ofoffer.com Open in urlscan Pro
91.220.101.99 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://fluxtok.com/click.php?key=ucqj2z8n1u84b7rwlq21&clickid=758088068&target=ac&subid=822225
Effective URL:
https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&...
Submission: On April 17 via manual (April 17th 2024, 4:48:44 am UTC) from CA — Scanned from CA

Summary HTTP 42 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 5 domains to perform 42 HTTP transactions. The main IP is 91.220.101.99, located in Ukraine and belongs to HIGHLOADSYSTEMS, UA. The main domain is ofoffer.com.
TLS certificate: Issued by R3 on March 11th 2024. Valid for: 3 months.

This is the only time ofoffer.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Customer Survey Spam (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 1	91.220.101.74 91.220.101.74	34259 (HIGHLOADS...) (HIGHLOADSYSTEMS)
23	91.220.101.99 91.220.101.99	34259 (HIGHLOADS...) (HIGHLOADSYSTEMS)
1	151.101.66.137 151.101.66.137	54113 (FASTLY) (FASTLY)
17	18.160.45.106 18.160.45.106	16509 (AMAZON-02) (AMAZON-02)
1	172.253.115.95 172.253.115.95	15169 (GOOGLE) (GOOGLE)
42	4

1 91.220.101.74 (Ukraine) 1 redirects

ASN34259 (HIGHLOADSYSTEMS, UA)
PTR: srv-s74.antiddos.eu

fluxtok.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

23 91.220.101.99 (Ukraine)

ASN34259 (HIGHLOADSYSTEMS, UA)
PTR: srv-s99.antiddos.eu

ofoffer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.66.137 (United States)

ASN54113 (FASTLY, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 18.160.45.106 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-160-45-106.iad55.r.cloudfront.net

d3e1y4kxkqljcb.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.253.115.95 (United States)

ASN15169 (GOOGLE, US)
PTR: bg-in-f95.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
23	ofoffer.com ofoffer.com	285 KB
17	cloudfront.net d3e1y4kxkqljcb.cloudfront.net	675 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 35	1 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 771	33 KB
1	fluxtok.com 1 redirects fluxtok.com	1 KB
42	5

	Domain	Requested by
23	ofoffer.com	ofoffer.com code.jquery.com
17	d3e1y4kxkqljcb.cloudfront.net	ofoffer.com code.jquery.com
1	fonts.googleapis.com	ofoffer.com
1	code.jquery.com	ofoffer.com
1	fluxtok.com	1 redirects
42	5

This site contains no links.

Subject Issuer	Validity	Valid
ofoffer.com R3	`2024-03-11` - `2024-06-09`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2023-07-11` - `2024-07-14`	a year	crt.sh
*.cloudfront.net Amazon RSA 2048 M01	`2023-10-10` - `2024-09-19`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Frame ID: B256BE63C160509F158253601953A989
Requests: 42 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

[1] Reward Pending - We Want Your Opinion!

Page URL History Show full URLs

https://fluxtok.com/click.php?key=ucqj2z8n1u84b7rwlq21&clickid=758088068&target=ac&subid=822225 HTTP 302
https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language... Page URL
https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

42
Requests

100 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

4
IPs

2
Countries

994 kB
Transfer

1421 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://fluxtok.com/click.php?key=ucqj2z8n1u84b7rwlq21&clickid=758088068&target=ac&subid=822225 HTTP 302
https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3 Page URL
https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://fluxtok.com/click.php?key=ucqj2z8n1u84b7rwlq21&clickid=758088068&target=ac&subid=822225 HTTP 302
https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3

42 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

index_1_d.php Show response
ofoffer.com/visitor_ca_st/
Redirect Chain

https://fluxtok.com/click.php?key=ucqj2z8n1u84b7rwlq21&clickid=758088068&target=ac&subid=822225
https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=171...

1 KB
972 B

566ms
141ms

Document
text/html

91.220.101.99
HIGHLOADSYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.220.101.99 , Ukraine, ASN34259 (HIGHLOADSYSTEMS, UA),
Reverse DNS: srv-s99.antiddos.eu
Software: openresty /
Resource Hash: e4fdd7ac61625aa75e3f51d703a222a51b1c9be1f843a0c5b95a82105dd77cb4

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Cache-Control: no-cache, no-store, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Type: text/html
Date: Wed, 17 Apr 2024 04:48:39 GMT
ETag: W/"5dc1dd91-4b7"
Expires: 0
Last-Modified: Tue, 05 Nov 2019 20:37:37 GMT
Pragma: no-cache
Server: openresty
Transfer-Encoding: chunked

Redirect headers

Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Date: Wed, 17 Apr 2024 04:48:39 GMT
Location: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Server: openresty
Transfer-Encoding: chunked

POST
H/1.1 200
OK check.page
ofoffer.com/ 1 B
259 B 544ms
140ms XHR
application/octet-stream 91.220.101.99
HIGHLOADSYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://ofoffer.com/check.page
Requested by: Host: ofoffer.com
URL: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.220.101.99 , Ukraine, ASN34259 (HIGHLOADSYSTEMS, UA),
Reverse DNS: srv-s99.antiddos.eu
Software: openresty /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Pragma: no-cache
Date: Wed, 17 Apr 2024 04:48:40 GMT
Cache-Control: no-cache, no-store, must-revalidate, max-age=0
Server: openresty
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: application/octet-stream

GET
H/1.1 404
Not Found favicon.ico
ofoffer.com/ 3 KB
2 KB 544ms
143ms Other
text/html 91.220.101.99
HIGHLOADSYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://ofoffer.com/favicon.ico
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.220.101.99 , Ukraine, ASN34259 (HIGHLOADSYSTEMS, UA),
Reverse DNS: srv-s99.antiddos.eu
Software: openresty /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 17 Apr 2024 04:48:40 GMT
Content-Encoding: gzip
Last-Modified: Thu, 11 Jan 2024 13:40:34 GMT
Server: openresty
ETag: W/"b96-60eabb12cff69"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H/1.1 200
OK Primary Request index_1_d.php Show response
ofoffer.com/visitor_ca_st/ 71 KB
16 KB 154ms
153ms Document
text/html 91.220.101.99
HIGHLOADSYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Requested by: Host: ofoffer.com
URL: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.220.101.99 , Ukraine, ASN34259 (HIGHLOADSYSTEMS, UA),
Reverse DNS: srv-s99.antiddos.eu
Software: openresty /
Resource Hash: cb6e7f2199d29353465ca7569b7ec9dad5dc246eee76f8b7c0061e7fabc2d9c9

