winbigsurvey.com/flag.png
104.21.37.177200 OK 396 B URL GET HTTP/3 winbigsurvey.com/flag.png
IP 104.21.37.177:443
Requested by https://winbigsurvey.com/index1?cep=pSJcfi0qGfAPUh4iAQyC32HlbpywJeW6QBF7OjVPq0yQMKR_FPIUUq3fGSpD8lMF8Nw2AhnsZe6-O_UbjISljIVvBCsQ59unjwwLodOROZXlBb1gspmfXpK1YGHS8a-qKpxufkSqSoKL2TeUfVPbQRbizuf3WcnkaDww7fhstuY_KE9PAkAOX4KKYFVIsl94JDMNYKVSzHxDtf1AQFgtkr9r8Kn914Xj84ZY24hJv9TteoQZKOrCljABdtX5ohMG7lX-47mnpmjWUnmnOOua2QCOvXt_y8hlZrrcdM513nTcgKgUWJ8stM0yj2w_Zo4NqLi5SL-1wr04pNhuO8Xm_vn2MzmQQNarlhrtI0pQsyElOKkeUA4j8Z9gCcY2WwcoG76yr_UNed4MwtWGOvCL8HxPzTEV2SbfAx8ZIf7U_ak&lptoken=16cb862e80d3121070c9
Certificate IssuerLet's Encrypt
Subjectwinbigsurvey.com
Fingerprint36:E1:35:65:EB:A1:A6:6D:26:6F:D8:F5:34:6D:81:D1:E9:73:B3:69
ValidityThu, 11 May 2023 06:57:49 GMT - Wed, 09 Aug 2023 06:57:48 GMT
File type PNG image data, 35 x 24, 8-bit/color RGBA, non-interlaced\012- data
Hash 4946ce8ece16515620550ffaa4794454
a2ce2cc55eb329be83209b35501cf23f0f8a0891
8d39313e9143edeee5d38c05fce025fa4edffd461b46ddd6bcc9a7eddcc50e0f
Analyzer Verdict Alert quad9 Sinkholed
GET /flag.png HTTP/1.1
Host: winbigsurvey.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://winbigsurvey.com/index1?cep=pSJcfi0qGfAPUh4iAQyC32HlbpywJeW6QBF7OjVPq0yQMKR_FPIUUq3fGSpD8lMF8Nw2AhnsZe6-O_UbjISljIVvBCsQ59unjwwLodOROZXlBb1gspmfXpK1YGHS8a-qKpxufkSqSoKL2TeUfVPbQRbizuf3WcnkaDww7fhstuY_KE9PAkAOX4KKYFVIsl94JDMNYKVSzHxDtf1AQFgtkr9r8Kn914Xj84ZY24hJv9TteoQZKOrCljABdtX5ohMG7lX-47mnpmjWUnmnOOua2QCOvXt_y8hlZrrcdM513nTcgKgUWJ8stM0yj2w_Zo4NqLi5SL-1wr04pNhuO8Xm_vn2MzmQQNarlhrtI0pQsyElOKkeUA4j8Z9gCcY2WwcoG76yr_UNed4MwtWGOvCL8HxPzTEV2SbfAx8ZIf7U_ak&lptoken=16cb862e80d3121070c9
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 15 Jun 2023 03:24:49 GMT
content-type: image/png
content-length: 396
access-control-allow-origin: *
cache-control: public, max-age=14400, must-revalidate
etag: "c6d668a33eb97f55f7efe14138a920fb"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wy7c2pU6ZfK0oRPm4kgq6%2FCQrc9KyKLO571KxvIuQCR%2B%2FcZX4wkloxjQnYrWSAAbIvkK1GQovi78Var8E%2FFYRbDoiOB5weEHfLm6ARakD0pzlA76vB7lCDULtDwmKz%2B%2Fq38T"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
cf-cache-status: MISS
accept-ranges: bytes
server: cloudflare
cf-ray: 7d77b3ca3ff1b500-OSL
alt-svc: h3=":443"; ma=86400
winbigsurvey.com/798de66f3f946ccb50a6c1e181b82b4660619f2c.png
104.21.37.177200 OK 4.2 kB URL GET HTTP/3 winbigsurvey.com/798de66f3f946ccb50a6c1e181b82b4660619f2c.png
