Report - shopswiz.com/gn/?tg=https://lg.provenpixel.com/plp.php?zoneid=8247&x_pid3=Windows&clickid=wlhfjku28kql03d2jrm3t90n&oadest=rate.com

Report Overview

Visited public
2024-06-30 19:27:15
Tags
sinkhole suspicious cloudflare
Submit Tags
URL
shopswiz.com/gn/?tg=https://lg.provenpixel.com/plp.php?zoneid=8247&x_pid3=Windows&clickid=wlhfjku28kql03d2jrm3t90n&oadest=rate.com
Finishing URL
www.rate.com/
IP / ASN
188.114.97.1
#13335 CLOUDFLARENET
Title
Attention Required! | Cloudflare
Suspicious - Sinkholed / Blocked

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
lg.provenpixel.com	95875	2009-04-10	2015-08-20 22:48:38	2024-06-28 10:19:12	1.1 kB	2.5 kB	3.209.177.37
lh-lvr.provenpixel.com	unknown	2009-04-10	2024-06-13 21:34:33	2024-06-13 21:34:33	1.3 kB	2.1 kB	3.209.177.37
nj-11.914trk.com	unknown	unknown	No data	No data	577 B	422 B	3.211.43.54
rate.com	165013	1997-06-18	2013-06-05 10:44:40	2024-04-16 20:42:41	463 B	324 B	35.168.192.59
www.rate.com	286728	1997-06-18	2013-06-05 10:44:40	2022-03-31 21:14:33	3.0 kB	21 kB	104.18.119.2
r10.o.lencr.org	unknown	2020-06-29	2024-06-06 21:45:11	2024-06-29 18:13:04	654 B	1.8 kB	23.36.77.32

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (3)

	URL	From	Size	First Seen	Last Seen
	www.rate.com/	ScriptElement	0 B	0001-01-01	2025-07-16
Pretty URL www.rate.com/ IP 104.18.119.2 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen0001-01-01 00:00 Last Seen2025-07-16 07:19 Times Seen5433806 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

	www.rate.com/	ScriptElement	393 B	2023-04-05	2025-03-02
Pretty URL www.rate.com/ IP 104.18.119.2 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen2023-04-05 04:39 Last Seen2025-03-02 06:13 Times Seen143291 Hash 34ad0a116707d3b794129a6720af92d7 424de9dbb8bc774e2a2d4ade100d90f5ac0ecbf4 d011a9449a990f2086894be870adc6fbb53595dc593b410a83e45e40bfbc7262 Loading...

	www.rate.com/	ScriptElement	0 B	0001-01-01	2025-07-16
Pretty URL www.rate.com/ IP 104.18.119.2 ASN #13335 CLOUDFLARENET Introduced by scriptElement Embedded in HTML true Observations First Seen0001-01-01 00:00 Last Seen2025-07-16 07:19 Times Seen5433806 Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Loading...

HTTP Transactions (13)

URL IP Response Size

r10.o.lencr.org/

23.36.77.32

504 B

URL
r10.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
f6d043d7b5e98906db1fe2695e98859c
154db889ef567d2839bb7eaa15818cd546495b4f
f4fcc79261acda8e1cb81b9fc6524ee560b60740b0cf8107308dc82750dc079a

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "F4FCC79261ACDA8E1CB81B9FC6524EE560B60740B0CF8107308DC82750DC079A"
Last-Modified: Sat, 29 Jun 2024 23:47:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=13797
Expires: Sun, 30 Jun 2024 23:16:47 GMT
Date: Sun, 30 Jun 2024 19:26:50 GMT
Connection: keep-alive

lg.provenpixel.com/plp.php?zoneid=8247&x_pid3=Windows&clickid=wlhfjku28kql03d2jrm3t90n&oadest=rate.com

3.209.177.37

768 B

URL
lg.provenpixel.com/plp.php?zoneid=8247&x_pid3=Windows&clickid=wlhfjku28kql03d2jrm3t90n&oadest=rate.com
IP
3.209.177.37:0
ASN
#14618 AMAZON-AES

File type
HTML document, ASCII text, with very long lines (1217)
Size
768 B (768 bytes)
Hash
41b8940fa1226351e3032f622e43627b
f7607bcbedb6a4152a8cd2c1a25b7790e1741d10
8d43dd443aa66e32a14e7707090869b13536edd40e60f949a7eeb1e0429c4337

