plusbonusnow.com Open in urlscan Pro
2606:4700:3035::6815:1f89 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://plusbonusnow.com/
Submission: On January 31 via api (January 31st 2024, 1:07:00 am UTC) from US — Scanned from US

Summary HTTP 30 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 12 IPs in 1 countries across 10 domains to perform 30 HTTP transactions. The main IP is 2606:4700:3035::6815:1f89, located in United States and belongs to CLOUDFLARENET, US. The main domain is plusbonusnow.com.
TLS certificate: Issued by GTS CA 1P5 on January 28th 2024. Valid for: 3 months.

This is the only time plusbonusnow.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
9	2606:4700:303... 2606:4700:3035::6815:1f89	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2607:f8b0:400... 2607:f8b0:4004:c09::5f	15169 (GOOGLE) (GOOGLE)
1	3.213.228.14 3.213.228.14	14618 (AMAZON-AES) (AMAZON-AES)
4	2a03:2880:f00... 2a03:2880:f003:c0e:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2606:4700:10:... 2606:4700:10::6816:27b6	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	3.217.27.177 3.217.27.177	14618 (AMAZON-AES) (AMAZON-AES)
1	18.67.3.63 18.67.3.63	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:26a... 2600:9000:26a0:b800:4:1957:6500:93a1	16509 (AMAZON-02) (AMAZON-02)
3	2a03:2880:f10... 2a03:2880:f103:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	54.198.53.3 54.198.53.3	14618 (AMAZON-AES) (AMAZON-AES)
3	45.223.17.68 45.223.17.68	19551 (INCAPSULA) (INCAPSULA)
30	12

9 2606:4700:3035::6815:1f89 (United States)

ASN13335 (CLOUDFLARENET, US)

plusbonusnow.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c09::5f (Ashburn, United States)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.213.228.14 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-213-228-14.compute-1.amazonaws.com

mylanderportal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f003:c0e:face:b00c:0:3 (Ashburn, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6816:27b6 (United States)

ASN13335 (CLOUDFLARENET, US)

create.lidstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 3.217.27.177 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-217-27-177.compute-1.amazonaws.com

create.leadid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.67.3.63 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-67-3-63.mia3.r.cloudfront.net

d2m2wsoho8qq12.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:26a0:b800:4:1957:6500:93a1 (United States)

ASN16509 (AMAZON-02, US)

b-js.ringba.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f103:83:face:b00c:0:25de (Ashburn, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.198.53.3 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-198-53-3.compute-1.amazonaws.com

display.ringba.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 45.223.17.68 (United States)

ASN19551 (INCAPSULA, US)

deviceid.trueleadid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
9	plusbonusnow.com plusbonusnow.com	117 KB
4	leadid.com create.leadid.com — Cisco Umbrella Rank: 16554	2 KB
4	facebook.net connect.facebook.net — Cisco Umbrella Rank: 174	74 KB
3	trueleadid.com deviceid.trueleadid.com — Cisco Umbrella Rank: 19602	23 KB
3	facebook.com www.facebook.com — Cisco Umbrella Rank: 107	247 B
2	ringba.com b-js.ringba.com — Cisco Umbrella Rank: 107905 display.ringba.com — Cisco Umbrella Rank: 84171	18 KB
1	cloudfront.net d2m2wsoho8qq12.cloudfront.net	2 KB
1	lidstatic.com create.lidstatic.com — Cisco Umbrella Rank: 28974	38 KB
1	mylanderportal.com mylanderportal.com
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 369	31 KB
30	10

	Domain	Requested by
9	plusbonusnow.com	plusbonusnow.com
4	create.leadid.com	create.lidstatic.com deviceid.trueleadid.com
4	connect.facebook.net	plusbonusnow.com connect.facebook.net
3	deviceid.trueleadid.com	d2m2wsoho8qq12.cloudfront.net deviceid.trueleadid.com
3	www.facebook.com
1	display.ringba.com	b-js.ringba.com
1	b-js.ringba.com	plusbonusnow.com
1	d2m2wsoho8qq12.cloudfront.net	create.lidstatic.com
1	create.lidstatic.com	plusbonusnow.com
1	mylanderportal.com	plusbonusnow.com
1	ajax.googleapis.com	plusbonusnow.com
30	11

This site contains links to these domains. Also see Links.

Domain
newsroom.uhc.com
www.cms.gov
www.irs.gov
www.taxpayeradvocate.irs.gov

Subject Issuer	Validity	Valid
plusbonusnow.com GTS CA 1P5	`2024-01-28` - `2024-04-27`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-01-02` - `2024-03-26`	3 months	crt.sh
mylanderportal.com R3	`2023-12-13` - `2024-03-12`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-11-09` - `2024-02-07`	3 months	crt.sh
lidstatic.com E1	`2024-01-28` - `2024-04-27`	3 months	crt.sh
create.leadid.com Amazon RSA 2048 M02	`2023-08-21` - `2024-09-17`	a year	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2023-10-10` - `2024-09-19`	a year	crt.sh
*.ringba.com Amazon RSA 2048 M03	`2023-11-27` - `2024-12-23`	a year	crt.sh
imperva.com GlobalSign Atlas R3 DV TLS CA 2024 Q1	`2024-01-16` - `2024-07-14`	6 months	crt.sh

This page contains 3 frames:

Primary Page: https://plusbonusnow.com/
Frame ID: 37D19277CC392466629FD5F4A6E0C794
Requests: 24 HTTP requests in this frame

Frame: https://d2m2wsoho8qq12.cloudfront.net/iframe.html?token=79EE4F4B-9B56-04FF-B7FE-AD7185C600D7&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.12.1&lck=A57816B4-6C59-F397-7853-7E14E45D3E1B&lac=F252983F-4BD1-0DD8-CD81-F4700AF60B66
Frame ID: A2F90A3F0B15E52FE25F837E7D8E7BB7
Requests: 1 HTTP requests in this frame

Frame: https://deviceid.trueleadid.com/iframe.html?token=79EE4F4B-9B56-04FF-B7FE-AD7185C600D7&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.12.1&lck=A57816B4-6C59-F397-7853-7E14E45D3E1B&lac=F252983F-4BD1-0DD8-CD81-F4700AF60B66
Frame ID: 2574CEC52A9D99BCD42135115380AAD9
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Americans Could Receive $5400 For Expensive Medical Care and Everyday Needs. Check in 2 Minutes.