IP 104.21.37.177:443
Requested by https://winbigsurvey.com/index1?cep=pSJcfi0qGfAPUh4iAQyC32HlbpywJeW6QBF7OjVPq0yQMKR_FPIUUq3fGSpD8lMF8Nw2AhnsZe6-O_UbjISljIVvBCsQ59unjwwLodOROZXlBb1gspmfXpK1YGHS8a-qKpxufkSqSoKL2TeUfVPbQRbizuf3WcnkaDww7fhstuY_KE9PAkAOX4KKYFVIsl94JDMNYKVSzHxDtf1AQFgtkr9r8Kn914Xj84ZY24hJv9TteoQZKOrCljABdtX5ohMG7lX-47mnpmjWUnmnOOua2QCOvXt_y8hlZrrcdM513nTcgKgUWJ8stM0yj2w_Zo4NqLi5SL-1wr04pNhuO8Xm_vn2MzmQQNarlhrtI0pQsyElOKkeUA4j8Z9gCcY2WwcoG76yr_UNed4MwtWGOvCL8HxPzTEV2SbfAx8ZIf7U_ak&lptoken=16cb862e80d3121070c9
Certificate IssuerLet's Encrypt
Subjectwinbigsurvey.com
Fingerprint36:E1:35:65:EB:A1:A6:6D:26:6F:D8:F5:34:6D:81:D1:E9:73:B3:69
ValidityThu, 11 May 2023 06:57:49 GMT - Wed, 09 Aug 2023 06:57:48 GMT
File type PNG image data, 251 x 44, 8-bit/color RGBA, non-interlaced\012- data
Hash 145dea4399a43eb197347f68088011b6
ebdbe0ab6e0579512a1d33907cbbfb01fe9f3d97
fe5f3db73f035587e4704cf88b5ce316e762b1cb8cce55a618164227462d15c3
Analyzer Verdict Alert quad9 Sinkholed
GET /798de66f3f946ccb50a6c1e181b82b4660619f2c.png HTTP/1.1
Host: winbigsurvey.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://winbigsurvey.com/index1?cep=pSJcfi0qGfAPUh4iAQyC32HlbpywJeW6QBF7OjVPq0yQMKR_FPIUUq3fGSpD8lMF8Nw2AhnsZe6-O_UbjISljIVvBCsQ59unjwwLodOROZXlBb1gspmfXpK1YGHS8a-qKpxufkSqSoKL2TeUfVPbQRbizuf3WcnkaDww7fhstuY_KE9PAkAOX4KKYFVIsl94JDMNYKVSzHxDtf1AQFgtkr9r8Kn914Xj84ZY24hJv9TteoQZKOrCljABdtX5ohMG7lX-47mnpmjWUnmnOOua2QCOvXt_y8hlZrrcdM513nTcgKgUWJ8stM0yj2w_Zo4NqLi5SL-1wr04pNhuO8Xm_vn2MzmQQNarlhrtI0pQsyElOKkeUA4j8Z9gCcY2WwcoG76yr_UNed4MwtWGOvCL8HxPzTEV2SbfAx8ZIf7U_ak&lptoken=16cb862e80d3121070c9
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 15 Jun 2023 03:24:49 GMT
content-type: image/png
content-length: 4169
access-control-allow-origin: *
cache-control: public, max-age=14400, must-revalidate
etag: "86c290f4c1d8d9a2e537cd83834177ae"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=q3%2FIfLWoUFye2gd20BOlFXOSSS0nYLYGCG3WKy8jGAgQ6cedkRzwMw%2F%2BHmDZ7qAgoxw6yEF8LiYdSfSVk51xaY1wQ9PeBxsVo%2BJ8yEK%2FZLTW0A%2FeCeoHhWW9Wm9HimfTKt7r"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
cf-cache-status: MISS
accept-ranges: bytes
server: cloudflare
cf-ray: 7d77b3ca4ff7b500-OSL
alt-svc: h3=":443"; ma=86400
winbigsurvey.com/c02173e7e4e2e6e95265f3f52dba5132a5a6e151.gif
104.21.37.177200 OK 32 kB URL GET HTTP/3 winbigsurvey.com/c02173e7e4e2e6e95265f3f52dba5132a5a6e151.gif
IP 104.21.37.177:443
