| goforrewards.info/RM/Arg/ |  104.26.14.73 | 301 Moved Permanently | 0 B |
URL HTTP/1.1goforrewards.info/RM/Arg/ IP104.26.14.73:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| fortinet | Phishing | |
GET /RM/Arg/ HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 301 Moved Permanently
Date: Thu, 08 Dec 2022 20:06:53 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Thu, 08 Dec 2022 21:06:53 GMT
Location: https://goforrewards.info/RM/Arg/
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=A1hHSxP3Wx7r1mN4goqeIC39h0QLEduvHCEy%2BnyHaCPt4%2BkCbG%2FYCK5tXHGMisnrYTTOw4LBTLkXk1AykM9I%2BAheBk5n12An%2BYmWvge0hwrWo9D1aytJMfjc5XK19rjbuUq%2B"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 77681fcb3a430b69-OSL
alt-svc: h2=":443"; ma=60
|
|
| r3.o.lencr.org/ |  23.33.119.27 | 200 OK | 503 B |
IP23.33.119.27:0 ASN#20940 Akamai International B.V.
Hashf2acd891dc6eb1f09f57a2b086791781 1e2088306501a61edcca1ade62c4d54f23b3b083 51148fed95cc00d60dc3640350f135b1b2763ff0e3cfbffc40f0948317894be9
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "51148FED95CC00D60DC3640350F135B1B2763FF0E3CFBFFC40F0948317894BE9"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=11871
Expires: Thu, 08 Dec 2022 23:24:45 GMT
Date: Thu, 08 Dec 2022 20:06:54 GMT
Connection: keep-alive
|
|
| r3.o.lencr.org/ | 23.33.119.27 | 200 OK | 503 B |
IP23.33.119.27:0 ASN#20940 Akamai International B.V.
Hash388f6fea5bafa378266622b72311a6ee 447f102dc12172ce1ba44c5e94e1d7bb49d43372 a597afb4d4f7f3c82f0f2857322226fc69dc92e099bfd0605f7a0cd562be9d21
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "A597AFB4D4F7F3C82F0F2857322226FC69DC92E099BFD0605F7A0CD562BE9D21"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6118
Expires: Thu, 08 Dec 2022 21:48:52 GMT
Date: Thu, 08 Dec 2022 20:06:54 GMT
Connection: keep-alive
|
|
| firefox.settings.services.mozilla.com/v1/ | 35.241.9.150 | 200 OK | 939 B |
URL HTTP/2firefox.settings.services.mozilla.com/v1/ IP35.241.9.150:0
File typeJSON data\012- , ASCII text, with very long lines (939), with no line terminators Hash14cd9a0afb6ba9a763651d5112760d1e 75d7b104ab9ab11fbb73c3f348b43b0119b5adfa 4e32a117106be587ffcd63239c16a8117eb7840830d4c9decf6527761967532e
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Alert, Retry-After, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Thu, 08 Dec 2022 19:08:13 GMT
content-type: application/json
age: 3521
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| r3.o.lencr.org/ | 23.33.119.27 | 200 OK | 503 B |
IP23.33.119.27:0 ASN#20940 Akamai International B.V.
Hash00e7703bd74975689fc9050356aaca6b 9788fe6a36d6f278e8da329ebc5dd87bcd212317 593bc437ff8a8233516c62613d50220fcb25b9f967ed5fb384c253f0db135103
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "593BC437FF8A8233516C62613D50220FCB25B9F967ED5FB384C253F0DB135103"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=5196
Expires: Thu, 08 Dec 2022 21:33:30 GMT
Date: Thu, 08 Dec 2022 20:06:54 GMT
Connection: keep-alive
|
|
| content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain | 34.160.144.191 | 200 OK | 5.3 kB |
URL HTTP/2content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain IP34.160.144.191:0
File typePEM certificate\012- , ASCII text Hash53341dea33f4f3d9b4966f80589f429a 20f7b07c686c986d2ed1e3e9ad1bb2aef8edaf0d 651683e52cdbc96b289f8f123155f0b96d9f67432689e89156fa56f5a346c6a0
GET /chains/remote-settings.content-signature.mozilla.org-2023-01-19-10-06-33.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: ai4/LX7Fz2srzSUoLCPvAepmWZqHvsbk/bhco266GKlqsb0mXAYXUnYMwGm02Y4v7SclrNkWRPM=
x-amz-request-id: T1NN6FMNPBEQKGRH
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Thu, 08 Dec 2022 19:49:56 GMT
age: 1018
last-modified: Wed, 30 Nov 2022 10:06:34 GMT
etag: "53341dea33f4f3d9b4966f80589f429a"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| contile.services.mozilla.com/v1/tiles | 34.117.237.239 | 200 OK | 12 B |
URL HTTP/2contile.services.mozilla.com/v1/tiles IP34.117.237.239:0
File typeJSON data\012- , ASCII text, with no line terminators Hash23e88fb7b99543fb33315b29b1fad9d6 a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Thu, 08 Dec 2022 20:06:54 GMT
content-type: application/json
content-length: 12
access-control-allow-credentials: true
access-control-expose-headers: content-type
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| e1.o.lencr.org/ | 95.101.11.115 | 200 OK | 346 B |
IP95.101.11.115:0 ASN#20940 Akamai International B.V.