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Imperva (Security) Expand

Overall confidence: 100%
Detected patterns

/_Incapsula_Resource

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

30
Requests

97 %
HTTPS

55 %
IPv6

10
Domains

11
Subdomains

12
IPs

1
Countries

306 kB
Transfer

822 kB
Size

6
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://newsroom.uhc.com/news-releases/uhc-rewards.html#:~:text=(Feb.,goals%20and%20one-time%20activities
Title: UnitedHealth

Search URL Search Domain Scan URL

URL: https://www.cms.gov/newsroom/fact-sheets/inflation-reduction-act-lowers-health-care-costs-millions-americans
Title: CMS.GOV

Search URL Search Domain Scan URL

URL: https://www.irs.gov/affordable-care-act/individuals-and-families/eligibility-for-the-premium-tax-credit
Title: IRS

Search URL Search Domain Scan URL

URL: https://www.taxpayeradvocate.irs.gov/estimator/premiumtaxcreditchange/index.htm
Title: TaxPayer IRS

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

30 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
plusbonusnow.com/ 13 KB
5 KB 212ms
123ms Document
text/html 2606:4700:3035::6815:1f89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://plusbonusnow.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6815:1f89 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 2360f1d79e99e079a67d798632a9c09c77813ffbb6ed717f589c3403f1d9559c

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cache-control: max-age=2678400
cf-cache-status: EXPIRED
cf-ray: 84de0e01ca694bc6-BUF
content-encoding: br
content-type: text/html; charset=utf-8
date: Wed, 31 Jan 2024 01:06:54 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LCf94E%2BmLDojaEHi%2BFhVhGVyfmP5iTb%2BrocJz0Yn0M%2FEeWhPWPcJrTl1CRDfpnMngq1Bfj4FiEdnzPittK0X%2BHRqkionGTeoC4ka37noO3%2BC1YaFSRVMkBEbzU3h9U8OnU8aNZWTFCPt9OAGcqpG"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-powered-by: Express

GET
H2 200 styles.css
plusbonusnow.com/css/ 3 KB
1 KB 172ms
170ms Stylesheet
text/css 2606:4700:3035::6815:1f89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://plusbonusnow.com/css/styles.css
Requested by: Host: plusbonusnow.com
URL: https://plusbonusnow.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6815:1f89 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 123081148f2b16549f97e30ce29fbfe23a4cd769b1319f03cfa7e353a88f34a3

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plusbonusnow.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 01:06:54 GMT
content-encoding: br
cf-cache-status: EXPIRED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"b35-CG4YrVb96XHM4kuH734tCT7qaFQ"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GRO8srVNl7FhmQ2YjSvnT%2B23qbJD0RQuxCyUHJMhGrPZoiJl%2FLvdq5xU6lgj%2Bj9RPe5HSCEYvSSzHdowMFpvG0iJOv%2FjBo%2Fh6TXj45G0AHZfjP6t6a1nWVLZCY27Nzu9juAzyf%2F%2BN1yL%2FzcfkLCl"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=2678400
cf-ray: 84de0e029b054bc6-BUF
alt-svc: h3=":443"; ma=86400

GET
H2 200 logo.webp
plusbonusnow.com/images/ 3 KB
4 KB 190ms
189ms Image
image/webp 2606:4700:3035::6815:1f89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://plusbonusnow.com/images/logo.webp
Requested by: Host: plusbonusnow.com
URL: https://plusbonusnow.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6815:1f89 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 0001aaeb9d257978c8985c0295c76f031200f806848b6b5f5704e78fd9eb8535

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plusbonusnow.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 01:06:54 GMT
cf-cache-status: EXPIRED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"d74-isOCM8wMElmdoyyRc3sIdeNp/UA"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=W%2B8PFPO07THKHOkZdIJCzoMvLz7WJPu1cVxrYps4kZulbxJg2PksHX5dUoFmhu5%2B2dZ3YeYIQbyYLrVdfc8NXl76p4Bgdf8Ua3WRRU4ytU36oWvFYCxwDK3A4O1X3%2FuREAikXrc%2FR8b9ZcHLEWbe"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 84de0e029b064bc6-BUF
alt-svc: h3=":443"; ma=86400
content-length: 3444

GET
H2 200 family.jpg
plusbonusnow.com/images/ 99 KB
99 KB 272ms
271ms Image
image/jpeg 2606:4700:3035::6815:1f89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://plusbonusnow.com/images/family.jpg
Requested by: Host: plusbonusnow.com
URL: https://plusbonusnow.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6815:1f89 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: d1965706316e1ad3d701bc06fa2f18b07a7ce8c12088adb7cccef426b5421a73

