urlscan.io logo urlscan.io
SecurityTrails logo

r3p02.netcrimson.com Open in urlscan Pro
63.146.102.137  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://ct.vexpress-4.com/rd/cts?d=143-2215-1757-1562-15755-144259-0-0-0-1-1-791
Effective URL: https://r3p02.netcrimson.com/survey.aspx?SID9=%2fiQidRUqjvY%3d&SAMP=901&vid=882f45d7-5ed3-40ca-857a-456a592e3f14
Submission: On February 24 via manual from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 2 countries across 9 domains to perform 19 HTTP transactions. The main IP is 63.146.102.137, located in United States and belongs to CENTURYLINK-US-LEGACY-QWEST, US. The main domain is r3p02.netcrimson.com.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on February 10th 2020. Valid for: 2 years.
This is the only time r3p02.netcrimson.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 68.233.137.208 12154 (INFOUSA)
1 1 54.221.243.88 14618 (AMAZON-AES)
1 1 3.232.213.24 14618 (AMAZON-AES)
1 1 72.15.205.152 13649 (ASN-VINS)
9 63.146.102.137 209 (CENTURYLI...)
1 2a00:1450:400... 15169 (GOOGLE)
2 2606:4700::68... 13335 (CLOUDFLAR...)
4 198.61.133.93 19994 (RACKSPACE)
3 2a00:1450:400... 15169 (GOOGLE)
19 5
1    68.233.137.208 (United States)

ASN12154 (INFOUSA, US)
ct.vexpress-4.com
1    54.221.243.88 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-221-243-88.compute-1.amazonaws.com
forwardrocketlaunch.com
1    3.232.213.24 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-232-213-24.compute-1.amazonaws.com
roi-rocket.org
1    72.15.205.152 (United States)

ASN13649 (ASN-VINS, US)
research.roirocket.com
9    63.146.102.137 (United States)

ASN209 (CENTURYLINK-US-LEGACY-QWEST, US)
r3p02.netcrimson.com
r3p01.netcrimson.com
1    2a00:1450:4001:82f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
ajax.googleapis.com
2    2606:4700::6810:135e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
4    198.61.133.93 (United States)

ASN19994 (RACKSPACE, US)
cleanidapi.navigatorsurveys.com
3    2a00:1450:4001:829::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
ssl.google-analytics.com
Apex Domain
Subdomains		 Transfer
9 netcrimson.com
r3p02.netcrimson.com
r3p01.netcrimson.com
50 KB
4 navigatorsurveys.com
cleanidapi.navigatorsurveys.com — Cisco Umbrella Rank: 263784
41 KB
3 google-analytics.com
ssl.google-analytics.com — Cisco Umbrella Rank: 236
17 KB
2 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 197
13 KB
1 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 250
93 KB
1 roirocket.com
research.roirocket.com — Cisco Umbrella Rank: 417864
561 B
1 roi-rocket.org
roi-rocket.org — Cisco Umbrella Rank: 418884
876 B
1 forwardrocketlaunch.com
forwardrocketlaunch.com — Cisco Umbrella Rank: 428724
265 B
1 vexpress-4.com
ct.vexpress-4.com
288 B
19 9
Domain Requested by
8 r3p02.netcrimson.com r3p02.netcrimson.com
4 cleanidapi.navigatorsurveys.com r3p02.netcrimson.com
cleanidapi.navigatorsurveys.com
3 ssl.google-analytics.com r3p02.netcrimson.com
2 cdnjs.cloudflare.com r3p02.netcrimson.com
1 r3p01.netcrimson.com
1 ajax.googleapis.com r3p02.netcrimson.com
1 research.roirocket.com 1 redirects
1 roi-rocket.org 1 redirects
1 forwardrocketlaunch.com 1 redirects
1 ct.vexpress-4.com 1 redirects
19 10

This site contains no links.