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Referer: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Length: 16475
Content-Type: text/html; charset=UTF-8
Date: Wed, 17 Apr 2024 04:48:40 GMT
Server: openresty
Vary: Accept-Encoding

GET
H/1.1 200
OK bootstrap.min.css
ofoffer.com/visitor_ca_st/assets/ 157 KB
24 KB 160ms
159ms Stylesheet
text/css 91.220.101.99
HIGHLOADSYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://ofoffer.com/visitor_ca_st/assets/bootstrap.min.css
Requested by: Host: ofoffer.com
URL: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.220.101.99 , Ukraine, ASN34259 (HIGHLOADSYSTEMS, UA),
Reverse DNS: srv-s99.antiddos.eu
Software: openresty /
Resource Hash: f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 17 Apr 2024 04:48:40 GMT
Content-Encoding: gzip
Last-Modified: Thu, 22 Jun 2023 07:28:39 GMT
Server: openresty
ETag: W/"6493f827-27288"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=315360000
Connection: keep-alive
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK all.css
ofoffer.com/visitor_ca_st/assets/ 72 KB
13 KB 150ms
148ms Stylesheet
text/css 91.220.101.99
HIGHLOADSYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://ofoffer.com/visitor_ca_st/assets/all.css
Requested by: Host: ofoffer.com
URL: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.220.101.99 , Ukraine, ASN34259 (HIGHLOADSYSTEMS, UA),
Reverse DNS: srv-s99.antiddos.eu
Software: openresty /
Resource Hash: 9ab4f4c2fbb7f22fd22e510a5797ecb47fb1c05c60c9c7ddc578d3841adaf33f

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 17 Apr 2024 04:48:40 GMT
Content-Encoding: gzip
Last-Modified: Thu, 22 Jun 2023 07:28:39 GMT
Server: openresty
ETag: W/"6493f827-11f2d"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=315360000
Connection: keep-alive
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK common.css
ofoffer.com/visitor_ca_st/assets/ 50 KB
11 KB 302ms
152ms Stylesheet
text/css 91.220.101.99
HIGHLOADSYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://ofoffer.com/visitor_ca_st/assets/common.css
Requested by: Host: ofoffer.com
URL: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.220.101.99 , Ukraine, ASN34259 (HIGHLOADSYSTEMS, UA),
Reverse DNS: srv-s99.antiddos.eu
Software: openresty /
Resource Hash: b3f721934cfdf7c66fdbfbd44588c3e3ce9f051b8f62a9f3023b2b5e32650233

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 17 Apr 2024 04:48:41 GMT
Content-Encoding: gzip
Last-Modified: Mon, 30 Oct 2023 17:01:12 GMT
Server: openresty
ETag: W/"653fe158-c651"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=315360000
Connection: keep-alive
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery-1.11.1.min.js Show response
code.jquery.com/ 94 KB
33 KB 56ms
17ms Script
application/javascript 151.101.66.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-1.11.1.min.js
Requested by: Host: ofoffer.com
URL: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.66.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx /
Resource Hash: 540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ofoffer.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 17 Apr 2024 04:48:40 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
age: 18528705
x-cache: HIT, HIT
content-length: 33202
x-served-by: cache-lga21922-LGA, cache-yyz4565-YYZ
last-modified: Fri, 18 Oct 1991 12:00:00 GMT
server: nginx
x-timer: S1713329321.915498,VS0,VE0
etag: W/"28feccc0-1762a"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=604800
accept-ranges: bytes
x-cache-hits: 52, 14034

GET
H/1.1 200
OK bootstrap.min.js Show response
ofoffer.com/visitor_ca_st/assets/ 62 KB
15 KB 316ms
154ms Script
application/javascript 91.220.101.99
HIGHLOADSYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://ofoffer.com/visitor_ca_st/assets/bootstrap.min.js
Requested by: Host: ofoffer.com
URL: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.220.101.99 , Ukraine, ASN34259 (HIGHLOADSYSTEMS, UA),
Reverse DNS: srv-s99.antiddos.eu
Software: openresty /
Resource Hash: d8968086f7509df34c3278563dab87399da4f9dcdfb419818e3a309eedc70b88

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 17 Apr 2024 04:48:41 GMT
Content-Encoding: gzip
Last-Modified: Thu, 22 Jun 2023 07:28:45 GMT
Server: openresty
ETag: W/"6493f82d-f708"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: max-age=315360000
Connection: keep-alive
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK myscript_2.js Show response
ofoffer.com/visitor_ca_st/assets/ 13 KB
4 KB 445ms
143ms Script
application/javascript 91.220.101.99
HIGHLOADSYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://ofoffer.com/visitor_ca_st/assets/myscript_2.js
Requested by: Host: ofoffer.com
URL: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.220.101.99 , Ukraine, ASN34259 (HIGHLOADSYSTEMS, UA),
Reverse DNS: srv-s99.antiddos.eu
Software: openresty /
Resource Hash: cb71249490a2ac7c66f3f80eecf854c6fb39bec0d6632d4b45000c023bb1d18b

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 17 Apr 2024 04:48:41 GMT
Content-Encoding: gzip
Last-Modified: Fri, 19 Jan 2024 14:25:38 GMT
Server: openresty
ETag: W/"65aa8662-334e"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: max-age=315360000
Connection: keep-alive
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 canada_flag.png
d3e1y4kxkqljcb.cloudfront.net/survey_us_d/ 8 KB
8 KB 158ms
78ms Image
image/png 18.160.45.106
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d3e1y4kxkqljcb.cloudfront.net/survey_us_d/canada_flag.png
Requested by: Host: ofoffer.com
URL: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.45.106 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-45-106.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c70c1756118c5ae5d94352cd42db95e81afacf00e82b1cb256fc20ef972be303

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ofoffer.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: LTOf0N5qrrHHdrbPZnp8QLY.QTg0vOr.
date: Wed, 17 Apr 2024 04:48:41 GMT
via: 1.1 9b00405a1ff669043791884b75822050.cloudfront.net (CloudFront)
last-modified: Wed, 05 Jul 2023 10:50:19 GMT
server: AmazonS3
x-amz-cf-pop: IAD55-P2
x-amz-server-side-encryption: AES256
etag: "965b1f43b65fc8e6c773abca89e9da1c"
x-cache: RefreshHit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 7843
x-amz-cf-id: Voi3pqqmrFXaFwU_tsvokqP1WXv-2-i8xjV-QDfMhkcPREwpFh5kVw==