Requested by https://winbigsurvey.com/index1?cep=pSJcfi0qGfAPUh4iAQyC32HlbpywJeW6QBF7OjVPq0yQMKR_FPIUUq3fGSpD8lMF8Nw2AhnsZe6-O_UbjISljIVvBCsQ59unjwwLodOROZXlBb1gspmfXpK1YGHS8a-qKpxufkSqSoKL2TeUfVPbQRbizuf3WcnkaDww7fhstuY_KE9PAkAOX4KKYFVIsl94JDMNYKVSzHxDtf1AQFgtkr9r8Kn914Xj84ZY24hJv9TteoQZKOrCljABdtX5ohMG7lX-47mnpmjWUnmnOOua2QCOvXt_y8hlZrrcdM513nTcgKgUWJ8stM0yj2w_Zo4NqLi5SL-1wr04pNhuO8Xm_vn2MzmQQNarlhrtI0pQsyElOKkeUA4j8Z9gCcY2WwcoG76yr_UNed4MwtWGOvCL8HxPzTEV2SbfAx8ZIf7U_ak&lptoken=16cb862e80d3121070c9
Certificate IssuerLet's Encrypt
Subjectwinbigsurvey.com
Fingerprint36:E1:35:65:EB:A1:A6:6D:26:6F:D8:F5:34:6D:81:D1:E9:73:B3:69
ValidityThu, 11 May 2023 06:57:49 GMT - Wed, 09 Aug 2023 06:57:48 GMT
File type GIF image data, version 89a, 253 x 365\012- data
Hash b2d36d1ca4afbbfcebe40a17bd0464a4
c02173e7e4e2e6e95265f3f52dba5132a5a6e151
a84ce04c95dc5d49848bed021f1531285004bc92585d28cdc4e69d2b5ea02bde
Analyzer Verdict Alert quad9 Sinkholed
GET /c02173e7e4e2e6e95265f3f52dba5132a5a6e151.gif HTTP/1.1
Host: winbigsurvey.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://winbigsurvey.com/index1?cep=pSJcfi0qGfAPUh4iAQyC32HlbpywJeW6QBF7OjVPq0yQMKR_FPIUUq3fGSpD8lMF8Nw2AhnsZe6-O_UbjISljIVvBCsQ59unjwwLodOROZXlBb1gspmfXpK1YGHS8a-qKpxufkSqSoKL2TeUfVPbQRbizuf3WcnkaDww7fhstuY_KE9PAkAOX4KKYFVIsl94JDMNYKVSzHxDtf1AQFgtkr9r8Kn914Xj84ZY24hJv9TteoQZKOrCljABdtX5ohMG7lX-47mnpmjWUnmnOOua2QCOvXt_y8hlZrrcdM513nTcgKgUWJ8stM0yj2w_Zo4NqLi5SL-1wr04pNhuO8Xm_vn2MzmQQNarlhrtI0pQsyElOKkeUA4j8Z9gCcY2WwcoG76yr_UNed4MwtWGOvCL8HxPzTEV2SbfAx8ZIf7U_ak&lptoken=16cb862e80d3121070c9
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 15 Jun 2023 03:24:49 GMT
content-type: image/gif
content-length: 31896
access-control-allow-origin: *
cache-control: public, max-age=14400, must-revalidate
etag: "5ed6653c08642b42051c9c65b6d085d7"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lqaJrkl6jrFrR7HSYpzWQsqyRqN%2BNGggN735gZ4WKGKJlPwW%2BFICer5l6XM9S4OxLI38Pj9BIuOnXoZqBRD24eDxSWjEXs5FIUlJpfqYoOA8GpthHkViDTNztNz7nUInIkUj"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
cf-cache-status: MISS
accept-ranges: bytes
server: cloudflare
cf-ray: 7d77b3ca5ff9b500-OSL
alt-svc: h3=":443"; ma=86400
winbigsurvey.com/2ef289afa287fa1e905a9eb520974fb963c1fe98.png
104.21.37.177200 OK 8.7 kB URL GET HTTP/3 winbigsurvey.com/2ef289afa287fa1e905a9eb520974fb963c1fe98.png
IP 104.21.37.177:443