Subject Issuer Validity Valid
*.netcrimson.com
Go Daddy Secure Certificate Authority - G2		 2020-02-10 -
2022-04-03		 2 years crt.sh
upload.video.google.com
GTS CA 1C3		 2022-02-17 -
2022-05-12		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-09-21 -
2022-09-20		 a year crt.sh
*.navigatorsurveys.com
Go Daddy Secure Certificate Authority - G2		 2021-04-11 -
2022-05-13		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2022-02-17 -
2022-05-12		 3 months crt.sh

This page contains 2 frames:

Frame: https://r3p01.netcrimson.com//mrIWeb/mrIWeb.dll
Frame ID: 1C9B5F9E82688C87A8C0286BC88C7D55
Requests: 17 HTTP requests in this frame

Frame: https://cleanidapi.navigatorsurveys.com/scripts/xd2.html
Frame ID: 13C92CB3BF2CE644BAE24FCF1D6738E3
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. http://ct.vexpress-4.com/rd/cts?d=143-2215-1757-1562-15755-144259-0-0-0-1-1-791 HTTP 302
    https://forwardrocketlaunch.com/?a=65964&c=49408&s1=IG HTTP 302
    https://roi-rocket.org/?a=65964&c=49408&s1=IG&ckmguid=0e505dd6-f926-4beb-9483-4bf2829036ad HTTP 302
    https://research.roirocket.com/vendorsurveyinvitation.aspx?p=196413&qg=1976491&vmid=158506649&reqid=1585066... HTTP 302
    https://r3p02.netcrimson.com/survey.aspx?SID9=%2fiQidRUqjvY%3d&SAMP=901&vid=882f45d7-5ed3-40ca-857a-456a5... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • fingerprint(\d)?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • ([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js
Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

19
Requests

100 %
HTTPS

33 %
IPv6

9
Domains

10
Subdomains

5
IPs

2
Countries

216 kB
Transfer

485 kB
Size

17
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://ct.vexpress-4.com/rd/cts?d=143-2215-1757-1562-15755-144259-0-0-0-1-1-791 HTTP 302
    https://forwardrocketlaunch.com/?a=65964&c=49408&s1=IG HTTP 302
    https://roi-rocket.org/?a=65964&c=49408&s1=IG&ckmguid=0e505dd6-f926-4beb-9483-4bf2829036ad HTTP 302
    https://research.roirocket.com/vendorsurveyinvitation.aspx?p=196413&qg=1976491&vmid=158506649&reqid=158506649&auto=true&s3=&s4= HTTP 302
    https://r3p02.netcrimson.com/survey.aspx?SID9=%2fiQidRUqjvY%3d&SAMP=901&vid=882f45d7-5ed3-40ca-857a-456a592e3f14 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request survey.aspx
r3p02.netcrimson.com/
Redirect Chain
  • http://ct.vexpress-4.com/rd/cts?d=143-2215-1757-1562-15755-144259-0-0-0-1-1-791
  • https://forwardrocketlaunch.com/?a=65964&c=49408&s1=IG
  • https://roi-rocket.org/?a=65964&c=49408&s1=IG&ckmguid=0e505dd6-f926-4beb-9483-4bf2829036ad
  • https://research.roirocket.com/vendorsurveyinvitation.aspx?p=196413&qg=1976491&vmid=158506649&reqid=158506649&auto=true&s3=&s4=
  • https://r3p02.netcrimson.com/survey.aspx?SID9=%2fiQidRUqjvY%3d&SAMP=901&vid=882f45d7-5ed3-40ca-857a-456a592e3f14
17 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://r3p02.netcrimson.com/survey.aspx?SID9=%2fiQidRUqjvY%3d&SAMP=901&vid=882f45d7-5ed3-40ca-857a-456a592e3f14
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
63.146.102.137 , United States, ASN209 (CENTURYLINK-US-LEGACY-QWEST, US),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
fcde5c4d3bc97c5b8417124defa0cef99d687f19059f5b3b785938b42e667e1e

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Cache-Control
private
Content-Type
text/html; charset=utf-8
Content-Encoding
gzip
Vary
Accept-Encoding
Server
Microsoft-IIS/7.5
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Date
Thu, 24 Feb 2022 22:47:46 GMT
Content-Length
5098