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plusbonusnow.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 01:06:54 GMT
cf-cache-status: EXPIRED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"18aa8-dOsJpvbbOOoFaWPkj/+KOtIWbDE"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mMgR6aAfcu7iDE0P4URfwQ48sDvAWgLsPzzFjWogTqenCTKslQrWdA0YcEVs1UHFy6%2ForO0hxKfnxXSw039TxkdFHUhadNzKtGO9TwDgJmv%2FjqDFOVgK3%2F2OpIe0EkWBmg5SY44lqoTVJFscX9m9"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=2678400
accept-ranges: bytes
cf-ray: 84de0e029b084bc6-BUF
alt-svc: h3=":443"; ma=86400
content-length: 101032

GET
H2 200 rocket-loader.min.js Show response
plusbonusnow.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/ 12 KB
4 KB 40ms
39ms Script
application/javascript 2606:4700:3035::6815:1f89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://plusbonusnow.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Requested by

Host: plusbonusnow.com
URL: https://plusbonusnow.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3035::6815:1f89 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plusbonusnow.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 01:06:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 30 Jan 2024 11:50:28 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"65b8e284-302c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OkZ7m1FkhmnGf3gtRkIkGLIUID33j1f2I%2FzHeewcacUtTU96%2FE2I4nTZlUnfirtgYrj5kIWmZ67cKqu%2B9XuoCvEuANf9jgcyL5lhCxg1RepUjUAVxoSzn2rDutwrR54Buoj0xAVHoGyWyu4G%2Bad4"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-frame-options: DENY
cache-control: max-age=172800, public
cf-ray: 84de0e029b0a4bc6-BUF
expires: Fri, 02 Feb 2024 01:06:54 GMT

GET
H3 200 absf_v3.0.js Show response
plusbonusnow.com/js/ 854 B
955 B 145ms
144ms Script
text/javascript 2606:4700:3035::6815:1f89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://plusbonusnow.com/js/absf_v3.0.js
Requested by: Host: plusbonusnow.com
URL: https://plusbonusnow.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:1f89 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 820df5df4233d5a588129d3b344b387e95f417e551ea40f716c7bb5c83164124

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plusbonusnow.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 01:06:54 GMT
content-encoding: br
cf-cache-status: EXPIRED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"356-8fIttMgCKLnZmSXrVpgWK1t7KTw"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JfnkuARhV20pLFXDvTbma0XAEMzhTrfKwQgsO8sMrYB8pkZplPk%2B8vvS0kqwkDo4uM5FwKULKDE0T6ciYcMTScuovX5kFdsEB2%2F5LvF07HYcUKQyHWqPxUXl6yohXjjWzyN%2BzZ0Xff0z07AhU9FA"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=2678400
cf-ray: 84de0e03c9b04bcf-BUF
alt-svc: h3=":443"; ma=86400

GET
H3 200 loader.js Show response
plusbonusnow.com/js/ 3 KB
1 KB 198ms
197ms Script
application/javascript 2606:4700:3035::6815:1f89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://plusbonusnow.com/js/loader.js
Requested by: Host: plusbonusnow.com
URL: https://plusbonusnow.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:1f89 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: b9c145899fb05ff5510dfebe9d4ef2da5a8d3439aaa9f3754bb5e8e64bf66c71

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plusbonusnow.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 01:06:54 GMT
content-encoding: br
cf-cache-status: EXPIRED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"aa8-7nA1H/3E0mrkEyTaaABVPNrGS3w"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wBL0Pr8x3AJN72rZn6N%2FvQlVMQGUDR1kSINkdeINdvUrPNv%2BmS7yPhgTQt1ab1tSMVXmwjZX4%2FNW%2Ff%2FD%2B5O%2FLOJvrR6SMNJMGQgBKav%2BfjQzt4T8YumfRNV7hw0cj%2BjY7eltuRL79mlouy7Gmkpm"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=2678400
cf-ray: 84de0e03d9b24bcf-BUF
alt-svc: h3=":443"; ma=86400

GET
H3 200 countdown.js Show response
plusbonusnow.com/js/ 504 B
752 B 168ms
167ms Script
application/javascript 2606:4700:3035::6815:1f89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://plusbonusnow.com/js/countdown.js
Requested by: Host: plusbonusnow.com
URL: https://plusbonusnow.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:1f89 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 0e47b1350cf329c793437da7e12c09f395d65726a80d9a7f35b6a0db85a896d9

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plusbonusnow.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 01:06:54 GMT
content-encoding: br
cf-cache-status: EXPIRED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"1f8-AUvfoIdMQ1X6qJRAcf5vy5+Y7Vg"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jP%2FSq0Vxuxggx82TqANsLY5nrmUaqzomsXvLQPcK%2FKFTNOmLRaiifOXO72PKkNvFTipErl7Zn9N22hphjajjpM1N41EgP55wjfRSjvvTNFOMpkUBU0XdV9AepLvoJUJLrMz8M7%2FJnMvBwMpXrxwj"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=2678400
cf-ray: 84de0e03d9b34bcf-BUF
alt-svc: h3=":443"; ma=86400

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ 87 KB
31 KB 100ms
34ms Script
text/javascript 2607:f8b0:4004:c09::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js

Requested by

Host: plusbonusnow.com
URL: https://plusbonusnow.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c09::5f Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plusbonusnow.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Thu, 25 Jan 2024 17:38:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 458899
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31017
x-xss-protection: 0
last-modified: Wed, 10 Mar 2021 14:28:09 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 24 Jan 2025 17:38:35 GMT

GET
H3 200 bootstrap@5.3.0.min.prot.js Show response
plusbonusnow.com/js/ 632 B
822 B 176ms
175ms Script
text/javascript 2606:4700:3035::6815:1f89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://plusbonusnow.com/js/bootstrap@5.3.0.min.prot.js
Requested by: Host: plusbonusnow.com
URL: https://plusbonusnow.com/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3035::6815:1f89 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 93720b7d0047b43b089ed778f251d3239b30b0db269c75270e24b4b0f9e1cd5f

