21:01:36 GMT
Connection: keep-alive
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"

cdn-adef.akamaized.net/landings/279321/1683207405/images/visa-logo.png

95.101.10.34

200 OK

8.5 kB

URL GET HTTP/1.1
cdn-adef.akamaized.net/landings/279321/1683207405/images/visa-logo.png
IP
95.101.10.34:443
ASN
#20940 Akamai International B.V.

Requested by
http://lsel.pollsandpromotions.site/c/4182ef8a9b09fd89?cid=__SID__&s1=__CAMPAIGN_NAME__&s2=__SID__&s3=__GROUP_NAME__&s4=__AD_ID__
Certificate
IssuerDigiCert Inc
Subjecta248.e.akamai.net
FingerprintA3:C7:B4:95:4E:16:BD:C5:8A:EE:85:53:5D:C1:C2:CD:43:E9:EC:B9
ValidityTue, 16 May 2023 00:00:00 GMT - Wed, 15 May 2024 23:59:59 GMT

File type
PNG image data, 300 x 68, 4-bit colormap, non-interlaced\012- data
Size
8.5 kB (8491 bytes)
Hash
a0157852d2a3d6e9aefbd7c23419e566
27d57dbdf88d42be5defcea6a1675d4932d13664
3b6b61919a663134edcdfe300b4de7e821ffa07cc72c15611988fb86fbba935c

HTTP Headers

GET /landings/279321/1683207405/images/visa-logo.png HTTP/1.1
Host: cdn-adef.akamaized.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://lsel.pollsandpromotions.site/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
x-amz-id-2: gvNq4L3SBytLEa+1YYITzPP3bWmJ3k4HAYD30ic7cjWXzc51eW4zyqI/ORXWTlRSEFEa8D/1Vus=
x-amz-request-id: 08GVY24KWDBSMAP4
Last-Modified: Thu, 04 May 2023 13:36:47 GMT
ETag: "a0157852d2a3d6e9aefbd7c23419e566"
x-amz-server-side-encryption: AES256
Accept-Ranges: bytes
Content-Type: image/png
Server: AmazonS3
Content-Length: 8491
Date: Thu, 01 Jun 2023 21:01:36 GMT
Connection: keep-alive
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"

route.frest.pro/is_redirect

104.21.77.196

200 OK

17 B

URL POST HTTP/2
route.frest.pro/is_redirect
IP
104.21.77.196:443
ASN
#13335 CLOUDFLARENET

Requested by
http://lsel.pollsandpromotions.site/c/4182ef8a9b09fd89?cid=__SID__&s1=__CAMPAIGN_NAME__&s2=__SID__&s3=__GROUP_NAME__&s4=__AD_ID__
Certificate
IssuerGoogle Trust Services LLC
Subjectfrest.pro
FingerprintBF:79:17:15:EB:F6:8D:E0:44:93:02:1B:18:9B:0E:C8:06:68:24:E1
ValidityFri, 14 Apr 2023 08:42:39 GMT - Thu, 13 Jul 2023 08:42:38 GMT

File type
JSON data\012- , ASCII text
Size
17 B (17 bytes)
Hash
6dec798efb56f56f33660938f6249ff6
e889219883cef38754dc1e5df7ca5277b3b314c8
b493cdb3b30ea63f6a924f814dfccfcfe305dac02106f9994ce2bcb2e8ed28c4