GET
H/1.1 200
OK applause_right.png
ofoffer.com/visitor_ca_st/assets/ 77 KB
78 KB 463ms
147ms Image
image/png 91.220.101.99
HIGHLOADSYSTEMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ofoffer.com/visitor_ca_st/assets/applause_right.png
Requested by: Host: ofoffer.com
URL: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.220.101.99 , Ukraine, ASN34259 (HIGHLOADSYSTEMS, UA),
Reverse DNS: srv-s99.antiddos.eu
Software: openresty /
Resource Hash: 0460c73243a3523e18d6a0e30e272e4107d462d54ea8fbd6667190724e5b8447

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 17 Apr 2024 04:48:41 GMT
Last-Modified: Thu, 22 Jun 2023 07:28:39 GMT
Server: openresty
ETag: "6493f827-135fc"
Content-Type: image/png
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 79356
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK 9b69072b6bef17360bbbbcd759320927.png
ofoffer.com/visitor_ca_st/assets/ 8 KB
8 KB 381ms
142ms Image
image/png 91.220.101.99
HIGHLOADSYSTEMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ofoffer.com/visitor_ca_st/assets/9b69072b6bef17360bbbbcd759320927.png
Requested by: Host: ofoffer.com
URL: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.220.101.99 , Ukraine, ASN34259 (HIGHLOADSYSTEMS, UA),
Reverse DNS: srv-s99.antiddos.eu
Software: openresty /
Resource Hash: 0d79ca3b13098126f0c0fc76aed54a8acf6e645e62eb5f0ff90571141dfe24b2

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 17 Apr 2024 04:48:41 GMT
Last-Modified: Thu, 22 Jun 2023 07:28:49 GMT
Server: openresty
ETag: "6493f831-1f6f"
Content-Type: image/png
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 8047
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK 279132e34471a44f9e9c889082127894.png
ofoffer.com/visitor_ca_st/assets/ 5 KB
6 KB 144ms
143ms Image
image/png 91.220.101.99
HIGHLOADSYSTEMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ofoffer.com/visitor_ca_st/assets/279132e34471a44f9e9c889082127894.png
Requested by: Host: ofoffer.com
URL: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.220.101.99 , Ukraine, ASN34259 (HIGHLOADSYSTEMS, UA),
Reverse DNS: srv-s99.antiddos.eu
Software: openresty /
Resource Hash: bc4ba5ab1f79419e5c8a06db6d5ed27f78b026617608d8513bdf476bf78e1120

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 17 Apr 2024 04:48:41 GMT
Last-Modified: Thu, 22 Jun 2023 07:28:46 GMT
Server: openresty
ETag: "6493f82e-150d"
Content-Type: image/png
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 5389
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK redirect_bin_withoutcomm.js Show response
ofoffer.com/ 3 KB
2 KB 143ms
142ms Script
application/javascript 91.220.101.99
HIGHLOADSYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://ofoffer.com/redirect_bin_withoutcomm.js
Requested by: Host: ofoffer.com
URL: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.220.101.99 , Ukraine, ASN34259 (HIGHLOADSYSTEMS, UA),
Reverse DNS: srv-s99.antiddos.eu
Software: openresty /
Resource Hash: faf64292e6fcbfbf8843de9a284e8dfab88f66adc5ffe3c51206ffc3f4f60303

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 17 Apr 2024 04:48:41 GMT
Content-Encoding: gzip
Last-Modified: Wed, 10 Apr 2024 21:20:37 GMT
Server: openresty
ETag: W/"661702a5-c4f"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: max-age=315360000
Connection: keep-alive
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK common.js Show response
ofoffer.com/visitor_ca_st/assets/ 6 KB
2 KB 143ms
143ms Script
application/javascript 91.220.101.99
HIGHLOADSYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://ofoffer.com/visitor_ca_st/assets/common.js
Requested by: Host: ofoffer.com
URL: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.220.101.99 , Ukraine, ASN34259 (HIGHLOADSYSTEMS, UA),
Reverse DNS: srv-s99.antiddos.eu
Software: openresty /
Resource Hash: 1e8d04ff0db02dc96ebb42e7e76514b0c722da09668b9b7908cabc7307161923

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 17 Apr 2024 04:48:41 GMT
Content-Encoding: gzip
Last-Modified: Thu, 22 Jun 2023 07:28:47 GMT
Server: openresty
ETag: W/"6493f82f-168a"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Cache-Control: max-age=315360000
Connection: keep-alive
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 css2
fonts.googleapis.com/ 5 KB
1 KB 129ms
53ms Stylesheet
text/css 172.253.115.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Arimo:wght@500;700&display=swap

Requested by

Host: ofoffer.com
URL: https://ofoffer.com/visitor_ca_st/assets/common.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f95.1e100.net

Software

ESF /

Resource Hash

1c718fdc9a84ed8781de12f63ff59f8d189727486c36024ee6dde16d90e368bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ofoffer.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Wed, 17 Apr 2024 04:48:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 17 Apr 2024 04:48:41 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 17 Apr 2024 04:48:41 GMT

GET
H/1.1 200
OK ca.json Show response
ofoffer.com/visitor_ca_st/lang/ 68 B
313 B 147ms
147ms XHR
application/json 91.220.101.99
HIGHLOADSYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://ofoffer.com/visitor_ca_st/lang/ca.json
Requested by: Host: code.jquery.com
URL: https://code.jquery.com/jquery-1.11.1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.220.101.99 , Ukraine, ASN34259 (HIGHLOADSYSTEMS, UA),
Reverse DNS: srv-s99.antiddos.eu
Software: openresty /
Resource Hash: 01d3adc7504c889384eb8506246d6ae29c39cff278938c4110b16249259a8b42

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01
Referer: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
X-Requested-With: XMLHttpRequest
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 17 Apr 2024 04:48:41 GMT
Last-Modified: Mon, 17 Jul 2023 14:38:47 GMT
Server: openresty
ETag: "44-600afc19e2721"
Content-Type: application/json
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 68

GET
H/1.1 200
OK ac.css
ofoffer.com/visitor_ca_st/css/ 3 KB
1 KB 141ms
141ms Stylesheet
text/css 91.220.101.99
HIGHLOADSYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://ofoffer.com/visitor_ca_st/css/ac.css
Requested by: Host: code.jquery.com
URL: https://code.jquery.com/jquery-1.11.1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.220.101.99 , Ukraine, ASN34259 (HIGHLOADSYSTEMS, UA),
Reverse DNS: srv-s99.antiddos.eu
Software: openresty /
Resource Hash: d28282cf435a47dee3c8abde8dda7f8b3c4acb6d594d0fd0396e26f050dfd36f

