| goforrewards.info/RM/Nic1/?devicemodel=&browser=Chrome&ip=2600:1900:2000:9::a&bemobdata=c=e6849ad1-df14-446f-a872-b3b884c6a392..l=fdb85537-1e47-45e4-bd4b-e8a16e8d46a2..a=0..b=0..r=http://cn47e.bemobtrk.com | 104.26.14.73 | 301 Moved Permanently | 0 B |
URL HTTP/1.1goforrewards.info/RM/Nic1/?devicemodel=&browser=Chrome&ip=2600:1900:2000:9::a&bemobdata=c=e6849ad1-df14-446f-a872-b3b884c6a392..l=fdb85537-1e47-45e4-bd4b-e8a16e8d46a2..a=0..b=0..r=http://cn47e.bemobtrk.com IP104.26.14.73:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /RM/Nic1/?devicemodel=&browser=Chrome&ip=2600:1900:2000:9::a&bemobdata=c=e6849ad1-df14-446f-a872-b3b884c6a392..l=fdb85537-1e47-45e4-bd4b-e8a16e8d46a2..a=0..b=0..r=http://cn47e.bemobtrk.com HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 301 Moved Permanently
Date: Thu, 08 Dec 2022 23:27:21 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Fri, 09 Dec 2022 00:27:21 GMT
Location: https://goforrewards.info/RM/Nic1/?devicemodel=&browser=Chrome&ip=2600:1900:2000:9::a&bemobdata=c=e6849ad1-df14-446f-a872-b3b884c6a392..l=fdb85537-1e47-45e4-bd4b-e8a16e8d46a2..a=0..b=0..r=http://cn47e.bemobtrk.com
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FgY5fN2vcsJBOCAvsuu0DFyc2TC7U7z0U7CVo2ycBgEnJwXoWnapYsch%2FF0m04mwA%2FVRWWEc2vtv3%2BzI3bIbqAmzIBAVMnAOD62Oqkdhfb5cz9yFioSAvrDMseFZDWFdMfGf"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7769456e9fb3b51d-OSL
alt-svc: h2=":443"; ma=60
|
|
| r3.o.lencr.org/ | 95.101.11.115 | 200 OK | 503 B |
IP95.101.11.115:0 ASN#20940 Akamai International B.V.
Hashf2acd891dc6eb1f09f57a2b086791781 1e2088306501a61edcca1ade62c4d54f23b3b083 51148fed95cc00d60dc3640350f135b1b2763ff0e3cfbffc40f0948317894be9
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "51148FED95CC00D60DC3640350F135B1B2763FF0E3CFBFFC40F0948317894BE9"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11610
Expires: Fri, 09 Dec 2022 02:40:51 GMT
Date: Thu, 08 Dec 2022 23:27:21 GMT
Connection: keep-alive
|
|
| r3.o.lencr.org/ | 95.101.11.115 | 200 OK | 503 B |
IP95.101.11.115:0 ASN#20940 Akamai International B.V.
Hashaea93551fa9deb76ae49a3b4019d64fe e3b8862057ebe839959228e42246d7b1807fc90c 7e210f03b140418085e94ec20c1d27d6ecf7a404cbd323e16476ae5ae95d6dac
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "7E210F03B140418085E94EC20C1D27D6ECF7A404CBD323E16476AE5AE95D6DAC"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10500
Expires: Fri, 09 Dec 2022 02:22:21 GMT
Date: Thu, 08 Dec 2022 23:27:21 GMT
Connection: keep-alive
|
|
| r3.o.lencr.org/ | 95.101.11.115 | 200 OK | 503 B |
IP95.101.11.115:0 ASN#20940 Akamai International B.V.
Hash4ee537977be9c03702f8ffe0025bf1fe 21637881c4aa34c4add703f8bff4eff573159f45 4819229fd8f502a0c68c80bd7409e104c1b4d1a98ca8a6cd9deba629b1511aea
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "4819229FD8F502A0C68C80BD7409E104C1B4D1A98CA8A6CD9DEBA629B1511AEA"
Last-Modified: Thu, 08 Dec 2022 23:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=20900
Expires: Fri, 09 Dec 2022 05:15:41 GMT
Date: Thu, 08 Dec 2022 23:27:21 GMT
Connection: keep-alive
|
|
| firefox.settings.services.mozilla.com/v1/ | 35.241.9.150 | 200 OK | 939 B |
URL HTTP/2firefox.settings.services.mozilla.com/v1/ IP35.241.9.150:0
File typeJSON data\012- , ASCII text, with very long lines (939), with no line terminators Hash14cd9a0afb6ba9a763651d5112760d1e 75d7b104ab9ab11fbb73c3f348b43b0119b5adfa 4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Retry-After, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Thu, 08 Dec 2022 23:08:14 GMT
content-type: application/json
age: 1147
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain | 34.160.144.191 | 200 OK | 5.3 kB |
URL HTTP/2content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain IP34.160.144.191:0
File typePEM certificate\012- , ASCII text Hash53341dea33f4f3d9b4966f80589f429a 20f7b07c686c986d2ed1e3e9ad1bb2aef8edaf0d 651683e52cdbc96b289f8f123155f0b96d9f67432689e89156fa56f5a346c6a0
GET /chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: ZQupyCZPUuGm3jLetoUk/bo3WBIh6fxrq0DtCLiq5auc5wBrZ6NFDogefFhY7yejr52G2bf9wRE=
x-amz-request-id: MRBGD8B7DS00EV0Q
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Thu, 08 Dec 2022 22:48:05 GMT
age: 2356
last-modified: Wed, 30 Nov 2022 10:06:34 GMT
etag: "53341dea33f4f3d9b4966f80589f429a"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| e1.o.lencr.org/ | 23.36.76.226 | 200 OK | 345 B |
IP23.36.76.226:0 ASN#20940 Akamai International B.V.