Requested by https://winbigsurvey.com/index1?cep=pSJcfi0qGfAPUh4iAQyC32HlbpywJeW6QBF7OjVPq0yQMKR_FPIUUq3fGSpD8lMF8Nw2AhnsZe6-O_UbjISljIVvBCsQ59unjwwLodOROZXlBb1gspmfXpK1YGHS8a-qKpxufkSqSoKL2TeUfVPbQRbizuf3WcnkaDww7fhstuY_KE9PAkAOX4KKYFVIsl94JDMNYKVSzHxDtf1AQFgtkr9r8Kn914Xj84ZY24hJv9TteoQZKOrCljABdtX5ohMG7lX-47mnpmjWUnmnOOua2QCOvXt_y8hlZrrcdM513nTcgKgUWJ8stM0yj2w_Zo4NqLi5SL-1wr04pNhuO8Xm_vn2MzmQQNarlhrtI0pQsyElOKkeUA4j8Z9gCcY2WwcoG76yr_UNed4MwtWGOvCL8HxPzTEV2SbfAx8ZIf7U_ak&lptoken=16cb862e80d3121070c9
Certificate IssuerLet's Encrypt
Subjectwinbigsurvey.com
Fingerprint36:E1:35:65:EB:A1:A6:6D:26:6F:D8:F5:34:6D:81:D1:E9:73:B3:69
ValidityThu, 11 May 2023 06:57:49 GMT - Wed, 09 Aug 2023 06:57:48 GMT
File type PNG image data, 395 x 77, 8-bit/color RGBA, non-interlaced\012- data
Hash bec6b8eab9d6e094df42a0e1b8230994
2ef289afa287fa1e905a9eb520974fb963c1fe98
ca9a2744b49c225c39ddd78239e2b4e1703f2f8ee03d6bc22a9f53532ac94046
Analyzer Verdict Alert quad9 Sinkholed
GET /2ef289afa287fa1e905a9eb520974fb963c1fe98.png HTTP/1.1
Host: winbigsurvey.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://winbigsurvey.com/style.css
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 15 Jun 2023 03:24:49 GMT
content-type: image/png
content-length: 8660
access-control-allow-origin: *
cache-control: public, max-age=14400, must-revalidate
etag: "b807f0faec2c500a1a2f76d99319ebc2"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PLgMaiamK6Pe4aewbSvcX3J9AFY%2BVomrZqq6oaavNuwQD9gEENv52lDMDiwsgTI5uH93HK76%2FZIdTkh%2F09gZnQWG1t8BvUDDtzFuYuRDMAemxOKlFhqqPuz5s9Cj%2BV2QzlbB"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
cf-cache-status: MISS
accept-ranges: bytes
server: cloudflare
cf-ray: 7d77b3cbe8ecb500-OSL
alt-svc: h3=":443"; ma=86400
hop.greenbluefrog.click/js/pub.min.js
108.178.23.115200 OK 1.5 kB URL GET HTTP/2 hop.greenbluefrog.click/js/pub.min.js
IP 108.178.23.115:443
Requested by https://winbigsurvey.com/index1?cep=pSJcfi0qGfAPUh4iAQyC32HlbpywJeW6QBF7OjVPq0yQMKR_FPIUUq3fGSpD8lMF8Nw2AhnsZe6-O_UbjISljIVvBCsQ59unjwwLodOROZXlBb1gspmfXpK1YGHS8a-qKpxufkSqSoKL2TeUfVPbQRbizuf3WcnkaDww7fhstuY_KE9PAkAOX4KKYFVIsl94JDMNYKVSzHxDtf1AQFgtkr9r8Kn914Xj84ZY24hJv9TteoQZKOrCljABdtX5ohMG7lX-47mnpmjWUnmnOOua2QCOvXt_y8hlZrrcdM513nTcgKgUWJ8stM0yj2w_Zo4NqLi5SL-1wr04pNhuO8Xm_vn2MzmQQNarlhrtI0pQsyElOKkeUA4j8Z9gCcY2WwcoG76yr_UNed4MwtWGOvCL8HxPzTEV2SbfAx8ZIf7U_ak&lptoken=16cb862e80d3121070c9
Certificate IssuerLet's Encrypt
Subjecthop.greenbluefrog.click
FingerprintCE:A2:6C:BC:81:F9:3B:C1:3B:FB:26:60:24:8C:E2:8B:9C:79:65:C9