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 17 Apr 2024 04:48:41 GMT
Content-Encoding: gzip
Last-Modified: Fri, 19 Jan 2024 12:59:53 GMT
Server: openresty
ETag: W/"65aa7249-d35"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=315360000
Connection: keep-alive
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK offers_3_d.json Show response
ofoffer.com/visitor_ca_st/datas/ 4 KB
1 KB 146ms
146ms XHR
application/json 91.220.101.99
HIGHLOADSYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://ofoffer.com/visitor_ca_st/datas/offers_3_d.json
Requested by: Host: code.jquery.com
URL: https://code.jquery.com/jquery-1.11.1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.220.101.99 , Ukraine, ASN34259 (HIGHLOADSYSTEMS, UA),
Reverse DNS: srv-s99.antiddos.eu
Software: openresty /
Resource Hash: b64f492abf4ab0adb076d75157f9534d8c619d9de98810aa59b6c40f4036ad1e

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01
Referer: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
X-Requested-With: XMLHttpRequest
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 17 Apr 2024 04:48:41 GMT
Content-Encoding: gzip
Last-Modified: Mon, 01 Apr 2024 18:52:17 GMT
Server: openresty
ETag: W/"11fe-6150d7d1810cd"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/json
Connection: keep-alive

GET
H/1.1 200
OK ac.json Show response
ofoffer.com/visitor_ca_st/datas/ 1 KB
703 B 144ms
144ms XHR
application/json 91.220.101.99
HIGHLOADSYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://ofoffer.com/visitor_ca_st/datas/ac.json
Requested by: Host: code.jquery.com
URL: https://code.jquery.com/jquery-1.11.1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.220.101.99 , Ukraine, ASN34259 (HIGHLOADSYSTEMS, UA),
Reverse DNS: srv-s99.antiddos.eu
Software: openresty /
Resource Hash: 6dcec3deeb5341a4694cbb4b0ea2120806155cfbfbf1be26d359fe28c230d363

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01
Referer: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
X-Requested-With: XMLHttpRequest
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 17 Apr 2024 04:48:41 GMT
Content-Encoding: gzip
Last-Modified: Mon, 28 Aug 2023 10:03:23 GMT
Server: openresty
ETag: W/"4a8-603f8ce01b306"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/json
Connection: keep-alive

GET
H/1.1 200
OK ac.json Show response
ofoffer.com/visitor_ca_st/datas/ 1 KB
0 145ms
144ms XHR
application/json 91.220.101.99
HIGHLOADSYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://ofoffer.com/visitor_ca_st/datas/ac.json
Requested by: Host: code.jquery.com
URL: https://code.jquery.com/jquery-1.11.1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.220.101.99 , Ukraine, ASN34259 (HIGHLOADSYSTEMS, UA),
Reverse DNS: srv-s99.antiddos.eu
Software: openresty /
Resource Hash: 6dcec3deeb5341a4694cbb4b0ea2120806155cfbfbf1be26d359fe28c230d363

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Accept: application/json, text/javascript, */*; q=0.01
Referer: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
X-Requested-With: XMLHttpRequest
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 17 Apr 2024 04:48:41 GMT
Content-Encoding: gzip
Last-Modified: Mon, 28 Aug 2023 10:03:23 GMT
Server: openresty
ETag: W/"4a8-603f8ce01b306"
Vary: Accept-Encoding
Content-Type: application/json

GET
H/1.1 200
OK addstyle.css
ofoffer.com/ 8 KB
2 KB 141ms
141ms Stylesheet
text/css 91.220.101.99
HIGHLOADSYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://ofoffer.com/addstyle.css
Requested by: Host: code.jquery.com
URL: https://code.jquery.com/jquery-1.11.1.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.220.101.99 , Ukraine, ASN34259 (HIGHLOADSYSTEMS, UA),
Reverse DNS: srv-s99.antiddos.eu
Software: openresty /
Resource Hash: 5930489b4bebe12e257a17b3a3c8f581a5daa0c5feda8c6103a88b14db7ce3e9

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 17 Apr 2024 04:48:41 GMT
Content-Encoding: gzip
Last-Modified: Wed, 10 Apr 2024 22:19:25 GMT
Server: openresty
ETag: W/"6617106d-2095"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=315360000
Connection: keep-alive
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 gold_gift_new.png
d3e1y4kxkqljcb.cloudfront.net/survey_us_d/gold_gift/ 153 KB
153 KB 40ms
39ms Image
image/png 18.160.45.106
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d3e1y4kxkqljcb.cloudfront.net/survey_us_d/gold_gift/gold_gift_new.png
Requested by: Host: ofoffer.com
URL: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.45.106 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-45-106.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 05c983ed393cf3e307c3deb93dd13e2ba12c32ca0a2ebee3fb723dd9e655aaf6

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ofoffer.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: SbZ4hMitY8jlxS69eEA95.dp1BJitoJJ
date: Wed, 17 Apr 2024 01:33:21 GMT
via: 1.1 9b00405a1ff669043791884b75822050.cloudfront.net (CloudFront)
last-modified: Tue, 23 May 2023 11:51:43 GMT
server: AmazonS3
x-amz-cf-pop: IAD55-P2
age: 11721
x-amz-server-side-encryption: AES256
etag: "77869306d1840a881e587f0712b2bc87"
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 156404
x-amz-cf-id: lzDYl4KqIY2uMd7o2FcbLsbyK-BL54iBIinzj1auBoUTxwfnPFAuNQ==

GET
H2 200 sprite_40.png
d3e1y4kxkqljcb.cloudfront.net/survey_us_d/ 57 KB
58 KB 35ms
35ms Image
image/png 18.160.45.106
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d3e1y4kxkqljcb.cloudfront.net/survey_us_d/sprite_40.png
Requested by: Host: ofoffer.com
URL: https://ofoffer.com/visitor_ca_st/assets/common.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.45.106 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-45-106.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: db5e4ee93c7b86d11f61d0e9ef1269f0c28013a828fb59efc79610a161131314

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ofoffer.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: ALoJkeO8kEneSLVqGy.kiCQogEnixMEt
date: Tue, 16 Apr 2024 15:44:51 GMT
via: 1.1 9b00405a1ff669043791884b75822050.cloudfront.net (CloudFront)
last-modified: Wed, 10 May 2023 07:48:18 GMT
server: AmazonS3
x-amz-cf-pop: IAD55-P2
age: 47031
x-amz-server-side-encryption: AES256
etag: "98452927287657121b00e73f65b1ff3d"
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 58805
x-amz-cf-id: MI7ZljbStUPOsYiM5ZROTqk7VkyIF338xNeyDgdwtbZHE0b5nOYhZg==