Redirect headers

Cache-Control
no-cache
Pragma
no-cache
Content-Type
text/html; charset=utf-8
Expires
-1
Location
https://r3p02.netcrimson.com/survey.aspx?SID9=%2fiQidRUqjvY%3d&SAMP=901&vid=882f45d7-5ed3-40ca-857a-456a592e3f14
Server
Microsoft-IIS/7.5
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Date
Thu, 24 Feb 2022 22:46:23 GMT
Content-Length
50852
X-Secure-Connection
true
bootstrap.min.css
r3p02.netcrimson.com/css/ 		118 KB
19 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://r3p02.netcrimson.com/css/bootstrap.min.css
Requested by
Host: r3p02.netcrimson.com
URL: https://r3p02.netcrimson.com/survey.aspx?SID9=%2fiQidRUqjvY%3d&SAMP=901&vid=882f45d7-5ed3-40ca-857a-456a592e3f14
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
63.146.102.137 , United States, ASN209 (CENTURYLINK-US-LEGACY-QWEST, US),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
eece6e0c65b7007ab0eb1b4998d36dafe381449525824349128efc3f86f4c91c

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://r3p02.netcrimson.com/survey.aspx?SID9=%2fiQidRUqjvY%3d&SAMP=901&vid=882f45d7-5ed3-40ca-857a-456a592e3f14
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Thu, 24 Feb 2022 22:47:46 GMT
Content-Encoding
gzip
Last-Modified
Wed, 15 Jul 2020 17:24:53 GMT
Server
Microsoft-IIS/7.5
X-Powered-By
ASP.NET
ETag
"80a0ecd9cc5ad61:0"
Vary
Accept-Encoding
Content-Type
text/css
Accept-Ranges
bytes
Content-Length
19631
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.7.2/ 		93 KB
93 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/1.7.2/jquery.min.js
Requested by
Host: r3p02.netcrimson.com
URL: https://r3p02.netcrimson.com/survey.aspx?SID9=%2fiQidRUqjvY%3d&SAMP=901&vid=882f45d7-5ed3-40ca-857a-456a592e3f14
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
47b68dce8cb6805ad5b3ea4d27af92a241f4e29a5c12a274c852e4346a0500b4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://r3p02.netcrimson.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Thu, 24 Feb 2022 12:15:14 GMT
x-content-type-options
nosniff
age
37952
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
94840
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 24 Feb 2023 12:15:14 GMT
json3.min.js
cdnjs.cloudflare.com/ajax/libs/json3/3.3.2/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/json3/3.3.2/json3.min.js
Requested by
Host: r3p02.netcrimson.com
URL: https://r3p02.netcrimson.com/survey.aspx?SID9=%2fiQidRUqjvY%3d&SAMP=901&vid=882f45d7-5ed3-40ca-857a-456a592e3f14
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7c3e64ef84e5290feef3e6e6943c4618cd3b609995b6d7bde6e898b06bbf5d5a
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://r3p02.netcrimson.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Thu, 24 Feb 2022 22:47:46 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
3287621
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
3209
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:11:53 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03ec9-1fd1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6TP7Dw1pxNaWAW7VBazIeVctyWx7pXYrxwvkBpU2zXhx%2FPg%2F1pOm74CJeRfBe3pRKUwC22ARDBNC3HNugl0pir%2F%2BOeTkZbU4gqev2PFQlEGp4BDfU3Z6szayU%2FGTG%2Fmq8yYbjL3L8I%2FexHDWilipR7r6"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
6e2c3cd63eb05c1a-FRA
expires
Tue, 14 Feb 2023 22:47:46 GMT
modernizr-custom.js
r3p02.netcrimson.com/Scripts/ 		52 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://r3p02.netcrimson.com/Scripts/modernizr-custom.js
Requested by
Host: r3p02.netcrimson.com
URL: https://r3p02.netcrimson.com/survey.aspx?SID9=%2fiQidRUqjvY%3d&SAMP=901&vid=882f45d7-5ed3-40ca-857a-456a592e3f14
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
63.146.102.137 , United States, ASN209 (CENTURYLINK-US-LEGACY-QWEST, US),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
d298c836ac4deccb8d347a75fd0bc67a8f1ffc72a4f56371209e91d2719dde83