ValidityFri, 07 Apr 2023 03:14:42 GMT - Thu, 06 Jul 2023 03:14:41 GMT
File type ASCII text, with very long lines (2752)
Hash 842d4889c73f6664245d70112389026a
3f5d934289e1acfebce633760640881a81ac8299
99f43e50f4179af4ebf4c93668866d5a5607914fa0a5daa087354c3159d3fa03
GET /js/pub.min.js HTTP/1.1
Host: hop.greenbluefrog.click
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://winbigsurvey.com/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Thu, 15 Jun 2023 03:24:49 GMT
content-type: application/javascript
content-length: 1482
last-modified: Fri, 09 Sep 2022 11:46:08 GMT
vary: Accept-Encoding
etag: "631b2780-5ca"
content-encoding: gzip
expires: Fri, 16 Jun 2023 03:24:49 GMT
cache-control: max-age=86400
strict-transport-security: max-age=31536000; includeSubdomains
accept-ranges: bytes
X-Firefox-Spdy: h2
winbigsurvey.com/1d936c9181a86fc7d77dc67ad3a3f2d194557253.png
104.21.37.177200 OK 48 kB URL GET HTTP/3 winbigsurvey.com/1d936c9181a86fc7d77dc67ad3a3f2d194557253.png
IP 104.21.37.177:443
Requested by https://winbigsurvey.com/index1?cep=pSJcfi0qGfAPUh4iAQyC32HlbpywJeW6QBF7OjVPq0yQMKR_FPIUUq3fGSpD8lMF8Nw2AhnsZe6-O_UbjISljIVvBCsQ59unjwwLodOROZXlBb1gspmfXpK1YGHS8a-qKpxufkSqSoKL2TeUfVPbQRbizuf3WcnkaDww7fhstuY_KE9PAkAOX4KKYFVIsl94JDMNYKVSzHxDtf1AQFgtkr9r8Kn914Xj84ZY24hJv9TteoQZKOrCljABdtX5ohMG7lX-47mnpmjWUnmnOOua2QCOvXt_y8hlZrrcdM513nTcgKgUWJ8stM0yj2w_Zo4NqLi5SL-1wr04pNhuO8Xm_vn2MzmQQNarlhrtI0pQsyElOKkeUA4j8Z9gCcY2WwcoG76yr_UNed4MwtWGOvCL8HxPzTEV2SbfAx8ZIf7U_ak&lptoken=16cb862e80d3121070c9
Certificate IssuerLet's Encrypt
Subjectwinbigsurvey.com
Fingerprint36:E1:35:65:EB:A1:A6:6D:26:6F:D8:F5:34:6D:81:D1:E9:73:B3:69
ValidityThu, 11 May 2023 06:57:49 GMT - Wed, 09 Aug 2023 06:57:48 GMT
File type PNG image data, 414 x 736, 8-bit colormap, non-interlaced\012- data
Hash a66a7278909b71cde6a87ae400e2de8b
1d936c9181a86fc7d77dc67ad3a3f2d194557253
52e9e7f992721ed81bdb6146fe578eb67437eeb378d7c87a46928996ff219b1c
Analyzer Verdict Alert quad9 Sinkholed
GET /1d936c9181a86fc7d77dc67ad3a3f2d194557253.png HTTP/1.1
Host: winbigsurvey.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://winbigsurvey.com/style.css
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 15 Jun 2023 03:24:50 GMT
content-type: image/png
content-length: 47495
access-control-allow-origin: *
cache-control: public, max-age=14400, must-revalidate
etag: "5266bfb1df8f28aee80335f15eacbac0"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zIBR7ydY3nlA6hoj3ngU4Kxf%2Bm%2B0%2FHwOqHbgFJ1yAJJrfO65mGTEFEjQJzXxZZQyl%2BseJfs%2FtaqJkD2cWETpulYmo44gk3OtD0KqJm9IYTqUeMyoDTMgpsqyHd70Ha%2FeP6PZ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
cf-cache-status: MISS
accept-ranges: bytes
server: cloudflare
cf-ray: 7d77b3cbe8ebb500-OSL
alt-svc: h3=":443"; ma=86400
winbigsurvey.com/99e01d3e0c461a43735019cc73db8074aa7ab504.png
104.21.37.177200 OK 96 B URL GET HTTP/3 winbigsurvey.com/99e01d3e0c461a43735019cc73db8074aa7ab504.png
IP 104.21.37.177:443
Requested by https://winbigsurvey.com/index1?cep=pSJcfi0qGfAPUh4iAQyC32HlbpywJeW6QBF7OjVPq0yQMKR_FPIUUq3fGSpD8lMF8Nw2AhnsZe6-O_UbjISljIVvBCsQ59unjwwLodOROZXlBb1gspmfXpK1YGHS8a-qKpxufkSqSoKL2TeUfVPbQRbizuf3WcnkaDww7fhstuY_KE9PAkAOX4KKYFVIsl94JDMNYKVSzHxDtf1AQFgtkr9r8Kn914Xj84ZY24hJv9TteoQZKOrCljABdtX5ohMG7lX-47mnpmjWUnmnOOua2QCOvXt_y8hlZrrcdM513nTcgKgUWJ8stM0yj2w_Zo4NqLi5SL-1wr04pNhuO8Xm_vn2MzmQQNarlhrtI0pQsyElOKkeUA4j8Z9gCcY2WwcoG76yr_UNed4MwtWGOvCL8HxPzTEV2SbfAx8ZIf7U_ak&lptoken=16cb862e80d3121070c9
Certificate IssuerLet's Encrypt
Subjectwinbigsurvey.com
Fingerprint36:E1:35:65:EB:A1:A6:6D:26:6F:D8:F5:34:6D:81:D1:E9:73:B3:69
ValidityThu, 11 May 2023 06:57:49 GMT - Wed, 09 Aug 2023 06:57:48 GMT
File type PNG image data, 16 x 16, 1-bit colormap, non-interlaced\012- data
Hash 35b9ee99fe32d3d68f7807c43d768092
99e01d3e0c461a43735019cc73db8074aa7ab504
cfee15b8d3ffca2475ecab6e25900ed1454d9c327fca1942728629452ad00ee6
Analyzer Verdict Alert quad9 Sinkholed
GET /99e01d3e0c461a43735019cc73db8074aa7ab504.png HTTP/1.1
Host: winbigsurvey.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://winbigsurvey.com/index1?cep=pSJcfi0qGfAPUh4iAQyC32HlbpywJeW6QBF7OjVPq0yQMKR_FPIUUq3fGSpD8lMF8Nw2AhnsZe6-O_UbjISljIVvBCsQ59unjwwLodOROZXlBb1gspmfXpK1YGHS8a-qKpxufkSqSoKL2TeUfVPbQRbizuf3WcnkaDww7fhstuY_KE9PAkAOX4KKYFVIsl94JDMNYKVSzHxDtf1AQFgtkr9r8Kn914Xj84ZY24hJv9TteoQZKOrCljABdtX5ohMG7lX-47mnpmjWUnmnOOua2QCOvXt_y8hlZrrcdM513nTcgKgUWJ8stM0yj2w_Zo4NqLi5SL-1wr04pNhuO8Xm_vn2MzmQQNarlhrtI0pQsyElOKkeUA4j8Z9gCcY2WwcoG76yr_UNed4MwtWGOvCL8HxPzTEV2SbfAx8ZIf7U_ak&lptoken=16cb862e80d3121070c9
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Thu, 15 Jun 2023 03:24:51 GMT
content-type: image/png
content-length: 96
access-control-allow-origin: *
cache-control: public, max-age=14400, must-revalidate
etag: "43e2c1f55b928aee3605029ae8c2d76e"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4u1f2vCLO3iYUHwlSLuO3IjsJrGafrz1TWVlzeUJBmf7Kcf8YLZe7sYi6FNlZu5of1CLNezxOQE9qk%2FToUQgyz4sof0SzVo2kMLreQ71LKvJ1Tytf87yIei%2BgjhFrcWkuYyr"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
cf-cache-status: MISS
accept-ranges: bytes
server: cloudflare
cf-ray: 7d77b3cdba76b500-OSL
alt-svc: h3=":443"; ma=86400
winbigsurvey.com/index1?cep=pSJcfi0qGfAPUh4iAQyC32HlbpywJeW6QBF7OjVPq0yQMKR_FPIUUq3fGSpD8lMF8Nw2AhnsZe6-O_UbjISljIVvBCsQ59unjwwLodOROZXlBb1gspmfXpK1YGHS8a-qKpxufkSqSoKL2TeUfVPbQRbizuf3WcnkaDww7fhstuY_KE9PAkAOX4KKYFVIsl94JDMNYKVSzHxDtf1AQFgtkr9r8Kn914Xj84ZY24hJv9TteoQZKOrCljABdtX5ohMG7lX-47mnpmjWUnmnOOua2QCOvXt_y8hlZrrcdM513nTcgKgUWJ8stM0yj2w_Zo4NqLi5SL-1wr04pNhuO8Xm_vn2MzmQQNarlhrtI0pQsyElOKkeUA4j8Z9gCcY2WwcoG76yr_UNed4MwtWGOvCL8HxPzTEV2SbfAx8ZIf7U_ak&lptoken=16cb862e80d3121070c9
104.21.37.177200 OK 3.0 kB URL User Request GET HTTP/2 winbigsurvey.com/index1?cep=pSJcfi0qGfAPUh4iAQyC32HlbpywJeW6QBF7OjVPq0yQMKR_FPIUUq3fGSpD8lMF8Nw2AhnsZe6-O_UbjISljIVvBCsQ59unjwwLodOROZXlBb1gspmfXpK1YGHS8a-qKpxufkSqSoKL2TeUfVPbQRbizuf3WcnkaDww7fhstuY_KE9PAkAOX4KKYFVIsl94JDMNYKVSzHxDtf1AQFgtkr9r8Kn914Xj84ZY24hJv9TteoQZKOrCljABdtX5ohMG7lX-47mnpmjWUnmnOOua2QCOvXt_y8hlZrrcdM513nTcgKgUWJ8stM0yj2w_Zo4NqLi5SL-1wr04pNhuO8Xm_vn2MzmQQNarlhrtI0pQsyElOKkeUA4j8Z9gCcY2WwcoG76yr_UNed4MwtWGOvCL8HxPzTEV2SbfAx8ZIf7U_ak&lptoken=16cb862e80d3121070c9
IP 104.21.37.177:443
Certificate IssuerLet's Encrypt
Subjectwinbigsurvey.com
Fingerprint36:E1:35:65:EB:A1:A6:6D:26:6F:D8:F5:34:6D:81:D1:E9:73:B3:69
ValidityThu, 11 May 2023 06:57:49 GMT - Wed, 09 Aug 2023 06:57:48 GMT
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (3124), with no line terminators
Hash b4b645417322a39b864e6769e991f494
c05f6f6c1d4303713acdf9d836bf5b55e07a97be
f79c9213bb54321682e050418fc25dceb9855dd8ff33d2106c3237ed213fa752
Analyzer Verdict Alert quad9 Sinkholed
GET /index1?cep=pSJcfi0qGfAPUh4iAQyC32HlbpywJeW6QBF7OjVPq0yQMKR_FPIUUq3fGSpD8lMF8Nw2AhnsZe6-O_UbjISljIVvBCsQ59unjwwLodOROZXlBb1gspmfXpK1YGHS8a-qKpxufkSqSoKL2TeUfVPbQRbizuf3WcnkaDww7fhstuY_KE9PAkAOX4KKYFVIsl94JDMNYKVSzHxDtf1AQFgtkr9r8Kn914Xj84ZY24hJv9TteoQZKOrCljABdtX5ohMG7lX-47mnpmjWUnmnOOua2QCOvXt_y8hlZrrcdM513nTcgKgUWJ8stM0yj2w_Zo4NqLi5SL-1wr04pNhuO8Xm_vn2MzmQQNarlhrtI0pQsyElOKkeUA4j8Z9gCcY2WwcoG76yr_UNed4MwtWGOvCL8HxPzTEV2SbfAx8ZIf7U_ak&lptoken=16cb862e80d3121070c9 HTTP/1.1
Host: winbigsurvey.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 15 Jun 2023 03:24:49 GMT