GET
H/1.1 200
OK icomoon.ttf
ofoffer.com/visitor_ca_st/assets/fonts/ 1 KB
2 KB 142ms
142ms Font
application/octet-stream 91.220.101.99
HIGHLOADSYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://ofoffer.com/visitor_ca_st/assets/fonts/icomoon.ttf?9ovn56
Requested by: Host: ofoffer.com
URL: https://ofoffer.com/visitor_ca_st/assets/common.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.220.101.99 , Ukraine, ASN34259 (HIGHLOADSYSTEMS, UA),
Reverse DNS: srv-s99.antiddos.eu
Software: openresty /
Resource Hash: 36d0b3552e3921a6af29a164f7f2b19de78c916ff06bfd1697c8411543c045ed

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ofoffer.com/visitor_ca_st/assets/common.css
Origin: https://ofoffer.com
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 17 Apr 2024 04:48:41 GMT
Last-Modified: Thu, 22 Jun 2023 07:28:52 GMT
Server: openresty
ETag: "6493f834-504"
Content-Type: application/octet-stream
Cache-Control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1284
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK fa-solid-900.woff2
ofoffer.com/visitor_ca_st/assets/fonts/ 93 KB
93 KB 150ms
150ms Font
font/woff2 91.220.101.99
HIGHLOADSYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://ofoffer.com/visitor_ca_st/assets/fonts/fa-solid-900.woff2
Requested by: Host: ofoffer.com
URL: https://ofoffer.com/visitor_ca_st/assets/all.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.220.101.99 , Ukraine, ASN34259 (HIGHLOADSYSTEMS, UA),
Reverse DNS: srv-s99.antiddos.eu
Software: openresty /
Resource Hash: c889fb1af64cceab36a53b3d6e622710e0880b0ed4b38be7730561105b3c5bcc

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ofoffer.com/visitor_ca_st/assets/all.css
Origin: https://ofoffer.com
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 17 Apr 2024 04:48:41 GMT
Last-Modified: Thu, 22 Jun 2023 07:28:54 GMT
Server: openresty
ETag: "172cc-5feb2d6345cec"
Content-Type: font/woff2
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 94924

GET
H2 200 rachaelray_withoutbg.png
d3e1y4kxkqljcb.cloudfront.net/survey_us_d/withoutbg/ 47 KB
47 KB 107ms
105ms Image
image/png 18.160.45.106
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d3e1y4kxkqljcb.cloudfront.net/survey_us_d/withoutbg/rachaelray_withoutbg.png
Requested by: Host: ofoffer.com
URL: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.45.106 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-45-106.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e9a507f5ff7134a65afe30e48496d47795dd9189e461c3fff11b9152300821b5

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ofoffer.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 17 Apr 2024 04:48:42 GMT
x-amz-version-id: Z2FbjTl6gobBPCxxPcAiVK_Mx741zY_H
via: 1.1 9b00405a1ff669043791884b75822050.cloudfront.net (CloudFront)
last-modified: Wed, 18 Oct 2023 13:45:59 GMT
server: AmazonS3
x-amz-cf-pop: IAD55-P2
etag: "f33605065ffa4ba408daec7e20964481"
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 48162
x-amz-cf-id: 504P2GzbvH9772Kbuh1Kr49jsWdpZuuSYC1c8hJJUSjFqvy8I7uL8Q==

GET
H2 200 vacuum_withoutbg.png
d3e1y4kxkqljcb.cloudfront.net/survey_us_d/withoutbg/ 17 KB
17 KB 103ms
101ms Image
image/png 18.160.45.106
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d3e1y4kxkqljcb.cloudfront.net/survey_us_d/withoutbg/vacuum_withoutbg.png
Requested by: Host: ofoffer.com
URL: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.45.106 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-45-106.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 70000c61c4a19c338d4bd3f9fb0dbf51c2afb7097b289c3937cab1b41fc4607d

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ofoffer.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 17 Apr 2024 04:48:42 GMT
x-amz-version-id: Id3HWPO4ez9cUv4SEzPx7oybmxSxaX4u
via: 1.1 9b00405a1ff669043791884b75822050.cloudfront.net (CloudFront)
last-modified: Fri, 13 May 2022 13:37:20 GMT
server: AmazonS3
x-amz-cf-pop: IAD55-P2
etag: "2221a61d05e6b4c398dcee958c7447e9"
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 16929
x-amz-cf-id: VkjJd-KGVrQm1uQjC2ilTyxJIuG_EZYMIJDQxm6TV9w0AbPFXwfWQg==

GET
H2 200 coffeeninja_withoutbg.png
d3e1y4kxkqljcb.cloudfront.net/survey_us_d/withoutbg/ 57 KB
57 KB 40ms
38ms Image
image/png 18.160.45.106
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d3e1y4kxkqljcb.cloudfront.net/survey_us_d/withoutbg/coffeeninja_withoutbg.png
Requested by: Host: ofoffer.com
URL: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.45.106 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-45-106.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: fe0f25591b2245b8b3ed1513f800465be35d95292c3625eb4b1fb05eeb1a1343

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ofoffer.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 17 Apr 2024 00:53:23 GMT
x-amz-version-id: DwgOf_n3Vvo9cBkXAOMASuO.4mF0HK17
via: 1.1 9b00405a1ff669043791884b75822050.cloudfront.net (CloudFront)
last-modified: Fri, 19 Aug 2022 07:45:28 GMT
server: AmazonS3
x-amz-cf-pop: IAD55-P2
age: 14119
etag: "2d7b72108ef7ffccaa684b179c1564b8"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 57949
x-amz-cf-id: iMZRR1oc4IJgCabwb-cQVEeFqcxMtDYWmODEOlTXVNDhQXu2jtH_xg==

GET
H2 200 apple_mysterybox.png
d3e1y4kxkqljcb.cloudfront.net/survey_us_d/withoutbg/ 41 KB
41 KB 64ms
62ms Image
image/png 18.160.45.106
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d3e1y4kxkqljcb.cloudfront.net/survey_us_d/withoutbg/apple_mysterybox.png
Requested by: Host: ofoffer.com
URL: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.45.106 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-45-106.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b2aa2f7b3c5df406516a8e8b5166243c5ed9c6e8842500f199a3fac360f9ce3c