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plusbonusnow.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 01:06:54 GMT
content-encoding: br
cf-cache-status: EXPIRED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-powered-by: Express
etag: W/"278-wcwbUZQw5YN20K3Y7gqn+Ng2VqQ"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=STjjYXCGdSZn6DHof7DBLJh7kUwI1Bgn6u0O6AwOY6wCGplFDMM7vza9g0uTZjWlvvyaSeflE4pebUQtjS%2BItRqyDHN9GLhZLZUy7ezHwVLYrit%2Fxb%2Fh9ROvxDV0yDqdiTGUyg3%2Bg9sC5K9h1Iu8"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=2678400
cf-ray: 84de0e03d9b54bcf-BUF
alt-svc: h3=":443"; ma=86400

OPTIONS
H/1.1 404
NOT FOUND location
mylanderportal.com/api/ Frame 0
0 134ms
42ms Preflight
text/html 3.213.228.14
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://mylanderportal.com/api/location
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 3.213.228.14 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-213-228-14.compute-1.amazonaws.com
Software: nginx/1.22.1 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://plusbonusnow.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

Access-Control-Allow-Headers: content-type
Access-Control-Allow-Methods: DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
Access-Control-Allow-Origin: https://plusbonusnow.com
Connection: keep-alive
Content-Length: 232
Content-Type: text/html; charset=utf-8
Date: Wed, 31 Jan 2024 01:06:54 GMT
Server: nginx/1.22.1
Vary: Origin

POST location
mylanderportal.com/api/ 0
0

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 213 KB
58 KB 106ms
33ms Script
application/x-javascript 2a03:2880:f003:c0e:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: plusbonusnow.com
URL: https://plusbonusnow.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f003:c0e:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

b0388a2387283b8457b08aadd7fdcca2702ba989863981b18e673a1394e74c4f

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plusbonusnow.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 31 Jan 2024 01:06:54 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 57158
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0"
pragma: public
x-fb-debug: s1ii9XDxmYhRqkxah7YBr8ejEFf/vFbJrzefrRchzax0Q8l15Iu5hTRokgwlsHCluLGElec56xLlIg6ndar3WA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 a57816b4-6c59-f397-7853-7e14e45d3e1b.js Show response
create.lidstatic.com/campaign/ 121 KB
38 KB 243ms
160ms Script
text/javascript 2606:4700:10::6816:27b6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://create.lidstatic.com/campaign/a57816b4-6c59-f397-7853-7e14e45d3e1b.js?snippet_version=2&callback=addToQueryString
Requested by: Host: plusbonusnow.com
URL: https://plusbonusnow.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:27b6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9947cbb5ca79a84719954ea34e03988bb27ea30bb57d9cb4ff3783c84564d0a5

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plusbonusnow.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 01:06:55 GMT
x-amz-version-id: 0TYZIhZnCiJDj1Gzr_aWxHS1MWCxaYWH
content-encoding: gzip
cf-cache-status: REVALIDATED
last-modified: Thu, 18 Jan 2024 02:21:13 GMT
server: cloudflare
x-amz-request-id: 7J8FWQTJSKANQTN0
etag: W/"bc138804ddd94411bd78fba4df4e96b0"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=1800
x-amz-replication-status: COMPLETED
cf-ray: 84de0e0598094bd2-BUF
x-amz-id-2: SCHOVz3r+ycSNFw8J6VfEtykKWxpIUrO6ELBXv9E+eLZ/acyJxnB8ovgMwd19XQEYkE97Vk4ZrTDFL3esXCDAQ==

GET
H2 200 1333889473851400 Show response
connect.facebook.net/signals/config/ 53 KB
11 KB 181ms
180ms Script
application/x-javascript 2a03:2880:f003:c0e:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1333889473851400?v=2.9.143&r=stable&domain=plusbonusnow.com&hme=1e96626f56fb37feabdb16bd09d3dbece570479b2ec677eec7364c762eaf296e&ex_m=62%2C104%2C92%2C96%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C146%2C149%2C160%2C156%2C157%2C159%2C25%2C89%2C45%2C68%2C158%2C141%2C144%2C153%2C154%2C161%2C113%2C13%2C43%2C165%2C164%2C115%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C93%2C95%2C31%2C94%2C26%2C22%2C142%2C145%2C122%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C91%2C38%2C70%2C60%2C97%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C98

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f003:c0e:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

4d32ae7d309c7a373d5bd11390aa0bf7a5c8093cd69f9baf425c2f00585a7228

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plusbonusnow.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 31 Jan 2024 01:06:55 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0"
pragma: public
x-fb-debug: S4p867KKWWYpBdK87ngei1cNnhwchuFsLjAJO0ZKjRxp3IM+A0t1Al68egNMtE38dheMEwBY5lUzfFtHrJlFBA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H2 200 GenerateToken Show response
create.leadid.com/2.12.1/ 36 B
659 B 208ms
102ms XHR
text/plain 3.217.27.177
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://create.leadid.com/2.12.1/GenerateToken?msn=1&pid=1117e466-3e79-48fc-9595-2d312ac39058&_=22513819

Requested by

Host: create.lidstatic.com
URL: https://create.lidstatic.com/campaign/a57816b4-6c59-f397-7853-7e14e45d3e1b.js?snippet_version=2&callback=addToQueryString

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.217.27.177 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-217-27-177.compute-1.amazonaws.com