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://r3p02.netcrimson.com/survey.aspx?SID9=%2fiQidRUqjvY%3d&SAMP=901&vid=882f45d7-5ed3-40ca-857a-456a592e3f14
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Thu, 24 Feb 2022 22:47:46 GMT
Content-Encoding
gzip
Last-Modified
Wed, 15 Jul 2020 17:24:55 GMT
Server
Microsoft-IIS/7.5
X-Powered-By
ASP.NET
ETag
"80cd1ddbcc5ad61:0"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Accept-Ranges
bytes
Content-Length
15541
detectizr.min.js
r3p02.netcrimson.com/Scripts/ 		8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://r3p02.netcrimson.com/Scripts/detectizr.min.js
Requested by
Host: r3p02.netcrimson.com
URL: https://r3p02.netcrimson.com/survey.aspx?SID9=%2fiQidRUqjvY%3d&SAMP=901&vid=882f45d7-5ed3-40ca-857a-456a592e3f14
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
63.146.102.137 , United States, ASN209 (CENTURYLINK-US-LEGACY-QWEST, US),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
58171ef015d742e4bcb89a04dcd2323037308b61a7779ea084c2f73faddfaf88

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://r3p02.netcrimson.com/survey.aspx?SID9=%2fiQidRUqjvY%3d&SAMP=901&vid=882f45d7-5ed3-40ca-857a-456a592e3f14
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Thu, 24 Feb 2022 22:47:46 GMT
Content-Encoding
gzip
Last-Modified
Wed, 15 Jul 2020 17:24:54 GMT
Server
Microsoft-IIS/7.5
X-Powered-By
ASP.NET
ETag
"03785dacc5ad61:0"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Accept-Ranges
bytes
Content-Length
3345
persist-min.js
r3p02.netcrimson.com/Scripts/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://r3p02.netcrimson.com/Scripts/persist-min.js
Requested by
Host: r3p02.netcrimson.com
URL: https://r3p02.netcrimson.com/survey.aspx?SID9=%2fiQidRUqjvY%3d&SAMP=901&vid=882f45d7-5ed3-40ca-857a-456a592e3f14
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
63.146.102.137 , United States, ASN209 (CENTURYLINK-US-LEGACY-QWEST, US),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
97fa29df907369dd398d2d6218fff9f41a26322c26a009b7ce96655b995da744

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://r3p02.netcrimson.com/survey.aspx?SID9=%2fiQidRUqjvY%3d&SAMP=901&vid=882f45d7-5ed3-40ca-857a-456a592e3f14
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Thu, 24 Feb 2022 22:47:46 GMT
Content-Encoding
gzip
Last-Modified
Wed, 15 Jul 2020 17:24:55 GMT
Server
Microsoft-IIS/7.5
X-Powered-By
ASP.NET
ETag
"80cd1ddbcc5ad61:0"
Vary
Accept-Encoding
Content-Type
application/x-javascript
Accept-Ranges
bytes
Content-Length
3335
fingerprint2.min.js
cdnjs.cloudflare.com/ajax/libs/fingerprintjs2/1.8.1/ 		35 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/fingerprintjs2/1.8.1/fingerprint2.min.js
Requested by
Host: r3p02.netcrimson.com
URL: https://r3p02.netcrimson.com/survey.aspx?SID9=%2fiQidRUqjvY%3d&SAMP=901&vid=882f45d7-5ed3-40ca-857a-456a592e3f14
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0a38f58671095a8a5b0eea4b27ab252e874c4230adb768ee2b0155bba1e9afc5
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://r3p02.netcrimson.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date
Thu, 24 Feb 2022 22:47:46 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
1915175
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
9260
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:10:04 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03e5c-8d59"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uu8DmxyhsnVl175AeJM%2FYm6ccGVMKggtndXywFMa4VW%2BTj316VRP2GgX5kfXEMfP35OaAVEsqdSVfXvLAPAvREuWhVrBUEw1QXyQ4N4vybmDyeBY2Ze4tul65H0HGpHGAZnhSm%2BVR11GxPy%2FhqcwiD5t"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
6e2c3cd64eb35c1a-FRA
expires
Tue, 14 Feb 2023 22:47:46 GMT
datasink.ashx
r3p02.netcrimson.com/api/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://r3p02.netcrimson.com/api/datasink.ashx?proxy
Requested by
Host: r3p02.netcrimson.com
URL: https://r3p02.netcrimson.com/survey.aspx?SID9=%2fiQidRUqjvY%3d&SAMP=901&vid=882f45d7-5ed3-40ca-857a-456a592e3f14
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
63.146.102.137 , United States, ASN209 (CENTURYLINK-US-LEGACY-QWEST, US),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
5d67d441fcb2bad8c9c9f4061e83708f7fcef576f43a2a5526f4e6245da93d93