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ofoffer.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: 8TghbrGQg0KOrjfSwzv2dFgwZN5gydO3
date: Wed, 17 Apr 2024 04:48:42 GMT
via: 1.1 9b00405a1ff669043791884b75822050.cloudfront.net (CloudFront)
last-modified: Mon, 20 Nov 2023 15:46:32 GMT
server: AmazonS3
x-amz-cf-pop: IAD55-P2
x-amz-server-side-encryption: AES256
etag: "f3cda3608e9a52e5452ef2f2f4d1c90b"
x-cache: RefreshHit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 41527
x-amz-cf-id: EQ0kdJg50wORrG6VMtgcSsfqNtGBVK3uf4lUpFE2BXGtEwL6sHgKFA==

GET
H2 200 hopper_withoutbg.png
d3e1y4kxkqljcb.cloudfront.net/survey_us_d/withoutbg/ 57 KB
57 KB 74ms
72ms Image
image/png 18.160.45.106
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d3e1y4kxkqljcb.cloudfront.net/survey_us_d/withoutbg/hopper_withoutbg.png
Requested by: Host: ofoffer.com
URL: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.45.106 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-45-106.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e841bfed515cc6312e44b87fe897cac0d09a6700792cb85adfc781741f68daec

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ofoffer.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: 9uXn2ahvLp6YmjbZfPYgjds2fnCx1Nto
date: Wed, 17 Apr 2024 04:48:42 GMT
via: 1.1 9b00405a1ff669043791884b75822050.cloudfront.net (CloudFront)
last-modified: Fri, 03 Jun 2022 07:57:14 GMT
server: AmazonS3
x-amz-cf-pop: IAD55-P2
x-amz-server-side-encryption: AES256
etag: "675e01f6f578b5951e556cef40976988"
x-cache: RefreshHit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 58216
x-amz-cf-id: dMi6NLCnPE98OalIs8rKH9Lb31EGNeL7VytbqFC8w4R6lIamZyz-_w==

GET
H2 200 oralb2_withoutbg.png
d3e1y4kxkqljcb.cloudfront.net/survey_us_d/withoutbg/ 37 KB
37 KB 78ms
76ms Image
image/png 18.160.45.106
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d3e1y4kxkqljcb.cloudfront.net/survey_us_d/withoutbg/oralb2_withoutbg.png
Requested by: Host: ofoffer.com
URL: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.45.106 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-45-106.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2715b471d5540e8a12f2d9cb7d375715af9bcb03e85181b6b14715c244a513c3

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ofoffer.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: eJh3xG4qcHylcn9kR06_9waWcs6G_0vB
date: Wed, 17 Apr 2024 04:48:42 GMT
via: 1.1 9b00405a1ff669043791884b75822050.cloudfront.net (CloudFront)
last-modified: Mon, 20 Mar 2023 15:04:31 GMT
server: AmazonS3
x-amz-cf-pop: IAD55-P2
x-amz-server-side-encryption: AES256
etag: "25e501052bc1ac4db3dc2998498a2025"
x-cache: RefreshHit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 37862
x-amz-cf-id: AnIP0ZqoDT6NUEyvVQum1pkegvBuBfL5Jsuiig8rE_9a5YJnCDxnAQ==

GET
H2 200 kitchebaid_withoutbg.png
d3e1y4kxkqljcb.cloudfront.net/survey_us_d/withoutbg/ 52 KB
52 KB 97ms
96ms Image
image/png 18.160.45.106
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d3e1y4kxkqljcb.cloudfront.net/survey_us_d/withoutbg/kitchebaid_withoutbg.png
Requested by: Host: ofoffer.com
URL: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.45.106 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-45-106.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 542484ece53b315967c1ac02c2f89e937a91d558e41d458e60df9faa7279f531

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ofoffer.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 17 Apr 2024 04:48:42 GMT
x-amz-version-id: 30_xnJ5.4q3.2kqe0A6joR9xzmDq9l.E
via: 1.1 9b00405a1ff669043791884b75822050.cloudfront.net (CloudFront)
last-modified: Mon, 15 Aug 2022 09:20:29 GMT
server: AmazonS3
x-amz-cf-pop: IAD55-P2
etag: "a9972fa022c274e37df3c4d569b6ac37"
x-amz-server-side-encryption: AES256
x-cache: Miss from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 53000
x-amz-cf-id: _xSPpQyawTy7Cza71qlcBLgeWhw3eiO-RPUAiW49JhnMQBg5WUAXjQ==

GET
H2 200 yetihaul_withoutbg.png
d3e1y4kxkqljcb.cloudfront.net/survey_us_d/withoutbg/ 31 KB
31 KB 71ms
70ms Image
image/png 18.160.45.106
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d3e1y4kxkqljcb.cloudfront.net/survey_us_d/withoutbg/yetihaul_withoutbg.png
Requested by: Host: ofoffer.com
URL: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.45.106 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-45-106.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 00a414af4d92e7f8debf314ca0baff94a20bd2be266d663cfe88bc9c0472bd69

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ofoffer.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: e3IgZTNC_0X.PHJb7yh7TS2Of8ydnoAQ
date: Wed, 17 Apr 2024 04:48:42 GMT
via: 1.1 9b00405a1ff669043791884b75822050.cloudfront.net (CloudFront)
last-modified: Mon, 20 Jun 2022 10:44:48 GMT
server: AmazonS3
x-amz-cf-pop: IAD55-P2
x-amz-server-side-encryption: AES256
etag: "9d08bacc0297df6105bf0d77974943c4"
x-cache: RefreshHit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 31597
x-amz-cf-id: avyeHuTezuI3lbGFMCupYkgayaVsuxZLPKLz4bZY1Qoff1x70NqkYQ==

GET
H2 200 blender_withoutbg.png
d3e1y4kxkqljcb.cloudfront.net/survey_us_d/withoutbg/ 55 KB
56 KB 66ms
66ms Image
image/png 18.160.45.106
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d3e1y4kxkqljcb.cloudfront.net/survey_us_d/withoutbg/blender_withoutbg.png
Requested by: Host: ofoffer.com
URL: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.45.106 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-45-106.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0d805673fda651a87cc5faab803caf6e9bc0dce3bdc72e8257778e085fc826a6

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ofoffer.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: IFqkXr8ezUBS7Ddrh.N_CUqtOWGZ6v1o
date: Wed, 17 Apr 2024 04:48:42 GMT
via: 1.1 9b00405a1ff669043791884b75822050.cloudfront.net (CloudFront)
last-modified: Mon, 30 May 2022 13:07:37 GMT
server: AmazonS3
x-amz-cf-pop: IAD55-P2
x-amz-server-side-encryption: AES256
etag: "27db867dee071d92dc7a6a5dee359472"
x-cache: RefreshHit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 56776
x-amz-cf-id: sSsnLXQXTZWX7vgCXNdOei5YRYZ7d1dkwHrTC9tK_bM9Wfp3IFp4qg==

GET
H2 200 banner_gift.png
d3e1y4kxkqljcb.cloudfront.net/survey_us_d/ 35 KB
35 KB 42ms
41ms Image
image/png 18.160.45.106
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d3e1y4kxkqljcb.cloudfront.net/survey_us_d/banner_gift.png
Requested by: Host: ofoffer.com
URL: https://ofoffer.com/addstyle.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.45.106 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-45-106.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2f10ec6bd6b33f0fb33ffc132eb50306ca0af5d46fc3d4294bf429757854a704

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ofoffer.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: g2czo00_BTZf8Q58BDGUBt1oJ7XftwPw
date: Tue, 16 Apr 2024 12:08:05 GMT
via: 1.1 9b00405a1ff669043791884b75822050.cloudfront.net (CloudFront)
last-modified: Wed, 28 Feb 2024 10:19:12 GMT
server: AmazonS3
x-amz-cf-pop: IAD55-P2
age: 60037
x-amz-server-side-encryption: AES256
etag: "a07fe09bd6fb1ab2bbe43ef55683992f"
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 35449
x-amz-cf-id: MjqY4QydVD-9dLXqRfV7VJl6CTri9RCWxExfGTEBqFOYMaD3E66LHA==

GET
H2 200 att_icon.png
d3e1y4kxkqljcb.cloudfront.net/survey_us_d/ 2 KB
2 KB 50ms
50ms Image
image/png 18.160.45.106
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d3e1y4kxkqljcb.cloudfront.net/survey_us_d/att_icon.png
Requested by: Host: ofoffer.com
URL: https://ofoffer.com/addstyle.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.45.106 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-45-106.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1e00b364233013e5c4374b421cc748f69433c5bd0792c6bfbc2e880505364f81

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ofoffer.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 09:44:19 GMT
x-amz-version-id: heRgZ.5FRE8WAh.Zfn7dHkF3y034Rcqp
via: 1.1 9b00405a1ff669043791884b75822050.cloudfront.net (CloudFront)
last-modified: Fri, 11 Aug 2023 11:44:24 GMT
server: AmazonS3
x-amz-cf-pop: IAD55-P2
age: 68663
etag: "4702d38ee49ea627957715d44a56aeb2"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 1939
x-amz-cf-id: oNftbVsMdMmJNYL5N6WNFUPoaeNo_P5ZSjCon5r27DPK6pH_RwhqjQ==

GET
H2 200 finger_move.png
d3e1y4kxkqljcb.cloudfront.net/survey_us_d/ 3 KB
3 KB 50ms
50ms Image
image/png 18.160.45.106
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d3e1y4kxkqljcb.cloudfront.net/survey_us_d/finger_move.png
Requested by: Host: ofoffer.com
URL: https://ofoffer.com/addstyle.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.45.106 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-45-106.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c94207784ea1f95d534eeadbd1a46b6f3c89ad00460b1b9955ab51ac9a5e7f68

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ofoffer.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 17:18:19 GMT
x-amz-version-id: u3YndU3fpIeI8iY6SptRbnFRue3bfR9g
via: 1.1 9b00405a1ff669043791884b75822050.cloudfront.net (CloudFront)
last-modified: Mon, 25 Mar 2024 16:16:34 GMT
server: AmazonS3
x-amz-cf-pop: IAD55-P2
age: 41423
etag: "354551d561542f8c6a6144946712a568"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 3104
x-amz-cf-id: PjNFIjSQuHNyny_w5uRZm8ukAJE1jTgo-bl5cM4Sx2Oz5ENbLTKImA==

GET
H2 200 sprite_comment1.png
d3e1y4kxkqljcb.cloudfront.net/survey_us_d/ 15 KB
15 KB 51ms
51ms Image
image/png 18.160.45.106
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d3e1y4kxkqljcb.cloudfront.net/survey_us_d/sprite_comment1.png
Requested by: Host: ofoffer.com
URL: https://ofoffer.com/addstyle.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.45.106 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-45-106.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cbfaf34950c7a7cd2047c03957476327d776836c6afb188054bb11db41a088b4

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ofoffer.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 14:17:36 GMT
x-amz-version-id: DurS4.baYLs3466NlANaKbJGYc.zs98N
via: 1.1 9b00405a1ff669043791884b75822050.cloudfront.net (CloudFront)
last-modified: Wed, 13 Dec 2023 09:03:47 GMT
server: AmazonS3
x-amz-cf-pop: IAD55-P2
age: 52266
etag: "596dfe1ec4383e41ef76376bfb062b2b"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 15408
x-amz-cf-id: _FDyf6D1hUEAs5TmWRgK6IA_KFsroJwdq7B5RbeQT-ovO4OQpKp6IQ==

GET
H2 200 conf.js Show response
d3e1y4kxkqljcb.cloudfront.net/survey_us_d/ 3 KB
3 KB 35ms
34ms Script
application/javascript 18.160.45.106
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d3e1y4kxkqljcb.cloudfront.net/survey_us_d/conf.js?_=1713329321310
Requested by: Host: code.jquery.com
URL: https://code.jquery.com/jquery-1.11.1.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.160.45.106 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-160-45-106.iad55.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4ac18ce9dd50403ef42cedc8bc65eb3b415131d6c6c2b667c425bebae2f3d08c

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ofoffer.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Apr 2024 07:22:47 GMT
x-amz-version-id: XRrWbkwz6unc8ZdaxnBdPgKNFZoZKJwD
via: 1.1 9b00405a1ff669043791884b75822050.cloudfront.net (CloudFront)
last-modified: Fri, 02 Sep 2022 11:17:49 GMT
server: AmazonS3
x-amz-cf-pop: IAD55-P2
age: 77155
etag: "78213dd6bc428cd3b11c6d408b0657db"
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 3028
x-amz-cf-id: _lflppoxonhAvJm76vsDBTh9fOpAgFKl_Ad-WolJmcZBjxqrcZW9hg==

GET
H/1.1 200
OK 2d57582017fdd1a91d6bf3a47b940401.ico
ofoffer.com/visitor_ca_st/assets/ 15 KB
2 KB 143ms
143ms Other
image/x-icon 91.220.101.99
HIGHLOADSYSTEMS

General

Check archive.org

Show headers Download Go to

Full URL: https://ofoffer.com/visitor_ca_st/assets/2d57582017fdd1a91d6bf3a47b940401.ico
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 91.220.101.99 , Ukraine, ASN34259 (HIGHLOADSYSTEMS, UA),
Reverse DNS: srv-s99.antiddos.eu
Software: openresty /
Resource Hash: 703063f5cfebf76bd6190dd87052d6664d3a0fcf474d837d89f6b7fae7a8f3b5