HTTP Headers

POST /is_redirect HTTP/1.1
Host: route.frest.pro
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-type: application/x-www-form-urlencoded
Content-Length: 10
Origin: http://lsel.pollsandpromotions.site
DNT: 1
Connection: keep-alive
Referer: http://lsel.pollsandpromotions.site/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 01 Jun 2023 21:01:36 GMT
content-type: application/json
content-length: 17
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Content-Type, Access-Control-Allow-Headers, X-Requested-With
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QnwyJIuvb5tcP7XiipzMimZkFEKfSSq3N8cgDWebe928cN5PMZnmSw%2BTRMPzCP3HH%2Fpe6j9rr%2BAVF4x%2BPyeg7PAJ5YCcslIBkIBDqyROLfm7yQz1bZv9wyThTVDkULlMBns%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7d0a648dab4d0b3d-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

tt.stfilecamp.com/jsfiles/second_back_multi_bigo.js

205.185.216.42

200 OK

2.3 kB

URL GET HTTP/2
tt.stfilecamp.com/jsfiles/second_back_multi_bigo.js
IP
205.185.216.42:443
ASN
#20446 STACKPATH-CDN

Requested by
http://lsel.pollsandpromotions.site/c/4182ef8a9b09fd89?cid=__SID__&s1=__CAMPAIGN_NAME__&s2=__SID__&s3=__GROUP_NAME__&s4=__AD_ID__
Certificate
IssuerLet's Encrypt
Subjectstfilecamp.com
FingerprintD9:D1:1B:D4:61:43:A2:E8:66:78:49:BD:B6:F7:72:58:0A:61:2E:19
ValidityTue, 02 May 2023 07:05:53 GMT - Mon, 31 Jul 2023 07:05:52 GMT

File type
HTML document, ASCII text
Size
2.3 kB (2307 bytes)
Hash
96af925d55cad494665471c73ac01b04
5d2b1c06d2edb1a1ba9a5335c5dbb73c508b879b
1109fbd42583528695ba5995a756fd0fd09a992a85f50e54862e4b13c1cf75c2

HTTP Headers

GET /jsfiles/second_back_multi_bigo.js HTTP/1.1
Host: tt.stfilecamp.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://lsel.pollsandpromotions.site/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 01 Jun 2023 21:01:36 GMT
cache-control: max-age=3600
content-length: 2307
content-type: text/javascript
last-modified: Mon, 27 Feb 2023 13:49:23 GMT
accept-ranges: bytes
x-rgw-object-type: Normal
etag: "96af925d55cad494665471c73ac01b04"
x-amz-request-id: tx00000000000019edfecad-0064790730-58c8a03d-nyc3c
strict-transport-security: max-age=15552000; includeSubDomains; preload
vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin
x-hw: 1685653296.dop217.sk1.t,1685653296.cds202.sk1.hn,1685653296.cds239.sk1.pr
X-Firefox-Spdy: h2

cdn-adef.akamaized.net/landings/279321/1683207405/images/prize.png

95.101.10.34

200 OK

121 kB

URL GET HTTP/1.1
cdn-adef.akamaized.net/landings/279321/1683207405/images/prize.png
IP
95.101.10.34:443
ASN
#20940 Akamai International B.V.

Requested by
http://lsel.pollsandpromotions.site/c/4182ef8a9b09fd89?cid=__SID__&s1=__CAMPAIGN_NAME__&s2=__SID__&s3=__GROUP_NAME__&s4=__AD_ID__
Certificate
IssuerDigiCert Inc
Subjecta248.e.akamai.net
FingerprintA3:C7:B4:95:4E:16:BD:C5:8A:EE:85:53:5D:C1:C2:CD:43:E9:EC:B9
ValidityTue, 16 May 2023 00:00:00 GMT - Wed, 15 May 2024 23:59:59 GMT

File type
PNG image data, 599 x 364, 8-bit/color RGBA, non-interlaced\012- data
Size
121 kB (121134 bytes)
Hash
9baf931fb00cffaf06a4f35d2278c84f
9080ebaa1e91376a8612cadd92ea4853a363b1da
57a7519e652fc50a895fd9e0b98c449188af8d27d7fde2a5294d7e1c80aec4ac