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://r3p02.netcrimson.com/survey.aspx?SID9=%2fiQidRUqjvY%3d&SAMP=901&vid=882f45d7-5ed3-40ca-857a-456a592e3f14
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Thu, 24 Feb 2022 22:47:46 GMT
Content-Encoding
gzip
Last-Modified
Mon, 16 Aug 2021 16:17:47 GMT
Server
Microsoft-IIS/7.5
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
text/javascript; charset=utf-8
Cache-Control
public
Content-Disposition
attachment; filename=DataSinkProxy.js
Content-Length
1882
forensic-v2.0.1.min.js
cleanidapi.navigatorsurveys.com/scripts/ 		92 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cleanidapi.navigatorsurveys.com/scripts/forensic-v2.0.1.min.js
Requested by
Host: r3p02.netcrimson.com
URL: https://r3p02.netcrimson.com/survey.aspx?SID9=%2fiQidRUqjvY%3d&SAMP=901&vid=882f45d7-5ed3-40ca-857a-456a592e3f14
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
198.61.133.93 , United States, ASN19994 (RACKSPACE, US),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
5bdc75eaf9607b256a65605c3483dc151a41be55fb1208d6864c09a6d4a1ffae

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://r3p02.netcrimson.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Thu, 24 Feb 2022 22:47:46 GMT
Content-Encoding
gzip
Last-Modified
Sun, 05 Jul 2020 13:55:36 GMT
Server
Microsoft-IIS/10.0
ETag
"1d652d3f53d932d"
Vary
Accept-Encoding
P3P
CP="NOI COR NID OUR"
Transfer-Encoding
chunked
Accept-Ranges
bytes
Content-Type
application/javascript
ga.js
ssl.google-analytics.com/ 		45 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ssl.google-analytics.com/ga.js
Requested by
Host: r3p02.netcrimson.com
URL: https://r3p02.netcrimson.com/survey.aspx?SID9=%2fiQidRUqjvY%3d&SAMP=901&vid=882f45d7-5ed3-40ca-857a-456a592e3f14
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://r3p02.netcrimson.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 02 Nov 2021 17:39:06 GMT
server
Golfe2
age
1423
date
Thu, 24 Feb 2022 22:24:03 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
17168
expires
Fri, 25 Feb 2022 00:24:03 GMT
__utm.gif
ssl.google-analytics.com/r/ 		35 B
197 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1583494203&utmhn=r3p02.netcrimson.com&utme=8(Project*3!SURVEYASPX)9(S25303*3!YES)11(2*3!2)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmhid=1211817094&utmr=-&utmp=%2Fsurvey.aspx%3FSID9%3D%25252fiQidRUqjvY%25253d%26SAMP%3D901%26vid%3D882f45d7-5ed3-40ca-857a-456a592e3f14&utmht=1645742867045&utmac=UA-648355-2&utmcc=__utma%3D106185088.1399217214.1645742867.1645742867.1645742867.1%3B%2B__utmz%3D106185088.1645742867.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=195396405&utmredir=1&utmu=qRAAAAAAAAAAAAAAAAAAAAAE~
Requested by
Host: r3p02.netcrimson.com
URL: https://r3p02.netcrimson.com/survey.aspx?SID9=%2fiQidRUqjvY%3d&SAMP=901&vid=882f45d7-5ed3-40ca-857a-456a592e3f14
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://r3p02.netcrimson.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 24 Feb 2022 22:47:47 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT
xd2.html
cleanidapi.navigatorsurveys.com/scripts/ Frame 13C9 		98 B
513 B 		Document
General
Check archive.org
Download Go to
Full URL
https://cleanidapi.navigatorsurveys.com/scripts/xd2.html
Requested by
Host: cleanidapi.navigatorsurveys.com
URL: https://cleanidapi.navigatorsurveys.com/scripts/forensic-v2.0.1.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
198.61.133.93 , United States, ASN19994 (RACKSPACE, US),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
fb86b401527ba69c4f08692e289bfe2d985ce2e151207a9bf84a747b38c3a0eb