Software

nginx /

Resource Hash

9e9b91401d2dee0cc34d61dda5c9a3d8f5e6806da8d7866273a967dc09478092

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://plusbonusnow.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Wed, 31 Jan 2024 01:06:55 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
server: nginx
access-control-max-age: 1728000
content-type: text/plain;charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
access-control-allow-headers: X-Requested-With, Content-Type
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H3 200 6411826982256929 Show response
connect.facebook.net/signals/config/ 20 KB
3 KB 153ms
152ms Script
application/x-javascript 2a03:2880:f003:c0e:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/6411826982256929?v=2.9.143&r=stable&domain=plusbonusnow.com&hme=1e96626f56fb37feabdb16bd09d3dbece570479b2ec677eec7364c762eaf296e&ex_m=62%2C104%2C92%2C96%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C146%2C149%2C160%2C156%2C157%2C159%2C25%2C89%2C45%2C68%2C158%2C141%2C144%2C153%2C154%2C161%2C113%2C13%2C43%2C165%2C164%2C115%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C93%2C95%2C31%2C94%2C26%2C22%2C142%2C145%2C122%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C91%2C38%2C70%2C60%2C97%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C98%2C171%2C170%2C172%2C177%2C178%2C179%2C175%2C167%2C114%2C166%2C168%2C105%2C133%2C127%2C130%2C111%2C162%2C202%2C99%2C203%2C140%2C103%2C125%2C118%2C106

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f003:c0e:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

034dd21f3bffe6ffe78dea96c7a4cb765dfd24a81187864c8224aad8dfe526c8

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plusbonusnow.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 31 Jan 2024 01:06:55 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0"
pragma: public
x-fb-debug: jeCr3daDNSfpSEdtPYeTEyBDeJ7L5hTJEj8wD00ivYdamw02T2ICHntqeRqGRKeD1ASh0pVaFoKLAN6SWragbA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK iframe.html Show response
d2m2wsoho8qq12.cloudfront.net/ Frame A2F9 3 KB
2 KB 220ms
73ms Document
text/html 18.67.3.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://d2m2wsoho8qq12.cloudfront.net/iframe.html?token=79EE4F4B-9B56-04FF-B7FE-AD7185C600D7&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.12.1&lck=A57816B4-6C59-F397-7853-7E14E45D3E1B&lac=F252983F-4BD1-0DD8-CD81-F4700AF60B66

Requested by

Host: create.lidstatic.com
URL: https://create.lidstatic.com/campaign/a57816b4-6c59-f397-7853-7e14e45d3e1b.js?snippet_version=2&callback=addToQueryString

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

18.67.3.63 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-67-3-63.mia3.r.cloudfront.net

Software

nginx /

Resource Hash

e3ad82a69faf9ec1b298a080ce5974322a33cc501e1455071cf8db58c7f2462f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://plusbonusnow.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

Age: 44062
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Tue, 30 Jan 2024 12:52:34 GMT
ETag: W/"65a0715c-dbb"
Last-Modified: Thu, 11 Jan 2024 22:53:16 GMT
Server: nginx
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Transfer-Encoding: chunked
Via: 1.1 5cbbb789c20cadb41189e8208ccbe54e.cloudfront.net (CloudFront)
X-Amz-Cf-Id: AIOtwai0anMltWZtDuWH73ZV6r8VtX8B_ng8_0HYt4LjxthVxJ2_CQ==
X-Amz-Cf-Pop: MIA3-P1
X-Cache: Hit from cloudfront

POST
H2 200 SaveDom Show response
create.leadid.com/2.12.1/ 0
622 B 46ms
45ms XHR
text/plain 3.217.27.177
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://create.leadid.com/2.12.1/SaveDom?msn=2&pid=1117e466-3e79-48fc-9595-2d312ac39058&token=79EE4F4B-9B56-04FF-B7FE-AD7185C600D7&_=22513820

Requested by

Host: create.lidstatic.com
URL: https://create.lidstatic.com/campaign/a57816b4-6c59-f397-7853-7e14e45d3e1b.js?snippet_version=2&callback=addToQueryString

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.217.27.177 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-217-27-177.compute-1.amazonaws.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://plusbonusnow.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Wed, 31 Jan 2024 01:06:55 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
server: nginx
access-control-max-age: 1728000
content-type: text/plain;charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
access-control-allow-headers: X-Requested-With, Content-Type
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2 200 CA701edcfda750434cbdf14b7ceddcabf1 Show response
b-js.ringba.com/ 17 KB
17 KB 681ms
47ms Script
text/html 2600:9000:26a0:b800:4:1957:6500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://b-js.ringba.com/CA701edcfda750434cbdf14b7ceddcabf1
Requested by: Host: plusbonusnow.com
URL: https://plusbonusnow.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:26a0:b800:4:1957:6500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 4e1c2c27abc05eb1612c1b1d4cb07bf0d7a273d4349f3fb146291c77906ae196

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plusbonusnow.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 01:05:22 GMT
via: 1.1 72620161c44640062c801bfda3ae46f2.cloudfront.net (CloudFront)
x-aspnet-version: 4.0.30319
x-amz-cf-pop: YUL62-P2
age: 93
x-powered-by: ASP.NET
x-cache: Hit from cloudfront
content-length: 17076
x-runtime: 0.0000
server: Microsoft-IIS/10.0
access-control-max-age: 300
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: public
x-amz-cf-id: ihPy4P_NZzgVWEGyizi5hQt7JME6uhPIoygx9qPw92h-tUMUPjwUcA==
expires: Wed, 31 Jan 2024 01:10:23 GMT

