urlscan.io logo urlscan.io
SecurityTrails logo

keeprewards.life Open in urlscan Pro
91.195.240.12  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://aktivasi-perubahan-tarif-bni-mobile.ld-biz.com/
Effective URL: https://keeprewards.life/?u=uezkp05&o=6zlm90u&m=1&t=lo1
Submission: On January 10 via api from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 7 IPs in 2 countries across 9 domains to perform 14 HTTP transactions. The main IP is 91.195.240.12, located in Germany and belongs to SEDO-AS, DE. The main domain is keeprewards.life.
TLS certificate: Issued by Encryption Everywhere DV TLS CA - G2 on January 6th 2024. Valid for: a year.
This is the only time keeprewards.life was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Cloudflare (Online)

Domain & IP information

IP Address AS Autonomous System
2 5 2606:4700:303... 13335 (CLOUDFLAR...)
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
2 91.195.240.12 47846 (SEDO-AS)
1 2607:f8b0:400... 15169 (GOOGLE)
1 205.234.175.175 30081 (CACHENETW...)
1 2607:f8b0:400... 15169 (GOOGLE)
4 2607:f8b0:400... 15169 (GOOGLE)
2 2607:f8b0:400... 15169 (GOOGLE)
14 7
5    2606:4700:3030::ac43:a999 (United States)

ASN13335 (CLOUDFLARENET, US)
aktivasi-perubahan-tarif-bni-mobile.ld-biz.com
1    2606:4700:3037::6815:d43 (United States)

ASN13335 (CLOUDFLARENET, US)
ayeshholdings.co.za
1    2606:4700:3037::6815:414e (United States)

ASN13335 (CLOUDFLARENET, US)
envatogoods.com
2    91.195.240.12 (Germany)

ASN47846 (SEDO-AS, DE)
keeprewards.life
1    2607:f8b0:4004:c1b::63 (Washington, United States)

ASN15169 (GOOGLE, US)
www.google.com
1    205.234.175.175 (United States)

ASN30081 (CACHENETWORKS, US)
PTR: vip1.G-anycast1.cachefly.net
img.sedoparking.com
1    2607:f8b0:4006:824::2002 (Colchester, United States)

ASN15169 (GOOGLE, US)
partner.googleadservices.com
4    2607:f8b0:4004:c06::65 (Washington, United States)

ASN15169 (GOOGLE, US)
www.adsensecustomsearchads.com
2    2607:f8b0:4006:81e::2001 (Colchester, United States)

ASN15169 (GOOGLE, US)
afs.googleusercontent.com
Apex Domain
Subdomains		 Transfer
5 ld-biz.com
aktivasi-perubahan-tarif-bni-mobile.ld-biz.com
8 KB
4 adsensecustomsearchads.com
www.adsensecustomsearchads.com — Cisco Umbrella Rank: 3803
57 KB
2 googleusercontent.com
afs.googleusercontent.com — Cisco Umbrella Rank: 9809
1 KB
2 keeprewards.life
keeprewards.life
7 KB
1 googleadservices.com
partner.googleadservices.com — Cisco Umbrella Rank: 5917
597 B
1 sedoparking.com
img.sedoparking.com — Cisco Umbrella Rank: 56974
81 KB
1 google.com
www.google.com — Cisco Umbrella Rank: 6
54 KB
1 envatogoods.com
envatogoods.com
450 B
1 ayeshholdings.co.za
ayeshholdings.co.za
425 B
14 9
Domain Requested by
5 aktivasi-perubahan-tarif-bni-mobile.ld-biz.com 2 redirects aktivasi-perubahan-tarif-bni-mobile.ld-biz.com
4 www.adsensecustomsearchads.com www.google.com
www.adsensecustomsearchads.com
2 afs.googleusercontent.com
2 keeprewards.life keeprewards.life
1 partner.googleadservices.com www.google.com
1 img.sedoparking.com keeprewards.life
1 www.google.com keeprewards.life
1 envatogoods.com 1 redirects
1 ayeshholdings.co.za 1 redirects
14 9

This site contains links to these domains. Also see Links.