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://r3p02.netcrimson.com/

Response headers

Transfer-Encoding
chunked
Content-Type
text/html
Content-Encoding
gzip
Last-Modified
Fri, 29 May 2020 16:27:10 GMT
Accept-Ranges
bytes
ETag
"1d635d600668362"
Vary
Accept-Encoding
Server
Microsoft-IIS/10.0
P3P
CP="NOI COR NID OUR"
Date
Thu, 24 Feb 2022 22:47:47 GMT
datasink.ashx
r3p02.netcrimson.com/api/ 		22 B
280 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://r3p02.netcrimson.com/api/datasink.ashx
Requested by
Host: r3p02.netcrimson.com
URL: https://r3p02.netcrimson.com/api/datasink.ashx?proxy
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
63.146.102.137 , United States, ASN209 (CENTURYLINK-US-LEGACY-QWEST, US),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
7f650557e190345d8b095801e3d2380904438f9b3e8c50783f5449f5b606e739

Request headers

Referer
https://r3p02.netcrimson.com/survey.aspx?SID9=%2fiQidRUqjvY%3d&SAMP=901&vid=882f45d7-5ed3-40ca-857a-456a592e3f14
Accept-Language
de-DE,de;q=0.9
X-JSON-RPC
recordStart
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type
application/json; charset=UTF-8

Response headers

Pragma
no-cache
Date
Thu, 24 Feb 2022 22:47:47 GMT
Server
Microsoft-IIS/7.5
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
application/json; charset=utf-8
Cache-Control
no-cache
Content-Length
22
Expires
-1
__utm.gif
ssl.google-analytics.com/ 		35 B
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ssl.google-analytics.com/__utm.gif?utmwv=5.7.2&utms=1&utmn=254179094&utmhn=r3p02.netcrimson.com&utme=8(Project*3!SURVEYASPX)9(S25303*3!YES)11(2*3!2)&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmhid=1211817094&utmr=-&utmp=%2Fsurvey.aspx%3FSID9%3D%25252fiQidRUqjvY%25253d%26SAMP%3D901%26vid%3D882f45d7-5ed3-40ca-857a-456a592e3f14&utmht=1645742867706&utmac=UA-648355-2&utmcc=__utma%3D106185088.1399217214.1645742867.1645742867.1645742867.1%3B%2B__utmz%3D106185088.1645742867.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=&utmu=qRAAAAAAAAAAAAAAAAAAAAAE~
Requested by
Host: r3p02.netcrimson.com
URL: https://r3p02.netcrimson.com/survey.aspx?SID9=%2fiQidRUqjvY%3d&SAMP=901&vid=882f45d7-5ed3-40ca-857a-456a592e3f14
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://r3p02.netcrimson.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 24 Feb 2022 13:40:04 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
32863
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
xd-v2.0.0.min.js
cleanidapi.navigatorsurveys.com/scripts/ Frame 13C9 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cleanidapi.navigatorsurveys.com/scripts/xd-v2.0.0.min.js
Requested by
Host: cleanidapi.navigatorsurveys.com
URL: https://cleanidapi.navigatorsurveys.com/scripts/xd2.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
198.61.133.93 , United States, ASN19994 (RACKSPACE, US),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
6c401a92fbd2568b54458641655d20f2bddcade318d934177ea4a4f5ce827513