Hashfaec6573e7a1d367680316ddef5c8a15 c108d0b60128b787b2f898c7c38b8735335ba6f3 cbeaee18a1f621d6c1353a9852992755adde5b9721d256d4a56a091fdad773a8
POST / HTTP/1.1
Host: e1.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 346
ETag: "CBEAEE18A1F621D6C1353A9852992755ADDE5B9721D256D4A56A091FDAD773A8"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21600
Expires: Fri, 09 Dec 2022 02:06:54 GMT
Date: Thu, 08 Dec 2022 20:06:54 GMT
Connection: keep-alive
|
|
| goforrewards.info/RM/Arg/img/lg.png | 104.26.14.73 | 200 OK | 11 kB |
URL HTTP/2goforrewards.info/RM/Arg/img/lg.png IP104.26.14.73:0
File typePNG image data, 150 x 56, 8-bit/color RGBA, non-interlaced\012- data Hashfb30ca654c9272d51ee91cc03bb283b3 e7a0d3d0884fbbb279905a53008aa66925080bf9 f56047b304ea124b4d473858686fa5c63eb3e84226e5aab01733ccc8d24e2f99
GET /RM/Arg/img/lg.png HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:06:54 GMT
content-type: image/png
content-length: 10807
last-modified: Mon, 05 Dec 2022 16:16:53 GMT
etag: "638e1975-2a37"
expires: Sat, 07 Jan 2023 18:06:01 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 7253
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1Uzmx6Lo6EsU0SMM95dUEnId6mqlHtTQMHHJxdb1RUnB0A5Y3iahHhveN75aWldu5uglOvOvHyCh41OETbsX7T2vJWi0JxNjLKhN5wMKNBtmLNf%2F8uGg9GshFGWq0KLtgJZm"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77681fcf8a550b45-OSL
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Arg/img/chk2.jpg | 104.26.14.73 | 200 OK | 36 kB |
URL HTTP/2goforrewards.info/RM/Arg/img/chk2.jpg IP104.26.14.73:0
File typeJPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2021:09:21 17:53:11], baseline, precision 8, 300x142, components 3\012- data Hashb470f64d686c16fc5b943d5214e08cd4 e95197030e48189cf0a2cae4e185d867378055bb b252efeddacee63748a47ad45e49574ac73ac80ecc27fe1eabe5dafbbbd0e751
GET /RM/Arg/img/chk2.jpg HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:06:54 GMT
content-type: image/jpeg
content-length: 35766
cache-control: max-age=2592000
cf-bgj: h2pri
etag: "638e1973-8bb6"
expires: Sat, 07 Jan 2023 18:06:01 GMT
last-modified: Mon, 05 Dec 2022 16:16:51 GMT
cf-cache-status: HIT
age: 7253
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rATUZG5P4fI%2BpSrs23i9uJTd7iUQ2WWtG4NNbtzoak41nJT5e4qvxYytI1qoQPAwDZfN4pKbdr5kuN2zAEuxIkqevC2%2FYhvzZbHqsVbzoqb6pJeKHUjLbVpR6qSs0xaiWR8o"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77681fcfaa710b45-OSL
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Arg/img/5555.jpg | 104.26.14.73 | 200 OK | 35 kB |
URL HTTP/2goforrewards.info/RM/Arg/img/5555.jpg IP104.26.14.73:0
File typeJPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2021:09:21 17:53:11], baseline, precision 8, 300x142, components 3\012- data Hash273b586bec0ef2dcb80627b2efde3832 3398fd84101aefa491ef8950180a67f514eb4dab db4d54ef2df3c7dc42d194747982b34186ab84beacdc650221abd0121df2a9fd
GET /RM/Arg/img/5555.jpg HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:06:54 GMT
content-type: image/jpeg
content-length: 34891
cache-control: max-age=2592000
cf-bgj: h2pri
etag: "638e1973-884b"
expires: Sat, 07 Jan 2023 18:06:01 GMT
last-modified: Mon, 05 Dec 2022 16:16:51 GMT
cf-cache-status: HIT
age: 7253
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZV3UipDgN3W3MF1Z7BeATeWU8VPEDl3E5y41Rphyreo7fNSU61L7RYNpAtK1tbrtGEunHIOPUHLjpYE52yw5ZMKKiJf57SbVFASsIKxH2gwjgT7Rxl%2BV1pgEaaknV0GdT2iX"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77681fcf9a5e0b45-OSL
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Arg/img/prof1.jpg | 104.26.14.73 | 200 OK | 12 kB |
URL HTTP/2goforrewards.info/RM/Arg/img/prof1.jpg IP104.26.14.73:0
File typeJPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=643, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=640], progressive, precision 8, 50x50, components 3\012- data Hash5691166cda59d447955372faf6eb9077 b753c5fc483b22fe11348d5eefa666c35743e3d2 10f9cee806b62c1c1c115dc47d2ac735ad565d1f0d53a73c36d0aa10211b4941
GET /RM/Arg/img/prof1.jpg HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:06:54 GMT
content-type: image/jpeg
content-length: 11922
cache-control: max-age=2592000
cf-bgj: h2pri
etag: "638e1976-2e92"
expires: Fri, 06 Jan 2023 05:17:48 GMT
last-modified: Mon, 05 Dec 2022 16:16:54 GMT
cf-cache-status: HIT
age: 139746
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=n8qGrEkESwY1e1%2BmQKubl0DOFZdna2S4FYqCqYaWfXNp3RSTk%2BjxfdsYmzOUK15dparfhGRaIQtfAJa%2BOingQGZ0o6YgPXVqdni8mjjewZxNhNX42DiybJcEnegTcZNOAzKh"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77681fcf9a600b45-OSL
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Arg/img/image1.png | 104.26.14.73 | 200 OK | 62 kB |
URL HTTP/2goforrewards.info/RM/Arg/img/image1.png IP104.26.14.73:0
File typePNG image data, 448 x 327, 8-bit/color RGBA, non-interlaced\012- data Hash666d53ee287e91e9be9eeb4250241936 91b8e454152d65368f8ea33826f856dd8718d94d 8439533d3e3f027fa1bd09ba2038ada51c6e0f0f3ff1100786e57762e685555f
GET /RM/Arg/img/image1.png HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:06:54 GMT
content-type: image/png
content-length: 62125
last-modified: Mon, 05 Dec 2022 16:16:52 GMT
etag: "638e1974-f2ad"
expires: Sat, 07 Jan 2023 18:06:01 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 7253
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RJa6Z1CHRrzZKsmGgDmIOk3dGMDom%2Fo1hucCPp6FFnzUY4VEn4zGtHWBin3UPrFdP6L8ahdvyY6auPHcuTT2HVn6Wa2knwC4BWr6D6DpKZJieBiHGjEwBrP82yzheA0TDA9E"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77681fcf8a580b45-OSL
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Arg/img/ld.gif | 104.26.14.73 | 200 OK | 122 kB |
URL HTTP/2goforrewards.info/RM/Arg/img/ld.gif IP104.26.14.73:0
File typeGIF image data, version 89a, 246 x 246\012- data Size122 kB (121587 bytes) Hash1f32223b3bcbe23d6efe15d914206440 1faa0c1e65002ca3880cb764be63abef5a3efac5 c0f27622e1c77dfe225b6e2637211c61861471c39e585461a5dc55017950e92a
GET /RM/Arg/img/ld.gif HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:06:54 GMT
content-type: image/gif
content-length: 121587
last-modified: Mon, 05 Dec 2022 16:16:55 GMT
etag: "638e1977-1daf3"
expires: Fri, 06 Jan 2023 05:17:48 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 139746
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GbS5hjzf0g5RN6k7xrvw0TzO7XHNf21kWT1aBbUtfLB%2BJpxfanlshjEDY8MKLSPLZN%2BZ0qEIzu7qw5JjwRhhQn%2F%2Ffa2JsBogm3kUJWLldA7J%2F8G7On4k3TQMpe8cByohfssM"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77681fcf8a5d0b45-OSL
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Arg/img/prof2.jpg | 104.26.14.73 | 200 OK | 13 kB |
URL HTTP/2goforrewards.info/RM/Arg/img/prof2.jpg IP104.26.14.73:0
File typeJPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=236, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=236], progressive, precision 8, 50x50, components 3\012- data Hash1f0194d278a3c2034942be5821463282 dc1b277396ee39475cc8dc31671312653f2f2d5f 8d0f6aaa483f1c319a81ba58c76889edcc228070e8f455ca2fbe6b6f7baaa695
GET /RM/Arg/img/prof2.jpg HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:06:54 GMT
content-type: image/jpeg
content-length: 12691
cache-control: max-age=2592000
cf-bgj: h2pri
etag: "638e1977-3193"
expires: Sat, 07 Jan 2023 18:06:01 GMT
last-modified: Mon, 05 Dec 2022 16:16:55 GMT
cf-cache-status: HIT
age: 7253
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Myoz%2B3cmAGEvPY2fYn5ytxvR%2FNXS9aj%2FwoPzFCN6aVOgw1pyR4bYMYmjDqiqP2Zyj%2B7c4AATihXxAYtckjOnV00vn965jtBIVz9JH%2FpB48JY%2FJ7JRVXUCcvF5QGy0E0BY0tU"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77681fcf9a660b45-OSL
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Arg/img/chk1.jpg | 104.26.14.73 | 200 OK | 36 kB |
URL HTTP/2goforrewards.info/RM/Arg/img/chk1.jpg IP104.26.14.73:0
File typeJPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2021:09:21 17:53:11], baseline, precision 8, 300x142, components 3\012- data Hash6712cb146c4a65c93d3a32095714503d a780fd30fd685508991c103ce7ece4286648460d 7c8bdc0aad64ac9cadd80de326d7e8a704507eeb87ee1c3f3e2a359058b902f5
GET /RM/Arg/img/chk1.jpg HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:06:54 GMT
content-type: image/jpeg
content-length: 35904
cache-control: max-age=2592000
cf-bgj: h2pri
etag: "638e1973-8c40"
expires: Fri, 06 Jan 2023 05:17:48 GMT
last-modified: Mon, 05 Dec 2022 16:16:51 GMT
cf-cache-status: HIT
age: 139746
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QVcEV59Ms%2F82fGMswZJ8gdLwFiJFY7134BSlBB%2BEUZc6QNVEuzLD8%2FD%2FxPVpX5ErtML26jC71rgGDJVmhd%2BrsR96049Z11V2mxRw4LFwX%2F9zT%2FqJ3uZPmvjjI%2B3JXLAv20TJ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77681fcf9a640b45-OSL
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Arg/img/prof5.jpg | 104.26.14.73 | 200 OK | 11 kB |
URL HTTP/2goforrewards.info/RM/Arg/img/prof5.jpg IP104.26.14.73:0
File typeJPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=238, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=211], progressive, precision 8, 50x56, components 3\012- data Hash87b448b012b880cfa014f09826557897 3f5b22cc8f998cef6ecf9a493bc19871352ed377 1a26eecccc51f9e2eee0432d4921070b3339bb2d9c87fb2e98eea4399a8cda51
GET /RM/Arg/img/prof5.jpg HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:06:54 GMT
content-type: image/jpeg
content-length: 11210
cache-control: max-age=2592000
cf-bgj: h2pri
etag: "638e1977-2bca"
expires: Fri, 06 Jan 2023 05:17:48 GMT
last-modified: Mon, 05 Dec 2022 16:16:55 GMT
cf-cache-status: HIT
age: 139746
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Zs%2FmqDHQV9%2BCKydUqxNWVxstKF3EIcLgD1hAMlQIJ%2BAFtMo%2Ff4pykiBDD%2FW80pLmOx29hHkrcIvY0lpNWmLsaawp%2F8APXwOQUFq8%2FN5zDiBG4816IU2whifFq2GyBz0T96ik"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77681fcf9a6f0b45-OSL
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Arg/img/prof3.jpg | 104.26.14.73 | 200 OK | 11 kB |
URL HTTP/2goforrewards.info/RM/Arg/img/prof3.jpg IP104.26.14.73:0
File typeJPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=895, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=1080], progressive, precision 8, 50x41, components 3\012- data Hash12509849dec0f36c72f0f90e6b437ced 6ce1638407c8dc1cdef4d6ec29094824427cf4e0 2933ebd009740031f0e6ab3cfcd021456828c9d84d4a3ee876d4681eb0dd332e
GET /RM/Arg/img/prof3.jpg HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:06:54 GMT
content-type: image/jpeg
content-length: 10640
cache-control: max-age=2592000
cf-bgj: h2pri
etag: "638e1977-2990"
expires: Sat, 07 Jan 2023 18:06:01 GMT
last-modified: Mon, 05 Dec 2022 16:16:55 GMT
cf-cache-status: HIT
age: 7253
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7ysGKfo%2FKs4GvPCjgSi3Z1FK29xhNflgLFst3dJCIT9704yGdATj%2Fip7s0a7jMkPjWLdhHRiCzS3hLVKvZs2SDyPaVFkI9NrfkubiLt60Nb%2F9PNXlmpQPZO42uu31ZYWqJ9I"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77681fcf9a6d0b45-OSL
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Arg/img/prof4.jpg | 104.26.14.73 | 200 OK | 9.8 kB |
URL HTTP/2goforrewards.info/RM/Arg/img/prof4.jpg IP104.26.14.73:0
File typeJPEG image data, Exif standard: [TIFF image data, big-endian, direntries=12, height=828, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=1012], progressive, precision 8, 50x41, components 3\012- data Hash4f30df9680ef2d63c8316a3d8bf245ac a82b9a9e1ed52f61f1f3b877a71f25f3a9911094 ef37748363082793824c1240d3dd291d79ffe3904163e56fc5613e3bd1a7e3e8
GET /RM/Arg/img/prof4.jpg HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:06:54 GMT
content-type: image/jpeg
content-length: 9838
cache-control: max-age=2592000
cf-bgj: h2pri