Domain
www.namesilo.com
www.sedo.com
Subject Issuer Validity Valid
ld-biz.com
GTS CA 1P5		 2023-11-30 -
2024-02-28		 3 months crt.sh
keeprewards.life
Encryption Everywhere DV TLS CA - G2		 2024-01-06 -
2025-01-05		 a year crt.sh
www.google.com
GTS CA 1C3		 2023-11-20 -
2024-02-12		 3 months crt.sh
*.cachefly.net
GlobalSign RSA OV SSL CA 2018		 2023-11-13 -
2024-12-14		 a year crt.sh
*.googleadservices.com
GTS CA 1C3		 2023-11-20 -
2024-02-12		 3 months crt.sh
misc-sni.google.com
GTS CA 1C3		 2023-11-20 -
2024-02-12		 3 months crt.sh
*.googleusercontent.com
GTS CA 1C3		 2023-11-20 -
2024-02-12		 3 months crt.sh

This page contains 2 frames:

Primary Page: https://keeprewards.life/?u=uezkp05&o=6zlm90u&m=1&t=lo1
Frame ID: 82CC8403AF8206D9595A9BB1F7CB09B5
Requests: 10 HTTP requests in this frame

Frame: https://www.adsensecustomsearchads.com/afs/ads?adsafe=low&adtest=off&psid=6267031743&channel=exp-0051%2Cauxa-control-1%2C8810114&client=dp-sedo80_3ph&r=m&hl=en&rpbu=https%3A%2F%2Fkeeprewards.life%2Fcaf%2F%3Fses%3DY3JlPTE3MDQ5MzAxNDEmdGNpZD1rZWVwcmV3YXJkcy5saWZlNjU5ZjJiNWQ2NGVhMDIuMjc3NjYzODcmdGFzaz1zZWFyY2gmZG9tYWluPWtlZXByZXdhcmRzLmxpZmUmYV9pZD0zJnNlc3Npb249dzlNUzNXVXNqN3k3cGtEaDl6Mmo%3D&type=3&uiopt=false&swp=as-drid-2383353299994854&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301383%2C71847096&format=r6&nocache=6311704930142013&num=0&output=afd_ads&domain_name=keeprewards.life&v=3&bsl=8&pac=0&u_his=3&u_tz=-600&dt=1704930142015&u_w=1600&u_h=1200&biw=1600&bih=1200&psw=1600&psh=1031&frm=0&cl=588056317&uio=-&cont=rb-default&drt=0&jsid=caf&jsv=588056317&rurl=https%3A%2F%2Fkeeprewards.life%2F%3Fu%3Duezkp05%26o%3D6zlm90u%26m%3D1%26t%3Dlo1&referer=https%3A%2F%2Faktivasi-perubahan-tarif-bni-mobile.ld-biz.com%2F
Frame ID: 96166347C5D61F378C0D6D0E20010271
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

keeprewards.life - keeprewards Resources and Information.

Page URL History Show full URLs

  1. https://aktivasi-perubahan-tarif-bni-mobile.ld-biz.com/ Page URL
  2. https://aktivasi-perubahan-tarif-bni-mobile.ld-biz.com/cdn-cgi/phish-bypass?atok=FMFFx825NBtgCiJjZ6rXG.2v.qEFQnfqYb8IdraBFMQ-170493... HTTP 301
    https://aktivasi-perubahan-tarif-bni-mobile.ld-biz.com/ HTTP 301
    https://ayeshholdings.co.za/ HTTP 301
    https://envatogoods.com/ HTTP 301
    https://keeprewards.life/?u=uezkp05&o=6zlm90u&m=1&t=lo1 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • [^a-z]mtc.*\.js