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://cleanidapi.navigatorsurveys.com/scripts/xd2.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date
Thu, 24 Feb 2022 22:47:47 GMT
Content-Encoding
gzip
Last-Modified
Fri, 29 May 2020 21:02:10 GMT
Server
Microsoft-IIS/10.0
ETag
"1d635fc6b2abc34"
Vary
Accept-Encoding
P3P
CP="NOI COR NID OUR"
Transfer-Encoding
chunked
Accept-Ranges
bytes
Content-Type
application/javascript
forensic
cleanidapi.navigatorsurveys.com/ 		1 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://cleanidapi.navigatorsurveys.com/forensic
Requested by
Host: cleanidapi.navigatorsurveys.com
URL: https://cleanidapi.navigatorsurveys.com/scripts/forensic-v2.0.1.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
198.61.133.93 , United States, ASN19994 (RACKSPACE, US),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
892d3d4fb3137bd84d6c858ad7e364766402a70a423ebec3a1b710fb045a81b6

Request headers

Accept
application/json, lk/960F6474A7F254B81F52BF8C7123B134-6001-1 q=0.1
Referer
https://r3p02.netcrimson.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type
text/plain; charset=UTF-8

Response headers

Date
Thu, 24 Feb 2022 22:47:48 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/10.0
Location
http://cleanidapi.navigatorsurveys.com/forensic?deviceId=75150106
ETag
DwPTqIjPabA1XypwUS27lt9jJTyOLocQWyXgeQ2VijdzAsqlht5969w5BwWOeKNo
Vary
Accept-Encoding
P3P
CP="NOI COR NID OUR"
Access-Control-Allow-Origin
https://r3p02.netcrimson.com
Transfer-Encoding
chunked
Access-Control-Allow-Credentials
true
Content-Type
application/json; charset=utf-8
datasink.ashx
r3p02.netcrimson.com/api/ 		22 B
280 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://r3p02.netcrimson.com/api/datasink.ashx
Requested by
Host: r3p02.netcrimson.com
URL: https://r3p02.netcrimson.com/api/datasink.ashx?proxy
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
63.146.102.137 , United States, ASN209 (CENTURYLINK-US-LEGACY-QWEST, US),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash
7f650557e190345d8b095801e3d2380904438f9b3e8c50783f5449f5b606e739

Request headers

Referer
https://r3p02.netcrimson.com/survey.aspx?SID9=%2fiQidRUqjvY%3d&SAMP=901&vid=882f45d7-5ed3-40ca-857a-456a592e3f14
Accept-Language
de-DE,de;q=0.9
X-JSON-RPC
cleanIDInsert
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type
application/json; charset=UTF-8

Response headers

Pragma
no-cache
Date
Thu, 24 Feb 2022 22:47:48 GMT
Server
Microsoft-IIS/7.5
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Content-Type
application/json; charset=utf-8
Cache-Control
no-cache
Content-Length
22
Expires
-1
mrIWeb.dll
r3p01.netcrimson.com//mrIWeb/ 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://r3p01.netcrimson.com//mrIWeb/mrIWeb.dll
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
63.146.102.137 , United States, ASN209 (CENTURYLINK-US-LEGACY-QWEST, US),
Reverse DNS
Software
Microsoft-IIS/7.5 / ASP.NET
Resource Hash

Request headers

Upgrade-Insecure-Requests
1
Origin
https://r3p02.netcrimson.com
Content-Type
application/x-www-form-urlencoded
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://r3p02.netcrimson.com/

Response headers

Pragma
no-cache
Content-Type
text/html; charset=utf-8
Content-Encoding
gzip
Expires
-1
Vary
Accept-Encoding
Server
Microsoft-IIS/7.5
X-Powered-By
ASP.NET
Date
Thu, 24 Feb 2022 22:47:52 GMT
Content-Length
1052

Verdicts & Comments Add Verdict or Comment

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| structuredClone

17 Cookies

Domain/Path Name / Value
ct.vexpress-4.com/rd Name: dc_ecomm
Value: 143-2215-1757-1562-15755-144259-0-0-0-1-1-791
.roi-rocket.org/ Name: sid
Value: 9ZdBYJtJfE6h0IZnyz7hgq6RpKGKmWYiGxCqs7uyiuARa23sYPRkPw==
.roi-rocket.org/ Name: trk
Value: G8s1UVO4y769mOZwOM9ohiQ20mBeKJK5wWyGFZQHlbHYTXqycP+CTg==
.roi-rocket.org/ Name: c43121
Value: 9ZdBYJtJfE4KS+ATINl7N07HdmWXq2FQjo/bGxAoVxR2uZWm5LbfJQ==
research.roirocket.com/ Name: ASP.NET_SessionId
Value: qmoe33hvv3ryopluinvhjnmh
research.roirocket.com/ Name: chocolate_chip
Value: 2744899001.1.2102043064.1682689536
.r3p02.netcrimson.com/ Name: __utma
Value: 106185088.1399217214.1645742867.1645742867.1645742867.1
.r3p02.netcrimson.com/ Name: __utmb
Value: 106185088.0.10.1645742867
.r3p02.netcrimson.com/ Name: __utmc
Value: 106185088
.r3p02.netcrimson.com/ Name: __utmz
Value: 106185088.1645742867.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
.netcrimson.com/ Name: __utmt
Value: 1
.netcrimson.com/ Name: __utma
Value: 106185088.1399217214.1645742867.1645742867.1645742867.1
.netcrimson.com/ Name: __utmb
Value: 106185088.1.10.1645742867
.netcrimson.com/ Name: __utmc
Value: 106185088
.netcrimson.com/ Name: __utmz
Value: 106185088.1645742867.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
.netcrimson.com/ Name: DGID
Value: fp%2422ef5857c9287125cf0c94b20216b82d
.cleanidapi.navigatorsurveys.com/ Name: zp_did2
Value: DwPTqIjPabA1XypwUS27lt9jJTyOLocQWyXgeQ2VijdzAsqlht5969w5BwWOeKNo

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdnjs.cloudflare.com
cleanidapi.navigatorsurveys.com
ct.vexpress-4.com
forwardrocketlaunch.com
r3p01.netcrimson.com
r3p02.netcrimson.com
research.roirocket.com
roi-rocket.org
ssl.google-analytics.com
198.61.133.93
2606:4700::6810:135e
2a00:1450:4001:829::2008
2a00:1450:4001:82f::200a
3.232.213.24
54.221.243.88
63.146.102.137
68.233.137.208
72.15.205.152
0a38f58671095a8a5b0eea4b27ab252e874c4230adb768ee2b0155bba1e9afc5
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
47b68dce8cb6805ad5b3ea4d27af92a241f4e29a5c12a274c852e4346a0500b4
58171ef015d742e4bcb89a04dcd2323037308b61a7779ea084c2f73faddfaf88
5bdc75eaf9607b256a65605c3483dc151a41be55fb1208d6864c09a6d4a1ffae
5d67d441fcb2bad8c9c9f4061e83708f7fcef576f43a2a5526f4e6245da93d93
6c401a92fbd2568b54458641655d20f2bddcade318d934177ea4a4f5ce827513
7c3e64ef84e5290feef3e6e6943c4618cd3b609995b6d7bde6e898b06bbf5d5a
7f650557e190345d8b095801e3d2380904438f9b3e8c50783f5449f5b606e739
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
892d3d4fb3137bd84d6c858ad7e364766402a70a423ebec3a1b710fb045a81b6
97fa29df907369dd398d2d6218fff9f41a26322c26a009b7ce96655b995da744
d298c836ac4deccb8d347a75fd0bc67a8f1ffc72a4f56371209e91d2719dde83
eece6e0c65b7007ab0eb1b4998d36dafe381449525824349128efc3f86f4c91c
fb86b401527ba69c4f08692e289bfe2d985ce2e151207a9bf84a747b38c3a0eb
fcde5c4d3bc97c5b8417124defa0cef99d687f19059f5b3b785938b42e667e1e