GET
H3 200 254961090299261 Show response
connect.facebook.net/signals/config/ 20 KB
3 KB 141ms
141ms Script
application/x-javascript 2a03:2880:f003:c0e:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/254961090299261?v=2.9.143&r=stable&domain=plusbonusnow.com&hme=1e96626f56fb37feabdb16bd09d3dbece570479b2ec677eec7364c762eaf296e&ex_m=62%2C104%2C92%2C96%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C146%2C149%2C160%2C156%2C157%2C159%2C25%2C89%2C45%2C68%2C158%2C141%2C144%2C153%2C154%2C161%2C113%2C13%2C43%2C165%2C164%2C115%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C93%2C95%2C31%2C94%2C26%2C22%2C142%2C145%2C122%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C91%2C38%2C70%2C60%2C97%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C98%2C171%2C170%2C172%2C177%2C178%2C179%2C175%2C167%2C114%2C166%2C168%2C105%2C133%2C127%2C130%2C111%2C162%2C202%2C99%2C203%2C140%2C103%2C125%2C118%2C106

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f003:c0e:face:b00c:0:3 Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

25abb7db6ec43b2c9e90a067b1523fdcb23f3aa4e86f260e232592805f9713e1

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' data: blob: ;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plusbonusnow.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src 'self' data: blob: *;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Wed, 31 Jan 2024 01:06:55 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0"
pragma: public
x-fb-debug: UzmZXdc7X6JgZFGv/8znDq3s2fPOd3cg+bmVKJII/Pd3qNmlG+d/RJwwtwloZV2uPhwy4VFLj3a/PwVQlmZK+w==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
vary: Accept-Encoding
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H2 200 Snap Show response
create.leadid.com/2.12.1/ 0
622 B 126ms
85ms XHR
text/plain 3.217.27.177
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://create.leadid.com/2.12.1/Snap?msn=3&pid=1117e466-3e79-48fc-9595-2d312ac39058&token=79EE4F4B-9B56-04FF-B7FE-AD7185C600D7&_=22513821

Requested by

Host: create.lidstatic.com
URL: https://create.lidstatic.com/campaign/a57816b4-6c59-f397-7853-7e14e45d3e1b.js?snippet_version=2&callback=addToQueryString

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.217.27.177 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-217-27-177.compute-1.amazonaws.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://plusbonusnow.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Wed, 31 Jan 2024 01:06:55 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
server: nginx
access-control-max-age: 1728000
content-type: text/plain;charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
access-control-allow-headers: X-Requested-With, Content-Type
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
31 B 102ms
36ms Image
text/plain 2a03:2880:f103:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1333889473851400&ev=PageView&dl=https%3A%2F%2Fplusbonusnow.com%2F%3Fleadid%3D79EE4F4B-9B56-04FF-B7FE-AD7185C600D7&rl=&if=false&ts=1706663215999&sw=1600&sh=1200&v=2.9.143&r=stable&ec=0&o=4126&fbp=fb.1.1706663215996.1800801990&ler=empty&cdl=API_unavailable&it=1706663215078&coo=false&exp=e1&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f103:83:face:b00c:0:25de Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plusbonusnow.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 31 Jan 2024 01:06:56 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 102ms
35ms Image
text/plain 2a03:2880:f103:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=6411826982256929&ev=PageView&dl=https%3A%2F%2Fplusbonusnow.com%2F%3Fleadid%3D79EE4F4B-9B56-04FF-B7FE-AD7185C600D7&rl=&if=false&ts=1706663216001&sw=1600&sh=1200&v=2.9.143&r=stable&ec=0&o=4126&fbp=fb.1.1706663215996.1800801990&ler=empty&cdl=API_unavailable&it=1706663215078&coo=false&exp=e1&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f103:83:face:b00c:0:25de Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plusbonusnow.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 31 Jan 2024 01:06:56 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
31 B 102ms
36ms Image
text/plain 2a03:2880:f103:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=254961090299261&ev=PageView&dl=https%3A%2F%2Fplusbonusnow.com%2F%3Fleadid%3D79EE4F4B-9B56-04FF-B7FE-AD7185C600D7&rl=&if=false&ts=1706663216002&sw=1600&sh=1200&v=2.9.143&r=stable&ec=0&o=4126&fbp=fb.1.1706663215996.1800801990&ler=empty&cdl=API_unavailable&it=1706663215078&coo=false&exp=e1&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f103:83:face:b00c:0:25de Ashburn, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://plusbonusnow.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Wed, 31 Jan 2024 01:06:56 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

POST
H/1.1 200
OK gnbulk Show response
display.ringba.com/v2/nis/ 398 B
785 B 182ms
44ms XHR
application/json 54.198.53.3
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://display.ringba.com/v2/nis/gnbulk
Requested by: Host: b-js.ringba.com
URL: https://b-js.ringba.com/CA701edcfda750434cbdf14b7ceddcabf1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.198.53.3 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-198-53-3.compute-1.amazonaws.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 1199275ccced4ba3c6c48a5f26b79a019f9808a9f216f653a3e87b7a613e0f2c

Request headers

Referer: https://plusbonusnow.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
Content-type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 31 Jan 2024 01:06:56 GMT
X-Runtime: 0.0030
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Access-Control-Max-Age: 300
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://plusbonusnow.com
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 398
Expires: -1

GET
H2 200 iframe.html Show response
deviceid.trueleadid.com/ Frame 2574 4 KB
2 KB 121ms
42ms Document
text/html 45.223.17.68
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://deviceid.trueleadid.com/iframe.html?token=79EE4F4B-9B56-04FF-B7FE-AD7185C600D7&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.12.1&lck=A57816B4-6C59-F397-7853-7E14E45D3E1B&lac=F252983F-4BD1-0DD8-CD81-F4700AF60B66