Hashe68389e830849ba236e77718580b536d e4284d7b713d5ee77b5ee09e9dd413f016895259 dd739507477cd5d1df748c2333da0e4f86e9c1d21b95714ef4e77022673c6b1c
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 345
ETag: "DD739507477CD5D1DF748C2333DA0E4F86E9C1D21B95714EF4E77022673C6B1C"
Last-Modified: Wed, 07 Dec 2022 18:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=17725
Expires: Fri, 09 Dec 2022 04:22:46 GMT
Date: Thu, 08 Dec 2022 23:27:21 GMT
Connection: keep-alive
|
|
| contile.services.mozilla.com/v1/tiles | 34.117.237.239 | 200 OK | 12 B |
URL HTTP/2contile.services.mozilla.com/v1/tiles IP34.117.237.239:0
File typeJSON data\012- , ASCII text, with no line terminators Hash23e88fb7b99543fb33315b29b1fad9d6 a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Thu, 08 Dec 2022 23:27:21 GMT
content-type: application/json
content-length: 12
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-expose-headers: content-type
access-control-allow-credentials: true
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Nic1/img/lg.png | 172.67.75.176 | 200 OK | 8.1 kB |
URL HTTP/2goforrewards.info/RM/Nic1/img/lg.png IP172.67.75.176:0
File typePNG image data, 150 x 86, 8-bit/color RGBA, non-interlaced\012- data Hashf017eccfcdd3210f6feda46921bdc1d1 ec31a454a2aa99dfbd2475332404d6ffba3146fd 114bf95579317d33c3a07b5b92d3fedd2a24c7a6833a48f058e5ee5496555a5c
GET /RM/Nic1/img/lg.png HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Nic1/?devicemodel=&browser=Chrome&ip=2600:1900:2000:9::a&bemobdata=c=e6849ad1-df14-446f-a872-b3b884c6a392..l=fdb85537-1e47-45e4-bd4b-e8a16e8d46a2..a=0..b=0..r=http://cn47e.bemobtrk.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 23:27:21 GMT
content-type: image/png
content-length: 8131
last-modified: Wed, 07 Dec 2022 00:35:07 GMT
etag: "638fdfbb-1fc3"
expires: Sat, 07 Jan 2023 23:27:21 GMT
cache-control: max-age=2592000
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AQW43I%2F0lKOQEK5LAn8d561MM0MAXOgtRBu3%2BmSyuSUj8eAieiDmluTYdLVVcloV1GHQNvkLHPKejAhWlhG4q%2B9hQ1uTk1ElwRuL64kuRooxmF5gXrLtVvXT9d52mSrhLA%2FA"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77694571787fb4f1-OSL
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Nic1/img/flag.png | 172.67.75.176 | 200 OK | 6.1 kB |
URL HTTP/2goforrewards.info/RM/Nic1/img/flag.png IP172.67.75.176:0
File typePNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced\012- data Hashc1676d668a3843e5c593b26aa8350fd1 d2f36ec42c6093a751a48dbdd0761ccf0940db5e 5fa91b2cd1f0ead1295321b482ce93a92bab92f28c4cdde2b88330cb8d23eb00
GET /RM/Nic1/img/flag.png HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Nic1/?devicemodel=&browser=Chrome&ip=2600:1900:2000:9::a&bemobdata=c=e6849ad1-df14-446f-a872-b3b884c6a392..l=fdb85537-1e47-45e4-bd4b-e8a16e8d46a2..a=0..b=0..r=http://cn47e.bemobtrk.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 23:27:21 GMT
content-type: image/png
content-length: 6145
last-modified: Wed, 07 Dec 2022 00:35:05 GMT
etag: "638fdfb9-1801"
expires: Sat, 07 Jan 2023 23:27:21 GMT
cache-control: max-age=2592000
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dgw4jQrBdZ79MWq%2FXiXno18y7YsmuesQHUUiae8dxkfPKsdLe1xzyGmGSisF7O2FcxYb8ek2j%2Fwp1cIk%2BuFdQrHftOUAgqEzwxfrzynh6aLHnI6iljCMM3jyDi8mYXpVGIkM"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 776945717888b4f1-OSL
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Nic1/img/logo.png | 172.67.75.176 | 200 OK | 8.6 kB |
URL HTTP/2goforrewards.info/RM/Nic1/img/logo.png IP172.67.75.176:0
File typePNG image data, 100 x 100, 8-bit/color RGBA, non-interlaced\012- data Hash3c71bd8854002e7068446e87debe8cb9 e0c13422c287364d965ed3f4ea904faa8334dc50 d64d7f46e8154cd56f9b2030560c2e79dadfac47b4a6b16ffc837078d50ce308
GET /RM/Nic1/img/logo.png HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Nic1/?devicemodel=&browser=Chrome&ip=2600:1900:2000:9::a&bemobdata=c=e6849ad1-df14-446f-a872-b3b884c6a392..l=fdb85537-1e47-45e4-bd4b-e8a16e8d46a2..a=0..b=0..r=http://cn47e.bemobtrk.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 23:27:21 GMT
content-type: image/png
content-length: 8571
last-modified: Wed, 07 Dec 2022 00:35:08 GMT
etag: "638fdfbc-217b"
expires: Sat, 07 Jan 2023 23:27:21 GMT
cache-control: max-age=2592000
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dbs1Jc%2FZoV%2Fcj3YJ1GaQxv6i8HYY7Eg5srjqqUaP%2BNv%2FL8BWmIz6fYHBck%2FI433c1qfUVpigk0OuidHzTsGFbag%2BUgxL9bagKiMErkIF3BFa5S6KLYgvfbSXFJQk7FxlwII8"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77694571789bb4f1-OSL
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Nic1/js/script.js.download | 172.67.75.176 | 200 OK | 4.0 kB |
URL HTTP/2goforrewards.info/RM/Nic1/js/script.js.download IP172.67.75.176:0
Hashaf7eb0685a2dc74d072e84d50f39738f e8dac0046b0fa00c655ef2b05a292e984d128457 424adf851ef0f98ea1b88589953e95aa27c5cdb746288371b63e253265cc233d
Analyzer | Verdict | Alert | fortinet | Phishing | |
GET /RM/Nic1/js/script.js.download HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Nic1/?devicemodel=&browser=Chrome&ip=2600:1900:2000:9::a&bemobdata=c=e6849ad1-df14-446f-a872-b3b884c6a392..l=fdb85537-1e47-45e4-bd4b-e8a16e8d46a2..a=0..b=0..r=http://cn47e.bemobtrk.com
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 23:27:21 GMT
content-type: application/octet-stream
content-length: 3977
last-modified: Wed, 07 Dec 2022 00:35:18 GMT
etag: "638fdfc6-f89"
accept-ranges: bytes
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=V2LQySn4nbnEfr%2BH8VG%2BMknW8054dQ%2F9IzSqwM0MnpyVx3HAGxucQPZCjD3eK7Cl7xzXeIn1tRObKgLiAnzI83IxO6%2FM9tyVrdwnoO2kpymwJxaKcUs6GV31xoZfuHcGDGUw"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7769457188a0b4f1-OSL
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Nic1/js/confetti.js.download | 172.67.75.176 | 200 OK | 5.7 kB |
URL HTTP/2goforrewards.info/RM/Nic1/js/confetti.js.download IP172.67.75.176:0
Hash0bf680ed10be0fc040015e7e735a4ae3 d02ea58f56584cb59cd2f7799822283032a666ee f79f02e3e9615682a3fa00c2aee52f2cea0656407ef311f5a0367dccd06186d9
Analyzer | Verdict | Alert | fortinet | Phishing | |
GET /RM/Nic1/js/confetti.js.download HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Nic1/?devicemodel=&browser=Chrome&ip=2600:1900:2000:9::a&bemobdata=c=e6849ad1-df14-446f-a872-b3b884c6a392..l=fdb85537-1e47-45e4-bd4b-e8a16e8d46a2..a=0..b=0..r=http://cn47e.bemobtrk.com
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 23:27:21 GMT