HTTP Headers

GET /plp.php?zoneid=8247&x_pid3=Windows&clickid=wlhfjku28kql03d2jrm3t90n&oadest=rate.com HTTP/1.1
Host: lg.provenpixel.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Sun, 30 Jun 2024 19:26:51 GMT
content-type: text/html; charset=utf-8
content-length: 768
cache-control: no-cache no-store must-revalidate proxy-revalidate
pragma: no-cache
expires: 0
p3p: CP="CUR ADM OUR NOR STA NID"
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2

lh-lvr.provenpixel.com/plp.php?sigd=1280_1024_0_0_0_1280_1024.7e5a00.sfwrd1&zoneid=8247&x_pid3=Windows&clickid=wlhfjku28kql03d2jrm3t90n&oadest=rate.com

3.209.177.37

240 B

URL
lh-lvr.provenpixel.com/plp.php?sigd=1280_1024_0_0_0_1280_1024.7e5a00.sfwrd1&zoneid=8247&x_pid3=Windows&clickid=wlhfjku28kql03d2jrm3t90n&oadest=rate.com
IP
3.209.177.37:0
ASN
#14618 AMAZON-AES

File type
HTML document, ASCII text
Size
240 B (240 bytes)
Hash
7bd3c11a91d88d07c02352a69a8892a9
77a710cf08eadb2381f0e3d17642f68aebbb88c8
4e3c69974122093371f62cbce7b384adf981ae1b4d7332d658d5523b9e6e6cd5

HTTP Headers

GET /plp.php?sigd=1280_1024_0_0_0_1280_1024.7e5a00.sfwrd1&zoneid=8247&x_pid3=Windows&clickid=wlhfjku28kql03d2jrm3t90n&oadest=rate.com HTTP/1.1
Host: lh-lvr.provenpixel.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lg.provenpixel.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 30 Jun 2024 19:26:52 GMT
content-type: text/html; charset=utf-8
content-length: 240
set-cookie: pxid=000bcc53-6655d05d-5b5a2a9a-0c62bc46a9aa; expires=Mon, 30-Jun-2025 19:26:52 GMT; Max-Age=31536000; path=/; domain=provenpixel.com; secure; HttpOnly; SameSite=None
cache-control: no-cache no-store must-revalidate proxy-revalidate
pragma: no-cache
expires: 0
p3p: CP="CUR ADM OUR NOR STA NID"
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2

lg.provenpixel.com/favicon.ico

3.209.177.37

1.2 kB

URL
lg.provenpixel.com/favicon.ico
IP
3.209.177.37:0
ASN
#14618 AMAZON-AES

File type
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Size
1.2 kB (1150 bytes)
Hash
43ad523e28772bbd364fef3744226b46
5259f933545cd40c37ea0adef38e1ffc3fecf56d
8266dd0f45921d13f40b7dd250cecf3a8993ec7a94da05da91aaa3e312c943a4

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: lg.provenpixel.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lg.provenpixel.com/plp.php?zoneid=8247&x_pid3=Windows&clickid=wlhfjku28kql03d2jrm3t90n&oadest=rate.com
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 30 Jun 2024 19:26:52 GMT
content-type: image/vnd.microsoft.icon
content-length: 1150
last-modified: Thu, 20 Jun 2024 19:56:09 GMT
etag: "47e-61b57b4c26730"
accept-ranges: bytes
X-Firefox-Spdy: h2

lh-lvr.provenpixel.com/favicon.ico

3.209.177.37

1.2 kB

URL
lh-lvr.provenpixel.com/favicon.ico
IP
3.209.177.37:0
ASN
#14618 AMAZON-AES

File type
MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Size
1.2 kB (1150 bytes)
Hash
43ad523e28772bbd364fef3744226b46
5259f933545cd40c37ea0adef38e1ffc3fecf56d
8266dd0f45921d13f40b7dd250cecf3a8993ec7a94da05da91aaa3e312c943a4

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: lh-lvr.provenpixel.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lh-lvr.provenpixel.com/plp.php?sigd=1280_1024_0_0_0_1280_1024.7e5a00.sfwrd1&zoneid=8247&x_pid3=Windows&clickid=wlhfjku28kql03d2jrm3t90n&oadest=rate.com
Cookie: pxid=000bcc53-6655d05d-5b5a2a9a-0c62bc46a9aa
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 30 Jun 2024 19:26:52 GMT
content-type: image/vnd.microsoft.icon
content-length: 1150
last-modified: Thu, 20 Jun 2024 19:56:09 GMT
etag: "47e-61b57b4c26730"
accept-ranges: bytes
X-Firefox-Spdy: h2

r10.o.lencr.org/

23.36.77.32

504 B

URL
r10.o.lencr.org/
IP
23.36.77.32:0
ASN
#20940 Akamai International B.V.