Requested by

Host: d2m2wsoho8qq12.cloudfront.net
URL: https://d2m2wsoho8qq12.cloudfront.net/iframe.html?token=79EE4F4B-9B56-04FF-B7FE-AD7185C600D7&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.12.1&lck=A57816B4-6C59-F397-7853-7E14E45D3E1B&lac=F252983F-4BD1-0DD8-CD81-F4700AF60B66

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.223.17.68 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

nginx /

Resource Hash

94877d9ebae654f378f9ea4912d016a8b4ad85d1906822ea2e3962f2ac9b2969

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://d2m2wsoho8qq12.cloudfront.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: max-age=86400 public
content-encoding: gzip
content-type: text/html
date: Wed, 31 Jan 2024 01:06:56 GMT
etag: W/"6554d155-1049"
expires: Thu, 01 Feb 2024 01:06:56 GMT
last-modified: Wed, 15 Nov 2023 14:10:29 GMT
p3p: CP="NOI DSP COR NID CUR ADM DEV OUR BUS"
server: nginx
strict-transport-security: max-age=31536000
x-cdn: Imperva
x-iinfo: 13-14179789-14161911 pNNN RT(1706663215896 30) q(0 0 0 0) r(0 0) U24
x-incap-sess-cookie-hdr: PEquN1M1cnx1Hr6zNcnCAy+duWUAAAAAivoPp6sJ3vuzVVlmGCyWFw==

GET
H2 200 _Incapsula_Resource Show response
deviceid.trueleadid.com/ Frame 2574 147 KB
21 KB 33ms
32ms Script
application/javascript 45.223.17.68
INCAPSULA

General

Check archive.org

Show headers Download Go to

Full URL

https://deviceid.trueleadid.com/_Incapsula_Resource?SWJIYLWA=719d34d31c8e3a6e6fffd425f7e032f3&ns=1&cb=1795160963

Requested by

Host: deviceid.trueleadid.com
URL: https://deviceid.trueleadid.com/iframe.html?token=79EE4F4B-9B56-04FF-B7FE-AD7185C600D7&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.12.1&lck=A57816B4-6C59-F397-7853-7E14E45D3E1B&lac=F252983F-4BD1-0DD8-CD81-F4700AF60B66

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.223.17.68 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

6f286c43dff7ac6588cab2782999c037162b1ab98c115df096bf7dbd96ec01a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://deviceid.trueleadid.com/iframe.html?token=79EE4F4B-9B56-04FF-B7FE-AD7185C600D7&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.12.1&lck=A57816B4-6C59-F397-7853-7E14E45D3E1B&lac=F252983F-4BD1-0DD8-CD81-F4700AF60B66
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
cache-control: no-cache, no-store
content-encoding: gzip
x-robots-tag: noindex
content-length: 21309
content-type: application/javascript

GET
H2 200 SaveDeviceId.js Show response
create.leadid.com/2.12.1/ Frame 2574 0
625 B 131ms
44ms Script
text/javascript 3.217.27.177
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://create.leadid.com/2.12.1/SaveDeviceId.js?lac=F252983F-4BD1-0DD8-CD81-F4700AF60B66&lck=A57816B4-6C59-F397-7853-7E14E45D3E1B&methods=48&token=79EE4F4B-9B56-04FF-B7FE-AD7185C600D7&uuid=738e4946d3924545896ab1d07424045c

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.217.27.177 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-217-27-177.compute-1.amazonaws.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: en-US,en;q=0.9
Referer: https://deviceid.trueleadid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

date: Wed, 31 Jan 2024 01:06:56 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
server: nginx
access-control-max-age: 1728000
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
access-control-allow-headers: X-Requested-With, Content-Type
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2 200 _Incapsula_Resource
deviceid.trueleadid.com/ Frame 2574 1 B
36 B 30ms
29ms Image
text/plain 45.223.17.68
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://deviceid.trueleadid.com/_Incapsula_Resource?SWKMTFSR=1&e=0.3874830382500565

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.223.17.68 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://deviceid.trueleadid.com/iframe.html?token=79EE4F4B-9B56-04FF-B7FE-AD7185C600D7&apiurl=https%3A%2F%2Fcreate.leadid.com%2F2.12.1&lck=A57816B4-6C59-F397-7853-7E14E45D3E1B&lac=F252983F-4BD1-0DD8-CD81-F4700AF60B66
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
cache-control: no-cache, no-store
x-robots-tag: noindex
content-length: 1
content-type: text/plain

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: mylanderportal.com
URL: https://mylanderportal.com/api/location

Verdicts & Comments Add Verdict or Comment

23 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
plusbonusnow.com/	1970-01-20 18:04:24	Name: leadid_token-F252983F-4BD1-0DD8-CD81-F4700AF60B66-A57816B4-6C59-F397-7853-7E14E45D3E1B Value: 79EE4F4B-9B56-04FF-B7FE-AD7185C600D7
.plusbonusnow.com/	1970-01-20 20:13:59	Name: _fbp Value: fb.1.1706663215996.1800801990
.trueleadid.com/	1969-12-31 23:59:59	Name: nlbi_3051494 Value: qiwjJWiQeS094rV5C30iGwAAAAD08v7K/lS57BcmdkMCXlh/
.trueleadid.com/	1970-01-21 02:48:56	Name: visid_incap_3051494 Value: OqS5dZa4QqOXWeN5HFwEfy+duWUAAAAAQUIPAAAAAAC+c9EyPa7KvJjYITWIegA1
.trueleadid.com/	1969-12-31 23:59:59	Name: incap_ses_271_3051494 Value: SeSyTL1vTmZ1Hr6zNcnCAy+duWUAAAAAtzu2fxhqQ4hUq9gsTHbyXQ==
.deviceid.trueleadid.com/	1970-01-21 03:40:23	Name: uuid Value: 738e4946d3924545896ab1d07424045c