content-type: application/octet-stream
content-length: 5735
last-modified: Wed, 07 Dec 2022 00:35:17 GMT
etag: "638fdfc5-1667"
accept-ranges: bytes
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EF5MXvfG2PZAk6%2FsFOXdyg8dTYwn9htwI1jlR4H57UdF39LtE%2F6AnqpG75ir2N9KPaEZ4OtpvX5eVpmqHKXCsrgy1LBvL9Qn7Mm59%2FpEp5F%2FUKJrqnQpAGa%2FoQR33jp%2Bx6Jy"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7769457188a3b4f1-OSL
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Nic1/js/jquery.min.js.download | 172.67.75.176 | 200 OK | 84 kB |
URL HTTP/2goforrewards.info/RM/Nic1/js/jquery.min.js.download IP172.67.75.176:0
File typeASCII text, with very long lines (32025) Hash4a356126b9573eb7bd1e9a7494737410 8258d046f17dd3c15a5d3984e1868b7b5d1db329 22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5
Analyzer | Verdict | Alert | fortinet | Phishing | |
GET /RM/Nic1/js/jquery.min.js.download HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Nic1/?devicemodel=&browser=Chrome&ip=2600:1900:2000:9::a&bemobdata=c=e6849ad1-df14-446f-a872-b3b884c6a392..l=fdb85537-1e47-45e4-bd4b-e8a16e8d46a2..a=0..b=0..r=http://cn47e.bemobtrk.com
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 23:27:21 GMT
content-type: application/octet-stream
content-length: 84380
last-modified: Wed, 07 Dec 2022 00:35:20 GMT
etag: "638fdfc8-1499c"
accept-ranges: bytes
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HQb4Ug%2B408pgRZW6A92oDTZlZK9%2BlKhYAMpM%2BXk3hiaKm0O4CB92UYSPdeTfurfqS3VXCQvzcgTIEDKEAHL3BkYBi%2BjKFiDd%2FY7yz4kYdlZ6KC2cUsSAkPLW1jADU%2BNG1e%2Fr"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77694571789cb4f1-OSL
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Nic1/img/prof3.jpg | 172.67.75.176 | 200 OK | 26 kB |
URL HTTP/2goforrewards.info/RM/Nic1/img/prof3.jpg IP172.67.75.176:0
File typeJPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=540, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=331], progressive, precision 8, 72x117, components 3\012- data Hashdb0ebf00c020021e19f0fd8ab93f1541 beddd7252f31169454c4afd138b742512435fb0c 937cbfbfad74c29b3eae2ba5712c3bd567abdfb11ab693a81b6c8ac819819ba2
GET /RM/Nic1/img/prof3.jpg HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Nic1/?devicemodel=&browser=Chrome&ip=2600:1900:2000:9::a&bemobdata=c=e6849ad1-df14-446f-a872-b3b884c6a392..l=fdb85537-1e47-45e4-bd4b-e8a16e8d46a2..a=0..b=0..r=http://cn47e.bemobtrk.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 23:27:21 GMT
content-type: image/jpeg
content-length: 25910
last-modified: Wed, 07 Dec 2022 00:35:11 GMT
etag: "638fdfbf-6536"
expires: Sat, 07 Jan 2023 23:27:21 GMT
cache-control: max-age=2592000
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TfuUZiSV%2BTA5Oo8UFe2LWe%2BM8PkchLfnGuY9TQSZx%2BhVJYyEAxl0KSJrYxY88%2F%2Bg%2F1V1LbqVOCYR5%2Fw1bCXWA7Iih9I1Cybq8tUpjz%2FonKdV%2FJ4l%2FsHuuqYe5GSdp8Kawhg9"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 776945717894b4f1-OSL
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Nic1/img/5555.jpg | 172.67.75.176 | 200 OK | 35 kB |
URL HTTP/2goforrewards.info/RM/Nic1/img/5555.jpg IP172.67.75.176:0
File typeJPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2021:09:21 17:53:11], baseline, precision 8, 300x142, components 3\012- data Hash2a37af22aa3e3a9ef4d3f970596e7845 7f89ebb1eec9ae33b1f0af1e2eb3a96132fddc42 6e98c90a1a4dcc1fe70627bf450b409df634c91c7448597f460c3c24502bdfad
GET /RM/Nic1/img/5555.jpg HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Nic1/?devicemodel=&browser=Chrome&ip=2600:1900:2000:9::a&bemobdata=c=e6849ad1-df14-446f-a872-b3b884c6a392..l=fdb85537-1e47-45e4-bd4b-e8a16e8d46a2..a=0..b=0..r=http://cn47e.bemobtrk.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 23:27:21 GMT
content-type: image/jpeg
content-length: 34648
last-modified: Wed, 07 Dec 2022 00:35:02 GMT
etag: "638fdfb6-8758"
expires: Sat, 07 Jan 2023 23:27:21 GMT
cache-control: max-age=2592000
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=W4q1RI5ZobKUmm%2FAXyrACv1A1uKrGcJjAhJKSA4d%2FiCKT74j%2BHCKs2Od%2BSA%2FXtK%2BFKtdoprTkjQJ%2FULzE%2BWbwJRVh961dYrvgArWT8mvFsXaUyON0wAQbcAORdlnGe%2Ft%2BRgR"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77694571788ab4f1-OSL
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Nic1/img/prof2.jpg | 172.67.75.176 | 200 OK | 37 kB |
URL HTTP/2goforrewards.info/RM/Nic1/img/prof2.jpg IP172.67.75.176:0
File typeJPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=2731, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=4096], progressive, precision 8, 144x96, components 3\012- data Hash8a7f53ff28c5bd5bc132976838974399 6d9b44201df5d85365b6acfdcd243f0d58001352 6cf856d9b2782dae6ebf43c8424258731c2bca717b82310a97811ac54adeb207
GET /RM/Nic1/img/prof2.jpg HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Nic1/?devicemodel=&browser=Chrome&ip=2600:1900:2000:9::a&bemobdata=c=e6849ad1-df14-446f-a872-b3b884c6a392..l=fdb85537-1e47-45e4-bd4b-e8a16e8d46a2..a=0..b=0..r=http://cn47e.bemobtrk.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 23:27:21 GMT
content-type: image/jpeg
content-length: 36854
last-modified: Wed, 07 Dec 2022 00:35:10 GMT
etag: "638fdfbe-8ff6"
expires: Sat, 07 Jan 2023 23:27:21 GMT
cache-control: max-age=2592000
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yI3lThzOMgaj9JiWab31Gx2INn6LYh%2BsB8b5%2B0AhOB9zhGuslEnn8F8ARgMs29DcAGcF42dA1XqfXufY4zrU2TCw1hPuZiuFhoZwPzJjdyiX0sTLjQqOFdKva2YDDar4d5d%2F"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 776945717893b4f1-OSL
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Nic1/img/chk2.jpg | 172.67.75.176 | 200 OK | 35 kB |
URL HTTP/2goforrewards.info/RM/Nic1/img/chk2.jpg IP172.67.75.176:0
File typeJPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2021:09:21 17:53:11], baseline, precision 8, 300x142, components 3\012- data Hashdb2b1e7ba1d7ab13e3770d7c0abfc4e7 c6cfa5b0ab6a778835644fea934b71c4e82a187c 26c73e58f2750f088196f242757d01cdd48dedbfea61b1a0ce487f580fd88b7d
GET /RM/Nic1/img/chk2.jpg HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Nic1/?devicemodel=&browser=Chrome&ip=2600:1900:2000:9::a&bemobdata=c=e6849ad1-df14-446f-a872-b3b884c6a392..l=fdb85537-1e47-45e4-bd4b-e8a16e8d46a2..a=0..b=0..r=http://cn47e.bemobtrk.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 23:27:21 GMT
content-type: image/jpeg
content-length: 35295