etag: "638e1977-266e"
expires: Sat, 07 Jan 2023 18:06:01 GMT
last-modified: Mon, 05 Dec 2022 16:16:55 GMT
cf-cache-status: HIT
age: 7253
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tBEw7v73IRAARDJE2o3oOi4%2BLH9byYlX8FWH96Ztat5KX80YNCgedKOBP3O4mpLgsnHLe9B5uXWUfqV4rI3LgsqTILUY8WJfWfE3C7IWP0ZloyBIHs%2BR9Kjr4bGLcXK4%2Fr%2BO"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77681fcf9a6e0b45-OSL
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Arg/img/flag.jpg | 104.26.14.73 | 200 OK | 11 kB |
URL HTTP/2goforrewards.info/RM/Arg/img/flag.jpg IP104.26.14.73:0
File typeJPEG image data, Exif standard: [TIFF image data, big-endian, direntries=15, height=480, bps=0, PhotometricIntepretation=RGB, orientation=upper-left, width=480], progressive, precision 8, 50x50, components 3\012- data Hash3da6f6ab99d6d33120443b819142dba5 243dfe1309f7ef5b5c646dfeb99f71c6656af7d4 76af28d5b349334ab752a1e30499a9b2da88f057aa0ca4fa7f65a9ba2b320725
GET /RM/Arg/img/flag.jpg HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:06:54 GMT
content-type: image/jpeg
content-length: 11245
cache-control: max-age=2592000
cf-bgj: h2pri
etag: "638e1974-2bed"
expires: Sat, 07 Jan 2023 18:06:01 GMT
last-modified: Mon, 05 Dec 2022 16:16:52 GMT
cf-cache-status: HIT
age: 7253
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OCMqGFmDb0uQMaAmc3oA1v%2BQ4KMEDnMn%2FQPkDxMswNz8DSPnZg1fBApAn3YcDfSH6B2JhLV0%2FdT0LSt9sGjLfs2A4eDZeY0cu0vyeSA3txvD1soZzq%2Fvg0k4l9LCMCw1Fysk"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77681fcf8a5a0b45-OSL
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Arg/img/logo.jpg | 104.26.14.73 | 200 OK | 10 kB |
URL HTTP/2goforrewards.info/RM/Arg/img/logo.jpg IP104.26.14.73:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, baseline, precision 8, 240x186, components 3\012- data Hashf93b62753c8e00162fe994650ab5bcf7 17a79c113808e78250ec99a3e6dd214f3dfbbbea 3e9202da6f25dea0528426ccd8a5811d4aedb29f5ba5fac6e036f820cd9e4985
GET /RM/Arg/img/logo.jpg HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:06:54 GMT
content-type: image/jpeg
content-length: 10365
cache-control: max-age=2592000
cf-bgj: h2pri
etag: "638e1975-287d"
expires: Fri, 06 Jan 2023 05:17:48 GMT
last-modified: Mon, 05 Dec 2022 16:16:53 GMT
cf-cache-status: HIT
age: 139746
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GMAInlA9sS7M3hNWOM7y2qTMY%2BPMhESKDt0hc0SW8REvLZNSqzZvdtUluZ8e23nu0o8DXkJ7wScM%2Bsp7LUlfdQetXwSix5aWRVNhkgM%2FJ%2FWRIhswuXJlzYNawovfcJv%2FmtRV"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77681fcfaa740b45-OSL
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Arg/js/script.js.download | 104.26.14.73 | 200 OK | 4.0 kB |
URL HTTP/2goforrewards.info/RM/Arg/js/script.js.download IP104.26.14.73:0
Hashaf7eb0685a2dc74d072e84d50f39738f e8dac0046b0fa00c655ef2b05a292e984d128457 424adf851ef0f98ea1b88589953e95aa27c5cdb746288371b63e253265cc233d
| Analyzer | Verdict | Alert |
|---|
| fortinet | Phishing | |
GET /RM/Arg/js/script.js.download HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:06:54 GMT
content-type: application/octet-stream
content-length: 3977
last-modified: Mon, 05 Dec 2022 16:16:58 GMT
etag: "638e197a-f89"
accept-ranges: bytes
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z3tBJaieZO4a7H79pvTBKPq7lhyBtwu9xQdLWWPvf2n789%2F9JaWQnB4RanYYbxFqJ47uokRgK%2B35jyju73z%2BqRrRBh21zVd0Yl4lG5zOVjSWlcRJLN9w%2FaaU6Ea1DpsQsxi%2F"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77681fcfaa760b45-OSL
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Arg/js/confetti.js.download | 104.26.14.73 | 200 OK | 5.7 kB |
URL HTTP/2goforrewards.info/RM/Arg/js/confetti.js.download IP104.26.14.73:0
Hash0bf680ed10be0fc040015e7e735a4ae3 d02ea58f56584cb59cd2f7799822283032a666ee f79f02e3e9615682a3fa00c2aee52f2cea0656407ef311f5a0367dccd06186d9
| Analyzer | Verdict | Alert |
|---|
| fortinet | Phishing | |
GET /RM/Arg/js/confetti.js.download HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:06:54 GMT
content-type: application/octet-stream
content-length: 5735
last-modified: Mon, 05 Dec 2022 16:16:57 GMT
etag: "638e1979-1667"
accept-ranges: bytes
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PEpeKdFSWUc5LPVpgMyhtr5XMSbK24UGvztInRCuj%2FVr89sG89KtSgA1%2FRQViPeSW%2B6T3VpKe25h2C8gHH4mzgOlDoe7x7bNiJrAlbnLhlXgpwXr1TWRc0jkutrha1dHmCNg"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77681fcfaa780b45-OSL
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Arg/js/count_down.js | 104.26.14.73 | 200 OK | 831 B |
URL HTTP/2goforrewards.info/RM/Arg/js/count_down.js IP104.26.14.73:0
File typeASCII text, with CRLF line terminators Hash5f7831ae4a01fb81a4602213bbe9b032 6b2ed9fb4205206fc7fb54a9616fafeab71c1143 ba0d97018b91905c0038c066b77da593fd6ae26bdbd171f8f91733eef6fef4a9
| Analyzer | Verdict | Alert |
|---|
| fortinet | Phishing | |
GET /RM/Arg/js/count_down.js HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:06:54 GMT
content-type: application/javascript
last-modified: Mon, 05 Dec 2022 16:16:57 GMT
etag: W/"638e1979-4cd"
expires: Sat, 07 Jan 2023 18:06:01 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 7253
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MQ%2Fa5pkO%2BZ0CxWElL3fvePmvToH6uWiizLDVCVX26kfh9QfqMNPkwiT1C3H1gO1ZzW1pERSmjue48CPgQmExao0QTtJl3fyTq6KKCgWTGmeL8uvnislVqTmXLdCgvcIinNCv"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77681fcf8a530b45-OSL
content-encoding: br
X-Firefox-Spdy: h2
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.131 | 200 OK | 472 B |
IP142.250.74.131:0
Hash6ec5f6261a8262e9f94b29627f54cefe 7ac766cf2ac8c2d960ec033388a767ff8a7d45e2 5f6ee11d840909fc5272c2c32f7874d55f49d831abc88d527e35562d218890f9
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 20:06:54 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| goforrewards.info/RM/Arg/js/jquery.min.js.download | 104.26.14.73 | 200 OK | 84 kB |