Page Statistics

14
Requests

100 %
HTTPS

78 %
IPv6

9
Domains

9
Subdomains

7
IPs

2
Countries

208 kB
Transfer

443 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://aktivasi-perubahan-tarif-bni-mobile.ld-biz.com/ Page URL
  2. https://aktivasi-perubahan-tarif-bni-mobile.ld-biz.com/cdn-cgi/phish-bypass?atok=FMFFx825NBtgCiJjZ6rXG.2v.qEFQnfqYb8IdraBFMQ-1704930135-0-%2F HTTP 301
    https://aktivasi-perubahan-tarif-bni-mobile.ld-biz.com/ HTTP 301
    https://ayeshholdings.co.za/ HTTP 301
    https://envatogoods.com/ HTTP 301
    https://keeprewards.life/?u=uezkp05&o=6zlm90u&m=1&t=lo1 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
aktivasi-perubahan-tarif-bni-mobile.ld-biz.com/ 		4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://aktivasi-perubahan-tarif-bni-mobile.ld-biz.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::ac43:a999 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e6d1ca7d1dedb36e4e6f28fb9de7fb003ef07cd4da6201cf31e21f804e6e0de7
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

cf-ray
8438c6838f7a4bd2-BUF
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Wed, 10 Jan 2024 23:42:15 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TWIz%2F4gfK0W4Dj9lM1kwiNDNQ5H0Z0wF8V61zgt7STLJn81uWiIwVtAaSTv0AovO8iBq59gAoWJp4F%2FUCcDJaN4rN4UilY4MGi1vhq6h8wlvg5yYQaA7mV79lXtZcik2r9oaxXf3%2B0rytE984qRtKHOxXPx21UkTAS91KmuTndRQ02mnjML1rw2QE2vs"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-frame-options
SAMEORIGIN
cf.errors.css
aktivasi-perubahan-tarif-bni-mobile.ld-biz.com/cdn-cgi/styles/ 		24 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://aktivasi-perubahan-tarif-bni-mobile.ld-biz.com/cdn-cgi/styles/cf.errors.css
Requested by
Host: aktivasi-perubahan-tarif-bni-mobile.ld-biz.com
URL: https://aktivasi-perubahan-tarif-bni-mobile.ld-biz.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::ac43:a999 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1103290e25ebda2712abe344a87facbac00ddaba712729be9fe5feef807bf91b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
en-US,en;q=0.9
Referer
https://aktivasi-perubahan-tarif-bni-mobile.ld-biz.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Wed, 10 Jan 2024 23:42:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Tue, 19 Dec 2023 14:09:38 GMT
server
cloudflare
etag
W/"6581a422-5e44"
x-frame-options
DENY
vary
Accept-Encoding
content-type
text/css
cache-control
max-age=7200, public
cf-ray
8438c683dfbf4bd2-BUF
expires
Thu, 11 Jan 2024 01:42:15 GMT
icon-exclamation.png
aktivasi-perubahan-tarif-bni-mobile.ld-biz.com/cdn-cgi/images/ 		452 B
540 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aktivasi-perubahan-tarif-bni-mobile.ld-biz.com/cdn-cgi/images/icon-exclamation.png?1376755637
Requested by
Host: aktivasi-perubahan-tarif-bni-mobile.ld-biz.com
URL: https://aktivasi-perubahan-tarif-bni-mobile.ld-biz.com/cdn-cgi/styles/cf.errors.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3030::ac43:a999 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
en-US,en;q=0.9
Referer
https://aktivasi-perubahan-tarif-bni-mobile.ld-biz.com/cdn-cgi/styles/cf.errors.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Wed, 10 Jan 2024 23:42:15 GMT
x-content-type-options
nosniff
last-modified
Tue, 19 Dec 2023 14:09:38 GMT
server
cloudflare
etag
"6581a422-1c4"
x-frame-options
DENY
vary
Accept-Encoding
content-type
image/png
cache-control
max-age=7200, public
accept-ranges
bytes
cf-ray
8438c6841fd64bd2-BUF
content-length
452
expires
Thu, 11 Jan 2024 01:42:15 GMT
Primary Request /
keeprewards.life/
Redirect Chain
  • https://aktivasi-perubahan-tarif-bni-mobile.ld-biz.com/cdn-cgi/phish-bypass?atok=FMFFx825NBtgCiJjZ6rXG.2v.qEFQnfqYb8IdraBFMQ-1704930135-0-%2F
  • https://aktivasi-perubahan-tarif-bni-mobile.ld-biz.com/
  • https://ayeshholdings.co.za/
  • https://envatogoods.com/
  • https://keeprewards.life/?u=uezkp05&o=6zlm90u&m=1&t=lo1
21 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://keeprewards.life/?u=uezkp05&o=6zlm90u&m=1&t=lo1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
91.195.240.12 , Germany, ASN47846 (SEDO-AS, DE),
Reverse DNS
Software
NginX / PHP/8.1.17
Resource Hash
400285f6e70641234abeddbf18a18d8e3b9c64dceb4d1254e87c9815d6aeecd6