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://plusbonusnow.com/ Message: Access to XMLHttpRequest at 'https://mylanderportal.com/api/location' from origin 'https://plusbonusnow.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: It does not have HTTP ok status.
network	error	URL: https://mylanderportal.com/api/location Message: Failed to load resource: net::ERR_FAILED
other	warning	URL: https://connect.facebook.net/signals/config/1333889473851400?v=2.9.143&r=stable&domain=plusbonusnow.com&hme=1e96626f56fb37feabdb16bd09d3dbece570479b2ec677eec7364c762eaf296e&ex_m=62%2C104%2C92%2C96%2C53%2C3%2C88%2C61%2C14%2C86%2C79%2C44%2C46%2C146%2C149%2C160%2C156%2C157%2C159%2C25%2C89%2C45%2C68%2C158%2C141%2C144%2C153%2C154%2C161%2C113%2C13%2C43%2C165%2C164%2C115%2C16%2C29%2C32%2C1%2C36%2C57%2C58%2C59%2C63%2C83%2C15%2C12%2C85%2C82%2C81%2C93%2C95%2C31%2C94%2C26%2C22%2C142%2C145%2C122%2C24%2C9%2C10%2C11%2C5%2C6%2C21%2C19%2C20%2C49%2C54%2C56%2C66%2C90%2C23%2C67%2C8%2C7%2C71%2C41%2C18%2C17%2C4%2C73%2C80%2C72%2C78%2C40%2C39%2C77%2C33%2C35%2C76%2C48%2C74%2C28%2C37%2C65%2C0%2C84%2C75%2C2%2C30%2C55%2C34%2C91%2C38%2C70%2C60%2C97%2C52%2C51%2C27%2C87%2C50%2C47%2C42%2C69%2C64%2C98(Line 95) Message: Unrecognized feature: 'attribution-reporting'.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
b-js.ringba.com
connect.facebook.net
create.leadid.com
create.lidstatic.com
d2m2wsoho8qq12.cloudfront.net
deviceid.trueleadid.com
display.ringba.com
mylanderportal.com
plusbonusnow.com
www.facebook.com
mylanderportal.com
18.67.3.63
2600:9000:26a0:b800:4:1957:6500:93a1
2606:4700:10::6816:27b6
2606:4700:3035::6815:1f89
2607:f8b0:4004:c09::5f
2a03:2880:f003:c0e:face:b00c:0:3
2a03:2880:f103:83:face:b00c:0:25de
3.213.228.14
3.217.27.177
45.223.17.68
54.198.53.3
0001aaeb9d257978c8985c0295c76f031200f806848b6b5f5704e78fd9eb8535
034dd21f3bffe6ffe78dea96c7a4cb765dfd24a81187864c8224aad8dfe526c8
0e47b1350cf329c793437da7e12c09f395d65726a80d9a7f35b6a0db85a896d9
1199275ccced4ba3c6c48a5f26b79a019f9808a9f216f653a3e87b7a613e0f2c
123081148f2b16549f97e30ce29fbfe23a4cd769b1319f03cfa7e353a88f34a3
2360f1d79e99e079a67d798632a9c09c77813ffbb6ed717f589c3403f1d9559c
25abb7db6ec43b2c9e90a067b1523fdcb23f3aa4e86f260e232592805f9713e1
4d32ae7d309c7a373d5bd11390aa0bf7a5c8093cd69f9baf425c2f00585a7228
4e1c2c27abc05eb1612c1b1d4cb07bf0d7a273d4349f3fb146291c77906ae196
6f286c43dff7ac6588cab2782999c037162b1ab98c115df096bf7dbd96ec01a1
820df5df4233d5a588129d3b344b387e95f417e551ea40f716c7bb5c83164124
93720b7d0047b43b089ed778f251d3239b30b0db269c75270e24b4b0f9e1cd5f
94877d9ebae654f378f9ea4912d016a8b4ad85d1906822ea2e3962f2ac9b2969
9947cbb5ca79a84719954ea34e03988bb27ea30bb57d9cb4ff3783c84564d0a5
9e9b91401d2dee0cc34d61dda5c9a3d8f5e6806da8d7866273a967dc09478092
b0388a2387283b8457b08aadd7fdcca2702ba989863981b18e673a1394e74c4f
b9c145899fb05ff5510dfebe9d4ef2da5a8d3439aaa9f3754bb5e8e64bf66c71
ccf00d1923b0131a10e0c6d26f95e5dee6ebf8621a27e83c5a2f68a2e0093142
d1965706316e1ad3d701bc06fa2f18b07a7ce8c12088adb7cccef426b5421a73
e3ad82a69faf9ec1b298a080ce5974322a33cc501e1455071cf8db58c7f2462f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

plusbonusnow.com Open in urlscan Pro 2606:4700:3035::6815:1f89 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

30 Requests

97 %HTTPS

55 %IPv6

10 Domains

11 Subdomains

12 IPs

1 Countries

306 kBTransfer

822 kBSize

6 Cookies

4 Outgoing links

Redirected requests

30 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

plusbonusnow.com Open in urlscan Pro
2606:4700:3035::6815:1f89 Public Scan

Screenshot
Live screenshot

Full Image

30
Requests

97 %
HTTPS

55 %
IPv6

10
Domains

11
Subdomains

12
IPs

1
Countries

306 kB
Transfer

822 kB
Size

6
Cookies

30 HTTP transactions
0 data transactions