URL HTTP/2goforrewards.info/RM/Arg/js/jquery.min.js.download IP104.26.14.73:0
File typeASCII text, with very long lines (32025) Hash4a356126b9573eb7bd1e9a7494737410 8258d046f17dd3c15a5d3984e1868b7b5d1db329 22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5
| Analyzer | Verdict | Alert |
|---|
| fortinet | Phishing | |
GET /RM/Arg/js/jquery.min.js.download HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:06:54 GMT
content-type: application/octet-stream
content-length: 84380
last-modified: Mon, 05 Dec 2022 16:16:58 GMT
etag: "638e197a-1499c"
accept-ranges: bytes
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ULpb8J2XRYYTthie%2FeJ8mzPZP%2B2qOf5TWlNHgykbnwwgKa54%2Fpb5nno%2FNU3U7MDCtzutoVAmpl3vcUUj9e2Q39dorgzmKiYnx1NqBzRErYoFDrZQK9xkhJXQ5nimXM87x7GJ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77681fcfaa750b45-OSL
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Arg/css/main.css | 104.26.14.73 | 200 OK | 4.0 kB |
URL HTTP/2goforrewards.info/RM/Arg/css/main.css IP104.26.14.73:0
Hashd984faa5da5c99d466ce5ad008a4a642 4122fa95aa0c8d278b5509c8baeb846da53532ff 9f75f544dee9ebc0d6534b8fa6c57c1a797621b00bd81b33d55dc920207995f8
GET /RM/Arg/css/main.css HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:06:54 GMT
content-type: text/css
last-modified: Mon, 05 Dec 2022 16:16:48 GMT
etag: W/"638e1970-2adc"
expires: Sat, 07 Jan 2023 18:06:01 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 7253
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=agjtxmHHRoPo3w049aOfRdufpM6XCav0C1nxiPz2q9Ol4n24k1bjlwU938SlEFYqp1TqSGQAM9CQjlKJKdOfhJpj%2F5ZurJPBfY304CNyWwe20XbKOrsumpsrwI4UC87RoDj8"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77681fcf8a510b45-OSL
content-encoding: br
X-Firefox-Spdy: h2
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.131 | 200 OK | 472 B |
IP142.250.74.131:0
Hash6ec5f6261a8262e9f94b29627f54cefe 7ac766cf2ac8c2d960ec033388a767ff8a7d45e2 5f6ee11d840909fc5272c2c32f7874d55f49d831abc88d527e35562d218890f9
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 20:06:54 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US | 35.241.9.150 | 200 OK | 329 B |
URL HTTP/2firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US IP35.241.9.150:0
File typeJSON data\012- , ASCII text, with very long lines (329), with no line terminators Hash0333b0655111aa68de771adfcc4db243 63f295a144ac87a7c8e23417626724eeca68a7eb 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
access-control-allow-origin: *
access-control-expose-headers: Content-Length, Pragma, Last-Modified, ETag, Alert, Expires, Retry-After, Cache-Control, Backoff, Content-Type
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Thu, 08 Dec 2022 19:07:58 GMT
age: 3536
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
content-type: application/json
cache-control: max-age=3600,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| ocsp.pki.goog/gts1c3 | 142.250.74.131 | 200 OK | 472 B |
IP142.250.74.131:0
Hash0e9eef4ed41ef94e9ea175ad243e294e b6f83e508270413dabe55e2884b5409ca7978e24 0e741ca8d92717128bca7aed937bca43519a8d20a9d3dd8670da656ad51a695e
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 20:06:54 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
|
|
| fonts.gstatic.com/s/changa/v20/2-c79JNi2YuVOUcOarRPgnNGooxCZ62xcjfj9w.woff2 | 142.250.74.35 | 200 OK | 9.1 kB |
URL HTTP/2fonts.gstatic.com/s/changa/v20/2-c79JNi2YuVOUcOarRPgnNGooxCZ62xcjfj9w.woff2 IP142.250.74.35:0
File typeWeb Open Font Format (Version 2), TrueType, length 9120, version 1.0\012- data Hash18ad880aaa4e28b6cd1ef0d30ac95573 da6a33a1ecc296aa481432e2727b273140b78543 f2c5710634752d1a156adf5ac961c8400e3a577c90f97a6a293a07f4a28957fd
GET /s/changa/v20/2-c79JNi2YuVOUcOarRPgnNGooxCZ62xcjfj9w.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://goforrewards.info
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 9120
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 08 Dec 2022 05:51:30 GMT
expires: Fri, 08 Dec 2023 05:51:30 GMT
cache-control: public, max-age=31536000
age: 51324
last-modified: Fri, 24 Jun 2022 18:40:48 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Arg/new/confetti.js.download | 104.26.14.73 | 404 Not Found | 575 B |
URL HTTP/2goforrewards.info/RM/Arg/new/confetti.js.download IP104.26.14.73:0
File typeHTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators Hash1cecc1baa40e7fde92d5f03bbcdec7ec f0ae82da96f252a0882df0de0eb43b6d9c5ce15c a116248973e2c7324439d08a47de36c68e279ca9c6ba4c0aaa50f80ab9c9ad36
| Analyzer | Verdict | Alert |
|---|
| fortinet | Phishing | |
GET /RM/Arg/new/confetti.js.download HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
date: Thu, 08 Dec 2022 20:06:55 GMT
content-type: text/html
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=knrWTPKAsEdJPzy%2FzQvje9aeNYQtgCG23pk7LgXeWzeESJ55RyYo97Xo18Yfx6JoOryuCZUigzWl%2Fx8jKxs6YIXV4eiDd%2B%2BVm6c%2B9NBvgPO6UgDKLZJCJAkeKxr%2FRzSO%2BExl"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77681fd1ac7e0b45-OSL
content-encoding: br
X-Firefox-Spdy: h2
|
|
| ocsp.digicert.com/ |  93.184.220.29 | 200 OK | 471 B |
IP93.184.220.29:0
Hashfd55f4aaaab6ec40bc7dc10252cd819a a72523f60be265a391fa9edc43e0a93418ad1fd0 bae354b3db14f4fd115311a0c412c9b5e436dd9e0a151afd8b9c18831dd8c2dd
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2075
Cache-Control: max-age=135272
Content-Type: application/ocsp-response
Date: Thu, 08 Dec 2022 20:06:55 GMT
Etag: "6391a92c-1d7"
Expires: Sat, 10 Dec 2022 09:41:27 GMT
Last-Modified: Thu, 08 Dec 2022 09:06:52 GMT
Server: ECS (ska/F713)
X-Cache: HIT
Content-Length: 471
|
|
| r3.o.lencr.org/ | 23.33.119.27 | 200 OK | 503 B |
IP23.33.119.27:0 ASN#20940 Akamai International B.V.