last-modified: Wed, 07 Dec 2022 00:35:03 GMT
etag: "638fdfb7-89df"
expires: Sat, 07 Jan 2023 23:27:21 GMT
cache-control: max-age=2592000
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wMIQhPxnXYoTwzc0o8rpOp9ur%2FFLkKu7RjOepR2lowWmplRPb2VTO6Rbc14GOWR2eYwaFN2HzTtvSrBzY1gRxK7h0u46FSrSYBKsCzvUO8pIkof6i8frzqMmuz%2BrSpCFW1lG"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77694571789ab4f1-OSL
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Nic1/img/prof5.jpg | 172.67.75.176 | 200 OK | 32 kB |
URL HTTP/2goforrewards.info/RM/Nic1/img/prof5.jpg IP172.67.75.176:0
File typeJPEG image data, Exif standard: [TIFF image data, big-endian, direntries=14, height=1336, bps=0, PhotometricIntepretation=RGB, manufacturer=SONY, model=ILCE-7S, orientation=upper-left, width=2000], progressive, precision 8, 120x80, components 3\012- data Hashf54990076c17440eb1f94a43f8940ccb 65b6d223e7ad2bb66180aa5481eade8a845c6ec9 1c1a62b2ca2967cf7eea0a06ab3c0ab1254e215afce1f70c0e104352cce097ee
GET /RM/Nic1/img/prof5.jpg HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Nic1/?devicemodel=&browser=Chrome&ip=2600:1900:2000:9::a&bemobdata=c=e6849ad1-df14-446f-a872-b3b884c6a392..l=fdb85537-1e47-45e4-bd4b-e8a16e8d46a2..a=0..b=0..r=http://cn47e.bemobtrk.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 23:27:21 GMT
content-type: image/jpeg
content-length: 32529
last-modified: Wed, 07 Dec 2022 00:35:13 GMT
etag: "638fdfc1-7f11"
expires: Sat, 07 Jan 2023 23:27:21 GMT
cache-control: max-age=2592000
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OI1yAjmkwYEfvpxSTSWMqjs45khDRtmf%2B5NrlAHfHe%2BUnEl%2FNFQjFRXLNR09tisH0B%2FxPR0G2xhp9LXXquTdQL4bIGIsEUEEXn5l%2F8vMdxZBgJfqoFBp%2FgDK8xkUawHLTg8k"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 776945717898b4f1-OSL
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Nic1/img/prof1.jpg | 172.67.75.176 | 200 OK | 51 kB |
URL HTTP/2goforrewards.info/RM/Nic1/img/prof1.jpg IP172.67.75.176:0
File typeJPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=900, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=599], progressive, precision 8, 150x225, components 3\012- data Hashb12ef6b3f1b8b39ad5481b332e0e2511 77611e19ebf164c0d83792766db5976b7f4c2525 1071192abcf23b5a822f4094e636a1cbe0b8f78a1115c2ab50b806e79c2d0ef1
GET /RM/Nic1/img/prof1.jpg HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Nic1/?devicemodel=&browser=Chrome&ip=2600:1900:2000:9::a&bemobdata=c=e6849ad1-df14-446f-a872-b3b884c6a392..l=fdb85537-1e47-45e4-bd4b-e8a16e8d46a2..a=0..b=0..r=http://cn47e.bemobtrk.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 23:27:21 GMT
content-type: image/jpeg
content-length: 50826
last-modified: Wed, 07 Dec 2022 00:35:10 GMT
etag: "638fdfbe-c68a"
expires: Sat, 07 Jan 2023 23:27:21 GMT
cache-control: max-age=2592000
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QTLTW7VxIISFQ0Bzy0Fc5B4F8BPHDK4y9UGci%2BaUqYDNeUtyKcZ25kXLuRXH6kR7B%2BJ0S3FBQ21BLqT5QL70djng3eRNC%2BjhswvWP4VVCp44piQBhtzKW%2FB3KKzKNwUidxTf"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77694571788bb4f1-OSL
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Nic1/img/image1.png | 172.67.75.176 | 200 OK | 62 kB |
URL HTTP/2goforrewards.info/RM/Nic1/img/image1.png IP172.67.75.176:0
File typePNG image data, 448 x 327, 8-bit/color RGBA, non-interlaced\012- data Hashe25f7aebf7e597a837e148b2bc003936 61312c64feda9f661a23739db34963c203af4a23 68ec2b166673112e7abc948fae17dbf5acdaaa73e07fe8d3630872d5b7d7c41b
GET /RM/Nic1/img/image1.png HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Nic1/?devicemodel=&browser=Chrome&ip=2600:1900:2000:9::a&bemobdata=c=e6849ad1-df14-446f-a872-b3b884c6a392..l=fdb85537-1e47-45e4-bd4b-e8a16e8d46a2..a=0..b=0..r=http://cn47e.bemobtrk.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 23:27:21 GMT
content-type: image/png
content-length: 61592
last-modified: Wed, 07 Dec 2022 00:35:05 GMT
etag: "638fdfb9-f098"
expires: Sat, 07 Jan 2023 23:27:21 GMT
cache-control: max-age=2592000
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=84uvtOskoYDismw9gB8jGiVGPo%2FDqjOF0cpVRw0p81%2FKOLpSecmWMEps%2Ftm2vXBUhewP5yrwkpGw8SdzFbrkOdZllkKeow5244%2F9N%2B5Oi1fxxjwIz%2FVwV2EUvFA3pToqmQOI"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 776945717885b4f1-OSL
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Nic1/img/prof4.jpg | 172.67.75.176 | 200 OK | 57 kB |
URL HTTP/2goforrewards.info/RM/Nic1/img/prof4.jpg IP172.67.75.176:0
File typeJPEG image data, Exif standard: [TIFF image data, little-endian, direntries=14, height=612, bps=182, PhotometricIntepretation=RGB, description=mayan lady in traditional outfit in Panajachel, Guatemala, orientation=upper-left, width=408], progressive, precision 8, 150x225, components 3\012- data Hash08ecabacf64b78968865fd9b6403c1c0 7c6ae87557514b8b35d79d395fca10e1123fd330 a27dd4c464e74916587a9eed7f6b0cca4382c077e1cdd3ef8ebb2ed0436abb68
GET /RM/Nic1/img/prof4.jpg HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Nic1/?devicemodel=&browser=Chrome&ip=2600:1900:2000:9::a&bemobdata=c=e6849ad1-df14-446f-a872-b3b884c6a392..l=fdb85537-1e47-45e4-bd4b-e8a16e8d46a2..a=0..b=0..r=http://cn47e.bemobtrk.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 23:27:21 GMT
content-type: image/jpeg
content-length: 57329
last-modified: Wed, 07 Dec 2022 00:35:12 GMT
etag: "638fdfc0-dff1"
expires: Sat, 07 Jan 2023 23:27:21 GMT
cache-control: max-age=2592000
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HCmsWT3jo2Mi2DgD46ARpNuSatlrsCUItvoFaAwGcNljhs1tElJur3nqbT7Nfxf4r3Qah9%2FyFkB8yOaZ5gmmVAJPZ1yswpueVFxFGaR0mnws%2B1sp7nXHmOVdE82mwsPRb0lk"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 776945717895b4f1-OSL
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Nic1/img/ld.gif | 172.67.75.176 | 200 OK | 122 kB |
URL HTTP/2goforrewards.info/RM/Nic1/img/ld.gif IP172.67.75.176:0
File typeGIF image data, version 89a, 246 x 246\012- data Size122 kB (121587 bytes) Hash1f32223b3bcbe23d6efe15d914206440 1faa0c1e65002ca3880cb764be63abef5a3efac5 c0f27622e1c77dfe225b6e2637211c61861471c39e585461a5dc55017950e92a
GET /RM/Nic1/img/ld.gif HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Nic1/?devicemodel=&browser=Chrome&ip=2600:1900:2000:9::a&bemobdata=c=e6849ad1-df14-446f-a872-b3b884c6a392..l=fdb85537-1e47-45e4-bd4b-e8a16e8d46a2..a=0..b=0..r=http://cn47e.bemobtrk.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 23:27:21 GMT
content-type: image/gif
content-length: 121587
last-modified: Wed, 07 Dec 2022 00:35:08 GMT
etag: "638fdfbc-1daf3"
expires: Sat, 07 Jan 2023 23:27:21 GMT
cache-control: max-age=2592000
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1v8cfwuyRNQEyAij%2BUAMY43RfpG5gsL1n6x%2BLWmMJRddFftayB%2F6mowO37iVypWRU%2Be3YuFkrewHjaH9%2FJMNni8wdXzoIvTHuT1BBFoGjtIMHQDn6b2Uic%2FkAgjIf6Wn5XrX"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 776945717889b4f1-OSL
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Nic1/css/style.css | 172.67.75.176 | 200 OK | 1.7 kB |
URL HTTP/2goforrewards.info/RM/Nic1/css/style.css IP172.67.75.176:0
File typeASCII text, with very long lines (768) Hashdc05f20113bf2917590e15c57c9f8906 2acf86b030f4c152c10d6966d85b7ec80c98b16c 0aded7c234f6dfcde2754783e58670601c84ad67a84e437063972afab976f87e
GET /RM/Nic1/css/style.css HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Nic1/?devicemodel=&browser=Chrome&ip=2600:1900:2000:9::a&bemobdata=c=e6849ad1-df14-446f-a872-b3b884c6a392..l=fdb85537-1e47-45e4-bd4b-e8a16e8d46a2..a=0..b=0..r=http://cn47e.bemobtrk.com
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 23:27:21 GMT
content-type: text/css
last-modified: Wed, 07 Dec 2022 00:34:57 GMT
etag: W/"638fdfb1-e3a"
expires: Sat, 07 Jan 2023 23:27:21 GMT
cache-control: max-age=2592000
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EGK%2FNm5w5VPmD%2FTsLwq2WjViltIjfNkatm%2FN2aErk%2Bk10wTAwlMu2R8jKDYxzApZ79v1sqzDWM21lt6HK4kslUMhbQUWvYl6CFj2DX6EeutAJdTK9j3zZdBiK0wNZJBfwHay"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 776945716877b4f1-OSL
content-encoding: br
X-Firefox-Spdy: h2
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.131 | 200 OK | 472 B |
IP142.250.74.131:0
Hashd61883097c47c0fcb4a15cafc5bdbdfc 54411aba43093cafd1cb2acea7c2b4c69184611f 0aef2b974544f530bd591dd0201909a9c2a6b3f4451c69288bafc126d9a37e2c
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 23:27:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.131 | 200 OK | 472 B |
IP142.250.74.131:0
Hashd61883097c47c0fcb4a15cafc5bdbdfc 54411aba43093cafd1cb2acea7c2b4c69184611f 0aef2b974544f530bd591dd0201909a9c2a6b3f4451c69288bafc126d9a37e2c
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 23:27:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| goforrewards.info/RM/Nic1/img/bg.jpg | 172.67.75.176 | 200 OK | 1.6 kB |
URL HTTP/2goforrewards.info/RM/Nic1/img/bg.jpg IP172.67.75.176:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1200x600, components 1\012- data Hash206202671b45d7642a72239b49b6d0e6 99d2cb7283e517039bd449d800b00737001a25bb 09c0abff830556a0fde331d383b3652703318e272db1646ffe3d0d37ce414937
GET /RM/Nic1/img/bg.jpg HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Nic1/css/style.css
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 23:27:22 GMT
content-type: image/jpeg
content-length: 1579
last-modified: Wed, 07 Dec 2022 00:35:02 GMT
etag: "638fdfb6-62b"
expires: Sat, 07 Jan 2023 23:27:22 GMT
cache-control: max-age=2592000
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pgIZNTkBO675WZqHskcjlFBwq3tH1T7sOzI2njpkSkpuNgP6oxzVzfYHiJH%2BrfABHNd0E3sVJM%2BCyBTCT2nPZDPg8MPnkf5v1IMWPraghd%2BFA6C0eBVcWNsrVeGJ3iE41igd"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 776945732a83b4f1-OSL
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Nic1/new/jquery.min.js.download | 172.67.75.176 | 404 Not Found | 575 B |
URL HTTP/2goforrewards.info/RM/Nic1/new/jquery.min.js.download IP172.67.75.176:0
File typeHTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators Hash1cecc1baa40e7fde92d5f03bbcdec7ec f0ae82da96f252a0882df0de0eb43b6d9c5ce15c a116248973e2c7324439d08a47de36c68e279ca9c6ba4c0aaa50f80ab9c9ad36
Analyzer | Verdict | Alert | fortinet | Phishing | |
GET /RM/Nic1/new/jquery.min.js.download HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Nic1/?devicemodel=&browser=Chrome&ip=2600:1900:2000:9::a&bemobdata=c=e6849ad1-df14-446f-a872-b3b884c6a392..l=fdb85537-1e47-45e4-bd4b-e8a16e8d46a2..a=0..b=0..r=http://cn47e.bemobtrk.com
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
date: Thu, 08 Dec 2022 23:27:22 GMT
content-type: text/html
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YUJ7bLqBFnggCeFgcDO33d4arEvbgBpuKvdq6zWeeEFNJmCng1S1nPdydgvri2WSQWixZn41w4OoaFK3sKLUEnUD3jJKAwAvSYA8N%2Fne4JvbD25ukmvC%2BPZiSWTVfjO862Nb"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 776945734aadb4f1-OSL
content-encoding: br
X-Firefox-Spdy: h2
|
|
| fonts.gstatic.com/s/changa/v20/2-c79JNi2YuVOUcOarRPgnNGooxCZ62xcjfj9w.woff2 | 142.250.74.35 | 200 OK | 9.1 kB |
URL HTTP/2fonts.gstatic.com/s/changa/v20/2-c79JNi2YuVOUcOarRPgnNGooxCZ62xcjfj9w.woff2 IP142.250.74.35:0
File typeWeb Open Font Format (Version 2), TrueType, length 9120, version 1.0\012- data Hash18ad880aaa4e28b6cd1ef0d30ac95573 da6a33a1ecc296aa481432e2727b273140b78543 f2c5710634752d1a156adf5ac961c8400e3a577c90f97a6a293a07f4a28957fd
GET /s/changa/v20/2-c79JNi2YuVOUcOarRPgnNGooxCZ62xcjfj9w.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://goforrewards.info
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 9120
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 08 Dec 2022 05:51:30 GMT
expires: Fri, 08 Dec 2023 05:51:30 GMT
cache-control: public, max-age=31536000
age: 63352
last-modified: Fri, 24 Jun 2022 18:40:48 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.131 | 200 OK | 472 B |
IP142.250.74.131:0
Hash0e9eef4ed41ef94e9ea175ad243e294e b6f83e508270413dabe55e2884b5409ca7978e24 0e741ca8d92717128bca7aed937bca43519a8d20a9d3dd8670da656ad51a695e
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 23:27:22 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US | 35.241.9.150 | 200 OK | 329 B |
URL HTTP/2firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US IP35.241.9.150:0
File typeJSON data\012- , ASCII text, with very long lines (329), with no line terminators Hash0333b0655111aa68de771adfcc4db243 63f295a144ac87a7c8e23417626724eeca68a7eb 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Pragma, Last-Modified, ETag, Alert, Expires, Retry-After, Cache-Control, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Thu, 08 Dec 2022 23:07:55 GMT
age: 1167
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| r3.o.lencr.org/ | 95.101.11.115 | 200 OK | 503 B |
IP95.101.11.115:0 ASN#20940 Akamai International B.V.
Hash1f51184f20d509df5914fd5a8df04a79 54014107467f2a3fc295e98e88a1231a0b0ac2a3 f368459b95943f2f01b40a7c7999fc7a6755f72da795c68c3736e78fac62b108
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "F368459B95943F2F01B40A7C7999FC7A6755F72DA795C68C3736E78FAC62B108"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=2320
Expires: Fri, 09 Dec 2022 00:06:02 GMT
Date: Thu, 08 Dec 2022 23:27:22 GMT
Connection: keep-alive
|
|
| ocsp.digicert.com/ | 93.184.220.29 | 200 OK | 471 B |
IP93.184.220.29:0
Hashfd55f4aaaab6ec40bc7dc10252cd819a a72523f60be265a391fa9edc43e0a93418ad1fd0 bae354b3db14f4fd115311a0c412c9b5e436dd9e0a151afd8b9c18831dd8c2dd
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 897
Cache-Control: max-age=122067
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 23:27:22 GMT
Etag: "6391a92c-1d7"
Expires: Sat, 10 Dec 2022 09:21:49 GMT
Last-Modified: Thu, 08 Dec 2022 09:06:52 GMT
Server: ECS (ska/F716)
X-Cache: HIT
Content-Length: 471
|
|
| push.services.mozilla.com/ | 54.70.68.230 | 101 Switching Protocols | 0 B |
URL HTTP/1.1push.services.mozilla.com/ IP54.70.68.230:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: IWc9fyb/yeWwgASILhmOCw==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: tU1jsaLBaBMPlIOCWNRgv9LFwaM=
|
|
| r3.o.lencr.org/ | 95.101.11.115 | 200 OK | 503 B |
IP95.101.11.115:0 ASN#20940 Akamai International B.V.
Hash48c90992f0837a58e0a36118a27dae6a 3d238fed35e6d247bddbba92864e6b92e6aed9b6 cacc53ed285e96dcd5ba7609823922a253bc0623999b8716f430632d2c0e7dac
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "CACC53ED285E96DCD5BA7609823922A253BC0623999B8716F430632D2C0E7DAC"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10999
Expires: Fri, 09 Dec 2022 02:30:42 GMT
Date: Thu, 08 Dec 2022 23:27:23 GMT
Connection: keep-alive
|
|
| r3.o.lencr.org/ | 95.101.11.115 | 200 OK | 503 B |
IP95.101.11.115:0 ASN#20940 Akamai International B.V.
Hash48c90992f0837a58e0a36118a27dae6a 3d238fed35e6d247bddbba92864e6b92e6aed9b6 cacc53ed285e96dcd5ba7609823922a253bc0623999b8716f430632d2c0e7dac
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "CACC53ED285E96DCD5BA7609823922A253BC0623999B8716F430632D2C0E7DAC"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10999
Expires: Fri, 09 Dec 2022 02:30:42 GMT
Date: Thu, 08 Dec 2022 23:27:23 GMT
Connection: keep-alive
|
|
| r3.o.lencr.org/ | 95.101.11.115 | 200 OK | 503 B |
IP95.101.11.115:0 ASN#20940 Akamai International B.V.
Hash48c90992f0837a58e0a36118a27dae6a 3d238fed35e6d247bddbba92864e6b92e6aed9b6 cacc53ed285e96dcd5ba7609823922a253bc0623999b8716f430632d2c0e7dac
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "CACC53ED285E96DCD5BA7609823922A253BC0623999B8716F430632D2C0E7DAC"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10999
Expires: Fri, 09 Dec 2022 02:30:42 GMT
Date: Thu, 08 Dec 2022 23:27:23 GMT
Connection: keep-alive
|
|
| goforrewards.info/RM/Nic1/img/chk1.jpg | 172.67.75.176 | 200 OK | 11 kB |
URL HTTP/2goforrewards.info/RM/Nic1/img/chk1.jpg IP172.67.75.176:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Hash8d1605154a552a8c3165c1358ea2e185 2e677da1f57c112d984180ead80481e8797ff2e8 12b075ad3e786dc68ab3fab1e4ce9d6f7810bdebc7bdafd993e19bc5bc7c0abc
GET /RM/Nic1/img/chk1.jpg HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Nic1/?devicemodel=&browser=Chrome&ip=2600:1900:2000:9::a&bemobdata=c=e6849ad1-df14-446f-a872-b3b884c6a392..l=fdb85537-1e47-45e4-bd4b-e8a16e8d46a2..a=0..b=0..r=http://cn47e.bemobtrk.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 23:27:21 GMT
content-type: image/jpeg
content-length: 35492
last-modified: Wed, 07 Dec 2022 00:35:03 GMT
etag: "638fdfb7-8aa4"
expires: Sat, 07 Jan 2023 23:27:21 GMT
cache-control: max-age=2592000
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qbPkbW24pLUK6K30MxRuKszmVfWYCYEbN31icP%2BoVZMMBX8MEDzRc8AOd8m%2FS9vTpI5W726lRviaJCiRZKCZI3MTZ9IUO2EVj1vC5eUJubpTGc76v5z1xj%2FMknyOSYwy0uLx"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77694571788cb4f1-OSL
X-Firefox-Spdy: h2
|
|
| img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb8ff35a0-24dc-4158-b67e-a5f03f5a9022.jpeg | 34.120.237.76 | 200 OK | 1.6 kB |
URL HTTP/2img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb8ff35a0-24dc-4158-b67e-a5f03f5a9022.jpeg IP34.120.237.76:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Hash4f6cfc43170be4dd0264f2b0b6bcc329 9ad22ea868f3b72832243fd11315c68117c7542b f5cc67d46241c2f5aebc2515bf8828889f8ceda8112b78cdf925a260b82fd833
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fb8ff35a0-24dc-4158-b67e-a5f03f5a9022.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 1584
x-amzn-requestid: 7743c8a6-118c-4c69-b833-a9e2f5561a54
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cw5VEGV8IAMFcOQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63903c20-41fdf6d004b388f51fa70833;Sampled=0
x-amzn-remapped-date: Wed, 07 Dec 2022 07:09:20 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: whmRQYshKD6d2Pz3Z0ZCCFr_MEPR1rEek7nVZqf5XeiWpt1LIcjvBQ==
via: 1.1 8dbfaf7df256a75768461d934659b6b2.cloudfront.net (CloudFront), 1.1 1a53057db389e96b4ef1bfbc925dde1c.cloudfront.net (CloudFront), 1.1 google
date: Thu, 08 Dec 2022 07:34:55 GMT
age: 57149
etag: "9ad22ea868f3b72832243fd11315c68117c7542b"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| psothoms.com/pfe/current/micro.tag.min.js?z=5579263&sw=/sw-check-permissions-41f6b.js | 139.45.197.251 | 200 OK | 22 kB |