HTTP Headers

GET /landings/279321/1683207405/images/prize.png HTTP/1.1
Host: cdn-adef.akamaized.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://lsel.pollsandpromotions.site/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
x-amz-id-2: 8DyTE5pP2SwW2kltHJgh4rBWdTTOAbg0DO4459oCKGdtIDs38SwTpws4z6EII9VZIb5OKZXa1gQ=
x-amz-request-id: 08GK1TC3N84PF39R
Last-Modified: Thu, 04 May 2023 13:36:47 GMT
ETag: "9baf931fb00cffaf06a4f35d2278c84f"
x-amz-server-side-encryption: AES256
Accept-Ranges: bytes
Content-Type: image/png
Server: AmazonS3
Content-Length: 121134
Date: Thu, 01 Jun 2023 21:01:36 GMT
Connection: keep-alive
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"

cdn-adef.akamaized.net/images/favicon.ico

95.101.10.34

200 OK

4.1 kB

URL GET HTTP/1.1
cdn-adef.akamaized.net/images/favicon.ico
IP
95.101.10.34:443
ASN
#20940 Akamai International B.V.

Requested by
http://lsel.pollsandpromotions.site/c/4182ef8a9b09fd89?cid=__SID__&s1=__CAMPAIGN_NAME__&s2=__SID__&s3=__GROUP_NAME__&s4=__AD_ID__
Certificate
IssuerDigiCert Inc
Subjecta248.e.akamai.net
FingerprintA3:C7:B4:95:4E:16:BD:C5:8A:EE:85:53:5D:C1:C2:CD:43:E9:EC:B9
ValidityTue, 16 May 2023 00:00:00 GMT - Wed, 15 May 2024 23:59:59 GMT

File type
PNG image data, 180 x 180, 8-bit/color RGBA, non-interlaced\012- data
Size
4.1 kB (4103 bytes)
Hash
4cdf3256cd7b8ec3917adb79d6bf457e
bc615337e9223183a126c8fb649774866fb53e69
fbfff44a653dc193b93620f1035d221d3aaddf3238742270b3385482986ef7f0

HTTP Headers

GET /images/favicon.ico HTTP/1.1
Host: cdn-adef.akamaized.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://lsel.pollsandpromotions.site/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
x-amz-id-2: IjvSRVcJlrA8KRtuHCIvySb7T9M4setamspkp4J4t5oLIH6qyzaHxu8PdVPZHXMCPnB1SRcSZOs=
x-amz-request-id: 9B7689322D7626CA
Last-Modified: Wed, 07 Nov 2018 08:41:38 GMT
ETag: "4cdf3256cd7b8ec3917adb79d6bf457e"
Accept-Ranges: bytes
Content-Type: image/x-icon
Content-Length: 4103
Server: AmazonS3
Unused62: 8096267
Date: Thu, 01 Jun 2023 21:01:36 GMT
Connection: keep-alive
Alt-Svc: h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"

cdn.stfilecamp.com/fp.min.js

205.185.216.10

200 OK

32 kB

URL GET HTTP/2
cdn.stfilecamp.com/fp.min.js
IP
205.185.216.10:443
ASN
#20446 STACKPATH-CDN

Requested by
http://lsel.pollsandpromotions.site/c/4182ef8a9b09fd89?cid=__SID__&s1=__CAMPAIGN_NAME__&s2=__SID__&s3=__GROUP_NAME__&s4=__AD_ID__
Certificate
IssuerLet's Encrypt
Subjectstfilecamp.com
FingerprintAA:B4:C4:9C:3A:FE:EA:21:AC:40:6C:C9:C7:60:1E:86:37:76:CE:92
ValidityMon, 29 May 2023 15:01:16 GMT - Sun, 27 Aug 2023 15:01:15 GMT

File type
Unicode text, UTF-8 text, with very long lines (31370)
Size
32 kB (31705 bytes)
Hash
198f2f5b0a649f41fe890c59d37319aa
f24629687612889bb59f610df3879afcd766fb80
d2bc2cb800679f495a7731c105b2e2047965800515f98008867ab33edc940912