Hash603f73fcfa1cc5debe925bda211db3d4 035a372a47ad11c3d8964875479383ee92060cc0 11f926d38625ca53da090423f4f073147f43086debd45b2baebd22f92439a84c
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "11F926D38625CA53DA090423F4F073147F43086DEBD45B2BAEBD22F92439A84C"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=21597
Expires: Fri, 09 Dec 2022 02:06:52 GMT
Date: Thu, 08 Dec 2022 20:06:55 GMT
Connection: keep-alive
|
|
| goforrewards.info/RM/Arg/css/style.css | 104.26.14.73 | 200 OK | 1.2 kB |
URL HTTP/2goforrewards.info/RM/Arg/css/style.css IP104.26.14.73:0
File typeASCII text, with very long lines (768) Hasha81916cc9318e3830aa7d6ae056489f9 768c290cebf828b0345158b452c7981b433868c4 67a10871bb61eb505de3c8db99873edb996427e25a5687e0d87ad26af9cde4e1
GET /RM/Arg/css/style.css HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:06:54 GMT
content-type: text/css
last-modified: Mon, 05 Dec 2022 16:16:48 GMT
etag: W/"638e1970-e3a"
expires: Sat, 07 Jan 2023 18:06:01 GMT
cache-control: max-age=2592000
cf-cache-status: HIT
age: 7253
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FyvwG%2Bjc5eVqB480VGVzKj09cyM3O6NwhnY7xPi7t9gW%2BXC0NZZKRWl6nc6tfx1HRsN2cwQ3Ec3mbyEWf3%2BDeqxoaYFS4cHJ3rQYBfUC9Q8dXmByKmziBshJRkdg5WN2eXQJ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77681fcf8a4f0b45-OSL
content-encoding: br
X-Firefox-Spdy: h2
|
|
| r3.o.lencr.org/ | 23.33.119.27 | 200 OK | 503 B |
IP23.33.119.27:0 ASN#20940 Akamai International B.V.
Hash48c90992f0837a58e0a36118a27dae6a 3d238fed35e6d247bddbba92864e6b92e6aed9b6 cacc53ed285e96dcd5ba7609823922a253bc0623999b8716f430632d2c0e7dac
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "CACC53ED285E96DCD5BA7609823922A253BC0623999B8716F430632D2C0E7DAC"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3556
Expires: Thu, 08 Dec 2022 21:06:12 GMT
Date: Thu, 08 Dec 2022 20:06:56 GMT
Connection: keep-alive
|
|
| r3.o.lencr.org/ | 23.33.119.27 | 200 OK | 503 B |
IP23.33.119.27:0 ASN#20940 Akamai International B.V.
Hash48c90992f0837a58e0a36118a27dae6a 3d238fed35e6d247bddbba92864e6b92e6aed9b6 cacc53ed285e96dcd5ba7609823922a253bc0623999b8716f430632d2c0e7dac
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "CACC53ED285E96DCD5BA7609823922A253BC0623999B8716F430632D2C0E7DAC"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3556
Expires: Thu, 08 Dec 2022 21:06:12 GMT
Date: Thu, 08 Dec 2022 20:06:56 GMT
Connection: keep-alive
|
|
| r3.o.lencr.org/ | 23.33.119.27 | 200 OK | 503 B |
IP23.33.119.27:0 ASN#20940 Akamai International B.V.
Hash48c90992f0837a58e0a36118a27dae6a 3d238fed35e6d247bddbba92864e6b92e6aed9b6 cacc53ed285e96dcd5ba7609823922a253bc0623999b8716f430632d2c0e7dac
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "CACC53ED285E96DCD5BA7609823922A253BC0623999B8716F430632D2C0E7DAC"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3556
Expires: Thu, 08 Dec 2022 21:06:12 GMT
Date: Thu, 08 Dec 2022 20:06:56 GMT
Connection: keep-alive
|
|
| r3.o.lencr.org/ | 23.33.119.27 | 200 OK | 503 B |
IP23.33.119.27:0 ASN#20940 Akamai International B.V.
Hash48c90992f0837a58e0a36118a27dae6a 3d238fed35e6d247bddbba92864e6b92e6aed9b6 cacc53ed285e96dcd5ba7609823922a253bc0623999b8716f430632d2c0e7dac
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "CACC53ED285E96DCD5BA7609823922A253BC0623999B8716F430632D2C0E7DAC"
Last-Modified: Wed, 07 Dec 2022 17:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=3556
Expires: Thu, 08 Dec 2022 21:06:12 GMT
Date: Thu, 08 Dec 2022 20:06:56 GMT
Connection: keep-alive
|
|
| img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9519925e-95b7-4e66-b317-84c1708c7f84.jpeg | 34.120.237.76 | 200 OK | 8.7 kB |
URL HTTP/2img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9519925e-95b7-4e66-b317-84c1708c7f84.jpeg IP34.120.237.76:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Hashb87d6543345f73653ed4a49b37d7c959 c4f26846b8b72293368ff16915d49297cf12bbb9 aee6aa42e4b5b83b81f74801ff8f0039fc6d38036f42ee81875813c856cf5eef
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9519925e-95b7-4e66-b317-84c1708c7f84.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8659
x-amzn-requestid: 6f420d07-65d5-4bb2-9f1f-e56025de497b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: czFSYFArIAMF46w=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63911c0f-0a295e5c48228d5806b4f107;Sampled=0
x-amzn-remapped-date: Wed, 07 Dec 2022 23:04:47 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: TSh1BNzzIPhWCfYEiqvQJckSPAyhHobe-HK6msEVeEJ1ruX-_rMSSA==
via: 1.1 2dc111aa3ead15d061e41a423155a53a.cloudfront.net (CloudFront), 1.1 591683988172c7980c4ebb318cbf18a8.cloudfront.net (CloudFront), 1.1 google
date: Wed, 07 Dec 2022 23:33:19 GMT
age: 74017
etag: "c4f26846b8b72293368ff16915d49297cf12bbb9"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fffe93cbd-4506-4ab1-b0ea-94eabecae7b9.jpeg | 34.120.237.76 | 200 OK | 6.6 kB |
URL HTTP/2img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fffe93cbd-4506-4ab1-b0ea-94eabecae7b9.jpeg IP34.120.237.76:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Hash210b27f5f6310d8fad640acce3d9ae0e 08d241e56622cb900754d95bc5d58ed8826d9f32 64410e13759cdfa24976dcba0c64aca27edc3ee56358f344e55f60793422e3ea
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fffe93cbd-4506-4ab1-b0ea-94eabecae7b9.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6557
x-amzn-requestid: 0232ddcd-8274-431e-a55e-8298fbfd6dfc
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cmcuMG6bIAMFUng=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638c0e5a-3cc17121425f87321ce7ae7e;Sampled=0