File type
data
Size
504 B (504 bytes)
Hash
0c22b10a118098f2cdc4b186e6f8e9a8
cfe8b247d843f42d2205bb16a48cefe38c78526e
1208b1961307dfb3c91a337dfa900f9be57f91cab6a7dd3d7c5e38d2399d5d10

HTTP Headers

POST / HTTP/1.1
Host: r10.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "1208B1961307DFB3C91A337DFA900F9BE57F91CAB6A7DD3D7C5E38D2399D5D10"
Last-Modified: Fri, 28 Jun 2024 05:32:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10514
Expires: Sun, 30 Jun 2024 22:22:06 GMT
Date: Sun, 30 Jun 2024 19:26:52 GMT
Connection: keep-alive

nj-11.914trk.com/trk/?sc539f0154cfbf8b&sig=e70606.sfwrd2&u=https%3A%2F%2Frate.com

3.211.43.54

197 B

URL
nj-11.914trk.com/trk/?sc539f0154cfbf8b&sig=e70606.sfwrd2&u=https%3A%2F%2Frate.com
IP
3.211.43.54:0
ASN
#14618 AMAZON-AES

File type
HTML document, ASCII text, with no line terminators
Size
197 B (197 bytes)
Hash
e6abaed947c0d88dd8c0f63609a0aaee
aaec03beb55a5c0d40df6fa7acad4626389e516e
3cdba78ab3f3f00843870d433fb616a204a02a4b949ace863e861d3e5740e726

HTTP Headers

GET /trk/?sc539f0154cfbf8b&sig=e70606.sfwrd2&u=https%3A%2F%2Frate.com HTTP/1.1
Host: nj-11.914trk.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lh-lvr.provenpixel.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Sun, 30 Jun 2024 19:26:52 GMT
content-type: text/html; charset=UTF-8
content-length: 197
referrer-policy: no-referrer
vary: Accept-Encoding
content-encoding: gzip
X-Firefox-Spdy: h2

GET rate.com/

35.168.192.59

301 Moved Permanently

134 B

URL User Request GET HTTP/2
rate.com/
IP
35.168.192.59:443
ASN
#14618 AMAZON-AES

Certificate
IssuerAmazon
Subject*.guaranteedrate.com
Fingerprint2D:03:4D:41:CD:9B:BB:C4:FC:F0:2F:09:FC:CF:4D:AE:DB:0C:C1:79
ValidityThu, 11 Apr 2024 00:00:00 GMT - Sat, 10 May 2025 23:59:59 GMT

File type
HTML document, ASCII text, with CRLF line terminators
Size
134 B (134 bytes)
Hash
4aa7a432bb447f094408f1bd6229c605
1965c4952cc8c082a6307ed67061a57aab6632fa
34ccdc351dc93dbf30a8630521968421091e3ed19c31a16e32c2eabb55c6a73a

HTTP Headers

GET / HTTP/1.1
Host: rate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 301 Moved Permanently
server: awselb/2.0
date: Sun, 30 Jun 2024 19:26:52 GMT
content-type: text/html
content-length: 134
location: https://www.rate.com:443/
X-Firefox-Spdy: h2

GET www.rate.com/cdn-cgi/images/cf-no-screenshot-error.png

104.18.119.2

200 OK

3.2 kB

URL GET HTTP/2
www.rate.com/cdn-cgi/images/cf-no-screenshot-error.png
IP
104.18.119.2:443
ASN
#13335 CLOUDFLARENET

Requested by
https://www.rate.com/
Certificate
IssuerCloudflare, Inc.
Subjectwww.rate.com
Fingerprint72:60:92:1B:1B:27:53:5C:AE:1D:CD:18:0A:FB:EE:4C:1E:09:D4:B9
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT

File type
PNG image data, 178 x 175, 8-bit colormap, non-interlaced
Size
3.2 kB (3213 bytes)
Hash
0d768cbc261841d3affc933b9ac3130e
aff136a4c761e1df1ada7e5d9a6ed0ebea74a4b7
1c53772285052e52bb7c12ad46a85a55747ed7bf66963fe1993fcef91ff5b0d0