Request headers

Referer
https://aktivasi-perubahan-tarif-bni-mobile.ld-biz.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-encoding
gzip
content-type
text/html; charset=UTF-8
date
Wed, 10 Jan 2024 23:42:21 GMT
expires
Mon, 26 Jul 1997 05:00:00 GMT
last-modified
Wed, 10 Jan 2024 23:42:21 GMT
pragma
no-cache
server
NginX
vary
Accept-Encoding
x-adblock-key
MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_leth7ZX+h79T/oZDqoaKX+oe8DVAJBumN53kmZ/ITEu8lEy8BMxi0t09EFjljZtW7qN40vOax6mBSeRT8Mpztw==
x-cache-miss-from
parking-7ccdf8cf6-vzqqf
x-powered-by
PHP/8.1.17

Redirect headers

cache-control
max-age=3600
cf-ray
8438c6a4fa4a4bc1-BUF
date
Wed, 10 Jan 2024 23:42:20 GMT
expires
Thu, 11 Jan 2024 00:42:20 GMT
location
https://keeprewards.life/?u=uezkp05&o=6zlm90u&m=1&t=lo1
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=j6KdeKrwgdgVX2iQbufJLg7YIZUswk2rwbUnS4pEtjjXhBkcYh0%2BzU21O1Znf8nP643c6mJ9DD1xeE0w%2BF6obn%2B3LBCKX2HGvNd3HdjhKIdfkZa2q1FMmFTBFnPxc2C3iR2CnJvs6jaNRjn%2Bab0%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
caf.js
www.google.com/adsense/domains/ 		146 KB
54 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/adsense/domains/caf.js
Requested by
Host: keeprewards.life
URL: https://keeprewards.life/?u=uezkp05&o=6zlm90u&m=1&t=lo1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c1b::63 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
345cbff2286a61e81b35339aaeb0349c9a19a69d3a48e1a4b6378712a872f3ab
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-US,en;q=0.9
Referer
https://keeprewards.life/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Wed, 10 Jan 2024 23:42:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-afs-ui"
etag
"4464428276990856763"
vary
Accept-Encoding
report-to
{"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
accept-ranges
bytes
link
<https://www.adsensecustomsearchads.com>; rel="preconnect"
expires
Wed, 10 Jan 2024 23:42:21 GMT
arrows-1-colors-3.png
img.sedoparking.com/templates/bg/ 		80 KB
81 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img.sedoparking.com/templates/bg/arrows-1-colors-3.png
Requested by
Host: keeprewards.life
URL: https://keeprewards.life/?u=uezkp05&o=6zlm90u&m=1&t=lo1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.234.175.175 , United States, ASN30081 (CACHENETWORKS, US),
Reverse DNS
vip1.G-anycast1.cachefly.net
Software
CFS 0215 /
Resource Hash
e7ff091c85669b175de49d629d7d77bd20cd08d2c16ae74deef2ab06aec5854d

Request headers

accept-language
en-US,en;q=0.9
Referer
https://keeprewards.life/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Wed, 10 Jan 2024 23:42:21 GMT
x-cf-tsc
1703298882
x-cf3
H
cf4ttl
31409804.000
x-cf1
11696:fA.yyz1:cf:cacheN.yyz1-01:H
x-cf-reqid
97eec52cf49d492b593c0ab26f02eb95
content-length
82231
x-cf2
H
last-modified
Wed, 22 Apr 2020 09:38:21 GMT
server
CFS 0215
x-cff
B
content-type
image/png
access-control-allow-origin
*
x-cfhash
"b68c0210cadb1e12efc4557d7e49e48e"
cache-control
max-age=604800
cf4age
126195
accept-ranges
bytes
expires
Wed, 17 Jan 2024 23:42:21 GMT
cookie.js
partner.googleadservices.com/gampad/ 		386 B
597 B 		Script
General
Check archive.org
Download Go to
Full URL
https://partner.googleadservices.com/gampad/cookie.js?domain=keeprewards.life&client=dp-sedo80_3ph&product=SAS&callback=__sasCookie
Requested by
Host: www.google.com
URL: https://www.google.com/adsense/domains/caf.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:824::2002 Colchester, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
717c99b660cacb92210f7de691855acb53cf932d7303ad9125e3a0772d4f729c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-US,en;q=0.9
Referer
https://keeprewards.life/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Wed, 10 Jan 2024 23:42:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
text/javascript; charset=UTF-8
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
245
x-xss-protection
0
ads
www.adsensecustomsearchads.com/afs/ Frame 9616 		20 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.adsensecustomsearchads.com/afs/ads?adsafe=low&adtest=off&psid=6267031743&channel=exp-0051%2Cauxa-control-1%2C8810114&client=dp-sedo80_3ph&r=m&hl=en&rpbu=https%3A%2F%2Fkeeprewards.life%2Fcaf%2F%3Fses%3DY3JlPTE3MDQ5MzAxNDEmdGNpZD1rZWVwcmV3YXJkcy5saWZlNjU5ZjJiNWQ2NGVhMDIuMjc3NjYzODcmdGFzaz1zZWFyY2gmZG9tYWluPWtlZXByZXdhcmRzLmxpZmUmYV9pZD0zJnNlc3Npb249dzlNUzNXVXNqN3k3cGtEaDl6Mmo%3D&type=3&uiopt=false&swp=as-drid-2383353299994854&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301383%2C71847096&format=r6&nocache=6311704930142013&num=0&output=afd_ads&domain_name=keeprewards.life&v=3&bsl=8&pac=0&u_his=3&u_tz=-600&dt=1704930142015&u_w=1600&u_h=1200&biw=1600&bih=1200&psw=1600&psh=1031&frm=0&cl=588056317&uio=-&cont=rb-default&drt=0&jsid=caf&jsv=588056317&rurl=https%3A%2F%2Fkeeprewards.life%2F%3Fu%3Duezkp05%26o%3D6zlm90u%26m%3D1%26t%3Dlo1&referer=https%3A%2F%2Faktivasi-perubahan-tarif-bni-mobile.ld-biz.com%2F
Requested by
Host: www.google.com
URL: https://www.google.com/adsense/domains/caf.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c06::65 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
gws /
Resource Hash
5c4b6594a532c3007043e427900eed90f5e55a51cd3d6337345a59c97d1edee1
Security Headers
Name Value
Content-Security-Policy object-src 'none';base-uri 'self';script-src 'nonce-7kIEyzG2mzPJX2a9mSSPWg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
X-Xss-Protection 0