URL HTTP/2psothoms.com/pfe/current/micro.tag.min.js?z=5579263&sw=/sw-check-permissions-41f6b.js IP139.45.197.251:0
Hashf459b1a5a036344b2e246d39ba91b6b0 6f1c7c0eb69a4c5bcdcbd5d42a4afd728d73feda 3b1667a6072afaef610a1a9509cf8d4dcd72c997b531d9386014f5bb4dada9ad
Analyzer | Verdict | Alert | quad9 | Sinkholed | |
GET /pfe/current/micro.tag.min.js?z=5579263&sw=/sw-check-permissions-41f6b.js HTTP/1.1
Host: psothoms.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Thu, 08 Dec 2022 23:27:22 GMT
content-type: application/javascript
last-modified: Thu, 01 Dec 2022 15:42:47 GMT
etag: W/"6388cb77-9a87"
access-control-allow-credentials: true
cache-control: no-cache
pragma: no-cache
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F042317d8-45b6-4c5f-8767-ff9367c24193.jpeg | 34.120.237.76 | 200 OK | 8.8 kB |
URL HTTP/2img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F042317d8-45b6-4c5f-8767-ff9367c24193.jpeg IP34.120.237.76:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Hash46275ec87d8221804dbb99f95b035131 c47af4e5770daad212f4290527b00321285105f8 2118ec68c738683d8f7e11b95239ca92fda2b9b5054aa7b128267eec0d0634c5
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F042317d8-45b6-4c5f-8767-ff9367c24193.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8803
x-amzn-requestid: e8516be3-5ce9-4f15-b522-c81c1e57a0e2
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cjtK9GavoAMFjpA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638af579-538cc8f300938698004f2241;Sampled=0
x-amzn-remapped-date: Sat, 03 Dec 2022 07:06:33 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: MiOdXHxd9Vmeji8Yqd8LG_EqYoMGf0YBy6by9bhfjb12y1OxKVvvqw==
via: 1.1 5ab5dc09da67e3ea794ec8a82992cc88.cloudfront.net (CloudFront), 1.1 112d82578d402a38d8d02e8b857617e0.cloudfront.net (CloudFront), 1.1 google
date: Thu, 08 Dec 2022 12:36:28 GMT
age: 39056
etag: "c47af4e5770daad212f4290527b00321285105f8"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcf07b4f3-8986-4a9c-8c85-b126338852d2.jpeg | 34.120.237.76 | 200 OK | 13 kB |
URL HTTP/2img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcf07b4f3-8986-4a9c-8c85-b126338852d2.jpeg IP34.120.237.76:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Hash730ba1a8edb79ba6f83b46d1ba5aed7b 55a236fedf6f5f7ca2bb88ae13e20846a50fd36d f8043e76265c59073d111987fd4c08d05a3ac80989af9269cca9ebcc21af4013
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcf07b4f3-8986-4a9c-8c85-b126338852d2.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 12748
x-amzn-requestid: edd028e3-c23e-4985-b12d-d3ebe760df47
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cjuciEptIAMFj9A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638af783-1c151eb66f590c9c0e0c4c82;Sampled=0
x-amzn-remapped-date: Sat, 03 Dec 2022 07:15:15 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: -y4-_OwHl5_OFykJYYZSqwIopjKoYy1MhaGTpVXd4Grq2EsUP2c3IA==
via: 1.1 cd48ffda04934d18865e47e99ea080bc.cloudfront.net (CloudFront), 1.1 57a21088b36c69a83578b5a5579df58e.cloudfront.net (CloudFront), 1.1 google
date: Thu, 08 Dec 2022 13:49:59 GMT
age: 34645
etag: "55a236fedf6f5f7ca2bb88ae13e20846a50fd36d"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbe602fad-66c2-48db-acd3-371ca6dcb8f6.jpeg | 34.120.237.76 | 200 OK | 7.9 kB |
URL HTTP/2img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbe602fad-66c2-48db-acd3-371ca6dcb8f6.jpeg IP34.120.237.76:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Hash8c3214044657f3b876d1f1848bca5684 7558222788f06623ddae6e883413e38e1146281e e1f9c9c445bba7765f371dbb655cab43c1e12de7cbd015f8034c494118f7f708
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbe602fad-66c2-48db-acd3-371ca6dcb8f6.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7897
x-amzn-requestid: 032fd8ae-b7e9-4e12-8546-838191a73688
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cwVM_F51IAMFunw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63900252-345ae6cd107d207f5dbe29a8;Sampled=0
x-amzn-remapped-date: Wed, 07 Dec 2022 03:02:42 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: N-zFZ8yeL7RrOZ5xfqvfBaE3zcXWecvr6Jd-93nKiUZlCXp2n2_Bgw==
via: 1.1 ddd913fbbe7367d44af4ac06097e7a2a.cloudfront.net (CloudFront), 1.1 325ed3ba58a560748d886354beef39c0.cloudfront.net (CloudFront), 1.1 google
date: Thu, 08 Dec 2022 03:42:37 GMT
age: 71087
etag: "7558222788f06623ddae6e883413e38e1146281e"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Nic1/?devicemodel=&browser=Chrome&ip=2600:1900:2000:9::a&bemobdata=c=e6849ad1-df14-446f-a872-b3b884c6a392..l=fdb85537-1e47-45e4-bd4b-e8a16e8d46a2..a=0..b=0..r=http://cn47e.bemobtrk.com | 172.67.75.176 | 200 OK | 0 B |
URL HTTP/2goforrewards.info/RM/Nic1/?devicemodel=&browser=Chrome&ip=2600:1900:2000:9::a&bemobdata=c=e6849ad1-df14-446f-a872-b3b884c6a392..l=fdb85537-1e47-45e4-bd4b-e8a16e8d46a2..a=0..b=0..r=http://cn47e.bemobtrk.com IP172.67.75.176:0
GET /RM/Nic1/?devicemodel=&browser=Chrome&ip=2600:1900:2000:9::a&bemobdata=c=e6849ad1-df14-446f-a872-b3b884c6a392..l=fdb85537-1e47-45e4-bd4b-e8a16e8d46a2..a=0..b=0..r=http://cn47e.bemobtrk.com HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 200 OK
date: Thu, 08 Dec 2022 23:27:21 GMT
content-type: text/html
last-modified: Wed, 07 Dec 2022 00:34:53 GMT