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l%2F4LCrw7PTkwnU2iQR%2BWVItBzJ9YS8ptP1CBnVC8GHeGkNy9URS6yQJmMMAmrw0vaMmiHGhodRHUt1V6StCVbv6lVTadTuzSvKiLcRambOMuGaI74xS0oZ7qk31qv%2BLySb1Z"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7d77b3c7d9cab4eb-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
winbigsurvey.com/style.css
104.21.37.177200 OK 2.1 kB URL GET HTTP/3 winbigsurvey.com/style.css
IP 104.21.37.177:443
Requested by https://winbigsurvey.com/index1?cep=pSJcfi0qGfAPUh4iAQyC32HlbpywJeW6QBF7OjVPq0yQMKR_FPIUUq3fGSpD8lMF8Nw2AhnsZe6-O_UbjISljIVvBCsQ59unjwwLodOROZXlBb1gspmfXpK1YGHS8a-qKpxufkSqSoKL2TeUfVPbQRbizuf3WcnkaDww7fhstuY_KE9PAkAOX4KKYFVIsl94JDMNYKVSzHxDtf1AQFgtkr9r8Kn914Xj84ZY24hJv9TteoQZKOrCljABdtX5ohMG7lX-47mnpmjWUnmnOOua2QCOvXt_y8hlZrrcdM513nTcgKgUWJ8stM0yj2w_Zo4NqLi5SL-1wr04pNhuO8Xm_vn2MzmQQNarlhrtI0pQsyElOKkeUA4j8Z9gCcY2WwcoG76yr_UNed4MwtWGOvCL8HxPzTEV2SbfAx8ZIf7U_ak&lptoken=16cb862e80d3121070c9
Certificate IssuerLet's Encrypt
Subjectwinbigsurvey.com
Fingerprint36:E1:35:65:EB:A1:A6:6D:26:6F:D8:F5:34:6D:81:D1:E9:73:B3:69
ValidityThu, 11 May 2023 06:57:49 GMT - Wed, 09 Aug 2023 06:57:48 GMT
File type ASCII text, with very long lines (2279), with no line terminators
Hash 0f1536f246fff2d6ae9b24a2c7857dc7
2a1a923e73ca5065e5fb0777cd44aeaf2b66f5db
de90a268bd0d0003f491c32b82845dbf4d82a11baac5bbdba92b03dce0b4a415
Analyzer Verdict Alert quad9 Sinkholed
GET /style.css HTTP/1.1
Host: winbigsurvey.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://winbigsurvey.com/index1?cep=pSJcfi0qGfAPUh4iAQyC32HlbpywJeW6QBF7OjVPq0yQMKR_FPIUUq3fGSpD8lMF8Nw2AhnsZe6-O_UbjISljIVvBCsQ59unjwwLodOROZXlBb1gspmfXpK1YGHS8a-qKpxufkSqSoKL2TeUfVPbQRbizuf3WcnkaDww7fhstuY_KE9PAkAOX4KKYFVIsl94JDMNYKVSzHxDtf1AQFgtkr9r8Kn914Xj84ZY24hJv9TteoQZKOrCljABdtX5ohMG7lX-47mnpmjWUnmnOOua2QCOvXt_y8hlZrrcdM513nTcgKgUWJ8stM0yj2w_Zo4NqLi5SL-1wr04pNhuO8Xm_vn2MzmQQNarlhrtI0pQsyElOKkeUA4j8Z9gCcY2WwcoG76yr_UNed4MwtWGOvCL8HxPzTEV2SbfAx8ZIf7U_ak&lptoken=16cb862e80d3121070c9
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Thu, 15 Jun 2023 03:24:49 GMT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=14400, must-revalidate
etag: W/"0a6bef0dca5d1b0ba04f320da81ee856"
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y1E1MwVimQsjYoeyOljbT19K2A3gvhTnTCeyVvCjDA7Oo9k1edXtMlatemzW%2FRSvH7avXVhEs91C7J9mjK%2FHwJ72YM0vHRimSb0uX5kczCNyG4Au2NyZHW75DQxDVEAhDe40"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
cf-cache-status: MISS
server: cloudflare
cf-ray: 7d77b3ca3ff0b500-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400