Request headers

Referer
https://keeprewards.life/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=3600
content-disposition
inline
content-encoding
br
content-length
3136
content-security-policy
object-src 'none';base-uri 'self';script-src 'nonce-7kIEyzG2mzPJX2a9mSSPWg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
content-type
text/html; charset=UTF-8
cross-origin-opener-policy
same-origin-allow-popups; report-to="gws"
date
Wed, 10 Jan 2024 23:42:22 GMT
expires
Wed, 10 Jan 2024 23:42:22 GMT
report-to
{"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
server
gws
x-xss-protection
0
tsc.php
keeprewards.life/search/ 		0
60 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://keeprewards.life/search/tsc.php?200=NTY3MTM3NjI5&21=OTYuOS4yNDkuMzY=&681=MTcwNDkzMDE0MTgwMmEyNTdiNDcxNGE3ZWU0MmIxZjY0N2E0NTZiZjYx&crc=4d64f67a9964933d99d6b5437d7a17d89006f3f9&cv=1
Requested by
Host: keeprewards.life
URL: https://keeprewards.life/?u=uezkp05&o=6zlm90u&m=1&t=lo1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
91.195.240.12 , Germany, ASN47846 (SEDO-AS, DE),
Reverse DNS
Software
NginX / PHP/8.1.17
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-US,en;q=0.9
Referer
https://keeprewards.life/?u=uezkp05&o=6zlm90u&m=1&t=lo1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Wed, 10 Jan 2024 23:42:22 GMT
x-cache-miss-from
parking-7ccdf8cf6-g4bts
server
NginX
x-powered-by
PHP/8.1.17
content-length
0
content-type
text/html; charset=UTF-8
caf.js
www.adsensecustomsearchads.com/adsense/domains/ Frame 9616 		146 KB
54 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.adsensecustomsearchads.com/adsense/domains/caf.js?pac=0
Requested by
Host: www.adsensecustomsearchads.com
URL: https://www.adsensecustomsearchads.com/afs/ads?adsafe=low&adtest=off&psid=6267031743&channel=exp-0051%2Cauxa-control-1%2C8810114&client=dp-sedo80_3ph&r=m&hl=en&rpbu=https%3A%2F%2Fkeeprewards.life%2Fcaf%2F%3Fses%3DY3JlPTE3MDQ5MzAxNDEmdGNpZD1rZWVwcmV3YXJkcy5saWZlNjU5ZjJiNWQ2NGVhMDIuMjc3NjYzODcmdGFzaz1zZWFyY2gmZG9tYWluPWtlZXByZXdhcmRzLmxpZmUmYV9pZD0zJnNlc3Npb249dzlNUzNXVXNqN3k3cGtEaDl6Mmo%3D&type=3&uiopt=false&swp=as-drid-2383353299994854&oe=UTF-8&ie=UTF-8&fexp=21404%2C17301383%2C71847096&format=r6&nocache=6311704930142013&num=0&output=afd_ads&domain_name=keeprewards.life&v=3&bsl=8&pac=0&u_his=3&u_tz=-600&dt=1704930142015&u_w=1600&u_h=1200&biw=1600&bih=1200&psw=1600&psh=1031&frm=0&cl=588056317&uio=-&cont=rb-default&drt=0&jsid=caf&jsv=588056317&rurl=https%3A%2F%2Fkeeprewards.life%2F%3Fu%3Duezkp05%26o%3D6zlm90u%26m%3D1%26t%3Dlo1&referer=https%3A%2F%2Faktivasi-perubahan-tarif-bni-mobile.ld-biz.com%2F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c06::65 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c3ef288058b6e1cb9849199b936c39fa916ac7ed53c53e6cbaa5ee139cb1b8a0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-US,en;q=0.9
Referer
https://www.adsensecustomsearchads.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

date
Wed, 10 Jan 2024 23:42:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-afs-ui"
etag
"272866671589718105"
vary
Accept-Encoding
report-to
{"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
accept-ranges
bytes
link
<https://www.adsensecustomsearchads.com>; rel="preconnect"
expires
Wed, 10 Jan 2024 23:42:22 GMT
search.svg
afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/ Frame 9616 		391 B
797 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/search.svg?c=%231967d2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81e::2001 Colchester, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
920a378947204498c122722933b3a4b67788a2b6fade8bd0d47cf830eeee0563
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-US,en;q=0.9
Referer
https://www.adsensecustomsearchads.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

content-security-policy
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
content-encoding
gzip
x-content-type-options
nosniff
date
Wed, 10 Jan 2024 01:02:05 GMT
age
81618
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
272
x-xss-protection
0
last-modified
Thu, 20 Jul 2023 22:48:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="afs-native-asset-managers"
vary
Accept-Encoding
report-to
{"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-type
image/svg+xml
cache-control
public, max-age=82800
accept-ranges
bytes
expires
Thu, 11 Jan 2024 00:02:05 GMT
chevron.svg
afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/ Frame 9616 		200 B
289 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81e::2001 Colchester, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
809fb4619d2a2f1a85dbda8cc69a7f1659215212d708a098d62150eee57070c1
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-US,en;q=0.9
Referer
https://www.adsensecustomsearchads.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