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=N7YvROwMWCMucSjmXnji1yc4LxqdfZkDxYv8kb1kg2iCAoUd6lIc4l4I8tjVoEOYaS8GUMTA4x4LnHfRCecg70hVivYPqTpKv1eJVvn2lpsNSc9a4UUVey9DrEAvnAJeimX%2B"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 776945704f31b4f1-OSL
content-encoding: br
X-Firefox-Spdy: h2
|
|
| fonts.googleapis.com/css?family=Cairo:700 | 142.250.74.106 | 200 OK | 0 B |
URL HTTP/2fonts.googleapis.com/css?family=Cairo:700 IP142.250.74.106:0
GET /css?family=Cairo:700 HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Thu, 08 Dec 2022 23:27:22 GMT
date: Thu, 08 Dec 2022 23:27:22 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Nic1/new/jquery.min.js.download | 172.67.75.176 | 404 Not Found | 0 B |
URL HTTP/2goforrewards.info/RM/Nic1/new/jquery.min.js.download IP172.67.75.176:0
Analyzer | Verdict | Alert | fortinet | Phishing | |
GET /RM/Nic1/new/jquery.min.js.download HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Nic1/?devicemodel=&browser=Chrome&ip=2600:1900:2000:9::a&bemobdata=c=e6849ad1-df14-446f-a872-b3b884c6a392..l=fdb85537-1e47-45e4-bd4b-e8a16e8d46a2..a=0..b=0..r=http://cn47e.bemobtrk.com
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
date: Thu, 08 Dec 2022 23:27:21 GMT
content-type: text/html
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OOJ6lNB5vv6l9pMMuFyDdKsdxm3ElT5PaX4ren4dO4xjrJ5z%2BIgUuQK16mSfpVFsMUP86aUb31oZohFALXtiOChajWYdfObzWzA%2FgeNfXsdmOOvl%2FTBIOSVPvnMYfvAVbCVg"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7769457188a2b4f1-OSL
content-encoding: br
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Nic1/new/confetti.js.download | 172.67.75.176 | 404 Not Found | 0 B |
URL HTTP/2goforrewards.info/RM/Nic1/new/confetti.js.download IP172.67.75.176:0
Analyzer | Verdict | Alert | fortinet | Phishing | |
GET /RM/Nic1/new/confetti.js.download HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Nic1/?devicemodel=&browser=Chrome&ip=2600:1900:2000:9::a&bemobdata=c=e6849ad1-df14-446f-a872-b3b884c6a392..l=fdb85537-1e47-45e4-bd4b-e8a16e8d46a2..a=0..b=0..r=http://cn47e.bemobtrk.com
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
date: Thu, 08 Dec 2022 23:27:22 GMT
content-type: text/html
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OrcBxGEF4xSz%2FFDG1eD7cnkjQlCZlMIndnUe5lfrrxhrXorqqytnSNtHPGyZsouJGTqk5zBOaOkmmwP%2F9jtDxGl0DBph%2Bt6RpTURxkloR3LkLpPb8sWWbveiJnM8TQ1nwMMe"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 776945742b7bb4f1-OSL
content-encoding: br
X-Firefox-Spdy: h2
|
|
| goforrewards.info/favicon.ico | 172.67.75.176 | 404 Not Found | 0 B |
URL HTTP/2goforrewards.info/favicon.ico IP172.67.75.176:0
GET /favicon.ico HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Nic1/?devicemodel=&browser=Chrome&ip=2600:1900:2000:9::a&bemobdata=c=e6849ad1-df14-446f-a872-b3b884c6a392..l=fdb85537-1e47-45e4-bd4b-e8a16e8d46a2..a=0..b=0..r=http://cn47e.bemobtrk.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
date: Thu, 08 Dec 2022 23:27:22 GMT
content-type: text/html
cache-control: max-age=14400
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=duKoaFid8xl8ZeEpTj1Nh%2Fl6Tl0ugqfbUmunOuW8W27zWjOuoyMbVFyNXzVgHcZ7szjsXzeM02l%2Fp7kwgQZ8cLXmXnTqLtuY26lJwJYmFHMlLSCW6g39a6fQD3ONuD420cG5"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 776945752c55b4f1-OSL
content-encoding: br
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Nic1/js/count_down.js | 172.67.75.176 | 200 OK | 0 B |
URL HTTP/2goforrewards.info/RM/Nic1/js/count_down.js IP172.67.75.176:0
Analyzer | Verdict | Alert | fortinet | Phishing | |
GET /RM/Nic1/js/count_down.js HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Nic1/?devicemodel=&browser=Chrome&ip=2600:1900:2000:9::a&bemobdata=c=e6849ad1-df14-446f-a872-b3b884c6a392..l=fdb85537-1e47-45e4-bd4b-e8a16e8d46a2..a=0..b=0..r=http://cn47e.bemobtrk.com
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 23:27:21 GMT
content-type: application/javascript
last-modified: Wed, 07 Dec 2022 00:35:17 GMT
etag: W/"638fdfc5-4cd"
expires: Sat, 07 Jan 2023 23:27:21 GMT
cache-control: max-age=2592000
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zG1lScR52uGwEDCg1w5S7r6sSlW7Sd13yV2Mb%2BXTSwo0Fb%2BKQtpS4giXoYrqL%2BuFxjIl3dogoAYGnPZAtGWvX5oPJwrSOREC9CUPGP%2BAEu0JGygTT1YyuiUFytz2GdqqMddv"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77694571687cb4f1-OSL
content-encoding: br
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Nic1/new/confetti.js.download | 172.67.75.176 | 404 Not Found | 0 B |
URL HTTP/2goforrewards.info/RM/Nic1/new/confetti.js.download IP172.67.75.176:0
Analyzer | Verdict | Alert | fortinet | Phishing | |
GET /RM/Nic1/new/confetti.js.download HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Nic1/?devicemodel=&browser=Chrome&ip=2600:1900:2000:9::a&bemobdata=c=e6849ad1-df14-446f-a872-b3b884c6a392..l=fdb85537-1e47-45e4-bd4b-e8a16e8d46a2..a=0..b=0..r=http://cn47e.bemobtrk.com
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
date: Thu, 08 Dec 2022 23:27:21 GMT
content-type: text/html
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WxOIrFwuR1AEdEbWJGlohaJscdQhwgFFEwBiELv5fjLEub1dTuUa5YiAN2YJQ5qcHHuOheD3Uwc1vYh%2F06DHFNjZFxMM4s88Yx9HhOd9AIHqHJ10gweC3HMkCnHIb2y4m%2BZo"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7769457188a4b4f1-OSL
content-encoding: br
X-Firefox-Spdy: h2
|
|