HTTP Headers

GET /fp.min.js HTTP/1.1
Host: cdn.stfilecamp.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: http://lsel.pollsandpromotions.site/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Thu, 01 Jun 2023 21:01:37 GMT
cache-control: max-age=3353
content-length: 31705
content-type: text/javascript
last-modified: Mon, 13 Jun 2022 11:23:14 GMT
accept-ranges: bytes
x-rgw-object-type: Normal
etag: "198f2f5b0a649f41fe890c59d37319aa"
x-amz-request-id: tx000000000000035458fdb-006479063a-35e6f1e2-sfo3a
strict-transport-security: max-age=15552000; includeSubDomains; preload
vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin
x-hw: 1685653297.dop067.sk1.t,1685653297.cds017.sk1.hn,1685653297.cds237.sk1.c
X-Firefox-Spdy: h2

api.imotech.video/bigoad/trackingview?it=1685653295798&title=Cash%20App%20%24750%20gift%20card&referer=&resolution=1024*1280&lang=en-US&url=http%3A%2F%2Flsel.pollsandpromotions.site%2Fc%2F4182ef8a9b09fd89%3Fcid%3D__SID__%26s1%3D__CAMPAIGN_NAME__%26s2%3D__SID__%26s3%3D__GROUP_NAME__%26s4%3D__AD_ID__&host=lsel.pollsandpromotions.site&cookie_id=BA1.1.3071558474.1685653296&session_id=BA1.1.4013004096.1685653296&pixel_id=902760083831232256&ts=1685653309262&extra=%7B%22action%22%3A%22leave%22%2C%22type%22%3A1%2C%22wst%22%3A112%2C%22drt%22%3A1616%2C%22tdt%22%3A2292%2C%22lgt%22%3A15084%7D

164.90.105.129

104 B

URL
api.imotech.video/bigoad/trackingview?it=1685653295798&title=Cash%20App%20%24750%20gift%20card&referer=&resolution=1024*1280&lang=en-US&url=http%3A%2F%2Flsel.pollsandpromotions.site%2Fc%2F4182ef8a9b09fd89%3Fcid%3D__SID__%26s1%3D__CAMPAIGN_NAME__%26s2%3D__SID__%26s3%3D__GROUP_NAME__%26s4%3D__AD_ID__&host=lsel.pollsandpromotions.site&cookie_id=BA1.1.3071558474.1685653296&session_id=BA1.1.4013004096.1685653296&pixel_id=902760083831232256&ts=1685653309262&extra=%7B%22action%22%3A%22leave%22%2C%22type%22%3A1%2C%22wst%22%3A112%2C%22drt%22%3A1616%2C%22tdt%22%3A2292%2C%22lgt%22%3A15084%7D
IP
164.90.105.129:0
ASN
#10122 BIGO TECHNOLOGY PTE. LTD.

Certificate
IssuerGlobalSign nv-sa
Subject*.imotech.video
FingerprintA0:67:1C:F6:41:66:7E:FA:52:CC:92:38:EA:B5:88:77:7A:A4:6B:D0
ValidityTue, 05 Jul 2022 02:31:37 GMT - Sun, 06 Aug 2023 02:31:36 GMT

File type
ASCII text, with no line terminators
Size
104 B (104 bytes)
Hash
3c0eec3d6cf170c838a89789f3a80020
31057b3b2e7cebe42bc6ce0a8d5710bba0a9e246
330d75740d1d5f9bc7e487158f5cbef56a3d3624212a595154da81092961828a

HTTP Headers

POST /bigoad/trackingview?it=1685653295798&title=Cash%20App%20%24750%20gift%20card&referer=&resolution=1024*1280&lang=en-US&url=http%3A%2F%2Flsel.pollsandpromotions.site%2Fc%2F4182ef8a9b09fd89%3Fcid%3D__SID__%26s1%3D__CAMPAIGN_NAME__%26s2%3D__SID__%26s3%3D__GROUP_NAME__%26s4%3D__AD_ID__&host=lsel.pollsandpromotions.site&cookie_id=BA1.1.3071558474.1685653296&session_id=BA1.1.4013004096.1685653296&pixel_id=902760083831232256&ts=1685653309262&extra=%7B%22action%22%3A%22leave%22%2C%22type%22%3A1%2C%22wst%22%3A112%2C%22drt%22%3A1616%2C%22tdt%22%3A2292%2C%22lgt%22%3A15084%7D HTTP/1.1
Host: api.imotech.video
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://lsel.pollsandpromotions.site
DNT: 1
Connection: keep-alive
Referer: http://lsel.pollsandpromotions.site/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
TE: trailers

HTTP/2 200 OK
server: openresty/1.13.6.1
date: Thu, 01 Jun 2023 21:01:49 GMT
content-type: application/json
content-length: 104
bigotraceresponse: 00-5d93d9e91e237713a4fc319287ba413d-0-00
X-Firefox-Spdy: h2

stormtrk.com/api/1.0/ping/pong?location=http%3A%2F%2Flsel.pollsandpromotions.site%2Fc%2F4182ef8a9b09fd89%3Fcid%3D__SID__%26s1%3D__CAMPAIGN_NAME__%26s2%3D__SID__%26s3%3D__GROUP_NAME__%26s4%3D__AD_ID__

104.26.4.120

200 OK

343 B

URL GET HTTP/2
stormtrk.com/api/1.0/ping/pong?location=http%3A%2F%2Flsel.pollsandpromotions.site%2Fc%2F4182ef8a9b09fd89%3Fcid%3D__SID__%26s1%3D__CAMPAIGN_NAME__%26s2%3D__SID__%26s3%3D__GROUP_NAME__%26s4%3D__AD_ID__
IP
104.26.4.120:443
ASN
#13335 CLOUDFLARENET

Requested by
http://lsel.pollsandpromotions.site/c/4182ef8a9b09fd89?cid=__SID__&s1=__CAMPAIGN_NAME__&s2=__SID__&s3=__GROUP_NAME__&s4=__AD_ID__
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint12:CF:2B:DC:A1:B5:77:12:91:68:E8:DD:F0:22:9A:1B:06:84:6A:74
ValidityFri, 09 Dec 2022 00:00:00 GMT - Sat, 09 Dec 2023 23:59:59 GMT

File type
troff or preprocessor input, ASCII text, with very long lines (364), with no line terminators
Size
343 B (343 bytes)
Hash
5d3b3f469ee148312cb98a845ae4edc0
38bd04ac239a20a3a5563a0d48997d1956a37d56
b7d611423094756e45faa52c00de9ba004b68cb5635268491d4cfbef7a8cb4b8

HTTP Headers

GET /api/1.0/ping/pong?location=http%3A%2F%2Flsel.pollsandpromotions.site%2Fc%2F4182ef8a9b09fd89%3Fcid%3D__SID__%26s1%3D__CAMPAIGN_NAME__%26s2%3D__SID__%26s3%3D__GROUP_NAME__%26s4%3D__AD_ID__ HTTP/1.1
Host: stormtrk.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: http://lsel.pollsandpromotions.site
DNT: 1
Connection: keep-alive
Referer: http://lsel.pollsandpromotions.site/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Thu, 01 Jun 2023 21:01:37 GMT
content-type: application/json
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Content-Type, Access-Control-Allow-Headers, X-Requested-With
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T6XFLPw8gyy8CRwo6zMlbx6ordZzJjqweOvavXTPPmwGrMDLxmhu9X%2BmdHrj5P2rmbOnzpXWEuWd8jAxvpqIIcim%2BwLm3EQfsTi8GS%2BOEQHRpjrI5h1IUvnWvYk3uA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7d0a648ef945b51b-OSL
content-encoding: br
X-Firefox-Spdy: h2

Report Overview

Submitted URL

IP

ASN

Submitted

Access

Website Title

Final URL

Tags

urlquery detections

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

OpenPhish

PhishTank

Fortinet's Web Filter

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (10)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML