Report - rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000

Report Overview

Visited public
2024-04-16 09:55:28
Tags
Submit Tags
URL
rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000
Finishing URL
newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
IP / ASN
31.220.27.98
#39572 DataWeb Global Group B.V.
Title
Bit GPT App Ai

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
wokoez.com	unknown	2024-02-05	2024-02-06 14:55:06	2024-04-13 20:01:40	476 B	623 B	185.162.85.14
ptaupsom.com	unknown	2023-07-12	2023-07-12 14:44:23	2024-04-16 02:29:32	1.5 kB	2.4 kB	139.45.197.242
newgreatoffers.top	unknown	unknown	No data	No data	13 kB	598 kB	172.67.215.176
g.mtrck.org	unknown	2023-02-27	2024-03-14 07:52:11	2024-04-12 18:34:11	521 B	11 kB	13.248.167.248
datatechone.com	unknown	2021-12-24	2015-06-17 15:52:19	2024-04-15 10:13:54	570 B	465 B	37.48.68.71
fonts.googleapis.com	8877	2005-01-25	2013-06-10 22:14:26	2024-04-16 05:33:18	756 B	89 kB	142.250.74.106
berebereuolakola.com	unknown	2024-03-11	2024-03-11 18:51:20	2024-04-09 11:10:15	1.3 kB	16 kB	139.45.196.64
secureltrk.com	unknown	2023-10-10	2024-01-09 22:07:38	2024-04-12 12:12:58	647 B	501 B	176.97.112.149
mgkstatic33.b-cdn.net	unknown	2016-04-25	2023-05-23 23:48:15	2024-04-12 18:34:12	5.1 kB	1.4 MB	194.242.11.186
static-133.b-cdn.net	unknown	2016-04-25	2021-10-05 23:06:29	2024-03-28 11:54:29	2.8 kB	2.4 MB	194.242.11.186
rjmieo.com	unknown	unknown	No data	No data	19 kB	39 kB	31.220.27.98
mdakky.com	unknown	2023-10-12	2023-10-13 10:25:55	2024-04-15 10:33:08	577 B	184 B	185.162.85.3
cdntechone.com	64371	2021-12-24	2021-12-24 18:09:58	2024-04-14 23:06:48	783 B	19 kB	172.67.195.28
fonts.gstatic.com	unknown	2008-02-11	2014-09-09 02:40:21	2024-04-16 05:45:06	2.2 kB	196 kB	216.58.207.227

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2024-04-16	medium	rjmieo.com	Sinkholed
2024-04-16	medium	rjmieo.com	Sinkholed
2024-04-16	medium	rjmieo.com	Sinkholed
2024-04-16	medium	rjmieo.com	Sinkholed
2024-04-16	medium	rjmieo.com	Sinkholed
2024-04-16	medium	rjmieo.com	Sinkholed
2024-04-16	medium	rjmieo.com	Sinkholed
2024-04-16	medium	berebereuolakola.com	Sinkholed
2024-04-16	medium	ptaupsom.com	Sinkholed
2024-04-16	medium	berebereuolakola.com	Sinkholed
2024-04-16	medium	ptaupsom.com	Sinkholed

ThreatFox

No alerts detected

JavaScript (5)

	URL	From	Size	First Seen	Last Seen
	newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=	ScriptElement	397 B	2024-03-14	2024-08-20
Pretty URL newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language= IP 172.67.215.176 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2024-03-14 16:59 Last Seen2024-08-20 07:52 Times Seen366 Hash a497a0afc16d3a49105f9199bffe7e9d f23d60f9f223603e9854a743f67e30a5d957124d c3e9748d0a3225d2b4471fd0721919c6b783eca4e9d21b0d51581b50e425d184 Loading...

	newgreatoffers.top/js/l.js?id=f699e0c1aa11fe1bdd00	ScriptElement	422 kB	2024-03-26	2024-08-20
Pretty URL newgreatoffers.top/js/l.js?id=f699e0c1aa11fe1bdd00 IP 172.67.215.176 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2024-03-26 16:50 Last Seen2024-08-20 06:53 Times Seen352 Hash f699e0c1aa11fe1bdd00a7400b51ac84 4193182e4873223501193aa85eedade88d531ce5 392c15facf9c22c83c1e8c4e47d73ea5875e4b7aaccd0b828874e56975081017 Loading...

	newgreatoffers.top/js/redirect.js?id=7205070985cfaaa84a2b	ScriptElement	2.7 kB	2023-03-11	2024-08-21
Pretty URL newgreatoffers.top/js/redirect.js?id=7205070985cfaaa84a2b IP 172.67.215.176 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-11 15:40 Last Seen2024-08-21 07:10 Times Seen377 Hash 7205070985cfaaa84a2b7e4b4312342a 9142390fc87574c77705c78b2b869ab9644756c4 5fd8e205f7ba2def2d0a5b7212189d9b8766ca0c515b09c39412531d49fcc655 Loading...

	mgkstatic33.b-cdn.net/43461/build/funnel.js	ScriptElement	735 kB	2024-03-14	2024-08-20
Pretty URL mgkstatic33.b-cdn.net/43461/build/funnel.js IP 194.242.11.186 ASN #34989 ServeTheWorld AS Introduced by scriptElement Embedded in HTML false Observations First Seen2024-03-14 16:59 Last Seen2024-08-20 07:52 Times Seen367 Hash 154334f976eb4c2bbea602efb4ad82ce 419f09216939d9817c52e4f8f928e4e40c7e0cb4 c0bc7d84863d6352319f4638e7f027022d4e008ce7d0680148b6a884fcbdb8ca Loading...

	newgreatoffers.top/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js	ScriptElement	1.2 kB	2023-03-07	2025-06-30
Pretty URL newgreatoffers.top/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js IP 172.67.215.176 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-06-30 22:26 Times Seen82067 Hash 9e8f56e8e1806253ba01a95cfc3d392c a8af90d7482e1e99d03de6bf88fed2315c5dd728 2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8 Loading...

HTTP Transactions (50)

URL IP Response Size

rjmieo.com/images/play-2/icon1.png

31.220.27.98

7.3 kB

URL
rjmieo.com/images/play-2/icon1.png
IP
31.220.27.98:0
ASN
#39572 DataWeb Global Group B.V.

File type
PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
Size
7.3 kB (7252 bytes)
Hash
3d0ab5834c8bf7134e4d21fa3288317f
c31d1a6b9df206f67ea194f4c424cdc372a423c2
0515ddd9185d263874e7b66bb6d521fcd63b857aac5fed51c08df98026dafe27

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /images/play-2/icon1.png HTTP/1.1
Host: rjmieo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000
Cookie: truniq=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx/1.25.0
date: Tue, 16 Apr 2024 09:55:00 GMT
content-type: image/png
content-length: 7252
last-modified: Tue, 09 Apr 2024 07:34:22 GMT
etag: "6614ef7e-1c54"
x-zone: eu4
accept-ranges: bytes
X-Firefox-Spdy: h2

rjmieo.com/images/play-2/icon2.png

31.220.27.98

4.6 kB

URL
rjmieo.com/images/play-2/icon2.png
IP
31.220.27.98:0
ASN
#39572 DataWeb Global Group B.V.

File type
PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
Size
4.6 kB (4576 bytes)
Hash
c947d439eb93367f1af5b2a3d222f057
5b4c10820d39e624bc6df72a113679da80a8e44e
aab564e67c47df65ddcb9c4eaa62cd798a51624a3fded9f9b3a1197b460a79c2

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /images/play-2/icon2.png HTTP/1.1
Host: rjmieo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000
Cookie: truniq=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx/1.25.0
date: Tue, 16 Apr 2024 09:55:00 GMT
content-type: image/png
content-length: 4576
last-modified: Tue, 09 Apr 2024 07:34:22 GMT
etag: "6614ef7e-11e0"
x-zone: eu
accept-ranges: bytes
X-Firefox-Spdy: h2

rjmieo.com/images/play-2/icon3.png

31.220.27.98

7.8 kB

URL
rjmieo.com/images/play-2/icon3.png
IP
31.220.27.98:0
ASN
#39572 DataWeb Global Group B.V.

File type
PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
Size
7.8 kB (7847 bytes)
Hash
8f3cc830da0b1fdf66bda7d1d734747b
94588f041eec3a78a8780c8124c56a1434a89277
ea3698c32039a115b03c2528cbb29c3ff97bbd49ad1345d5095e98d1fd0ea8ba

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /images/play-2/icon3.png HTTP/1.1
Host: rjmieo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000
Cookie: truniq=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx/1.25.0
date: Tue, 16 Apr 2024 09:55:00 GMT
content-type: image/png
content-length: 7847
last-modified: Tue, 09 Apr 2024 07:34:22 GMT
etag: "6614ef7e-1ea7"
x-zone: eu4
accept-ranges: bytes
X-Firefox-Spdy: h2

rjmieo.com/images/play-2/icon4.png

31.220.27.98

7.0 kB

URL
rjmieo.com/images/play-2/icon4.png
IP
31.220.27.98:0
ASN
#39572 DataWeb Global Group B.V.

File type
PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
Size
7.0 kB (7032 bytes)
Hash
7ad7f32c1c0df7b4975cc41bda4ac435
81d57e996ee6cd9e122592e68ffa3d55c1ba10ff
c0af6cb2280bba97d235dfad7c72d22353a0d2cf277733ce9fc4701df7ed1d5f

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /images/play-2/icon4.png HTTP/1.1
Host: rjmieo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000
Cookie: truniq=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx/1.25.0
date: Tue, 16 Apr 2024 09:55:00 GMT
content-type: image/png
content-length: 7032
last-modified: Tue, 09 Apr 2024 07:34:22 GMT
etag: "6614ef7e-1b78"
x-zone: eu3
accept-ranges: bytes
X-Firefox-Spdy: h2

rjmieo.com/images/play-2/icon5.png

31.220.27.98

3.3 kB

URL
rjmieo.com/images/play-2/icon5.png
IP
31.220.27.98:0
ASN
#39572 DataWeb Global Group B.V.

File type
PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
Size
3.3 kB (3264 bytes)
Hash
1e1a7582b5da63e10485d63f97abc9a0
ca3ee3067f96c732f455bc7c99ec5100194f13f6
196083352a09a19cf2d4364e3ad406606fedb562f2096c1bef373ff2c485b503

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /images/play-2/icon5.png HTTP/1.1
Host: rjmieo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000
Cookie: truniq=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx/1.25.0
date: Tue, 16 Apr 2024 09:55:00 GMT
content-type: image/png
content-length: 3264
last-modified: Tue, 09 Apr 2024 07:34:22 GMT
etag: "6614ef7e-cc0"
x-zone: eu4
accept-ranges: bytes
X-Firefox-Spdy: h2

rjmieo.com/images/play-2/icon7.png

31.220.27.98

3.3 kB

URL
rjmieo.com/images/play-2/icon7.png
IP
31.220.27.98:0
ASN
#39572 DataWeb Global Group B.V.

File type
PNG image data, 500 x 500, 8-bit/color RGBA, non-interlaced
Size
3.3 kB (3283 bytes)
Hash
b512735542cb07b3b2dcf153a7dfe456
93bde8875412ce266600e2af1c37123483a50376
e9c661cc8adbaa1b9cd4cf65f0ba93a1c24211cb5f94ed0950e0fbc973781718

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /images/play-2/icon7.png HTTP/1.1
Host: rjmieo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000
Cookie: truniq=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx/1.25.0
date: Tue, 16 Apr 2024 09:55:00 GMT
content-type: image/png
content-length: 3283
last-modified: Tue, 09 Apr 2024 07:34:22 GMT
etag: "6614ef7e-cd3"
x-zone: eu
accept-ranges: bytes
X-Firefox-Spdy: h2

rjmieo.com/images/play-2/icon8.png

31.220.27.98

4.1 kB

URL
rjmieo.com/images/play-2/icon8.png
IP
31.220.27.98:0
ASN
#39572 DataWeb Global Group B.V.

File type
PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
Size
4.1 kB (4064 bytes)
Hash
f92d6474ebc6a3a0b576749cfb4afe98
0f4ce3dcf04873b8098c01d20c44967fb9fce0cc
3a7abff293d71fd8c5a58deacb964b50fe074a6f458575d37abbd367a3a930a1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /images/play-2/icon8.png HTTP/1.1
Host: rjmieo.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000intent://rjmieo.com/play-2_1?h=waWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzEsInNyYyI6Mn0=eyJ&si1=DB06-0HN1F09U52QUQJQID&si2=a0128000
Cookie: truniq=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx/1.25.0
date: Tue, 16 Apr 2024 09:55:00 GMT
content-type: image/png
content-length: 4064
last-modified: Tue, 09 Apr 2024 07:34:22 GMT
etag: "6614ef7e-fe0"
x-zone: eu3
accept-ranges: bytes
X-Firefox-Spdy: h2

mdakky.com/rpe?a=1&s=1&act=18&src=2&p=1102421&st=1341271&wd=560731&d=rjmieo.com&tpl=78&rnd=0.8324829313695276&sbid=DB06-0HN1F09U52QUQJQID&sbid2=a0128000intent%3A%2F%2Frjmieo.com%2Fplay

185.162.85.3

0 B

URL
mdakky.com/rpe?a=1&s=1&act=18&src=2&p=1102421&st=1341271&wd=560731&d=rjmieo.com&tpl=78&rnd=0.8324829313695276&sbid=DB06-0HN1F09U52QUQJQID&sbid2=a0128000intent%3A%2F%2Frjmieo.com%2Fplay
IP
185.162.85.3:0
ASN
#39572 DataWeb Global Group B.V.

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /rpe?a=1&s=1&act=18&src=2&p=1102421&st=1341271&wd=560731&d=rjmieo.com&tpl=78&rnd=0.8324829313695276&sbid=DB06-0HN1F09U52QUQJQID&sbid2=a0128000intent%3A%2F%2Frjmieo.com%2Fplay HTTP/1.1
Host: mdakky.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://rjmieo.com
DNT: 1
Connection: keep-alive
Referer: https://rjmieo.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx/1.18.0
date: Tue, 16 Apr 2024 09:55:00 GMT
content-length: 0
accept-ch: Sec-CH-UA-Platform-Version
access-control-allow-origin: *
X-Firefox-Spdy: h2

wokoez.com/phtbload?a=1&e=aeyJwaWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzF9

185.162.85.14

358 B

URL
wokoez.com/phtbload?a=1&e=aeyJwaWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzF9
IP
185.162.85.14:0
ASN
#39572 DataWeb Global Group B.V.

File type
gzip compressed data, from Unix
Size
358 B (358 bytes)
Hash
925f21a264d08d1b82024b0555e47835
f9f195ad8acf3273dec11650792546be8f3218ea
2de23eb824ee290a392d2c6b88c5f18a0078699f57c336a55416ee29d6f78954

HTTP Headers

GET /phtbload?a=1&e=aeyJwaWQiOjExMDI0MjEsInNpZCI6MTM0MTI3MSwid2lkIjo1NjA3MzF9 HTTP/1.1
Host: wokoez.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://rjmieo.com/
Origin: https://rjmieo.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx/1.18.0
date: Tue, 16 Apr 2024 09:55:00 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
access-control-allow-origin: *
accept-ch: Sec-CH-UA-Platform-Version
content-encoding: gzip
X-Firefox-Spdy: h2

berebereuolakola.com/link?z=6849336&var=a560731&ymid=a2_10133921922112047619_560731_2_0

139.45.196.64

0 B

URL
berebereuolakola.com/link?z=6849336&var=a560731&ymid=a2_10133921922112047619_560731_2_0
IP
139.45.196.64:0
ASN
#9002 RETN Limited

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /link?z=6849336&var=a560731&ymid=a2_10133921922112047619_560731_2_0 HTTP/1.1
Host: berebereuolakola.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://rjmieo.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
server: nginx
date: Tue, 16 Apr 2024 09:55:01 GMT
content-length: 0
location: https://cdntechone.com/r.html?axcid=e7ddf874-40d2-43d7-b8fd-56541bff0853&axtsid=6849336&axcusid1=a560731&clid={ymid}&r=http%3A%2F%2Fberebereuolakola.com%2Flink%3Fz%3D6849336%26var%3Da560731%26ymid%3Da2_10133921922112047619_560731_2_0%26acb%3Dproxy-smart-link&axcusid2=Smartlink&axadvid=1053995&axcamid=10505
access-control-allow-credentials: true
access-control-allow-origin: 
access-control-allow-methods: POST, GET, OPTIONS, PUT, DELETE
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding
pragma: no-cache
cache-control: no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
link: <https://cdntechone.com>; rel="dns-prefetch preconnect"
set-cookie: OAID=048040b8692145f1fbf5d748ada55687; expires=Wed, 16 Apr 2025 09:55:01 GMT
oaidts=1713261301; expires=Wed, 16 Apr 2025 09:55:01 GMT
phpckd6849336=true; expires=Wed, 17 Apr 2024 09:55:01 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *
X-Firefox-Spdy: h2

datatechone.com/log/add?cid=e7ddf874-40d2-43d7-b8fd-56541bff0853&ruid=1d87c56c-756e-4bbf-8bd8-03633b9dc37d

37.48.68.71

2 B

URL
datatechone.com/log/add?cid=e7ddf874-40d2-43d7-b8fd-56541bff0853&ruid=1d87c56c-756e-4bbf-8bd8-03633b9dc37d
IP
37.48.68.71:0
ASN
#60781 LeaseWeb Netherlands B.V.

File type
ASCII text, with no line terminators
Size
2 B (2 bytes)
Hash
444bcb3a3fcf8389296c49467f27e1d6
7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

HTTP Headers

POST /log/add?cid=e7ddf874-40d2-43d7-b8fd-56541bff0853&ruid=1d87c56c-756e-4bbf-8bd8-03633b9dc37d HTTP/1.1
Host: datatechone.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 1661
Origin: https://cdntechone.com
DNT: 1
Connection: keep-alive
Referer: https://cdntechone.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.19.10
Date: Tue, 16 Apr 2024 09:55:01 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 2
Connection: keep-alive
Access-Control-Allow-Origin: https://cdntechone.com
Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE
Access-Control-Allow-Headers: Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Forwarded-For, If-None-Match
Access-Control-Allow-Credentials: true

cdntechone.com/r.html?axcid=e7ddf874-40d2-43d7-b8fd-56541bff0853&axtsid=6849336&axcusid1=a560731&clid={ymid}&r=http%3A%2F%2Fberebereuolakola.com%2Flink%3Fz%3D6849336%26var%3Da560731%26ymid%3Da2_10133921922112047619_560731_2_0%26acb%3Dproxy-smart-link&axcusid2=Smartlink&axadvid=1053995&axcamid=10505

172.67.195.28

18 kB

URL
cdntechone.com/r.html?axcid=e7ddf874-40d2-43d7-b8fd-56541bff0853&axtsid=6849336&axcusid1=a560731&clid={ymid}&r=http%3A%2F%2Fberebereuolakola.com%2Flink%3Fz%3D6849336%26var%3Da560731%26ymid%3Da2_10133921922112047619_560731_2_0%26acb%3Dproxy-smart-link&axcusid2=Smartlink&axadvid=1053995&axcamid=10505
IP
172.67.195.28:0
ASN
#13335 CLOUDFLARENET

File type
HTML document, ASCII text, with very long lines (18452)
Size
18 kB (18067 bytes)
Hash
bb831dd6d50f6c8b53353103ec9a3703
9d78eba98e3da16601fb5492a7d66030865293e0
785c9ae55eb9710019f4b32060731514e6bf11d2fb96e0c5bc5dec7d2bfc9319

HTTP Headers

GET /r.html?axcid=e7ddf874-40d2-43d7-b8fd-56541bff0853&axtsid=6849336&axcusid1=a560731&clid={ymid}&r=http%3A%2F%2Fberebereuolakola.com%2Flink%3Fz%3D6849336%26var%3Da560731%26ymid%3Da2_10133921922112047619_560731_2_0%26acb%3Dproxy-smart-link&axcusid2=Smartlink&axadvid=1053995&axcamid=10505 HTTP/1.1
Host: cdntechone.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://rjmieo.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 16 Apr 2024 09:55:01 GMT
content-type: text/html
last-modified: Wed, 07 Feb 2024 12:51:04 GMT
link: <https://datatechone.com/>; rel=preconnect; crossorigin, <https://datatechonert.com/>; rel=preconnect; crossorigin
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KK1gTqBAm0B%2FyVgX0thwLza30%2F0DJJa7r3DA4Zwg9UGTt3honnEbFgl9QoTpYoDLsn91eMlbcn0G7dw4Jv%2FJI7XdHLwrvHw4XX6o4LMUgscBxAVjVIXso8MI1LhfKn%2ByvQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87534c1c9e390b69-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

ptaupsom.com/sftouch?userId=048040b8692145f1fbf5d748ada55687&z=6849338&p_rid=8001245a-5197-415e-b561-f8d3f1f2be7a&p_src=sf&branchId=0&rb=W-PiSWF55qGxtWFL33xHbO0iovYQYgujPEzExSrmmimbGqWw2aPGEsz4IwhvKK7EuGASnNHEe41b6lcpjlgu6tw24dCtcdSw_sBl672i0X2swLScbf7jP-SoVSAXXx0BylEVyxd1k1k_O8UfMAe7H7VgHj08na2glzoUgMptXyh_z1Zg5eloBSzspL2GI5N_P48opUYt-3GlgTp3RbSvi0paVjGII-_eDtFcFWgPIjI_cLo7ajidYdE7wdf2srLFTupzbO2rFgsUcKHW

139.45.197.242

2 B

URL
ptaupsom.com/sftouch?userId=048040b8692145f1fbf5d748ada55687&z=6849338&p_rid=8001245a-5197-415e-b561-f8d3f1f2be7a&p_src=sf&branchId=0&rb=W-PiSWF55qGxtWFL33xHbO0iovYQYgujPEzExSrmmimbGqWw2aPGEsz4IwhvKK7EuGASnNHEe41b6lcpjlgu6tw24dCtcdSw_sBl672i0X2swLScbf7jP-SoVSAXXx0BylEVyxd1k1k_O8UfMAe7H7VgHj08na2glzoUgMptXyh_z1Zg5eloBSzspL2GI5N_P48opUYt-3GlgTp3RbSvi0paVjGII-_eDtFcFWgPIjI_cLo7ajidYdE7wdf2srLFTupzbO2rFgsUcKHW
IP
139.45.197.242:0
ASN
#9002 RETN Limited

File type
ASCII text, with no line terminators
Size
2 B (2 bytes)
Hash
444bcb3a3fcf8389296c49467f27e1d6
7a85f4764bbd6daf1c3545efbbf0f279a6dc0beb
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /sftouch?userId=048040b8692145f1fbf5d748ada55687&z=6849338&p_rid=8001245a-5197-415e-b561-f8d3f1f2be7a&p_src=sf&branchId=0&rb=W-PiSWF55qGxtWFL33xHbO0iovYQYgujPEzExSrmmimbGqWw2aPGEsz4IwhvKK7EuGASnNHEe41b6lcpjlgu6tw24dCtcdSw_sBl672i0X2swLScbf7jP-SoVSAXXx0BylEVyxd1k1k_O8UfMAe7H7VgHj08na2glzoUgMptXyh_z1Zg5eloBSzspL2GI5N_P48opUYt-3GlgTp3RbSvi0paVjGII-_eDtFcFWgPIjI_cLo7ajidYdE7wdf2srLFTupzbO2rFgsUcKHW HTTP/1.1
Host: ptaupsom.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://berebereuolakola.com
DNT: 1
Connection: keep-alive
Referer: https://berebereuolakola.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0

HTTP/2 200 OK
server: nginx
date: Tue, 16 Apr 2024 09:55:01 GMT
content-type: text/plain
content-length: 2
x-trace-id: 958310da66b246b4a9a2807bffc399eb
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-origin: https://berebereuolakola.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
access-control-max-age: 86400
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2

berebereuolakola.com/link?z=6849336&var=a560731&ymid=a2_10133921922112047619_560731_2_0&acb=proxy-smart-link&axcusid2=Smartlink&axadvid=1053995&axcamid=10505

139.45.196.64

13 kB

URL
berebereuolakola.com/link?z=6849336&var=a560731&ymid=a2_10133921922112047619_560731_2_0&acb=proxy-smart-link&axcusid2=Smartlink&axadvid=1053995&axcamid=10505
IP
139.45.196.64:0
ASN
#9002 RETN Limited

File type
gzip compressed data, max speed, from Unix
Size
13 kB (13394 bytes)
Hash
48f7b15d0c81ec0d74471c8df728bda9
b2685371e378d052b0b3928dfbcb5f35de24b190
a144c4cf3ed464126174a9c4d86ad3e8f23d649c5eb7ba13982cfb9661fc297a

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /link?z=6849336&var=a560731&ymid=a2_10133921922112047619_560731_2_0&acb=proxy-smart-link&axcusid2=Smartlink&axadvid=1053995&axcamid=10505 HTTP/1.1
Host: berebereuolakola.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Cookie: OAID=048040b8692145f1fbf5d748ada55687; oaidts=1713261301; phpckd6849336=true
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Tue, 16 Apr 2024 09:55:01 GMT
content-type: text/html; charset=utf8
x-trace-id: 32a2f8eab5c9753c13e14c6753c6b19e
link: <https://yonmewon.com>; rel="preconnect dns-prefetch",<https://my.rtmark.net>; rel="preconnect dns-prefetch"
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
access-control-max-age: 86400
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
set-cookie: OAID=048040b8692145f1fbf5d748ada55687; expires=Wed, 16 Apr 2025 09:55:01 GMT; path=/; secure; SameSite=None
oaidts=1713261301; expires=Wed, 16 Apr 2025 09:55:01 GMT; path=/; secure; SameSite=None
allcnt=1; expires=Wed, 16 Apr 2025 09:55:01 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
content-encoding: gzip
X-Firefox-Spdy: h2

POST ptaupsom.com/?z=6849338&syncedCookie=true&rhd=false

139.45.197.242

302 Found

0 B

URL User Request POST HTTP/2
ptaupsom.com/?z=6849338&syncedCookie=true&rhd=false
IP
139.45.197.242:443
ASN
#9002 RETN Limited

Certificate
IssuerLet's Encrypt
Subjectptaupsom.com
FingerprintAB:9A:62:A1:9D:E4:06:4C:2A:03:DA:B9:42:CB:A2:16:50:FE:57:6E
ValidityFri, 08 Mar 2024 05:29:04 GMT - Thu, 06 Jun 2024 05:29:03 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

POST /?z=6849338&syncedCookie=true&rhd=false HTTP/1.1
Host: ptaupsom.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 715
Origin: https://berebereuolakola.com
DNT: 1
Connection: keep-alive
Referer: https://berebereuolakola.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
server: nginx
date: Tue, 16 Apr 2024 09:55:02 GMT
content-length: 0
location: https://secureltrk.com/click?key=964a6cb724a8ed441ad5&visitor_id=804038767743865689&cost=0.001050&zoneid=6849338&campaignid=7910866&banner=20283117&zone_type={zone_type}&user_activity=high&subzone_id=0
x-trace-id: 802c3d28a1592ecba63aa047ccefe418
link: <https://secureltrk.com>; rel="preconnect dns-prefetch",<https://yonmewon.com>; rel="preconnect dns-prefetch",<https://sr7pv7n5x.com>; rel="preconnect dns-prefetch"
referrer-policy: no-referrer
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model
access-control-allow-origin: https://berebereuolakola.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: Accept, Content-Type, Content-Length, Accept-Encoding, baggage, sentry-trace, favicon
access-control-max-age: 86400
pragma: no-cache
cache-control: no-transform, no-store, no-cache, must-revalidate, max-age=0
expires: Tue, 11 Jan 1994 10:00:00 GMT
set-cookie: OAID=008040c7ea674a50f57b563c32edb75d; expires=Wed, 16 Apr 2025 09:55:02 GMT; path=/; secure; SameSite=None
oaidts=1713261302; expires=Wed, 16 Apr 2025 09:55:02 GMT; path=/; secure; SameSite=None
syncedCookie=; expires=Tue, 10 Nov 2009 23:00:00 GMT
strict-transport-security: max-age=1
x-content-type-options: nosniff
timing-allow-origin: *, *
X-Firefox-Spdy: h2

GET secureltrk.com/click?key=964a6cb724a8ed441ad5&visitor_id=804038767743865689&cost=0.001050&zoneid=6849338&campaignid=7910866&banner=20283117&zone_type={zone_type}&user_activity=high&subzone_id=0

176.97.112.149

307 Temporary Redirect

0 B

URL User Request GET HTTP/2
secureltrk.com/click?key=964a6cb724a8ed441ad5&visitor_id=804038767743865689&cost=0.001050&zoneid=6849338&campaignid=7910866&banner=20283117&zone_type={zone_type}&user_activity=high&subzone_id=0
IP
176.97.112.149:443
ASN
#43180 Virtual Systems LLC

Certificate
IssuerLet's Encrypt
Subjectsecureltrk.com
Fingerprint91:A8:57:2C:3B:9E:B5:B7:A7:E4:55:0C:08:59:E7:45:9D:A9:4C:9D
ValidityFri, 22 Mar 2024 12:23:21 GMT - Thu, 20 Jun 2024 12:23:20 GMT

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /click?key=964a6cb724a8ed441ad5&visitor_id=804038767743865689&cost=0.001050&zoneid=6849338&campaignid=7910866&banner=20283117&zone_type={zone_type}&user_activity=high&subzone_id=0 HTTP/1.1
Host: secureltrk.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 307 Temporary Redirect
date: Tue, 16 Apr 2024 09:55:02 GMT
location: https://g.mtrck.org/c?aid=xoLG2W&lpid=9trgqE&aff_sub5b=cof4ltla6vts738dk9ag
server: Caddy
set-cookie: uclick=yrrclVldO9s11eWgbGCYsy1uJ6n0h1qLwzPcBoQOSwezNYgACLCfkQmHhwLzK8tCA5fdjQ==; Max-Age=31536000; SameSite=Lax
bcid=cof4ltla6vts738dk9ag; Max-Age=31536000; SameSite=Lax
cid=cof4ltla6vts738dk9ag; Max-Age=31536000; SameSite=Lax
x-request-id: 8c937361-b759-4bbb-bcb4-11a6c4e23c9c
content-length: 0
X-Firefox-Spdy: h2

GET newgreatoffers.top/images/check-icon.png

172.67.215.176

200 OK

45 kB

URL GET HTTP/3
newgreatoffers.top/images/check-icon.png
IP
172.67.215.176:443
ASN
#13335 CLOUDFLARENET

Requested by
https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Certificate
IssuerGoogle Trust Services LLC
Subjectnewgreatoffers.top
Fingerprint8D:52:89:23:5C:65:D7:D9:03:5A:E6:CA:C5:DF:46:16:56:55:B5:2D
ValidityWed, 10 Apr 2024 05:11:29 GMT - Tue, 09 Jul 2024 05:11:28 GMT

File type
PNG image data, 900 x 520, 8-bit/color RGBA, non-interlaced
Size
45 kB (45018 bytes)
Hash
678be8aead34ae53e3a53f79ba30c820
a90e388c192e1287fb9132385e0e9960a1f7c15e
79bb457691c6f5dc0d3fd537218a627750b199db5253e22dad9dc4f78fa48016

HTTP Headers

GET /images/check-icon.png HTTP/1.1
Host: newgreatoffers.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Cookie: XSRF-TOKEN=eyJpdiI6Im1aSHl2VVcxbXA2ZTdUUTRXRGZxUVE9PSIsInZhbHVlIjoiM3BZbFBYRGpUVHBXV3FIcVwvTUVlNGNmSWJUNGtSXC96aW9nSHY4ZWhvYk1LbmE2Wm5uNVZ6T1VBanhiaVNRQXcyIiwibWFjIjoiYzcwNWRjOTg1MzIyNmYwNWRkNzU4YjY1ZDMyZTdkNDczNzQwYzQ1N2ZkYzZjMzc3OGY4YjA3MWIwNTA3ZTk3ZCJ9; c=eyJpdiI6IkErZXZUeW5Uejgya0hUczU0Q2RaRlE9PSIsInZhbHVlIjoiVXlGekU2YVZlVHZ6bm9ZMnFZdTZrbUZCTzZTb2w3eFwvZmw4M3BJbXlhejdiV0xpXC9rVnZHb3ZQZm81Q05seWxhIiwibWFjIjoiMjkwN2Q5MGM4Zjc0ODUyNTg3Nzg4YzllYzQ5YThmYjczZTQzNWM2YjdkOGZhOGU3MWNhNjQyZjUzMmUwN2IwMyJ9
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 16 Apr 2024 09:55:03 GMT
content-type: image/png
content-length: 45018
last-modified: Wed, 27 Mar 2024 14:37:42 GMT
etag: "66042f36-afda"
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-proc: 1
cache-control: max-age=14400
cf-cache-status: HIT
age: 101
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ztV7V%2BRD3o1eYKQYmuUxJ5QZPLV9FlJEiXR0D%2FrGT2%2Fw6%2FZpyzi8a%2F2R4R6ox0mbBhfat32Ow0nwY10fGJp8gyTY2PM1anDBgM6eFqUGBljYO0tfd5ywYuj2aEUfNd7TZ5ttqew%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87534c298987568d-OSL
alt-svc: h3=":443"; ma=86400

GET newgreatoffers.top/css/forms.css?id=f996a15d4340ce7f6a99

172.67.215.176

200 OK

4.0 kB

URL GET HTTP/3
newgreatoffers.top/css/forms.css?id=f996a15d4340ce7f6a99
IP
172.67.215.176:443
ASN
#13335 CLOUDFLARENET

Requested by
https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Certificate
IssuerGoogle Trust Services LLC
Subjectnewgreatoffers.top
Fingerprint8D:52:89:23:5C:65:D7:D9:03:5A:E6:CA:C5:DF:46:16:56:55:B5:2D
ValidityWed, 10 Apr 2024 05:11:29 GMT - Tue, 09 Jul 2024 05:11:28 GMT

File type
ASCII text, with very long lines (19895)
Size
4.0 kB (3988 bytes)
Hash
f996a15d4340ce7f6a994015a99c95d9
e59e2ce631dcf0619e149659a0052285e374def4
f93e02936033f95f052bec10b8041b15ec34b661a699957113f8646875c81718

HTTP Headers

GET /css/forms.css?id=f996a15d4340ce7f6a99 HTTP/1.1
Host: newgreatoffers.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Cookie: XSRF-TOKEN=eyJpdiI6Im1aSHl2VVcxbXA2ZTdUUTRXRGZxUVE9PSIsInZhbHVlIjoiM3BZbFBYRGpUVHBXV3FIcVwvTUVlNGNmSWJUNGtSXC96aW9nSHY4ZWhvYk1LbmE2Wm5uNVZ6T1VBanhiaVNRQXcyIiwibWFjIjoiYzcwNWRjOTg1MzIyNmYwNWRkNzU4YjY1ZDMyZTdkNDczNzQwYzQ1N2ZkYzZjMzc3OGY4YjA3MWIwNTA3ZTk3ZCJ9; c=eyJpdiI6IkErZXZUeW5Uejgya0hUczU0Q2RaRlE9PSIsInZhbHVlIjoiVXlGekU2YVZlVHZ6bm9ZMnFZdTZrbUZCTzZTb2w3eFwvZmw4M3BJbXlhejdiV0xpXC9rVnZHb3ZQZm81Q05seWxhIiwibWFjIjoiMjkwN2Q5MGM4Zjc0ODUyNTg3Nzg4YzllYzQ5YThmYjczZTQzNWM2YjdkOGZhOGU3MWNhNjQyZjUzMmUwN2IwMyJ9
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 16 Apr 2024 09:55:03 GMT
content-type: text/css
last-modified: Wed, 27 Mar 2024 14:41:19 GMT
vary: Accept-Encoding
etag: W/"6604300f-570a"
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-proc: 2
cache-control: max-age=14400
cf-cache-status: HIT
age: 101
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QhPZnNx6tk3%2FYPggZ2ZRf0ZQOCCW4akExg0GyxSgW9V%2FFzJGk6X4K3E5U2Vw58gi%2FySW01x4obP4Ag%2Bn3ZfdJt3CNB3CUJsqJhzzUWgc%2BmVlu%2F90ajjJShP8Y83G%2BA8hadC9hrw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87534c29797a568d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

GET mgkstatic33.b-cdn.net/43461/images/logo.png

194.242.11.186

200 OK

12 kB

URL GET HTTP/2
mgkstatic33.b-cdn.net/43461/images/logo.png
IP
194.242.11.186:443
ASN
#34989 ServeTheWorld AS

Requested by
https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Certificate
IssuerSectigo Limited
Subject*.b-cdn.net
FingerprintFC:D9:3E:09:69:F5:9D:8A:AA:45:73:03:05:F1:8D:E4:5B:80:10:E4
ValiditySun, 05 Nov 2023 00:00:00 GMT - Mon, 11 Nov 2024 23:59:59 GMT

File type
PNG image data, 436 x 130, 8-bit/color RGBA, non-interlaced
Size
12 kB (12510 bytes)
Hash
34156c9cf33b3a62f654c05dce790379
3e937d90138e64ceb158a1d7940e88551e7d3ae4
d13af073b360ef22d6fae9f4553a70389ba215b9d4dff52a9e2358417be6921c

HTTP Headers

GET /43461/images/logo.png HTTP/1.1
Host: mgkstatic33.b-cdn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://newgreatoffers.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Tue, 16 Apr 2024 09:55:03 GMT
content-type: image/png
content-length: 12510
server: BunnyCDN-NO1-830
cdn-pullzone: 1367785
cdn-uid: 6f116605-ddce-4644-a514-65e3765b9786
cdn-requestcountrycode: NO
cache-control: max-age=3600
etag: "34156c9cf33b3a62f654c05dce790379"
last-modified: Wed, 13 Mar 2024 15:17:34 GMT
x-rgw-object-type: Normal
x-amz-request-id: tx000008b1c89a4d0b15148-0065f29eca-5280acec-ams3c
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-do-cdn-uuid: b0c9cd13-c401-4707-9471-40949c09e155
cf-cache-status: HIT
cf-ray: 864461ec3802b51d-OSL
cdn-proxyver: 1.04
cdn-requestpullsuccess: True
cdn-requestpullcode: 200
cdn-cachedat: 03/14/2024 12:49:13
cdn-edgestorageid: 830
cdn-status: 200
cdn-requestid: d9915b6082fe94ae4b90409a746aaed5
cdn-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2

GET mgkstatic33.b-cdn.net/43461/images/Icon-ionic-md-trophy.png

194.242.11.186

200 OK

4.0 kB

URL GET HTTP/2
mgkstatic33.b-cdn.net/43461/images/Icon-ionic-md-trophy.png
IP
194.242.11.186:443
ASN
#34989 ServeTheWorld AS

Requested by
https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Certificate
IssuerSectigo Limited
Subject*.b-cdn.net
FingerprintFC:D9:3E:09:69:F5:9D:8A:AA:45:73:03:05:F1:8D:E4:5B:80:10:E4
ValiditySun, 05 Nov 2023 00:00:00 GMT - Mon, 11 Nov 2024 23:59:59 GMT

File type
PNG image data, 71 x 72, 8-bit/color RGBA, non-interlaced
Size
4.0 kB (3992 bytes)
Hash
aa55fd19e5efcaea20c5baf81e722bbc
6e5466aa0c4bf4586f1d6e53ae63f9c1fc1a3f56
3d25d49488fafac19a1fd40686a0d901d245e613db1d0b1ddb9a38fa101c659e

HTTP Headers

GET /43461/images/Icon-ionic-md-trophy.png HTTP/1.1
Host: mgkstatic33.b-cdn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://newgreatoffers.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Tue, 16 Apr 2024 09:55:03 GMT
content-type: image/png
content-length: 3992
server: BunnyCDN-NO1-830
cdn-pullzone: 1367785
cdn-uid: 6f116605-ddce-4644-a514-65e3765b9786
cdn-requestcountrycode: NO
cache-control: max-age=3600
etag: "aa55fd19e5efcaea20c5baf81e722bbc"
last-modified: Wed, 13 Mar 2024 15:17:30 GMT
x-rgw-object-type: Normal
x-amz-request-id: tx0000052d3ae9d438c6d95-0065f1c7cc-52830f45-ams3c
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-do-cdn-uuid: b0c9cd13-c401-4707-9471-40949c09e155
cf-cache-status: HIT
cf-ray: 869c8b73bf9f0b45-OSL
cdn-proxyver: 1.04
cdn-requestpullsuccess: True
cdn-requestpullcode: 200
cdn-cachedat: 03/25/2024 05:36:41
cdn-edgestorageid: 830
cdn-status: 200
cdn-requestid: 108e9985a73d6a86894f513eaae0f41a
cdn-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2

GET mgkstatic33.b-cdn.net/43461/images/Icon-awesome-download.png

194.242.11.186

200 OK

3.8 kB

URL GET HTTP/2
mgkstatic33.b-cdn.net/43461/images/Icon-awesome-download.png
IP
194.242.11.186:443
ASN
#34989 ServeTheWorld AS

Requested by
https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Certificate
IssuerSectigo Limited
Subject*.b-cdn.net
FingerprintFC:D9:3E:09:69:F5:9D:8A:AA:45:73:03:05:F1:8D:E4:5B:80:10:E4
ValiditySun, 05 Nov 2023 00:00:00 GMT - Mon, 11 Nov 2024 23:59:59 GMT

File type
PNG image data, 78 x 78, 8-bit/color RGBA, non-interlaced
Size
3.8 kB (3776 bytes)
Hash
2973d7d42cbc07bd0099eec135a5de96
a657b46c370c998c751368bd9231d9729e2b8d23
cd37a4eede36ce73ad4388f7f6a0483c87455e888b16eaee0c9e076abf7882dc

HTTP Headers

GET /43461/images/Icon-awesome-download.png HTTP/1.1
Host: mgkstatic33.b-cdn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://newgreatoffers.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Tue, 16 Apr 2024 09:55:03 GMT
content-type: image/png
content-length: 3776
server: BunnyCDN-NO1-830
cdn-pullzone: 1367785
cdn-uid: 6f116605-ddce-4644-a514-65e3765b9786
cdn-requestcountrycode: NO
cache-control: max-age=3600
etag: "2973d7d42cbc07bd0099eec135a5de96"
last-modified: Wed, 13 Mar 2024 15:17:26 GMT
x-rgw-object-type: Normal
x-amz-request-id: tx0000096a6b8a15cae6941-0065f29eca-5281cd35-ams3c
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-do-cdn-uuid: b0c9cd13-c401-4707-9471-40949c09e155
cf-cache-status: HIT
cf-ray: 869c8b74dc1c0b55-OSL
cdn-proxyver: 1.04
cdn-requestpullsuccess: True
cdn-requestpullcode: 200
cdn-cachedat: 03/25/2024 05:36:41
cdn-edgestorageid: 830
cdn-status: 200
cdn-requestid: d0ad99f582d0fe573c415b7dd1869c35
cdn-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2

GET mgkstatic33.b-cdn.net/43461/images/Icon-awesome-rocket.png

194.242.11.186

200 OK

3.7 kB

URL GET HTTP/2
mgkstatic33.b-cdn.net/43461/images/Icon-awesome-rocket.png
IP
194.242.11.186:443
ASN
#34989 ServeTheWorld AS

Requested by
https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Certificate
IssuerSectigo Limited
Subject*.b-cdn.net
FingerprintFC:D9:3E:09:69:F5:9D:8A:AA:45:73:03:05:F1:8D:E4:5B:80:10:E4
ValiditySun, 05 Nov 2023 00:00:00 GMT - Mon, 11 Nov 2024 23:59:59 GMT

File type
PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
Size
3.7 kB (3717 bytes)
Hash
e26549054b8a37aff472cc3c68ca9f92
6d982d6d54f9f1af0ee1b88992dd25a16c66d77d
7cdbc2c72709df7bd0a11927adf1f751a7fc681d3e032267a2b9c4e328dcf40b

HTTP Headers

GET /43461/images/Icon-awesome-rocket.png HTTP/1.1
Host: mgkstatic33.b-cdn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://newgreatoffers.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Tue, 16 Apr 2024 09:55:03 GMT
content-type: image/png
content-length: 3717
server: BunnyCDN-NO1-830
cdn-pullzone: 1367785
cdn-uid: 6f116605-ddce-4644-a514-65e3765b9786
cdn-requestcountrycode: NO
cache-control: max-age=3600
etag: "e26549054b8a37aff472cc3c68ca9f92"
last-modified: Wed, 13 Mar 2024 15:17:28 GMT
x-rgw-object-type: Normal
x-amz-request-id: tx000001277ebaeb444c088-0065f29eca-52830f45-ams3c
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-do-cdn-uuid: b0c9cd13-c401-4707-9471-40949c09e155
cf-cache-status: REVALIDATED
cf-ray: 865fdc82efeb7130-OSL
cdn-proxyver: 1.04
cdn-requestpullsuccess: True
cdn-requestpullcode: 200
cdn-cachedat: 03/17/2024 20:51:30
cdn-edgestorageid: 830
cdn-status: 200
cdn-requestid: 07d7be4da5089575e5294e69f3426c24
cdn-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2

GET mgkstatic33.b-cdn.net/43461/images/phone-with-shadow-bitbotapp.png

194.242.11.186

200 OK

101 kB

URL GET HTTP/2
mgkstatic33.b-cdn.net/43461/images/phone-with-shadow-bitbotapp.png
IP
194.242.11.186:443
ASN
#34989 ServeTheWorld AS

Requested by
https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Certificate
IssuerSectigo Limited
Subject*.b-cdn.net
FingerprintFC:D9:3E:09:69:F5:9D:8A:AA:45:73:03:05:F1:8D:E4:5B:80:10:E4
ValiditySun, 05 Nov 2023 00:00:00 GMT - Mon, 11 Nov 2024 23:59:59 GMT

File type
PNG image data, 522 x 848, 8-bit/color RGBA, non-interlaced
Size
101 kB (101329 bytes)
Hash
8d3c7b42fdd79ef3c7d81aee046465c8
933e6035c9082dc87418519e8c4e6550c3f1d8a1
f6d18c1ec94df13f3f335ee98f1cdc6010656e117c6a5bd0b47812580c188123

HTTP Headers

GET /43461/images/phone-with-shadow-bitbotapp.png HTTP/1.1
Host: mgkstatic33.b-cdn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://newgreatoffers.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Tue, 16 Apr 2024 09:55:03 GMT
content-type: image/png
content-length: 101329
server: BunnyCDN-NO1-830
cdn-pullzone: 1367785
cdn-uid: 6f116605-ddce-4644-a514-65e3765b9786
cdn-requestcountrycode: NO
cache-control: max-age=3600
etag: "8d3c7b42fdd79ef3c7d81aee046465c8"
last-modified: Wed, 13 Mar 2024 15:17:30 GMT
x-rgw-object-type: Normal
x-amz-request-id: tx000001497924583aa2f5c-0065f1c7cc-5281cd5d-ams3c
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-do-cdn-uuid: b0c9cd13-c401-4707-9471-40949c09e155
cf-cache-status: REVALIDATED
cf-ray: 865fdc830eae56a4-OSL
cdn-proxyver: 1.04
cdn-requestpullsuccess: True
cdn-requestpullcode: 200
cdn-cachedat: 03/17/2024 20:51:30
cdn-edgestorageid: 830
cdn-status: 200
cdn-requestid: c226050613faf513d5539903e04e5bc5
cdn-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2

GET mgkstatic33.b-cdn.net/43461/images/Polygon-10.png

194.242.11.186

200 OK

465 B

URL GET HTTP/2
mgkstatic33.b-cdn.net/43461/images/Polygon-10.png
IP
194.242.11.186:443
ASN
#34989 ServeTheWorld AS

Requested by
https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Certificate
IssuerSectigo Limited
Subject*.b-cdn.net
FingerprintFC:D9:3E:09:69:F5:9D:8A:AA:45:73:03:05:F1:8D:E4:5B:80:10:E4
ValiditySun, 05 Nov 2023 00:00:00 GMT - Mon, 11 Nov 2024 23:59:59 GMT

File type
PNG image data, 46 x 69, 8-bit/color RGBA, non-interlaced
Size
465 B (465 bytes)
Hash
250d763ae00c38fc8d960305e2f11950
130acf813f4c80c9cc7db53decc8799c28e3eb43
d074af86e879deab518c017c9078083a6dc2214d6ca96b892c245bab5c94ceb1

HTTP Headers

GET /43461/images/Polygon-10.png HTTP/1.1
Host: mgkstatic33.b-cdn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://newgreatoffers.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Tue, 16 Apr 2024 09:55:03 GMT
content-type: image/png
content-length: 465
server: BunnyCDN-NO1-830
cdn-pullzone: 1367785
cdn-uid: 6f116605-ddce-4644-a514-65e3765b9786
cdn-requestcountrycode: NO
cache-control: max-age=3600
etag: "250d763ae00c38fc8d960305e2f11950"
last-modified: Wed, 13 Mar 2024 15:17:46 GMT
x-rgw-object-type: Normal
x-amz-request-id: tx000003cd7736e5659ab25-0065f1c7cc-52830f45-ams3c
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-do-cdn-uuid: b0c9cd13-c401-4707-9471-40949c09e155
cf-cache-status: REVALIDATED
cf-ray: 865fdc844d30b517-OSL
cdn-proxyver: 1.04
cdn-requestpullsuccess: True
cdn-requestpullcode: 200
cdn-cachedat: 03/17/2024 20:51:30
cdn-edgestorageid: 830
cdn-status: 200
cdn-requestid: d4e2ab4c6896e848118255377bc84bcf
cdn-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2

GET mgkstatic33.b-cdn.net/43461/images/0PTcCKIlgr.gif

194.242.11.186

200 OK

18 kB

URL GET HTTP/2
mgkstatic33.b-cdn.net/43461/images/0PTcCKIlgr.gif
IP
194.242.11.186:443
ASN
#34989 ServeTheWorld AS

Requested by
https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Certificate
IssuerSectigo Limited
Subject*.b-cdn.net
FingerprintFC:D9:3E:09:69:F5:9D:8A:AA:45:73:03:05:F1:8D:E4:5B:80:10:E4
ValiditySun, 05 Nov 2023 00:00:00 GMT - Mon, 11 Nov 2024 23:59:59 GMT

File type
GIF image data, version 89a, 64 x 64
Size
18 kB (17963 bytes)
Hash
313d1440d21ae95e5dcfa2f447f14456
8c850ce459c6b12090b887f19b3d824f49049a23
f95799c3fd4e8f9124459f03b697451744cec2c9fbc74626d2dd50c17e5c72bb

HTTP Headers

GET /43461/images/0PTcCKIlgr.gif HTTP/1.1
Host: mgkstatic33.b-cdn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://newgreatoffers.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Tue, 16 Apr 2024 09:55:03 GMT
content-type: image/gif
content-length: 17963
server: BunnyCDN-NO1-830
cdn-pullzone: 1367785
cdn-uid: 6f116605-ddce-4644-a514-65e3765b9786
cdn-requestcountrycode: NO
cache-control: max-age=3600
etag: "313d1440d21ae95e5dcfa2f447f14456"
last-modified: Wed, 13 Mar 2024 15:17:39 GMT
x-rgw-object-type: Normal
x-amz-request-id: tx0000020d12b6785ad2760-0065f29eca-52830f45-ams3c
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-do-cdn-uuid: b0c9cd13-c401-4707-9471-40949c09e155
cf-cache-status: HIT
cf-ray: 864461ec9f3a56ae-OSL
cdn-proxyver: 1.04
cdn-requestpullsuccess: True
cdn-requestpullcode: 200
cdn-cachedat: 03/14/2024 12:49:13
cdn-edgestorageid: 830
cdn-status: 200
cdn-requestid: 97ca0904bfba3df309d2b4a4e2d57a82
cdn-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2

GET mgkstatic33.b-cdn.net/43461/images/robot-and-phone-final-img.png

194.242.11.186

200 OK

405 kB

URL GET HTTP/2
mgkstatic33.b-cdn.net/43461/images/robot-and-phone-final-img.png
IP
194.242.11.186:443
ASN
#34989 ServeTheWorld AS

Requested by
https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Certificate
IssuerSectigo Limited
Subject*.b-cdn.net
FingerprintFC:D9:3E:09:69:F5:9D:8A:AA:45:73:03:05:F1:8D:E4:5B:80:10:E4
ValiditySun, 05 Nov 2023 00:00:00 GMT - Mon, 11 Nov 2024 23:59:59 GMT

File type
PNG image data, 960 x 795, 8-bit/color RGBA, non-interlaced
Size
405 kB (405350 bytes)
Hash
b961c9e7e178aa1bb10a1ed8bbc37f76
5a4ae86e986118b8792a85c6c561e07c1f23ee03
15775556fc3dd033df8b911c03448a47cc4e14f26e36aecc2ac378f76c9307d8

HTTP Headers

GET /43461/images/robot-and-phone-final-img.png HTTP/1.1
Host: mgkstatic33.b-cdn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://newgreatoffers.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Tue, 16 Apr 2024 09:55:03 GMT
content-type: image/png
content-length: 405350
server: BunnyCDN-NO1-830
cdn-pullzone: 1367785
cdn-uid: 6f116605-ddce-4644-a514-65e3765b9786
cdn-requestcountrycode: NO
cache-control: max-age=3600
etag: "b961c9e7e178aa1bb10a1ed8bbc37f76"
last-modified: Wed, 13 Mar 2024 15:17:46 GMT
x-rgw-object-type: Normal
x-amz-request-id: tx00000d699074756f91dc7-0065f1c7cc-5281cd5d-ams3c
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-do-cdn-uuid: b0c9cd13-c401-4707-9471-40949c09e155
cf-cache-status: HIT
cf-ray: 869c8b76181e0b45-OSL
cdn-proxyver: 1.04
cdn-requestpullsuccess: True
cdn-requestpullcode: 200
cdn-cachedat: 03/25/2024 05:36:41
cdn-edgestorageid: 830
cdn-status: 200
cdn-requestid: d1fa5e920fd70c5e644a38d35e985d27
cdn-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2

GET newgreatoffers.top/css/flow.css?id=1a2dada5ba76c1b29ae1

172.67.215.176

200 OK

642 B

URL GET HTTP/3
newgreatoffers.top/css/flow.css?id=1a2dada5ba76c1b29ae1
IP
172.67.215.176:443
ASN
#13335 CLOUDFLARENET

Requested by
https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Certificate
IssuerGoogle Trust Services LLC
Subjectnewgreatoffers.top
Fingerprint8D:52:89:23:5C:65:D7:D9:03:5A:E6:CA:C5:DF:46:16:56:55:B5:2D
ValidityWed, 10 Apr 2024 05:11:29 GMT - Tue, 09 Jul 2024 05:11:28 GMT

File type
ASCII text, with very long lines (311)
Size
642 B (642 bytes)
Hash
1a2dada5ba76c1b29ae13ddd11b16743
5076e9545fae3a01adce54e076706173de9f48c5
df456c4794989b11dda8d76813cbf505b2707048f4cc89d7db15956779ca3fb0

HTTP Headers

GET /css/flow.css?id=1a2dada5ba76c1b29ae1 HTTP/1.1
Host: newgreatoffers.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Cookie: XSRF-TOKEN=eyJpdiI6Im1aSHl2VVcxbXA2ZTdUUTRXRGZxUVE9PSIsInZhbHVlIjoiM3BZbFBYRGpUVHBXV3FIcVwvTUVlNGNmSWJUNGtSXC96aW9nSHY4ZWhvYk1LbmE2Wm5uNVZ6T1VBanhiaVNRQXcyIiwibWFjIjoiYzcwNWRjOTg1MzIyNmYwNWRkNzU4YjY1ZDMyZTdkNDczNzQwYzQ1N2ZkYzZjMzc3OGY4YjA3MWIwNTA3ZTk3ZCJ9; c=eyJpdiI6IkErZXZUeW5Uejgya0hUczU0Q2RaRlE9PSIsInZhbHVlIjoiVXlGekU2YVZlVHZ6bm9ZMnFZdTZrbUZCTzZTb2w3eFwvZmw4M3BJbXlhejdiV0xpXC9rVnZHb3ZQZm81Q05seWxhIiwibWFjIjoiMjkwN2Q5MGM4Zjc0ODUyNTg3Nzg4YzllYzQ5YThmYjczZTQzNWM2YjdkOGZhOGU3MWNhNjQyZjUzMmUwN2IwMyJ9
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 16 Apr 2024 09:55:03 GMT
content-type: text/css
last-modified: Wed, 27 Mar 2024 14:41:29 GMT
vary: Accept-Encoding
etag: W/"66043019-181"
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-proc: 3
cache-control: max-age=14400
cf-cache-status: HIT
age: 101
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vGce7HP6QqSd%2BzsFRmSIs6iXwhaD789dLXqN13CdI6T4MfKH6ul6jnqkYYWf3%2BMYeyTi4Vm66GXkwRFp3wgoO%2BBOJ1Enz2bUuWLUNg89odgGIK8AT%2B5HLtNaGf41rHzAgVzeg7o%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87534c298980568d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

GET newgreatoffers.top/media/sad-face.svg

172.67.215.176

200 OK

1.2 kB

URL GET HTTP/3
newgreatoffers.top/media/sad-face.svg
IP
172.67.215.176:443
ASN
#13335 CLOUDFLARENET

Requested by
https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Certificate
IssuerGoogle Trust Services LLC
Subjectnewgreatoffers.top
Fingerprint8D:52:89:23:5C:65:D7:D9:03:5A:E6:CA:C5:DF:46:16:56:55:B5:2D
ValidityWed, 10 Apr 2024 05:11:29 GMT - Tue, 09 Jul 2024 05:11:28 GMT

File type
SVG Scalable Vector Graphics image
Size
1.2 kB (1156 bytes)
Hash
b53fccab8b86eecc2ff24237d099321d
39ad520ffafe5e725ac32e823911575dbfb89ec9
186b9079a05f19ddd2a548dbc1ec2c69087c76d8e9e1637dbced630edb793104

HTTP Headers

GET /media/sad-face.svg HTTP/1.1
Host: newgreatoffers.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Cookie: XSRF-TOKEN=eyJpdiI6Im1aSHl2VVcxbXA2ZTdUUTRXRGZxUVE9PSIsInZhbHVlIjoiM3BZbFBYRGpUVHBXV3FIcVwvTUVlNGNmSWJUNGtSXC96aW9nSHY4ZWhvYk1LbmE2Wm5uNVZ6T1VBanhiaVNRQXcyIiwibWFjIjoiYzcwNWRjOTg1MzIyNmYwNWRkNzU4YjY1ZDMyZTdkNDczNzQwYzQ1N2ZkYzZjMzc3OGY4YjA3MWIwNTA3ZTk3ZCJ9; c=eyJpdiI6IkErZXZUeW5Uejgya0hUczU0Q2RaRlE9PSIsInZhbHVlIjoiVXlGekU2YVZlVHZ6bm9ZMnFZdTZrbUZCTzZTb2w3eFwvZmw4M3BJbXlhejdiV0xpXC9rVnZHb3ZQZm81Q05seWxhIiwibWFjIjoiMjkwN2Q5MGM4Zjc0ODUyNTg3Nzg4YzllYzQ5YThmYjczZTQzNWM2YjdkOGZhOGU3MWNhNjQyZjUzMmUwN2IwMyJ9
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 16 Apr 2024 09:55:03 GMT
content-type: image/svg+xml
last-modified: Wed, 27 Mar 2024 14:41:29 GMT
vary: Accept-Encoding
etag: W/"66043019-5dc"
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-proc: 3
cache-control: max-age=14400
cf-cache-status: HIT
age: 100
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Yky3wEdr5z7UCPV5%2BGo7XczZfumr7R98JHQGe7g%2FAS7TlSKEQR1xU%2FqOG3Ovr6DCMWQUkQk6YoZiSGTCSbJkZ7d134nMLJsPgWAIrlx4goJUaLq0Kr%2FQx7hIwHBF%2FeUsVzTQjUU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87534c2999a6568d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

GET static-133.b-cdn.net/43461/images/bg-img-2.jpg

194.242.11.186

200 OK

242 kB

URL GET HTTP/2
static-133.b-cdn.net/43461/images/bg-img-2.jpg
IP
194.242.11.186:443
ASN
#34989 ServeTheWorld AS

Requested by
https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Certificate
IssuerSectigo Limited
Subject*.b-cdn.net
FingerprintFC:D9:3E:09:69:F5:9D:8A:AA:45:73:03:05:F1:8D:E4:5B:80:10:E4
ValiditySun, 05 Nov 2023 00:00:00 GMT - Mon, 11 Nov 2024 23:59:59 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1920x788, components 3
Size
242 kB (241782 bytes)
Hash
87ea1d39178e8229c5e1d3f4820d371b
ffbc7e6774a0e1fdcbc0fa2dea5fa1ee91b2095f
762daaf85334b0f65ee1a790a52257782cef0f4481df7ce04715bfd2acf0f633

HTTP Headers

GET /43461/images/bg-img-2.jpg HTTP/1.1
Host: static-133.b-cdn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mgkstatic33.b-cdn.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Tue, 16 Apr 2024 09:55:04 GMT
content-type: image/jpeg
content-length: 241782
server: BunnyCDN-NO1-830
cdn-pullzone: 561175
cdn-uid: 6f116605-ddce-4644-a514-65e3765b9786
cdn-requestcountrycode: NO
cache-control: max-age=3600
etag: "87ea1d39178e8229c5e1d3f4820d371b"
last-modified: Wed, 13 Mar 2024 15:17:40 GMT
cf-bgj: h2pri
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: tx0000090b60f5f7e80b015-0065f29eca-52830f45-ams3c
x-do-cdn-uuid: b0c9cd13-c401-4707-9471-40949c09e155
x-rgw-object-type: Normal
cf-cache-status: HIT
cf-ray: 869c8b7778650b45-OSL
cdn-proxyver: 1.04
cdn-requestpullsuccess: True
cdn-requestpullcode: 200
cdn-cachedat: 03/25/2024 05:36:42
cdn-edgestorageid: 830
cdn-status: 200
cdn-requestid: 57341ab945ef8d604844a6512c84db6a
cdn-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2

GET static-133.b-cdn.net/43461/images/mockup-three-phone.png

194.242.11.186

200 OK

965 kB

URL GET HTTP/2
static-133.b-cdn.net/43461/images/mockup-three-phone.png
IP
194.242.11.186:443
ASN
#34989 ServeTheWorld AS

Requested by
https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Certificate
IssuerSectigo Limited
Subject*.b-cdn.net
FingerprintFC:D9:3E:09:69:F5:9D:8A:AA:45:73:03:05:F1:8D:E4:5B:80:10:E4
ValiditySun, 05 Nov 2023 00:00:00 GMT - Mon, 11 Nov 2024 23:59:59 GMT

File type
PNG image data, 1920 x 808, 8-bit/color RGBA, non-interlaced
Size
965 kB (964789 bytes)
Hash
d656e316c5f67a3d7eadc3a4e8a9c1f2
41d0a52bb6ad7351526c739589b85b9c275e963d
2236f4e50c3ddd56f65a30164785676c5d3a1569fa9297418679f25f6ff0bd90

HTTP Headers

GET /43461/images/mockup-three-phone.png HTTP/1.1
Host: static-133.b-cdn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mgkstatic33.b-cdn.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Tue, 16 Apr 2024 09:55:04 GMT
content-type: image/png
content-length: 964789
server: BunnyCDN-NO1-830
cdn-pullzone: 561175
cdn-uid: 6f116605-ddce-4644-a514-65e3765b9786
cdn-requestcountrycode: NO
cache-control: max-age=3600
etag: "d656e316c5f67a3d7eadc3a4e8a9c1f2"
last-modified: Wed, 13 Mar 2024 15:17:29 GMT
x-rgw-object-type: Normal
x-amz-request-id: tx000002dd9f695ca30bbb0-0065f29eca-5281cd35-ams3c
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-do-cdn-uuid: b0c9cd13-c401-4707-9471-40949c09e155
cf-cache-status: HIT
cf-ray: 8673df3bda460b3d-OSL
cdn-proxyver: 1.04
cdn-requestpullsuccess: True
cdn-requestpullcode: 200
cdn-cachedat: 03/20/2024 07:08:37
cdn-edgestorageid: 830
cdn-status: 200
cdn-requestid: 0b450e3576ed9c43537c9e76108e2a1e
cdn-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2

GET static-133.b-cdn.net/43461/images/hero-img-new.jpg

194.242.11.186

200 OK

394 kB

URL GET HTTP/2
static-133.b-cdn.net/43461/images/hero-img-new.jpg
IP
194.242.11.186:443
ASN
#34989 ServeTheWorld AS

Requested by
https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Certificate
IssuerSectigo Limited
Subject*.b-cdn.net
FingerprintFC:D9:3E:09:69:F5:9D:8A:AA:45:73:03:05:F1:8D:E4:5B:80:10:E4
ValiditySun, 05 Nov 2023 00:00:00 GMT - Mon, 11 Nov 2024 23:59:59 GMT

File type
JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=0], baseline, precision 8, 1920x935, components 3
Size
394 kB (393575 bytes)
Hash
8867f07ab37b30a70556531fab9ab745
b38438f367b8db496568700d6f07ffc17a185151
d74199bd755af51a2080d1caad0f8655afebbd5da7b56ee3302699c7bd856b0a

HTTP Headers

GET /43461/images/hero-img-new.jpg HTTP/1.1
Host: static-133.b-cdn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mgkstatic33.b-cdn.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Tue, 16 Apr 2024 09:55:04 GMT
content-type: image/jpeg
content-length: 393575
server: BunnyCDN-NO1-830
cdn-pullzone: 561175
cdn-uid: 6f116605-ddce-4644-a514-65e3765b9786
cdn-requestcountrycode: NO
cache-control: max-age=3600
etag: "8867f07ab37b30a70556531fab9ab745"
last-modified: Wed, 13 Mar 2024 15:17:40 GMT
cf-bgj: h2pri
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: tx000001c2614e59fb41b02-0065f1c7cc-52827f33-ams3c
x-do-cdn-uuid: b0c9cd13-c401-4707-9471-40949c09e155
x-rgw-object-type: Normal
cf-cache-status: HIT
cf-ray: 8673df3bda3bb51b-OSL
cdn-proxyver: 1.04
cdn-requestpullsuccess: True
cdn-requestpullcode: 200
cdn-cachedat: 03/20/2024 07:08:37
cdn-edgestorageid: 830
cdn-status: 200
cdn-requestid: c94dfbe8910a65d216d9b51e88e913d7
cdn-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2

GET static-133.b-cdn.net/43461/images/bg-img-3.jpg

194.242.11.186

200 OK

246 kB

URL GET HTTP/2
static-133.b-cdn.net/43461/images/bg-img-3.jpg
IP
194.242.11.186:443
ASN
#34989 ServeTheWorld AS

Requested by
https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Certificate
IssuerSectigo Limited
Subject*.b-cdn.net
FingerprintFC:D9:3E:09:69:F5:9D:8A:AA:45:73:03:05:F1:8D:E4:5B:80:10:E4
ValiditySun, 05 Nov 2023 00:00:00 GMT - Mon, 11 Nov 2024 23:59:59 GMT

File type
JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=0], baseline, precision 8, 1920x473, components 3
Size
246 kB (246271 bytes)
Hash
1b514cd6bf37cbbb0738a585510fd600
e171926ee51ece136dc499e19c1adbb118f26f35
9d89491bdea31bb858e17bb9add38046eefa867be00184f3b653798969e3a7ea

HTTP Headers

GET /43461/images/bg-img-3.jpg HTTP/1.1
Host: static-133.b-cdn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mgkstatic33.b-cdn.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Tue, 16 Apr 2024 09:55:04 GMT
content-type: image/jpeg
content-length: 246271
server: BunnyCDN-NO1-830
cdn-pullzone: 561175
cdn-uid: 6f116605-ddce-4644-a514-65e3765b9786
cdn-requestcountrycode: NO
cache-control: max-age=3600
etag: "1b514cd6bf37cbbb0738a585510fd600"
last-modified: Wed, 13 Mar 2024 15:17:38 GMT
cf-bgj: h2pri
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: tx000000225d7167c00f3db-0065f29eca-52827f33-ams3c
x-do-cdn-uuid: b0c9cd13-c401-4707-9471-40949c09e155
x-rgw-object-type: Normal
cf-cache-status: HIT
cf-ray: 8673df3bdb3556cb-OSL
cdn-proxyver: 1.04
cdn-requestpullsuccess: True
cdn-requestpullcode: 200
cdn-cachedat: 03/20/2024 07:08:37
cdn-edgestorageid: 830
cdn-status: 200
cdn-requestid: 375dd722d64c08e8d3ed775c087f7db0
cdn-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2

GET newgreatoffers.top/images/vendor/intl-tel-input/build/flags.png?416250f60d785a2e02f17e054d2e4e44

172.67.215.176

200 OK

71 kB

URL GET HTTP/3
newgreatoffers.top/images/vendor/intl-tel-input/build/flags.png?416250f60d785a2e02f17e054d2e4e44
IP
172.67.215.176:443
ASN
#13335 CLOUDFLARENET

Requested by
https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Certificate
IssuerGoogle Trust Services LLC
Subjectnewgreatoffers.top
Fingerprint8D:52:89:23:5C:65:D7:D9:03:5A:E6:CA:C5:DF:46:16:56:55:B5:2D
ValidityWed, 10 Apr 2024 05:11:29 GMT - Tue, 09 Jul 2024 05:11:28 GMT

File type
PNG image data, 5652 x 15, 8-bit/color RGBA, non-interlaced
Size
71 kB (70857 bytes)
Hash
416250f60d785a2e02f17e054d2e4e44
21572c9751e5a3dc20395befa0fcb349c32c4811
0a012cf808a24573168308916092d2d4bd3f2b4af8e16b59167013cc77acee55

HTTP Headers

GET /images/vendor/intl-tel-input/build/flags.png?416250f60d785a2e02f17e054d2e4e44 HTTP/1.1
Host: newgreatoffers.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://newgreatoffers.top/css/forms.css?id=f996a15d4340ce7f6a99
Cookie: XSRF-TOKEN=eyJpdiI6Im1aSHl2VVcxbXA2ZTdUUTRXRGZxUVE9PSIsInZhbHVlIjoiM3BZbFBYRGpUVHBXV3FIcVwvTUVlNGNmSWJUNGtSXC96aW9nSHY4ZWhvYk1LbmE2Wm5uNVZ6T1VBanhiaVNRQXcyIiwibWFjIjoiYzcwNWRjOTg1MzIyNmYwNWRkNzU4YjY1ZDMyZTdkNDczNzQwYzQ1N2ZkYzZjMzc3OGY4YjA3MWIwNTA3ZTk3ZCJ9; c=eyJpdiI6IkErZXZUeW5Uejgya0hUczU0Q2RaRlE9PSIsInZhbHVlIjoiVXlGekU2YVZlVHZ6bm9ZMnFZdTZrbUZCTzZTb2w3eFwvZmw4M3BJbXlhejdiV0xpXC9rVnZHb3ZQZm81Q05seWxhIiwibWFjIjoiMjkwN2Q5MGM4Zjc0ODUyNTg3Nzg4YzllYzQ5YThmYjczZTQzNWM2YjdkOGZhOGU3MWNhNjQyZjUzMmUwN2IwMyJ9
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 16 Apr 2024 09:55:04 GMT
content-type: image/png
content-length: 70857
last-modified: Wed, 27 Mar 2024 14:41:19 GMT
etag: "6604300f-114c9"
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-proc: 2
cache-control: max-age=14400
cf-cache-status: HIT
age: 101
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6gpxrdzwlEcUFchRLdS9rkKQwjMugdDxTrkI4b6JTTN3cAqqumHRwJVc2Oh0UHWCAsGrN17efN1rb%2F9fMVhohcFOa73pUgPB2CfJHg99JV%2BrNnMaqS851c9g6IdPcASTutStrtM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87534c30cb23568d-OSL
alt-svc: h3=":443"; ma=86400

GET static-133.b-cdn.net/43461/images/bg-img-4.jpg

194.242.11.186

200 OK

375 kB

URL GET HTTP/2
static-133.b-cdn.net/43461/images/bg-img-4.jpg
IP
194.242.11.186:443
ASN
#34989 ServeTheWorld AS

Requested by
https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Certificate
IssuerSectigo Limited
Subject*.b-cdn.net
FingerprintFC:D9:3E:09:69:F5:9D:8A:AA:45:73:03:05:F1:8D:E4:5B:80:10:E4
ValiditySun, 05 Nov 2023 00:00:00 GMT - Mon, 11 Nov 2024 23:59:59 GMT

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1920x692, components 3
Size
375 kB (374893 bytes)
Hash
ca2af1e0db4ffa75dc11257debbca866
9a4ecbbbb46dc174daa5eb39d804d00914602fdf
26c2c413b4a6d8f79064e6a92528e0a886da3e41f99acf7e5b8a01ff082f3f97

HTTP Headers

GET /43461/images/bg-img-4.jpg HTTP/1.1
Host: static-133.b-cdn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mgkstatic33.b-cdn.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Tue, 16 Apr 2024 09:55:04 GMT
content-type: image/jpeg
content-length: 374893
server: BunnyCDN-NO1-830
cdn-pullzone: 561175
cdn-uid: 6f116605-ddce-4644-a514-65e3765b9786
cdn-requestcountrycode: NO
cache-control: max-age=3600
etag: "ca2af1e0db4ffa75dc11257debbca866"
last-modified: Wed, 13 Mar 2024 15:17:41 GMT
cf-bgj: h2pri
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-request-id: tx000003769d44dac3c04af-0065f1c7cc-5280acec-ams3c
x-do-cdn-uuid: b0c9cd13-c401-4707-9471-40949c09e155
x-rgw-object-type: Normal
cf-cache-status: HIT
cf-ray: 869c8b777cce0b55-OSL
cdn-proxyver: 1.04
cdn-requestpullsuccess: True
cdn-requestpullcode: 200
cdn-cachedat: 03/25/2024 05:36:42
cdn-edgestorageid: 830
cdn-status: 200
cdn-requestid: 7bb72fc403aefa6d8a50c68edc71c8e9
cdn-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2

GET fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

216.58.207.227

200 OK

48 kB

URL GET HTTP/2
fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
IP
216.58.207.227:443
ASN
#15169 GOOGLE

Requested by
https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint8F:81:43:71:C4:F3:8C:FA:6D:EC:B4:5E:1F:58:71:AA:48:42:0E:E9
ValidityMon, 04 Mar 2024 07:16:39 GMT - Mon, 27 May 2024 07:16:38 GMT

File type
Web Open Font Format (Version 2), TrueType, length 48236, version 1.0
Size
48 kB (48236 bytes)
Hash
015c126a3520c9a8f6a27979d0266e96
2acf956561d44434a6d84204670cf849d3215d5f
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

HTTP Headers

GET /s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://newgreatoffers.top
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 48236
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 11 Apr 2024 02:35:00 GMT
expires: Fri, 11 Apr 2025 02:35:00 GMT
cache-control: public, max-age=31536000
age: 458404
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

GET newgreatoffers.top/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

172.67.215.176

200 OK

1.1 kB

URL GET HTTP/3
newgreatoffers.top/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
IP
172.67.215.176:443
ASN
#13335 CLOUDFLARENET

Requested by
https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Certificate
IssuerGoogle Trust Services LLC
Subjectnewgreatoffers.top
Fingerprint8D:52:89:23:5C:65:D7:D9:03:5A:E6:CA:C5:DF:46:16:56:55:B5:2D
ValidityWed, 10 Apr 2024 05:11:29 GMT - Tue, 09 Jul 2024 05:11:28 GMT

File type
gzip compressed data, from Unix
Size
1.1 kB (1126 bytes)
Hash
695a6216d14509a4ddc536e096f31b9c
abec491daf873a1a186f3b0a606ad571effb2e8e
dc00fa87022876785357886f5002eb96cfbc60ec0e4948bc78670362b4f22b9e

HTTP Headers

GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1
Host: newgreatoffers.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Cookie: XSRF-TOKEN=eyJpdiI6Im1aSHl2VVcxbXA2ZTdUUTRXRGZxUVE9PSIsInZhbHVlIjoiM3BZbFBYRGpUVHBXV3FIcVwvTUVlNGNmSWJUNGtSXC96aW9nSHY4ZWhvYk1LbmE2Wm5uNVZ6T1VBanhiaVNRQXcyIiwibWFjIjoiYzcwNWRjOTg1MzIyNmYwNWRkNzU4YjY1ZDMyZTdkNDczNzQwYzQ1N2ZkYzZjMzc3OGY4YjA3MWIwNTA3ZTk3ZCJ9; c=eyJpdiI6IkErZXZUeW5Uejgya0hUczU0Q2RaRlE9PSIsInZhbHVlIjoiVXlGekU2YVZlVHZ6bm9ZMnFZdTZrbUZCTzZTb2w3eFwvZmw4M3BJbXlhejdiV0xpXC9rVnZHb3ZQZm81Q05seWxhIiwibWFjIjoiMjkwN2Q5MGM4Zjc0ODUyNTg3Nzg4YzllYzQ5YThmYjczZTQzNWM2YjdkOGZhOGU3MWNhNjQyZjUzMmUwN2IwMyJ9
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Tue, 16 Apr 2024 09:55:03 GMT
content-type: application/javascript
last-modified: Mon, 15 Apr 2024 08:31:34 GMT
etag: W/"661ce5e6-4d7"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qZF4f0U1peZZuHVcnulzkN2E0woLd%2By5nMxyKDlnwIKjjwAJr8QyXjsqY3a9M8t6IAez%2Fpt1hk2JUR5pmDGTh2bf535yOL%2Fak%2B3Acnaeqvwsgoih4%2B9zx89eQp%2FWC7PhhuRMMbc%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 87534c2999a8568d-OSL
x-frame-options: DENY
x-content-type-options: nosniff
expires: Thu, 18 Apr 2024 09:55:03 GMT
cache-control: max-age=172800, public
content-encoding: gzip

GET fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

216.58.207.227

200 OK

48 kB

URL GET HTTP/2
fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
IP
216.58.207.227:443
ASN
#15169 GOOGLE

Requested by
https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint8F:81:43:71:C4:F3:8C:FA:6D:EC:B4:5E:1F:58:71:AA:48:42:0E:E9
ValidityMon, 04 Mar 2024 07:16:39 GMT - Mon, 27 May 2024 07:16:38 GMT

File type
Web Open Font Format (Version 2), TrueType, length 48236, version 1.0
Size
48 kB (48236 bytes)
Hash
015c126a3520c9a8f6a27979d0266e96
2acf956561d44434a6d84204670cf849d3215d5f
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

HTTP Headers

GET /s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://newgreatoffers.top
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 48236
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 11 Apr 2024 02:35:00 GMT
expires: Fri, 11 Apr 2025 02:35:00 GMT
cache-control: public, max-age=31536000
age: 458404
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

GET fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

216.58.207.227

200 OK

48 kB

URL GET HTTP/2
fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
IP
216.58.207.227:443
ASN
#15169 GOOGLE

Requested by
https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint8F:81:43:71:C4:F3:8C:FA:6D:EC:B4:5E:1F:58:71:AA:48:42:0E:E9
ValidityMon, 04 Mar 2024 07:16:39 GMT - Mon, 27 May 2024 07:16:38 GMT

File type
Web Open Font Format (Version 2), TrueType, length 48236, version 1.0
Size
48 kB (48236 bytes)
Hash
015c126a3520c9a8f6a27979d0266e96
2acf956561d44434a6d84204670cf849d3215d5f
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

HTTP Headers

GET /s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://newgreatoffers.top
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 48236
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 11 Apr 2024 02:35:00 GMT
expires: Fri, 11 Apr 2025 02:35:00 GMT
cache-control: public, max-age=31536000
age: 458404
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

GET fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

216.58.207.227

200 OK

48 kB

URL GET HTTP/2
fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
IP
216.58.207.227:443
ASN
#15169 GOOGLE

Requested by
https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Certificate
IssuerGoogle Trust Services LLC
Subject*.gstatic.com
Fingerprint8F:81:43:71:C4:F3:8C:FA:6D:EC:B4:5E:1F:58:71:AA:48:42:0E:E9
ValidityMon, 04 Mar 2024 07:16:39 GMT - Mon, 27 May 2024 07:16:38 GMT

File type
Web Open Font Format (Version 2), TrueType, length 48236, version 1.0
Size
48 kB (48236 bytes)
Hash
015c126a3520c9a8f6a27979d0266e96
2acf956561d44434a6d84204670cf849d3215d5f
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa

HTTP Headers

GET /s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://newgreatoffers.top
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 48236
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 11 Apr 2024 02:35:00 GMT
expires: Fri, 11 Apr 2025 02:35:00 GMT
cache-control: public, max-age=31536000
age: 458404
last-modified: Thu, 14 Dec 2023 02:08:40 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

GET g.mtrck.org/c?aid=xoLG2W&lpid=9trgqE&aff_sub5b=cof4ltla6vts738dk9ag

13.248.167.248

302 Found

8.9 kB

URL User Request GET HTTP/2
g.mtrck.org/c?aid=xoLG2W&lpid=9trgqE&aff_sub5b=cof4ltla6vts738dk9ag
IP
13.248.167.248:443
ASN
#16509 AMAZON-02

Certificate
IssuerLet's Encrypt
Subjectg.mtrck.org
FingerprintB1:97:7C:87:E0:27:AF:43:D2:96:20:A4:78:6D:0C:61:EF:62:F7:69
ValidityThu, 14 Mar 2024 05:51:05 GMT - Wed, 12 Jun 2024 05:51:04 GMT

File type
data
Size
8.9 kB (8938 bytes)
Hash
1e8900ba0304780fd42341dbfd4f399c
283d69f6e9c677d941dc38fcfc3696628c02d8fe
a2d1a3a20182611a9e13bd52ee04c63290bd4dc6afb6e5e41d97337efd0aff80

HTTP Headers

GET /c?aid=xoLG2W&lpid=9trgqE&aff_sub5b=cof4ltla6vts738dk9ag HTTP/1.1
Host: g.mtrck.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
cache-control: no-cache, private
content-type: text/html; charset=UTF-8
date: Tue, 16 Apr 2024 09:55:02 GMT
location: https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
server: Caddy, nginx
set-cookie: XSRF-TOKEN=eyJpdiI6IjlnUmIway9IM2sycmtEK1R0SHNCdkE9PSIsInZhbHVlIjoiNUZ4SGxneFl3OWlqZEdsczUwRE5yQVp4a201cy9DL2tORFdXYzJQaUgyRktuNTI5MzIyMnlRcVpLV25tRUx3QVFwWjZaYWp5YVNaSStENnlCd1ZwcnJmOTZ2bzF2NWRSMllMVERtZzZUbk5OZWdpVHRGbWhrYVJKTzNnUWNwLzgiLCJtYWMiOiJlOTlhYjE1YThlZWIxZGJlMmFjOWNhYTE0NjEzODI3YWFmMzZmMWIwYmRhMWU3ZWNiMTAzNWVkMzYyNDA3ZGE5IiwidGFnIjoiIn0%3D; expires=Tue, 16-Apr-2024 11:55:02 GMT; Max-Age=7200; path=/; samesite=lax
clickbit_session=eyJpdiI6IndxQnN3YVVOOXpBaTBSQWJSK1hDc0E9PSIsInZhbHVlIjoiQVB3dnRuVVhGRHh1QzZQc0xvSjk2V3B3YzdoUlYxUUxwRzJzeTJ0QjFURFQvajdWUXdZekpsaVRvdkszbk5OMjNsUXJXK3duSkw3YkZHN29RY1JYUXNMK1hXd1hUYzFDMVU2SGIvbFlINVlwdVVkNGpmQkduSU9YY1hBcjVqQzYiLCJtYWMiOiJkNjFlMGQzNmU5ZmEzOTJmNTg5YTQ3NWEyZGQxMjVjYTc5YWYyMjhiOWQ4YTQ0MzdkZmM5MjlhN2UyMWY2ZjBmIiwidGFnIjoiIn0%3D; expires=Tue, 16-Apr-2024 11:55:02 GMT; Max-Age=7200; path=/; httponly; samesite=lax
cid=eyJpdiI6IkpCcGptTGlaTXNNc0JiTTRzVmhYTnc9PSIsInZhbHVlIjoiY1VNRDFYMjFKaFhwZndYQzdWY1poY0JxelA0VXFhalNIWDdpQnFKM1VFZlRBUzNhOFlSZkYzZWg2OUkrNFN0ZE42OGlSK3RDbEwvOUJHa3VHK0RqbzBPWWtEaVhmZ1FDSzNxNkc5V3UxQkk9IiwibWFjIjoiNDAzYTE5OTU3MjdiM2M0ZWU0NjEzNDBkMjVmODRlODQxNzFmY2NkYmIxMzhlN2QzZjllYTUzMmY1NGZiMDU4MyIsInRhZyI6IiJ9; expires=Sun, 31-Jul-2078 16:32:37 GMT; Max-Age=1713249455; path=/; httponly; samesite=lax
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
X-Firefox-Spdy: h2

GET mgkstatic33.b-cdn.net/43461/images/favicon.png

194.242.11.186

200 OK

1.8 kB

URL GET HTTP/2
mgkstatic33.b-cdn.net/43461/images/favicon.png
IP
194.242.11.186:443
ASN
#34989 ServeTheWorld AS

Requested by
https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Certificate
IssuerSectigo Limited
Subject*.b-cdn.net
FingerprintFC:D9:3E:09:69:F5:9D:8A:AA:45:73:03:05:F1:8D:E4:5B:80:10:E4
ValiditySun, 05 Nov 2023 00:00:00 GMT - Mon, 11 Nov 2024 23:59:59 GMT

File type
PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Size
1.8 kB (1805 bytes)
Hash
482ce499d40d67a9f4e12e5c992e98ce
9b8ce74d23795fdafa1bd6ca98a45a402e77dcc8
a7e3b96b4eab4a0a983b1db97750021b9d18574877b51f5a23a600514694a887

HTTP Headers

GET /43461/images/favicon.png HTTP/1.1
Host: mgkstatic33.b-cdn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://newgreatoffers.top/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Tue, 16 Apr 2024 09:55:04 GMT
content-type: image/png
content-length: 1805
server: BunnyCDN-NO1-830
cdn-pullzone: 1367785
cdn-uid: 6f116605-ddce-4644-a514-65e3765b9786
cdn-requestcountrycode: NO
cache-control: max-age=3600
etag: "482ce499d40d67a9f4e12e5c992e98ce"
last-modified: Wed, 13 Mar 2024 15:17:45 GMT
x-rgw-object-type: Normal
x-amz-request-id: tx00000931254d7e4b970d6-0065f1c7a0-5280acec-ams3c
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-do-cdn-uuid: b0c9cd13-c401-4707-9471-40949c09e155
cf-cache-status: HIT
cf-ray: 874b2f61f8dd56ba-OSL
cdn-proxyver: 1.04
cdn-requestpullsuccess: True
cdn-requestpullcode: 200
cdn-cachedat: 04/15/2024 10:17:18
cdn-edgestorageid: 830
cdn-status: 200
cdn-requestid: 0362ddfb5bf32b6499485aa029026279
cdn-cache: HIT
accept-ranges: bytes
X-Firefox-Spdy: h2

POST newgreatoffers.top/event?hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715

172.67.215.176

201 Created

10 kB

URL POST HTTP/3
newgreatoffers.top/event?hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715
IP
172.67.215.176:443
ASN
#13335 CLOUDFLARENET

Requested by
https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Certificate
IssuerGoogle Trust Services LLC
Subjectnewgreatoffers.top
Fingerprint8D:52:89:23:5C:65:D7:D9:03:5A:E6:CA:C5:DF:46:16:56:55:B5:2D
ValidityWed, 10 Apr 2024 05:11:29 GMT - Tue, 09 Jul 2024 05:11:28 GMT

File type
data
Size
10 kB (9959 bytes)
Hash
fcaada50fde23751201c8657b97b8604
6b05239953807ce6485eab1a253e2f370e7b6fd0
b4e9ab1d8aaa6a0e3096fe7e90d9809a0ca6ba064a2b96858aff61e097a9cbea

HTTP Headers

POST /event?hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715 HTTP/1.1
Host: newgreatoffers.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json;charset=utf-8
X-XSRF-TOKEN: eyJpdiI6ImFHV05rNm1MWE1PNWg0RjBDR3BpUWc9PSIsInZhbHVlIjoiYTBJNzFuXC9DVlJ5R1Z6UlR0WnpRSHpBZklPUHJscE5VNDQ1SExjamYzKytBa0lzRUJTUnBZdktKcU1Pc21sVXUiLCJtYWMiOiJjNGFiMmQyZmM1OGNjYTgxZWM0NjhmZDVmYTVjMTA2MzRkZDVhZjAxMDlmMGNkYWIzYzVmYmRhYTcxYTUxYTU1In0=
Content-Length: 182
Origin: https://newgreatoffers.top
DNT: 1
Connection: keep-alive
Referer: https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Cookie: XSRF-TOKEN=eyJpdiI6ImFHV05rNm1MWE1PNWg0RjBDR3BpUWc9PSIsInZhbHVlIjoiYTBJNzFuXC9DVlJ5R1Z6UlR0WnpRSHpBZklPUHJscE5VNDQ1SExjamYzKytBa0lzRUJTUnBZdktKcU1Pc21sVXUiLCJtYWMiOiJjNGFiMmQyZmM1OGNjYTgxZWM0NjhmZDVmYTVjMTA2MzRkZDVhZjAxMDlmMGNkYWIzYzVmYmRhYTcxYTUxYTU1In0%3D; c=eyJpdiI6IjZPTVd5Q1FxRTR5WDM2aUFQS3JOVUE9PSIsInZhbHVlIjoiRVY1TzFDUml1RUt6eXpzMjlySExzTFVvRmk5dyt1amJKUkt2NWNwRFJLeUo2TmQ0enNPcitmYVdGRFBsZmtkSCIsIm1hYyI6IjgxZDU5NzgxY2M4ZmRjOTRlOTMxZWRhZDQ5NWE2MDRhNzViYzgwYTRlMmI4MjNiNDM0YjYzNDJlZjczNTAyNjkifQ%3D%3D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 201 Created
date: Tue, 16 Apr 2024 09:55:04 GMT
content-type: application/json
cache-control: no-cache, private
access-control-allow-origin: https://newgreatoffers.top
vary: Origin
set-cookie: XSRF-TOKEN=eyJpdiI6ImhrYmZJNTRtTWhpZU5JTHU3ZkJrT2c9PSIsInZhbHVlIjoiU0ZDUE45Q3Zmd1orRjBWMUtCREMrTFppVkdZYTVEQXNZMzIzaW9XV3Fyc1lIRTJZVjYzVm5YQ2I3S3Y4OXpSTCIsIm1hYyI6IjZkYjI0NTg2MmIxZGJiMzAxNzEwMzQwNTMxM2QwNjVkYjRlZDg4N2E5MWM5YjMxMzNhM2Y5N2RiZTY1ZGZiOGUifQ%3D%3D; expires=Tue, 16-Apr-2024 11:55:04 GMT; Max-Age=7200; path=/
c=eyJpdiI6IjJ4MTBEOWhUUW9pTkdYS1pBY1RaTUE9PSIsInZhbHVlIjoibVJXeXFIa1pETnp6VXhtdnd3b2h0K09iU3Yzb3FLUElqbzErazRUTzE0cDlsU0EydEZRazhhb2NUTys5MURzQyIsIm1hYyI6IjVhYmExZDRmNzYxYjZkMzQ3NjYzODY3MDYzMTZmZTA3ZmQ2NjMwNDU4Y2IyM2U0YzBkZDhmZWQ0NGZiMGI0NGQifQ%3D%3D; expires=Tue, 16-Apr-2024 11:55:04 GMT; Max-Age=7200; path=/; httponly
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-proc: 1
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RExPvYQb19bGDwaUhwLQS1iwHYY9NKSQOGgTE7n%2B%2FkKTKRlEPe4ix0k2IRByOb9Ah7Q71CmR6b%2FBnNqitH6j0oSNCn5M2QogM%2BUlyaqaPjciMlf%2Br9ctR%2FAt2tQV4lzysvVMYEo%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87534c31fca6568d-OSL
alt-svc: h3=":443"; ma=86400

GET mgkstatic33.b-cdn.net/43461/build/funnel.js

194.242.11.186

200 OK

735 kB

URL GET HTTP/2
mgkstatic33.b-cdn.net/43461/build/funnel.js
IP
194.242.11.186:443
ASN
#34989 ServeTheWorld AS

Requested by
https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Certificate
IssuerSectigo Limited
Subject*.b-cdn.net
FingerprintFC:D9:3E:09:69:F5:9D:8A:AA:45:73:03:05:F1:8D:E4:5B:80:10:E4
ValiditySun, 05 Nov 2023 00:00:00 GMT - Mon, 11 Nov 2024 23:59:59 GMT

File type

Size
735 kB (735343 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /43461/build/funnel.js HTTP/1.1
Host: mgkstatic33.b-cdn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://newgreatoffers.top/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 16 Apr 2024 09:55:03 GMT
content-type: application/javascript
server: BunnyCDN-NO1-830
cdn-pullzone: 1367785
cdn-uid: 6f116605-ddce-4644-a514-65e3765b9786
cdn-requestcountrycode: NO
vary: Accept-Encoding, Accept-Encoding
cache-control: max-age=3600
etag: W/"154334f976eb4c2bbea602efb4ad82ce"
last-modified: Wed, 13 Mar 2024 15:17:26 GMT
x-rgw-object-type: Normal
x-amz-request-id: tx00000171f16e097b1d7c2-0065f29eca-5281cd5d-ams3c
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-do-cdn-uuid: b0c9cd13-c401-4707-9471-40949c09e155
cf-cache-status: HIT
cf-ray: 869b6440a89156bb-OSL
cdn-proxyver: 1.04
cdn-requestpullsuccess: True
cdn-requestpullcode: 200
cdn-cachedat: 03/25/2024 02:15:10
cdn-edgestorageid: 830
cdn-status: 200
cdn-requestid: 6a739f3673842cef00ca29848295739d
cdn-cache: HIT
content-encoding: br
X-Firefox-Spdy: h2

GET fonts.googleapis.com/css2?family=Lato:ital,wght@0,300;0,400;0,700;0,900;1,300;1,400;1,700;1,900&family=Montserrat:wght@300;400;500;600;700&family=Noto+Sans:wght@300;400;500;600;700;800;900&family=Open+Sans:wght@400;500;600;700;800&family=Quicksand:wght@300;400;500;600;700&family=Roboto:wght@300;400;500;700;900&family=Tajawal:wght@300;400;500;700&display=swap

142.250.74.106

200 OK

88 kB

URL GET HTTP/2
fonts.googleapis.com/css2?family=Lato:ital,wght@0,300;0,400;0,700;0,900;1,300;1,400;1,700;1,900&family=Montserrat:wght@300;400;500;600;700&family=Noto+Sans:wght@300;400;500;600;700;800;900&family=Open+Sans:wght@400;500;600;700;800&family=Quicksand:wght@300;400;500;600;700&family=Roboto:wght@300;400;500;700;900&family=Tajawal:wght@300;400;500;700&display=swap
IP
142.250.74.106:443
ASN
#15169 GOOGLE

Requested by
https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Certificate
IssuerGoogle Trust Services LLC
Subjectupload.video.google.com
Fingerprint47:5A:64:7D:9F:47:34:07:31:91:97:F7:04:42:7A:D5:EA:AD:07:4E
ValidityMon, 04 Mar 2024 07:16:44 GMT - Mon, 27 May 2024 07:16:43 GMT

File type
ASCII text, with very long lines (1572)
Size
88 kB (88472 bytes)
Hash
6a4571112dc1d4b0e37c6df7eba27cac
196e9eec0684faa62878e6f5e476710bd11f27bd
84675537119f9cc7f7a12120e2cf7ebe9cf645accde5cffca6d6da0c6ed03b32

HTTP Headers

GET /css2?family=Lato:ital,wght@0,300;0,400;0,700;0,900;1,300;1,400;1,700;1,900&family=Montserrat:wght@300;400;500;600;700&family=Noto+Sans:wght@300;400;500;600;700;800;900&family=Open+Sans:wght@400;500;600;700;800&family=Quicksand:wght@300;400;500;600;700&family=Roboto:wght@300;400;500;700;900&family=Tajawal:wght@300;400;500;700&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mgkstatic33.b-cdn.net/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Tue, 16 Apr 2024 09:55:04 GMT
date: Tue, 16 Apr 2024 09:55:04 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

GET newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=

172.67.215.176

200 OK

30 kB

URL User Request GET HTTP/2
newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
IP
172.67.215.176:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerGoogle Trust Services LLC
Subjectnewgreatoffers.top
Fingerprint8D:52:89:23:5C:65:D7:D9:03:5A:E6:CA:C5:DF:46:16:56:55:B5:2D
ValidityWed, 10 Apr 2024 05:11:29 GMT - Tue, 09 Jul 2024 05:11:28 GMT

File type

Size
30 kB (30120 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language= HTTP/1.1
Host: newgreatoffers.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 16 Apr 2024 09:55:03 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
cache-control: no-cache, private
set-cookie: XSRF-TOKEN=eyJpdiI6Im1aSHl2VVcxbXA2ZTdUUTRXRGZxUVE9PSIsInZhbHVlIjoiM3BZbFBYRGpUVHBXV3FIcVwvTUVlNGNmSWJUNGtSXC96aW9nSHY4ZWhvYk1LbmE2Wm5uNVZ6T1VBanhiaVNRQXcyIiwibWFjIjoiYzcwNWRjOTg1MzIyNmYwNWRkNzU4YjY1ZDMyZTdkNDczNzQwYzQ1N2ZkYzZjMzc3OGY4YjA3MWIwNTA3ZTk3ZCJ9; expires=Tue, 16-Apr-2024 11:55:03 GMT; Max-Age=7200; path=/
c=eyJpdiI6IkErZXZUeW5Uejgya0hUczU0Q2RaRlE9PSIsInZhbHVlIjoiVXlGekU2YVZlVHZ6bm9ZMnFZdTZrbUZCTzZTb2w3eFwvZmw4M3BJbXlhejdiV0xpXC9rVnZHb3ZQZm81Q05seWxhIiwibWFjIjoiMjkwN2Q5MGM4Zjc0ODUyNTg3Nzg4YzllYzQ5YThmYjczZTQzNWM2YjdkOGZhOGU3MWNhNjQyZjUzMmUwN2IwMyJ9; expires=Tue, 16-Apr-2024 11:55:03 GMT; Max-Age=7200; path=/; httponly
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-proc: 1
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T2QyykLTUKnQixOqVlsLKiizfHYMyTS0Csy4nyEioZ4ueIrojjLN77jxuyZ81hVmg%2Fqy3kYYMZ2uoK65FiEYkbt%2BNjamFaSc4b8boi%2F41tfRWYqp%2FioaYWxKtlYrh8cBAAG9u30%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87534c267909b4fd-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

GET mgkstatic33.b-cdn.net/43461/build/funnel.css

194.242.11.186

200 OK

83 kB

URL GET HTTP/2
mgkstatic33.b-cdn.net/43461/build/funnel.css
IP
194.242.11.186:443
ASN
#34989 ServeTheWorld AS

Requested by
https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Certificate
IssuerSectigo Limited
Subject*.b-cdn.net
FingerprintFC:D9:3E:09:69:F5:9D:8A:AA:45:73:03:05:F1:8D:E4:5B:80:10:E4
ValiditySun, 05 Nov 2023 00:00:00 GMT - Mon, 11 Nov 2024 23:59:59 GMT

File type
ASCII text, with very long lines (45962)
Size
83 kB (83397 bytes)
Hash
670878add58e57bb842fb7530256b6f7
4e642526889846d2b06727762c71c5ec59a60f16
8db1af5a48d72fa1716165f347f781448ac6228b5fd21ec8b9008c2758e87b83

HTTP Headers

GET /43461/build/funnel.css HTTP/1.1
Host: mgkstatic33.b-cdn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://newgreatoffers.top/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 16 Apr 2024 09:55:03 GMT
content-type: text/css
server: BunnyCDN-NO1-830
cdn-pullzone: 1367785
cdn-uid: 6f116605-ddce-4644-a514-65e3765b9786
cdn-requestcountrycode: NO
vary: Accept-Encoding, Accept-Encoding
access-control-allow-origin: *
access-control-allow-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
access-control-expose-headers: Server, x-goog-meta-frames, Content-Length, Content-Type, Range, X-Requested-With, If-Modified-Since, If-None-Match
cache-control: max-age=3600
etag: W/"670878add58e57bb842fb7530256b6f7"
last-modified: Wed, 13 Mar 2024 15:17:25 GMT
x-rgw-object-type: Normal
x-amz-request-id: tx000003038141ea2822112-0065f1c7cc-5280ad0f-ams3c
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-do-cdn-uuid: b0c9cd13-c401-4707-9471-40949c09e155
cf-cache-status: REVALIDATED
cf-ray: 865fdc805baf56a4-OSL
cdn-proxyver: 1.04
cdn-requestpullsuccess: True
cdn-requestpullcode: 200
cdn-cachedat: 03/17/2024 20:51:30
cdn-edgestorageid: 830
cdn-status: 200
cdn-requestid: bb54f66e10ea51d7cb8f8249fb617dd3
cdn-cache: HIT
content-encoding: br
X-Firefox-Spdy: h2

GET newgreatoffers.top/js/redirect.js?id=7205070985cfaaa84a2b

172.67.215.176

200 OK

2.7 kB

URL GET HTTP/3
newgreatoffers.top/js/redirect.js?id=7205070985cfaaa84a2b
IP
172.67.215.176:443
ASN
#13335 CLOUDFLARENET

Requested by
https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Certificate
IssuerGoogle Trust Services LLC
Subjectnewgreatoffers.top
Fingerprint8D:52:89:23:5C:65:D7:D9:03:5A:E6:CA:C5:DF:46:16:56:55:B5:2D
ValidityWed, 10 Apr 2024 05:11:29 GMT - Tue, 09 Jul 2024 05:11:28 GMT

File type
JavaScript source, ASCII text, with very long lines (2812), with no line terminators
Size
2.7 kB (2738 bytes)
Hash
db1ca2ad2cadb6217bca95f7084e4dfa
7f0c9879b54c9220d7f62014dfd96dd1eacdb7c8
28e07720845339964050f6b68fd46908907d911a6abc687e2a41fc220ebf4f99

HTTP Headers

GET /js/redirect.js?id=7205070985cfaaa84a2b HTTP/1.1
Host: newgreatoffers.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Cookie: XSRF-TOKEN=eyJpdiI6Im1aSHl2VVcxbXA2ZTdUUTRXRGZxUVE9PSIsInZhbHVlIjoiM3BZbFBYRGpUVHBXV3FIcVwvTUVlNGNmSWJUNGtSXC96aW9nSHY4ZWhvYk1LbmE2Wm5uNVZ6T1VBanhiaVNRQXcyIiwibWFjIjoiYzcwNWRjOTg1MzIyNmYwNWRkNzU4YjY1ZDMyZTdkNDczNzQwYzQ1N2ZkYzZjMzc3OGY4YjA3MWIwNTA3ZTk3ZCJ9; c=eyJpdiI6IkErZXZUeW5Uejgya0hUczU0Q2RaRlE9PSIsInZhbHVlIjoiVXlGekU2YVZlVHZ6bm9ZMnFZdTZrbUZCTzZTb2w3eFwvZmw4M3BJbXlhejdiV0xpXC9rVnZHb3ZQZm81Q05seWxhIiwibWFjIjoiMjkwN2Q5MGM4Zjc0ODUyNTg3Nzg4YzllYzQ5YThmYjczZTQzNWM2YjdkOGZhOGU3MWNhNjQyZjUzMmUwN2IwMyJ9
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 16 Apr 2024 09:55:03 GMT
content-type: application/javascript; charset=utf-8
last-modified: Wed, 27 Mar 2024 14:41:19 GMT
vary: Accept-Encoding
etag: W/"6604300f-ab2"
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-proc: 2
cache-control: max-age=14400
cf-cache-status: HIT
age: 101
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HfLhHCjWXJn9jujHbREhGSOYeyvIpZmTB0vJ3VLOE%2Fk8z%2BLKHGlhYuJ2MsPyGo72xgVDsf6iq6Lo3lzqFsBlCcfCzC0EKGBQzREJfdsVH%2F2ZoeMnpAx0NGtv%2Fx56X0YlfvFtD04%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87534c2999aa568d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

GET newgreatoffers.top/js/l.js?id=f699e0c1aa11fe1bdd00

172.67.215.176

200 OK

422 kB

URL GET HTTP/3
newgreatoffers.top/js/l.js?id=f699e0c1aa11fe1bdd00
IP
172.67.215.176:443
ASN
#13335 CLOUDFLARENET

Requested by
https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Certificate
IssuerGoogle Trust Services LLC
Subjectnewgreatoffers.top
Fingerprint8D:52:89:23:5C:65:D7:D9:03:5A:E6:CA:C5:DF:46:16:56:55:B5:2D
ValidityWed, 10 Apr 2024 05:11:29 GMT - Tue, 09 Jul 2024 05:11:28 GMT

File type

Size
422 kB (421698 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /js/l.js?id=f699e0c1aa11fe1bdd00 HTTP/1.1
Host: newgreatoffers.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Cookie: XSRF-TOKEN=eyJpdiI6Im1aSHl2VVcxbXA2ZTdUUTRXRGZxUVE9PSIsInZhbHVlIjoiM3BZbFBYRGpUVHBXV3FIcVwvTUVlNGNmSWJUNGtSXC96aW9nSHY4ZWhvYk1LbmE2Wm5uNVZ6T1VBanhiaVNRQXcyIiwibWFjIjoiYzcwNWRjOTg1MzIyNmYwNWRkNzU4YjY1ZDMyZTdkNDczNzQwYzQ1N2ZkYzZjMzc3OGY4YjA3MWIwNTA3ZTk3ZCJ9; c=eyJpdiI6IkErZXZUeW5Uejgya0hUczU0Q2RaRlE9PSIsInZhbHVlIjoiVXlGekU2YVZlVHZ6bm9ZMnFZdTZrbUZCTzZTb2w3eFwvZmw4M3BJbXlhejdiV0xpXC9rVnZHb3ZQZm81Q05seWxhIiwibWFjIjoiMjkwN2Q5MGM4Zjc0ODUyNTg3Nzg4YzllYzQ5YThmYjczZTQzNWM2YjdkOGZhOGU3MWNhNjQyZjUzMmUwN2IwMyJ9
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 16 Apr 2024 09:55:03 GMT
content-type: application/javascript; charset=utf-8
last-modified: Wed, 27 Mar 2024 14:41:29 GMT
vary: Accept-Encoding
etag: W/"66043019-66f42"
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-proc: 3
cache-control: max-age=14400
cf-cache-status: HIT
age: 101
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fTHVKj0hfoSgN9KBE%2FJ62aWmHiLMxz2uAhsUJg%2BMxPw9mgrSIJQyVTgvs%2BPyMsD%2Bs1GpknDkEu2wxAgt4O3OHj7DDcKx0q0%2B0fjcserB2MhpNdUlsxgnUIh8yAPTpTUo8x%2BrJqE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87534c2999ae568d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

GET static-133.b-cdn.net/43461/images/brush-stroke.svg

194.242.11.186

200 OK

124 kB

URL GET HTTP/2
static-133.b-cdn.net/43461/images/brush-stroke.svg
IP
194.242.11.186:443
ASN
#34989 ServeTheWorld AS

Requested by
https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Certificate
IssuerSectigo Limited
Subject*.b-cdn.net
FingerprintFC:D9:3E:09:69:F5:9D:8A:AA:45:73:03:05:F1:8D:E4:5B:80:10:E4
ValiditySun, 05 Nov 2023 00:00:00 GMT - Mon, 11 Nov 2024 23:59:59 GMT

File type
SVG Scalable Vector Graphics image
Size
124 kB (124282 bytes)
Hash
2affaa6cbada4631a14b44e4390b0358
e7ad09b7af15b3c1aaff622222a654343e358dfe
d8783d3e7e17ac28d426e6d7b992027af21ba4f86976b1526b9a1e53a047d169

HTTP Headers

GET /43461/images/brush-stroke.svg HTTP/1.1
Host: static-133.b-cdn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://mgkstatic33.b-cdn.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Tue, 16 Apr 2024 09:55:04 GMT
content-type: image/svg+xml
vary: Accept-Encoding
server: BunnyCDN-NO1-830
cdn-pullzone: 561175
cdn-uid: 6f116605-ddce-4644-a514-65e3765b9786
cdn-requestcountrycode: NO
cache-control: max-age=3600
etag: W/"2affaa6cbada4631a14b44e4390b0358"
last-modified: Wed, 13 Mar 2024 15:17:35 GMT
x-rgw-object-type: Normal
x-amz-request-id: tx000005c4296c53e680ad2-0065f29eca-5281cd5d-ams3c
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-do-cdn-uuid: b0c9cd13-c401-4707-9471-40949c09e155
cf-cache-status: HIT
cf-ray: 869c8b777a0b56ae-OSL
cdn-proxyver: 1.04
cdn-requestpullsuccess: True
cdn-requestpullcode: 200
cdn-cachedat: 03/25/2024 05:36:42
cdn-edgestorageid: 830
cdn-status: 200
cdn-requestid: 61486b78ea3cdc15290ecd8fad4bb6bf
cdn-cache: HIT
content-encoding: br
X-Firefox-Spdy: h2

GET newgreatoffers.top/locate

172.67.215.176

200 OK

144 B

URL GET HTTP/3
newgreatoffers.top/locate
IP
172.67.215.176:443
ASN
#13335 CLOUDFLARENET

Requested by
https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Certificate
IssuerGoogle Trust Services LLC
Subjectnewgreatoffers.top
Fingerprint8D:52:89:23:5C:65:D7:D9:03:5A:E6:CA:C5:DF:46:16:56:55:B5:2D
ValidityWed, 10 Apr 2024 05:11:29 GMT - Tue, 09 Jul 2024 05:11:28 GMT

File type
troff or preprocessor input, ASCII text, with no line terminators
Size
144 B (144 bytes)
Hash
a78c1f9242aa33a87bd5f7a7f6cf21af
61484ea912efce8fe8b9aef0eb79eacadecd0968
47ba1d847752b8b99d6b67a2eaa654648624b7035ae2780c5efcbb328b09749e

HTTP Headers

GET /locate HTTP/1.1
Host: newgreatoffers.top
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-XSRF-TOKEN: eyJpdiI6Im1aSHl2VVcxbXA2ZTdUUTRXRGZxUVE9PSIsInZhbHVlIjoiM3BZbFBYRGpUVHBXV3FIcVwvTUVlNGNmSWJUNGtSXC96aW9nSHY4ZWhvYk1LbmE2Wm5uNVZ6T1VBanhiaVNRQXcyIiwibWFjIjoiYzcwNWRjOTg1MzIyNmYwNWRkNzU4YjY1ZDMyZTdkNDczNzQwYzQ1N2ZkYzZjMzc3OGY4YjA3MWIwNTA3ZTk3ZCJ9
DNT: 1
Connection: keep-alive
Referer: https://newgreatoffers.top/bit-gpt-pp-ai/?oid=133&qze=1&hitid=9bd1f922-b5aa-44cf-a20a-176bb2ba6715&aff_sub=&saf=&cvu=&action=&aff_sub5=&url_id=133&aff_sub2=&aff_sub3=&aff_sub4=&tracker=cg&language=
Cookie: XSRF-TOKEN=eyJpdiI6Im1aSHl2VVcxbXA2ZTdUUTRXRGZxUVE9PSIsInZhbHVlIjoiM3BZbFBYRGpUVHBXV3FIcVwvTUVlNGNmSWJUNGtSXC96aW9nSHY4ZWhvYk1LbmE2Wm5uNVZ6T1VBanhiaVNRQXcyIiwibWFjIjoiYzcwNWRjOTg1MzIyNmYwNWRkNzU4YjY1ZDMyZTdkNDczNzQwYzQ1N2ZkYzZjMzc3OGY4YjA3MWIwNTA3ZTk3ZCJ9; c=eyJpdiI6IkErZXZUeW5Uejgya0hUczU0Q2RaRlE9PSIsInZhbHVlIjoiVXlGekU2YVZlVHZ6bm9ZMnFZdTZrbUZCTzZTb2w3eFwvZmw4M3BJbXlhejdiV0xpXC9rVnZHb3ZQZm81Q05seWxhIiwibWFjIjoiMjkwN2Q5MGM4Zjc0ODUyNTg3Nzg4YzllYzQ5YThmYjczZTQzNWM2YjdkOGZhOGU3MWNhNjQyZjUzMmUwN2IwMyJ9
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/3 200 OK
date: Tue, 16 Apr 2024 09:55:04 GMT
content-type: application/json
vary: Accept-Encoding
cache-control: no-cache, private
set-cookie: XSRF-TOKEN=eyJpdiI6ImFHV05rNm1MWE1PNWg0RjBDR3BpUWc9PSIsInZhbHVlIjoiYTBJNzFuXC9DVlJ5R1Z6UlR0WnpRSHpBZklPUHJscE5VNDQ1SExjamYzKytBa0lzRUJTUnBZdktKcU1Pc21sVXUiLCJtYWMiOiJjNGFiMmQyZmM1OGNjYTgxZWM0NjhmZDVmYTVjMTA2MzRkZDVhZjAxMDlmMGNkYWIzYzVmYmRhYTcxYTUxYTU1In0%3D; expires=Tue, 16-Apr-2024 11:55:04 GMT; Max-Age=7200; path=/
c=eyJpdiI6IjZPTVd5Q1FxRTR5WDM2aUFQS3JOVUE9PSIsInZhbHVlIjoiRVY1TzFDUml1RUt6eXpzMjlySExzTFVvRmk5dyt1amJKUkt2NWNwRFJLeUo2TmQ0enNPcitmYVdGRFBsZmtkSCIsIm1hYyI6IjgxZDU5NzgxY2M4ZmRjOTRlOTMxZWRhZDQ5NWE2MDRhNzViYzgwYTRlMmI4MjNiNDM0YjYzNDJlZjczNTAyNjkifQ%3D%3D; expires=Tue, 16-Apr-2024 11:55:04 GMT; Max-Age=7200; path=/; httponly
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-proc: 1
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KK4ySP5LrdTdSqIfF8LfgvWUa2IcLcBtQlCeKhTy386tQgQljSGTGVMY6Vw9KBJ1kshwLmJpeQUs78WaM01McQ0sWBcU8Y90Z83%2BjrLpnR1Sn1NEDOHmA1gWusp2Jd6YWmeWcJs%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 87534c311b82568d-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (5)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (50)

URL

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

File type

Size

Hash

Detections

HTTP Headers

URL

IP

ASN

File type

Size

Hash

Detections