x-amzn-remapped-date: Sun, 04 Dec 2022 03:04:58 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: etWGqF-8tXSwaeZVTPK4g9CV5ZbdYv5ZDjF5Yx2PSNnTsreewpbhdA==
via: 1.1 9c60d6224ac0b44e908b5c9dcf70e9a4.cloudfront.net (CloudFront), 1.1 12a392bc3a7281f8d5d4591bfadc41fc.cloudfront.net (CloudFront), 1.1 google
date: Thu, 08 Dec 2022 08:48:08 GMT
age: 40728
etag: "08d241e56622cb900754d95bc5d58ed8826d9f32"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa9301ee5-df75-4967-a2c7-597f869e557b.jpeg | 34.120.237.76 | 200 OK | 12 kB |
URL HTTP/2img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa9301ee5-df75-4967-a2c7-597f869e557b.jpeg IP34.120.237.76:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Hash57be99ac898a37d73f2ba4a24f56248f 04e32eb45581201a6a1863200e4d139df48285e6 a20081b64fc019372843360b15aa3461ec9dd3deb50ab398bca0a5e74d5468c2
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa9301ee5-df75-4967-a2c7-597f869e557b.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 12534
x-amzn-requestid: 2a01f2ba-cf3a-4f59-8339-214c66bcc0d2
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: czDbyGTcoAMF_TQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63911918-5d3eba8d01e4175a71acc6cd;Sampled=0
x-amzn-remapped-date: Wed, 07 Dec 2022 22:52:08 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: NoZlZ8WFfOuIbkWaC2pJPJQrWtjzz2gCHJWr-u-nMNYmu8MkTf6_PA==
via: 1.1 86b676273517904f44af31586adb06ae.cloudfront.net (CloudFront), 1.1 e66162aafd55b64ba1478ff7105150fa.cloudfront.net (CloudFront), 1.1 google
date: Wed, 07 Dec 2022 23:03:58 GMT
age: 75778
etag: "04e32eb45581201a6a1863200e4d139df48285e6"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbbba0eea-a6f1-4374-a9c7-dab84270023b.jpeg | 34.120.237.76 | 200 OK | 7.3 kB |
URL HTTP/2img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbbba0eea-a6f1-4374-a9c7-dab84270023b.jpeg IP34.120.237.76:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Hash24d89b69ba37bf23c5d576aff4063caf 3d46a21b4da571d7e4962e335c18a28ca5f81ecf 09b52cdab278805c6e7282f469a02768ee62fc9ef09a6623a337e3d3aaa446fd
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbbba0eea-a6f1-4374-a9c7-dab84270023b.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7268
x-amzn-requestid: ae5c231c-b1be-498a-a242-e8d641f3fe8e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: czFDgEzUoAMFgyQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63911baf-10f06dc37cac69631c823fd9;Sampled=0
x-amzn-remapped-date: Wed, 07 Dec 2022 23:03:11 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: QSv756DvAzOQnKae5wVg75wrQS6oDGPkfIZka86FNQ2vizBnZ7sIDQ==
via: 1.1 2afae0d44e2540f472c0635ab62c232a.cloudfront.net (CloudFront), 1.1 d6a002c70d55f415107618b0750d493c.cloudfront.net (CloudFront), 1.1 google
date: Wed, 07 Dec 2022 23:12:45 GMT
age: 75251
etag: "3d46a21b4da571d7e4962e335c18a28ca5f81ecf"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F74e98e03-fa9f-4e56-a8ba-5411568d88c8.jpeg | 34.120.237.76 | 200 OK | 9.6 kB |
URL HTTP/2img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F74e98e03-fa9f-4e56-a8ba-5411568d88c8.jpeg IP34.120.237.76:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Hashc408efaa98ac2ce63bb1618368d10c15 a51bbb49ebd862d04eaee465d0a35b22dcd21391 077eb8c8739f527828c71c25a1c3aaae46afead3aac093ec11a6d5488ef2f0ec
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F74e98e03-fa9f-4e56-a8ba-5411568d88c8.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9596
x-amzn-requestid: e5e6ceb2-5bad-4146-a9de-92a859716029
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cy3_qH63oAMFfLg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-639106ca-678bed1b7729b8aa2645688d;Sampled=0
x-amzn-remapped-date: Wed, 07 Dec 2022 21:34:02 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: FsbiyZG0110CEANduIIWuLcxFOxfrV0YPvOSy-ScXFIX1qM6qaOdCg==
via: 1.1 49b94a8674d6e86a841d6523f7dbaf14.cloudfront.net (CloudFront), 1.1 7eb3b782ab09047ce0d11ee03763894c.cloudfront.net (CloudFront), 1.1 google
date: Wed, 07 Dec 2022 22:21:22 GMT
age: 78334
etag: "a51bbb49ebd862d04eaee465d0a35b22dcd21391"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4119e239-0c3b-4175-bfe0-f5d42729d743.jpeg | 34.120.237.76 | 200 OK | 7.8 kB |
URL HTTP/2img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4119e239-0c3b-4175-bfe0-f5d42729d743.jpeg IP34.120.237.76:0
File typeJPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data Hash8c94003641bb5a7595e7004f80f95d22 3446450df60d732f9021d5bfd5f5f7c6c870d9ec 4d782dbf94b2163e9bc18028cd0c1a391fdcfcb019f23c4c26ea0b44432039ff
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4119e239-0c3b-4175-bfe0-f5d42729d743.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7801
x-amzn-requestid: cb8d5aab-409f-4b39-b498-b1ba84f34e06
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: czFRNHX4oAMFvoQ=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63911c07-7c6e3bfa3f81082b48f43fa9;Sampled=0
x-amzn-remapped-date: Wed, 07 Dec 2022 23:04:39 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: 8QHhEAFHTHd-5UqS1S5qwJj_h4WNfix2CgS4MO4zR_psrzgMP3SZ5g==
via: 1.1 98e601970ea59f4d5f56a752787ff9fc.cloudfront.net (CloudFront), 1.1 57a21088b36c69a83578b5a5579df58e.cloudfront.net (CloudFront), 1.1 google
date: Wed, 07 Dec 2022 23:16:35 GMT
age: 75021
etag: "3446450df60d732f9021d5bfd5f5f7c6c870d9ec"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
|
|
| psothoms.com/zone?&pub=0&zone_id=5579263&is_mobile=false&domain=goforrewards.info&var=&ymid=&var_3=&dsig=&action=prerequest | 139.45.197.251 | 200 OK | 0 B |