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://ofoffer.com/visitor_ca_st/index_1_d.php?device_name=Desktop&browser_name=Chrome&language=en-CA&city=Toronto&clickid=44c4117ik8pa5185&campaign=6563&user_id=1&clickcost=0&lander=2072&time=1713311319&browser_version=123.0.0.0&device_model=Desktop&device_brand=Desktop&resolution=Desktop&os_name=Windows&os_version=10.0&country=Canada&country_code=CA&isp=Cogent%20Communications&ip=154.47.17.4&user_agent=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/123.0.0.0%20Safari/537.36&lpkey=1773138e327296b319&target=ac&device=DESKTOP&domain=fluxtok.com&uclick=17ik8pa5&uclickhash=17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 17 Apr 2024 04:48:42 GMT
Content-Encoding: gzip
Last-Modified: Thu, 22 Jun 2023 07:28:48 GMT
Server: openresty
ETag: W/"6493f830-3c2e"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: image/x-icon
Cache-Control: max-age=315360000
Connection: keep-alive
Expires: Thu, 31 Dec 2037 23:55:55 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Customer Survey Spam (Consumer)

40 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
ofoffer.com/visitor_ca_st	1969-12-31 23:59:59	Name: referrer Value:
fluxtok.com/	1970-01-20 19:56:55	Name: uclick Value: 17ik8pa5
fluxtok.com/	1970-01-20 19:56:55	Name: uclickhash Value: 17ik8pa5-17ik8pa5-zwdv-zw6o-171mbl-xrvc8n-xrvcvr-b3daa3

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://ofoffer.com/favicon.ico Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

code.jquery.com
d3e1y4kxkqljcb.cloudfront.net
fluxtok.com
fonts.googleapis.com
ofoffer.com
151.101.66.137
172.253.115.95
18.160.45.106
91.220.101.74
91.220.101.99
00a414af4d92e7f8debf314ca0baff94a20bd2be266d663cfe88bc9c0472bd69
01d3adc7504c889384eb8506246d6ae29c39cff278938c4110b16249259a8b42
0460c73243a3523e18d6a0e30e272e4107d462d54ea8fbd6667190724e5b8447
05c983ed393cf3e307c3deb93dd13e2ba12c32ca0a2ebee3fb723dd9e655aaf6
0d79ca3b13098126f0c0fc76aed54a8acf6e645e62eb5f0ff90571141dfe24b2
0d805673fda651a87cc5faab803caf6e9bc0dce3bdc72e8257778e085fc826a6
1c718fdc9a84ed8781de12f63ff59f8d189727486c36024ee6dde16d90e368bc
1e00b364233013e5c4374b421cc748f69433c5bd0792c6bfbc2e880505364f81
1e8d04ff0db02dc96ebb42e7e76514b0c722da09668b9b7908cabc7307161923
2715b471d5540e8a12f2d9cb7d375715af9bcb03e85181b6b14715c244a513c3
2f10ec6bd6b33f0fb33ffc132eb50306ca0af5d46fc3d4294bf429757854a704
36d0b3552e3921a6af29a164f7f2b19de78c916ff06bfd1697c8411543c045ed
4ac18ce9dd50403ef42cedc8bc65eb3b415131d6c6c2b667c425bebae2f3d08c
540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441
542484ece53b315967c1ac02c2f89e937a91d558e41d458e60df9faa7279f531
5930489b4bebe12e257a17b3a3c8f581a5daa0c5feda8c6103a88b14db7ce3e9
6dcec3deeb5341a4694cbb4b0ea2120806155cfbfbf1be26d359fe28c230d363
70000c61c4a19c338d4bd3f9fb0dbf51c2afb7097b289c3937cab1b41fc4607d
703063f5cfebf76bd6190dd87052d6664d3a0fcf474d837d89f6b7fae7a8f3b5
9ab4f4c2fbb7f22fd22e510a5797ecb47fb1c05c60c9c7ddc578d3841adaf33f
b2aa2f7b3c5df406516a8e8b5166243c5ed9c6e8842500f199a3fac360f9ce3c
b3f721934cfdf7c66fdbfbd44588c3e3ce9f051b8f62a9f3023b2b5e32650233
b64f492abf4ab0adb076d75157f9534d8c619d9de98810aa59b6c40f4036ad1e
bc4ba5ab1f79419e5c8a06db6d5ed27f78b026617608d8513bdf476bf78e1120
c70c1756118c5ae5d94352cd42db95e81afacf00e82b1cb256fc20ef972be303
c889fb1af64cceab36a53b3d6e622710e0880b0ed4b38be7730561105b3c5bcc
c94207784ea1f95d534eeadbd1a46b6f3c89ad00460b1b9955ab51ac9a5e7f68
cb6e7f2199d29353465ca7569b7ec9dad5dc246eee76f8b7c0061e7fabc2d9c9
cb71249490a2ac7c66f3f80eecf854c6fb39bec0d6632d4b45000c023bb1d18b
cbfaf34950c7a7cd2047c03957476327d776836c6afb188054bb11db41a088b4
d28282cf435a47dee3c8abde8dda7f8b3c4acb6d594d0fd0396e26f050dfd36f
d8968086f7509df34c3278563dab87399da4f9dcdfb419818e3a309eedc70b88
db5e4ee93c7b86d11f61d0e9ef1269f0c28013a828fb59efc79610a161131314
e4fdd7ac61625aa75e3f51d703a222a51b1c9be1f843a0c5b95a82105dd77cb4
e841bfed515cc6312e44b87fe897cac0d09a6700792cb85adfc781741f68daec
e9a507f5ff7134a65afe30e48496d47795dd9189e461c3fff11b9152300821b5
f77c0d1739b618edc4a01ca3f6b2990b01a3009030af49ee8cf68e83052df194
faf64292e6fcbfbf8843de9a284e8dfab88f66adc5ffe3c51206ffc3f4f60303
fe0f25591b2245b8b3ed1513f800465be35d95292c3625eb4b1fb05eeb1a1343

ofoffer.com Open in urlscan Pro 91.220.101.99 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

42 Requests

100 %HTTPS

0 %IPv6

5 Domains

5 Subdomains

4 IPs

2 Countries

994 kBTransfer

1421 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

42 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

ofoffer.com Open in urlscan Pro
91.220.101.99 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

42
Requests

100 %
HTTPS

0 %
IPv6

5
Domains

5
Subdomains

4
IPs

2
Countries

994 kB
Transfer

1421 kB
Size

3
Cookies

42 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!