content-security-policy
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
content-encoding
gzip
x-content-type-options
nosniff
date
Wed, 10 Jan 2024 19:02:48 GMT
age
16775
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
174
x-xss-protection
0
last-modified
Thu, 02 Nov 2023 22:48:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="afs-native-asset-managers"
vary
Accept-Encoding
report-to
{"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-type
image/svg+xml
cache-control
public, max-age=82800
accept-ranges
bytes
expires
Thu, 11 Jan 2024 18:02:48 GMT
gen_204
www.adsensecustomsearchads.com/afs/ 		0
19 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.adsensecustomsearchads.com/afs/gen_204?client=dp-sedo80_3ph&output=uds_ads_only&zx=bsemxzen88do&aqid=XiufZaXaK5uUnboPvryXyAo&psid=6267031743&pbt=bs&adbx=584&adby=212.828125&adbh=983&adbw=432&adbah=153%2C153%2C153%2C153%2C201%2C153&adbn=master-1&eawp=partner-dp-sedo80_3ph&errv=588056317&csala=12%7C0%7C869%7C109%7C27&lle=0&ifv=1&hpt=0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c06::65 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
gws /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy object-src 'none';base-uri 'self';script-src 'nonce-jHYrqcWQpc3QcidC1KDUOA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-US,en;q=0.9
Referer
https://keeprewards.life/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

content-security-policy
object-src 'none';base-uri 'self';script-src 'nonce-jHYrqcWQpc3QcidC1KDUOA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
date
Wed, 10 Jan 2024 23:42:24 GMT
server
gws
cross-origin-opener-policy
same-origin-allow-popups; report-to="gws"
x-frame-options
SAMEORIGIN
report-to
{"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
content-type
text/html; charset=UTF-8
permissions-policy
unload=()
origin-trial
Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0=, AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0=
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
gen_204
www.adsensecustomsearchads.com/afs/ 		0
19 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.adsensecustomsearchads.com/afs/gen_204?client=dp-sedo80_3ph&output=uds_ads_only&zx=qo1z3dgpdy65&aqid=XiufZaXaK5uUnboPvryXyAo&psid=6267031743&pbt=bv&adbx=584&adby=212.828125&adbh=983&adbw=432&adbah=153%2C153%2C153%2C153%2C201%2C153&adbn=master-1&eawp=partner-dp-sedo80_3ph&errv=588056317&csala=12%7C0%7C869%7C109%7C27&lle=0&ifv=1&hpt=0
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4004:c06::65 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
gws /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy object-src 'none';base-uri 'self';script-src 'nonce-Uf8e4MV41heNGktG_ncmhg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-US,en;q=0.9
Referer
https://keeprewards.life/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36

Response headers

content-security-policy
object-src 'none';base-uri 'self';script-src 'nonce-Uf8e4MV41heNGktG_ncmhg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
date
Wed, 10 Jan 2024 23:42:25 GMT
server
gws
cross-origin-opener-policy
same-origin-allow-popups; report-to="gws"
x-frame-options
SAMEORIGIN
report-to
{"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
content-type
text/html; charset=UTF-8
permissions-policy
unload=()
origin-trial
Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0=, AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0=
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Cloudflare (Online)

34 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| documentPictureInPicture object| dto number| googleNDT_ number| googleAltLoader object| google object| cafRL object| cafEl string| onclick_param_l string| onclick_value_l string| onclick_value_al string| onclick_param_v string| onclick_value_v string| fb string| fb_token string| pu boolean| ds string| pus number| tlt boolean| dsb object| pdto object| request object| $parkModalButton object| $parkModalCloseButton object| $parkModal object| $parkCookieMessage object| $parkThirdPartyCookieCheckbox object| $parkAcceptAllCookiesButton function| executeTrackingPixel function| getCookieExpirationTime function| saveParkingCookie function| createCaf function| __sasCookie number| experimentId_

2 Cookies

Domain/Path Name / Value
.aktivasi-perubahan-tarif-bni-mobile.ld-biz.com/ Name: __cf_mw_byp
Value: FMFFx825NBtgCiJjZ6rXG.2v.qEFQnfqYb8IdraBFMQ-1704930135-0-/
.keeprewards.life/ Name: __gsas
Value: ID=d4e393b77f550132:T=1704930142:RT=1704930142:S=ALNI_MaiZ8cdq_D5hwdNkfFQxp2w8gjkhw

1 Console Messages

Source Level URL
Text
other warning URL: https://www.google.com/adsense/domains/caf.js(Line 213)
Message:
Unrecognized feature: 'attribution-reporting'.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Frame-Options SAMEORIGIN