URL HTTP/2psothoms.com/zone?&pub=0&zone_id=5579263&is_mobile=false&domain=goforrewards.info&var=&ymid=&var_3=&dsig=&action=prerequest IP139.45.197.251:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
POST /zone?&pub=0&zone_id=5579263&is_mobile=false&domain=goforrewards.info&var=&ymid=&var_3=&dsig=&action=prerequest HTTP/1.1
Host: psothoms.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://goforrewards.info
Connection: keep-alive
Referer: https://goforrewards.info/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0
HTTP/2 200 OK
server: nginx
date: Thu, 08 Dec 2022 20:07:03 GMT
content-length: 0
x-trace-id: 759e5760bf96d3f33d0cf6becea7e10d
access-control-allow-origin: https://goforrewards.info
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=1
x-content-type-options: nosniff
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Arg/new/jquery.min.js.download | 104.26.14.73 | 404 Not Found | 0 B |
URL HTTP/2goforrewards.info/RM/Arg/new/jquery.min.js.download IP104.26.14.73:0
| Analyzer | Verdict | Alert |
|---|
| fortinet | Phishing | |
GET /RM/Arg/new/jquery.min.js.download HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
date: Thu, 08 Dec 2022 20:06:54 GMT
content-type: text/html
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UpXzSHtzW1lGA2p5nwKMu%2BmEH%2B%2FQKaiRzQidUUj0O%2Bf8sY3KiydfAA0OgXKJ2zxbOEFaeIzYsGdlxJ0jKwbC%2Fygn5SBFEq5ROS850SSpNnHQX2FcRFzxTSgtasdPPNM%2BxpUv"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77681fd13c050b45-OSL
content-encoding: br
X-Firefox-Spdy: h2
|
|
| fonts.googleapis.com/css?family=Changa | 142.250.74.106 | 200 OK | 0 B |
URL HTTP/2fonts.googleapis.com/css?family=Changa IP142.250.74.106:0
GET /css?family=Changa HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/css; charset=utf-8
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Thu, 08 Dec 2022 20:06:54 GMT
date: Thu, 08 Dec 2022 20:06:54 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
|
|
| goforrewards.info/favicon.ico | 104.26.14.73 | 404 Not Found | 0 B |
URL HTTP/2goforrewards.info/favicon.ico IP104.26.14.73:0
GET /favicon.ico HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
date: Thu, 08 Dec 2022 20:06:55 GMT
content-type: text/html
cache-control: max-age=14400
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Bh7l9DOIzktbh4ouHSKTj922EWZMsT53lpeN5tABbxvXwqzfoM3WwzlTGLCCT8adlJwNCvM%2FGnyXahvhNUiGF8EKD%2BN95I6tQQV43SIyA8I9BsV6lJ5n1CROpgHhW2VJDdGw"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 77681fd2bd7d0b45-OSL
content-encoding: br
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Arg/new/jquery.min.js.download | 104.26.14.73 | 404 Not Found | 0 B |
URL HTTP/2goforrewards.info/RM/Arg/new/jquery.min.js.download IP104.26.14.73:0
| Analyzer | Verdict | Alert |
|---|
| fortinet | Phishing | |
GET /RM/Arg/new/jquery.min.js.download HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
date: Thu, 08 Dec 2022 20:06:54 GMT
content-type: text/html
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4IuBHTV34JOuDLOBFm5cBLZ5m62B2HozmW02bwTP0%2BTHbdGf%2Foe8gp9FCqKHu0qdr6OSXBV9qSJv08QPEtjZpaCLtJTvzPgcZxIBHAhZVstM1elSpYHlb%2BM9E%2F%2FNNB9fEWgV"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77681fcfaa770b45-OSL
content-encoding: br
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Arg/new/confetti.js.download | 104.26.14.73 | 404 Not Found | 0 B |
URL HTTP/2goforrewards.info/RM/Arg/new/confetti.js.download IP104.26.14.73:0
| Analyzer | Verdict | Alert |
|---|
| fortinet | Phishing | |
GET /RM/Arg/new/confetti.js.download HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/RM/Arg/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 404 Not Found
date: Thu, 08 Dec 2022 20:06:54 GMT
content-type: text/html
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JSqKJi8drP0KUNr9PB1rwxezd%2B6VQa7AR2bCDH12Y5t%2FDE3LSPAMY7YK3tMl7ljUxajcfqVvWVIFKySxQr42BNpC2SoysLRD8we2CGh49vNpLKn7P54F8NaLHPy3xJd3Mi6W"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77681fcfaa790b45-OSL
content-encoding: br
X-Firefox-Spdy: h2
|
|
| psothoms.com/pfe/current/micro.tag.min.js?z=5579263&sw=/sw-check-permissions-41f6b.js | 139.45.197.251 | 200 OK | 0 B |
URL HTTP/2psothoms.com/pfe/current/micro.tag.min.js?z=5579263&sw=/sw-check-permissions-41f6b.js IP139.45.197.251:0
| Analyzer | Verdict | Alert |
|---|
| quad9 | Sinkholed | |
GET /pfe/current/micro.tag.min.js?z=5579263&sw=/sw-check-permissions-41f6b.js HTTP/1.1
Host: psothoms.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://goforrewards.info/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Thu, 08 Dec 2022 20:06:55 GMT
content-type: application/javascript
last-modified: Thu, 01 Dec 2022 15:42:47 GMT
etag: W/"6388cb77-9a87"
access-control-allow-credentials: true
cache-control: no-cache
pragma: no-cache
content-encoding: gzip
X-Firefox-Spdy: h2
|
|
| goforrewards.info/RM/Arg/ | 104.26.14.73 | 200 OK | 0 B |
URL HTTP/2goforrewards.info/RM/Arg/ IP104.26.14.73:0
| Analyzer | Verdict | Alert |
|---|
| fortinet | Phishing | |
GET /RM/Arg/ HTTP/1.1
Host: goforrewards.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
HTTP/2 200 OK
date: Thu, 08 Dec 2022 20:06:54 GMT
content-type: text/html
last-modified: Mon, 05 Dec 2022 16:16:46 GMT
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=49XfYu7RDDguq8ViXBqDYQp5Q%2F0Kg8VgMgafRCyaqu58cmh6QPIkv%2FBbHAjTrDBYNjp6M1ZjLmY%2B7GYvKaimYQ%2BDt1mbu5g%2BkfLhG5ncKgfyqMOrhXsdzGAYC2fdfaPsbTr5"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 77681fce79860b45-OSL
content-encoding: br
X-Firefox-Spdy: h2
|
|