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - Sinkholed / Blocked

HTTP Headers

GET /cdn-cgi/images/cf-no-screenshot-error.png HTTP/1.1
Host: www.rate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.rate.com/cdn-cgi/styles/cf.errors.css
Cookie: __cf_bm=LRaeLlhmgTYX_q8djDhnfkjLSvGe30as5GEWmxRwcnI-1719775613-1.0.1.1-rTOkiuqj.u7jKaDiqrJMgLtLDKCzZN_JM7sYaDgmM6SG5qt8KAUNzXcOqsLCh_enFWfoIRT_1mXWpGYNF2O_zg
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Sun, 30 Jun 2024 19:26:53 GMT
content-type: image/png
content-length: 3213
last-modified: Wed, 26 Jun 2024 17:42:45 GMT
etag: "667c5315-c8d"
server: cloudflare
cf-ray: 89c08cef2d9992f8-CPH
x-frame-options: DENY
x-content-type-options: nosniff
vary: Accept-Encoding
expires: Sun, 30 Jun 2024 21:26:53 GMT
cache-control: max-age=7200, public
accept-ranges: bytes
X-Firefox-Spdy: h2

GET www.rate.com/cdn-cgi/styles/cf.errors.css

104.18.119.2

200 OK

5.2 kB

URL GET HTTP/2
www.rate.com/cdn-cgi/styles/cf.errors.css
IP
104.18.119.2:443
ASN
#13335 CLOUDFLARENET

Requested by
https://www.rate.com/
Certificate
IssuerCloudflare, Inc.
Subjectwww.rate.com
Fingerprint72:60:92:1B:1B:27:53:5C:AE:1D:CD:18:0A:FB:EE:4C:1E:09:D4:B9
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT

File type
gzip compressed data, from Unix
Size
5.2 kB (5230 bytes)
Hash
8c7180398bb47e8b677a0a808382b4d2
0c315b451a86b3a4934d9c6b988fd05df5de5fe2
a3010138b9546f73cd9d9d1331c2d69a8a19138303d3ab12680188c95b754d93

HTTP Headers

GET /cdn-cgi/styles/cf.errors.css HTTP/1.1
Host: www.rate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.rate.com/
DNT: 1
Connection: keep-alive
Cookie: __cf_bm=LRaeLlhmgTYX_q8djDhnfkjLSvGe30as5GEWmxRwcnI-1719775613-1.0.1.1-rTOkiuqj.u7jKaDiqrJMgLtLDKCzZN_JM7sYaDgmM6SG5qt8KAUNzXcOqsLCh_enFWfoIRT_1mXWpGYNF2O_zg
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
date: Sun, 30 Jun 2024 19:26:53 GMT
content-type: text/css
last-modified: Wed, 26 Jun 2024 17:42:45 GMT
etag: W/"667c5315-5df3"
server: cloudflare
cf-ray: 89c08ceeccff92f8-CPH
x-frame-options: DENY
x-content-type-options: nosniff
vary: Accept-Encoding
expires: Sun, 30 Jun 2024 21:26:53 GMT
cache-control: max-age=7200, public
content-encoding: gzip
X-Firefox-Spdy: h2

GET www.rate.com/cdn-cgi/images/browser-bar.png?1376755637

104.18.119.2

200 OK

715 B

URL GET HTTP/2
www.rate.com/cdn-cgi/images/browser-bar.png?1376755637
IP
104.18.119.2:443
ASN
#13335 CLOUDFLARENET

Requested by
https://www.rate.com/
Certificate
IssuerCloudflare, Inc.
Subjectwww.rate.com
Fingerprint72:60:92:1B:1B:27:53:5C:AE:1D:CD:18:0A:FB:EE:4C:1E:09:D4:B9
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT

File type
PNG image data, 960 x 53, 8-bit colormap, non-interlaced
Size
715 B (715 bytes)
Hash
226dcb8f6144bdaafdfbd8f2f354be64
3785cc5b3bf52f8e398177b0ff1020b24aa86b8c
8c873472f4925d5d47521db4d52532d2983e9cb1bde8b43143a6cc6db56c35db

Detections

Analyzer	Verdict	Alert
urlquery	suspicious	Suspicious - Sinkholed / Blocked

HTTP Headers

GET /cdn-cgi/images/browser-bar.png?1376755637 HTTP/1.1
Host: www.rate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.rate.com/cdn-cgi/styles/cf.errors.css
Cookie: __cf_bm=LRaeLlhmgTYX_q8djDhnfkjLSvGe30as5GEWmxRwcnI-1719775613-1.0.1.1-rTOkiuqj.u7jKaDiqrJMgLtLDKCzZN_JM7sYaDgmM6SG5qt8KAUNzXcOqsLCh_enFWfoIRT_1mXWpGYNF2O_zg
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sun, 30 Jun 2024 19:26:53 GMT
content-type: image/png
content-length: 715
last-modified: Wed, 26 Jun 2024 17:42:45 GMT
etag: "667c5315-2cb"
server: cloudflare
cf-ray: 89c08cef2d8692f8-CPH
x-frame-options: DENY
x-content-type-options: nosniff
vary: Accept-Encoding
expires: Sun, 30 Jun 2024 21:26:53 GMT
cache-control: max-age=7200, public
accept-ranges: bytes
X-Firefox-Spdy: h2

GET www.rate.com/favicon.ico

104.18.119.2

403 Forbidden

4.5 kB

URL GET HTTP/2
www.rate.com/favicon.ico
IP
104.18.119.2:443
ASN
#13335 CLOUDFLARENET

Requested by
https://www.rate.com/
Certificate
IssuerCloudflare, Inc.
Subjectwww.rate.com
Fingerprint72:60:92:1B:1B:27:53:5C:AE:1D:CD:18:0A:FB:EE:4C:1E:09:D4:B9
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT

File type
HTML document, ASCII text, with very long lines (4745), with no line terminators
Size
4.5 kB (4510 bytes)
Hash
368b2ae23b539948bcf3ae54f111f218
47955de69ebaf734c5cf8c1b151bc317872d1922
4ca219738f5b2805197753175342610ef360c2aff2e46506f87179c55ab2e549

HTTP Headers

GET /favicon.ico HTTP/1.1
Host: www.rate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.rate.com/
DNT: 1
Connection: keep-alive
Cookie: __cf_bm=LRaeLlhmgTYX_q8djDhnfkjLSvGe30as5GEWmxRwcnI-1719775613-1.0.1.1-rTOkiuqj.u7jKaDiqrJMgLtLDKCzZN_JM7sYaDgmM6SG5qt8KAUNzXcOqsLCh_enFWfoIRT_1mXWpGYNF2O_zg
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 403 Forbidden
date: Sun, 30 Jun 2024 19:26:53 GMT
content-type: text/html; charset=UTF-8
x-frame-options: SAMEORIGIN
referrer-policy: same-origin
cache-control: max-age=15
expires: Sun, 30 Jun 2024 19:27:08 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
server: cloudflare
cf-ray: 89c08cef1d7892f8-CPH
content-encoding: br
X-Firefox-Spdy: h2

GET www.rate.com/

104.18.119.2

403 Forbidden

4.5 kB

URL User Request GET HTTP/2
www.rate.com/
IP
104.18.119.2:443
ASN
#13335 CLOUDFLARENET

Certificate
IssuerCloudflare, Inc.
Subjectwww.rate.com
Fingerprint72:60:92:1B:1B:27:53:5C:AE:1D:CD:18:0A:FB:EE:4C:1E:09:D4:B9
ValiditySun, 08 Oct 2023 00:00:00 GMT - Mon, 07 Oct 2024 23:59:59 GMT

File type
HTML document, ASCII text, with very long lines (4745), with no line terminators
Size
4.5 kB (4510 bytes)
Hash
d3ec2f68efb13fc90e0ba55ae68bc333
88f0489f7789ca15a8c52b7c5cc807596600d701
4e5a5f560eef294ad69a2e4cbc77157b796cd259ef71421144268bafd96aab28

HTTP Headers

GET / HTTP/1.1
Host: www.rate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 403 Forbidden
date: Sun, 30 Jun 2024 19:26:53 GMT
content-type: text/html; charset=UTF-8
x-frame-options: SAMEORIGIN
referrer-policy: same-origin
cache-control: max-age=15
expires: Sun, 30 Jun 2024 19:27:08 GMT
set-cookie: __cf_bm=LRaeLlhmgTYX_q8djDhnfkjLSvGe30as5GEWmxRwcnI-1719775613-1.0.1.1-rTOkiuqj.u7jKaDiqrJMgLtLDKCzZN_JM7sYaDgmM6SG5qt8KAUNzXcOqsLCh_enFWfoIRT_1mXWpGYNF2O_zg; path=/; expires=Sun, 30-Jun-24 19:56:53 GMT; domain=.rate.com; HttpOnly; Secure; SameSite=None
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
server: cloudflare
cf-ray: 89c08ced6ac292f8-CPH
content-encoding: br
X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (3)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (13)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN