| fonts.googleapis.com/css2?family=Roboto:wght@100;300;400;500;700;900&display=swap |  142.250.74.10 | 200 OK | 1.4 kB |
URL GET HTTP/2fonts.googleapis.com/css2?family=Roboto:wght@100;300;400;500;700;900&display=swap IP142.250.74.10:443
Requested byhttps://daughablelea.com/s?0ymKGkau CertificateIssuerGoogle Trust Services Subjectupload.video.google.com Fingerprint30:E5:7E:29:A5:A1:81:DB:C8:A8:49:80:67:40:12:AB:30:C0:34:8D ValidityMon, 02 Dec 2024 08:36:58 GMT - Mon, 24 Feb 2025 08:36:57 GMT
File typegzip compressed data, max compression Hash7623fb9a61d1c7fa76f7acff41dd925a c450a1326fe965b158e66ba9c13351eab73765ed ad8e9da405c259a020b5f0d4bed192f397a958a70827a1b107514e5ba6ff2eb3
GET /css2?family=Roboto:wght@100;300;400;500;700;900&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://daughablelea.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Wed, 08 Jan 2025 10:03:02 GMT
date: Wed, 08 Jan 2025 10:03:02 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| daughablelea.com/favicon.ico | 172.67.177.146 | 404 Not Found | 149 B |
URL GET HTTP/3daughablelea.com/favicon.ico IP172.67.177.146:443
Requested byhttps://daughablelea.com/s?0ymKGkau CertificateIssuerGoogle Trust Services Subjectdaughablelea.com Fingerprint42:87:D9:C4:59:06:62:DB:DB:1E:B1:D2:A1:EC:E4:03:1D:08:12:F1 ValidityThu, 21 Nov 2024 13:31:02 GMT - Wed, 19 Feb 2025 13:31:01 GMT
File typeHTML document, ASCII text, with CRLF line terminators Hash9e37deb55ca9f546027c1659d978f585 42bf4108e9db71b0939fb3894e1fe819c530c6af bd9b8dc5e4936e1d19cb5095a9a6de3cf82859cc2ff7bbbf561a8b5290a7f745
GET /favicon.ico HTTP/1.1
Host: daughablelea.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://daughablelea.com/s?0ymKGkau
Cookie: uid=f0FM3QeNEdMNxBXIjIU7mEtDa6CRaPHq
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 404 Not Found
date: Wed, 08 Jan 2025 10:03:02 GMT
content-type: text/html
cache-control: max-age=14400
cf-cache-status: HIT
age: 116
priority: u=6,i=?0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1EqTwazCsbjpo%2FAJqI7jRP319xirKkRYsP0iaVh0K9oj0MHIB0bPRqAGAgGell4n%2FhvfTAXCnJyErGmgq5tZh5ET4FBmBkMx3I85e3TOGg93oBQ%2BniK6cvwDzPQwSoJ4ARWz"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8feb5afbbfa056ab-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=5144&min_rtt=1652&rtt_var=3114&sent=12&recv=6&lost=0&retrans=0&sent_bytes=4076&recv_bytes=1134&delivery_rate=356520&cwnd=12000&unsent_bytes=0&cid=3f598b5691ab1e80&ts=493&x=1", cfExtPri, cfHdrFlush;dur=0
|
|
| daughablelea.com/s?0ymKGkau | 172.67.177.146 | 200 OK | 141 kB |
URL User Request GET HTTP/2daughablelea.com/s?0ymKGkau IP172.67.177.146:443
CertificateIssuerGoogle Trust Services Subjectdaughablelea.com Fingerprint42:87:D9:C4:59:06:62:DB:DB:1E:B1:D2:A1:EC:E4:03:1D:08:12:F1 ValidityThu, 21 Nov 2024 13:31:02 GMT - Wed, 19 Feb 2025 13:31:01 GMT
File typeHTML document, ASCII text, with very long lines (61256) Size141 kB (140890 bytes) Hash0e4e6edc5e88ef0c964f26cff698914f 02df622305556cbaa0ac1f89710c6e467beadd92 24768c914f67f11482068467b35885d99e75a482cebc55f50c4ca95c1dce6cb4
GET /s?0ymKGkau HTTP/1.1
Host: daughablelea.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Wed, 08 Jan 2025 10:03:01 GMT
content-type: text/html
access-control-allow-headers: Access-Control-Allow-Headers, Origin,Accept, X-Requested-With, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST, GET, OPTIONS, HEAD
access-control-allow-credentials: true
set-cookie: uid=f0FM3QeNEdMNxBXIjIU7mEtDa6CRaPHq; expires=Thu, 08 Jan 2026 10:03:01 GMT; Path=/; Secure
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GUYetp7eji0L45nhXGcmBIxHCxVBzrh3TxRc2nma3%2BBLfupujTysPSbM6iRGLIoyuPCzttPrU7REk9CENqfb8zxUjtXeVafC7l4p2HBhqyTBeqqc%2FhPzplQomB7lKpZcNMcw"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8feb5af70a5956c5-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=6180&min_rtt=608&rtt_var=11094&sent=7&recv=11&lost=0&retrans=0&sent_bytes=3213&recv_bytes=1126&delivery_rate=5430000&cwnd=254&unsent_bytes=0&cid=793e9e549bff8a2e&ts=275&x=0"
X-Firefox-Spdy: h2
|
|
| ntowritingneewebfu.com/popunder.gif |  104.21.96.1 | 200 OK | 58 B |
URL GET ntowritingneewebfu.com/popunder.gif IP104.21.96.1:0
Requested byhttps://daughablelea.com/s?0ymKGkau CertificateIssuerGoogle Trust Services Subjectntowritingneewebfu.com Fingerprint1B:12:12:F3:AD:33:6E:F0:D9:EC:76:A5:3C:58:2E:C2:AD:40:FF:E9 ValidityMon, 06 Jan 2025 12:17:18 GMT - Sun, 06 Apr 2025 13:14:22 GMT
File typeGIF image data, version 89a, 1 x 1 Hash28d6814f309ea289f847c69cf91194c6 0f4e929dd5bb2564f7ab9c76338e04e292a42ace 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
GET /popunder.gif HTTP/1.1
Host: ntowritingneewebfu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://daughablelea.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Wed, 08 Jan 2025 10:03:03 GMT
content-type: image/gif
content-length: 58
access-control-allow-origin: *
pragma: public
cache-control: public, max-age=604800, immutable
content-encoding: gzip
cf-cache-status: HIT
age: 65137
last-modified: Tue, 07 Jan 2025 15:57:26 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XjnsfjjQQZSRYm382bQX4tC0AKfbCKP2vCvfFopIc5DEADxAHWJ448Kbzd3whvf7QMdz7FbR18xPWhM1OJeJzFufgUQaExWXaNrQwv%2FwwToUptKcgcXqtHOlq3T5pWjpdkWnmMPf3NA0"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8feb5b00ec51b523-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=5993&min_rtt=500&rtt_var=10941&sent=7&recv=12&lost=0&retrans=0&sent_bytes=3232&recv_bytes=1271&delivery_rate=5838709&cwnd=254&unsent_bytes=0&cid=275b8ecfcee1bbcc&ts=413&x=0"
X-Firefox-Spdy: h2
|
|
| fingerprinting36542.s3.us-east-1.amazonaws.com/loadFingerPrint.js | 52.216.250.112 | 200 OK | 653 B |
URL GET HTTP/1.1fingerprinting36542.s3.us-east-1.amazonaws.com/loadFingerPrint.js IP52.216.250.112:443
Requested byhttps://daughablelea.com/s?0ymKGkau CertificateIssuerAmazon Subjects3.amazonaws.com FingerprintE8:B4:46:AB:CF:F8:1A:F9:65:3F:DD:AD:F3:14:03:B8:A9:44:A2:1F ValidityMon, 18 Nov 2024 00:00:00 GMT - Fri, 07 Nov 2025 23:59:59 GMT
Hash6c2ea9c45e0053e2d4fe3eaeada5d896 e5ec1f9cf5dceded1d58900137c9ecdea4fca4d6 6b3e0f4edb818818625ffb8ede90fea90a9778c7516bec1d197fed877d5d37e2
GET /loadFingerPrint.js HTTP/1.1
Host: fingerprinting36542.s3.us-east-1.amazonaws.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://daughablelea.com
DNT: 1
Connection: keep-alive
Referer: https://daughablelea.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
x-amz-id-2: zc76Rmcnm8NcilZUqTMmRE4PS81vMnshF06PL+PzHGdW/A/PFax5WF5ChxeHur0SxlIEC0hUE5w=
x-amz-request-id: VBRAAZAWFMNGEPAJ
Date: Wed, 08 Jan 2025 10:03:04 GMT
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, PUT, POST, DELETE
Vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
Last-Modified: Mon, 09 Dec 2024 12:05:18 GMT
ETag: "6c2ea9c45e0053e2d4fe3eaeada5d896"
x-amz-server-side-encryption: AES256
Accept-Ranges: bytes
Content-Type: application/javascript
Content-Length: 653
Server: AmazonS3
|
|
| fingerprinting36542.s3.us-east-1.amazonaws.com/fingerprint.js | 52.216.250.112 | 200 OK | 38 kB |
URL GET HTTP/1.1fingerprinting36542.s3.us-east-1.amazonaws.com/fingerprint.js IP52.216.250.112:443
Requested byhttps://daughablelea.com/s?0ymKGkau CertificateIssuerAmazon Subjects3.amazonaws.com FingerprintE8:B4:46:AB:CF:F8:1A:F9:65:3F:DD:AD:F3:14:03:B8:A9:44:A2:1F ValidityMon, 18 Nov 2024 00:00:00 GMT - Fri, 07 Nov 2025 23:59:59 GMT
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (38136), with no line terminators Hash9ac06ba71cc5803c7515b3e8c3a2854d 03ba918aad85dda720c6f46267eb4fba9103aac3 6cf24eed847d975853348f50d95b192ac37a4c49e96d8888af6dd2e15631a1fd
GET /fingerprint.js HTTP/1.1
Host: fingerprinting36542.s3.us-east-1.amazonaws.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://daughablelea.com
DNT: 1
Connection: keep-alive
Referer: https://fingerprinting36542.s3.us-east-1.amazonaws.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
x-amz-id-2: +LpFkBpvejcq+JtUk4j4NuvW70K3pdlNbrSMlukudV5cXE3TJ+j3xglG3wd3Jon6uiW5SdLluo8=
x-amz-request-id: VBR0BYB4H77KPHV0
Date: Wed, 08 Jan 2025 10:03:04 GMT
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, PUT, POST, DELETE
Vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
Last-Modified: Mon, 09 Dec 2024 12:08:59 GMT
ETag: "9ac06ba71cc5803c7515b3e8c3a2854d"
x-amz-server-side-encryption: AES256
Accept-Ranges: bytes
Content-Type: application/javascript
Content-Length: 38143
Server: AmazonS3
|
|
| yfueuktureu.com/tc | 172.67.132.181 | 200 OK | 0 B |
IP172.67.132.181:443
Requested byhttps://daughablelea.com/s?0ymKGkau CertificateIssuerGoogle Trust Services Subjectyfueuktureu.com Fingerprint83:69:22:BD:D6:7B:2C:F9:25:08:DE:B9:10:B2:3E:B5:0F:DC:BD:63 ValidityWed, 27 Nov 2024 10:36:16 GMT - Tue, 25 Feb 2025 10:36:15 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
OPTIONS /tc HTTP/1.1
Host: yfueuktureu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Referer: https://daughablelea.com/
Origin: https://daughablelea.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Wed, 08 Jan 2025 10:03:04 GMT
content-type: application/json
content-length: 0
set-cookie: ci=1102900701745397; Max-Age=86400; Secure; SameSite=None
access-control-allow-origin: https://daughablelea.com
access-control-allow-headers: Access-Control-Allow-Headers, Origin,Accept, X-Requested-With, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST, GET, OPTIONS, HEAD
access-control-allow-credentials: true
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yemUtmMWJQukLPO6ypgvUumo%2B58IRKTojGnd%2BJEjnTpdXxgKO6tThsMtHGES5qFxa1rGoFUvnLsDJ37lwWepSBtt1lt6WZuPcXBZ9yCeKDn725RddxYkWZmiD6p08GkSIdE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8feb5b0668c2b4f1-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=513&min_rtt=427&rtt_var=137&sent=7&recv=10&lost=0&retrans=0&sent_bytes=3207&recv_bytes=1143&delivery_rate=6016620&cwnd=254&unsent_bytes=0&cid=9a91ab6ba6a2f5ad&ts=283&x=0"
X-Firefox-Spdy: h2
|
|
| fonts.gstatic.com/s/poppins/v22/pxiEyp8kv8JHgFVrJJfecg.woff2 | 142.250.74.35 | 200 OK | 7.9 kB |
URL GET HTTP/2fonts.gstatic.com/s/poppins/v22/pxiEyp8kv8JHgFVrJJfecg.woff2 IP142.250.74.35:443
Requested byhttps://daughablelea.com/s?0ymKGkau CertificateIssuerGoogle Trust Services Subject*.gstatic.com Fingerprint40:A7:D7:D3:7D:FA:BE:34:C0:7E:6F:F7:9F:55:52:22:92:07:C7:EF ValidityMon, 02 Dec 2024 08:36:58 GMT - Mon, 24 Feb 2025 08:36:57 GMT
File typeWeb Open Font Format (Version 2), TrueType, length 7884, version 1.0 Hash9212f6f9860f9fc6c69b02fedf6db8c3 ac6d71b4d5fdd2b3dabc9a06ff6c001e4251da0b 7d93459d86585bfcdbb7e0376056226adb25821ee54b96236fe2123e9560929f
GET /s/poppins/v22/pxiEyp8kv8JHgFVrJJfecg.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://daughablelea.com
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 7884
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 04 Jan 2025 04:15:23 GMT
expires: Sun, 04 Jan 2026 04:15:23 GMT
cache-control: public, max-age=31536000
age: 366462
last-modified: Wed, 04 Dec 2024 06:53:08 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| yfueuktureu.com/tc | 172.67.132.181 | 200 OK | 8.2 kB |
IP172.67.132.181:443
Requested byhttps://daughablelea.com/s?0ymKGkau CertificateIssuerGoogle Trust Services Subjectyfueuktureu.com Fingerprint83:69:22:BD:D6:7B:2C:F9:25:08:DE:B9:10:B2:3E:B5:0F:DC:BD:63 ValidityWed, 27 Nov 2024 10:36:16 GMT - Tue, 25 Feb 2025 10:36:15 GMT
Hashd8c0a40829b0153323d59df55d0a0bbe ff30241b13f425d8ad4fabf393bc2ba0403b2a64 fedb4dc3ff3ca44791ed2b2771f45d01d1d0912c44b246f5ace7abfa8ae416ff
POST /tc HTTP/1.1
Host: yfueuktureu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://daughablelea.com/
Content-Type: application/json
Content-Length: 234
Origin: https://daughablelea.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Wed, 08 Jan 2025 10:03:05 GMT
content-type: application/json
set-cookie: ci=1374674412773122; Max-Age=86400; Secure; SameSite=None
access-control-allow-origin: https://daughablelea.com
access-control-allow-headers: Access-Control-Allow-Headers, Origin,Accept, X-Requested-With, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST, GET, OPTIONS, HEAD
access-control-allow-credentials: true
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SdEAQBn%2B9yNtWkXDN1Af%2BVUsfL9HqPwKPLySnkcCWsEwRNNmF8tvjOYIefW66vCKElmMx31twf7sMMi8ZrqkevNXPtaY4VbCipGi0goA7h6mNbnOPJp89znYXHj2OZ3gYjg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8feb5b081b25569a-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=547&min_rtt=427&rtt_var=298&sent=9&recv=11&lost=0&retrans=0&sent_bytes=3208&recv_bytes=1358&delivery_rate=6250359&cwnd=254&unsent_bytes=0&cid=599dfc0e3ac57c60&ts=1036&x=0"
X-Firefox-Spdy: h2
|
|
| ntowritingneewebfu.com/YUhxaWpOdxIaVzMMEl0OCyRBKw0RDjVaLyUMQQonBQk0JjggI1cdAwV1QFhYWXtIXUwRIRVUWVRuAh0LFT0CVFtHIR8PBVxuB1RaT35fXkRQbgRUW0c8AQgNXHlXGR4VJExYXVJ+QlpaVHBDXlxY | 104.21.96.1 | 204 No Content | 0 B |
URL GET HTTP/2ntowritingneewebfu.com/YUhxaWpOdxIaVzMMEl0OCyRBKw0RDjVaLyUMQQonBQk0JjggI1cdAwV1QFhYWXtIXUwRIRVUWVRuAh0LFT0CVFtHIR8PBVxuB1RaT35fXkRQbgRUW0c8AQgNXHlXGR4VJExYXVJ+QlpaVHBDXlxY IP104.21.96.1:443
Requested byhttps://daughablelea.com/s?0ymKGkau CertificateIssuerGoogle Trust Services Subjectntowritingneewebfu.com Fingerprint1B:12:12:F3:AD:33:6E:F0:D9:EC:76:A5:3C:58:2E:C2:AD:40:FF:E9 ValidityMon, 06 Jan 2025 12:17:18 GMT - Sun, 06 Apr 2025 13:14:22 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /YUhxaWpOdxIaVzMMEl0OCyRBKw0RDjVaLyUMQQonBQk0JjggI1cdAwV1QFhYWXtIXUwRIRVUWVRuAh0LFT0CVFtHIR8PBVxuB1RaT35fXkRQbgRUW0c8AQgNXHlXGR4VJExYXVJ+QlpaVHBDXlxY HTTP/1.1
Host: ntowritingneewebfu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://daughablelea.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 204 No Content
date: Wed, 08 Jan 2025 10:03:23 GMT
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1C1SqTDUy4nkThYMPN4KAifw%2FA%2F%2F3Lr7gCRoQc7EVhcY7lq3dqk5v5VkKOBj%2Bw0wmd5p1KRdoKGsjqP3gokyURp6EmV7IU11kEx5uV8TUGylOGvAKRUG1eJ1pU4v3t4axowEP%2FobU4Q%2B"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8feb5afe792fb523-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=4243&min_rtt=500&rtt_var=7246&sent=10&recv=15&lost=0&retrans=0&sent_bytes=4029&recv_bytes=1271&delivery_rate=5846567&cwnd=257&unsent_bytes=0&cid=275b8ecfcee1bbcc&ts=20678&x=0"
X-Firefox-Spdy: h2
|
|
| ukankingwithea.com/ | 104.21.96.1 | 200 OK | 27 B |
IP104.21.96.1:443
Requested byhttps://daughablelea.com/s?0ymKGkau CertificateIssuerGoogle Trust Services Subjectukankingwithea.com FingerprintE8:14:F0:35:7D:16:C6:75:8B:49:F3:D0:CD:D7:52:BF:0E:4A:BA:B8 ValidityWed, 01 Jan 2025 13:14:55 GMT - Tue, 01 Apr 2025 14:13:37 GMT
File typeASCII text, with no line terminators Hash83df04540bb6bce8bb30c2ddbd057274 e9e4028d458e1ccfb74390e4ba9476326cfa4768 ad7e8b93f297e443479373ee65391906089375b274fd38b0fdf8bb2cbed524e4
GET / HTTP/1.1
Host: ukankingwithea.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://daughablelea.com/
Origin: https://daughablelea.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Wed, 08 Jan 2025 10:03:03 GMT
content-type: text/plain
set-cookie: csu=2196739199019826@1@1736330582; Max-Age=31104000; Secure; SameSite=None
access-control-allow-origin: https://daughablelea.com
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-headers: X-Requested-With, content-type
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ISwW%2FsCQ5u4eqgy%2F%2BJUAIgw%2Bd9HZN0j8DQ0RJDUpVyJ9RbI7xMO8Jos60%2FTJPx%2F8H0WR48vFBwMDhq2%2Bhwn8lKXbP%2Bfb1h6EcGR12lJOx12%2FDshhpdgOqRDwXTmOMOUMyTLMQZQ%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8feb5aff596c5699-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=1299&min_rtt=492&rtt_var=404&sent=84&recv=23&lost=0&retrans=0&sent_bytes=107714&recv_bytes=1282&delivery_rate=14979310&cwnd=254&unsent_bytes=0&cid=9d4ac34037bc7c2a&ts=168&x=0"
X-Firefox-Spdy: h2
|
|
| d1ou8n65t6oyh4.cloudfront.net/?tid=1128394 | 108.157.232.176 | 200 OK | 267 kB |
URL GET HTTP/2d1ou8n65t6oyh4.cloudfront.net/?tid=1128394 IP108.157.232.176:443
Requested byhttps://daughablelea.com/s?0ymKGkau CertificateIssuerAmazon Subject*.cloudfront.net Fingerprint28:D3:87:79:3C:E8:8B:3C:D9:10:45:E5:F7:64:7A:6D:44:4E:5A:62 ValidityTue, 30 Jul 2024 00:00:00 GMT - Thu, 03 Jul 2025 23:59:59 GMT
File typeJavaScript source, ASCII text, with very long lines (1741) Size267 kB (266924 bytes) Hash543a86f643f7b8ead81752469dee8175 3f15a7541a04dc2bb6348abb0c166198e26920bf ee880a6155472142d4433614083a5461a819431450f565c719ce6c738a5bfa01
GET /?tid=1128394 HTTP/1.1
Host: d1ou8n65t6oyh4.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://daughablelea.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-length: 72120
date: Wed, 08 Jan 2025 10:03:02 GMT
access-control-allow-origin: *
cache-control: no-store, no-cache, proxy-revalidate, must-revalidate, private, no-transform
content-encoding: gzip
pragma: no-cache
x-cache: Miss from cloudfront
via: 1.1 d009c4305a73ef1e26138117423d6076.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN56-P2
x-amz-cf-id: MrhYhckQdRK8xwLbVrIfkUVwWjNjkWmlpNt5vIVzoNUZuIzvGWiCSQ==
X-Firefox-Spdy: h2
|
|
| fonts.googleapis.com/css?family=Poppins:wght@300;400;500;600;700&display=swap | 142.250.74.10 | 200 OK | 838 B |
URL GET HTTP/3fonts.googleapis.com/css?family=Poppins:wght@300;400;500;600;700&display=swap IP142.250.74.10:443
Requested byhttps://daughablelea.com/s?0ymKGkau CertificateIssuerGoogle Trust Services Subjectupload.video.google.com Fingerprint30:E5:7E:29:A5:A1:81:DB:C8:A8:49:80:67:40:12:AB:30:C0:34:8D ValidityMon, 02 Dec 2024 08:36:58 GMT - Mon, 24 Feb 2025 08:36:57 GMT
File typeASCII text, with very long lines (856), with no line terminators Hash5156943b0db8129e5eab09b1c17ae5be 218739de99cdbb2473ec48ea85ab0a5a5366236e 77db9e438748081cb84e88d7caf4978e460a7f92e82c4839e86b3bbfa1eccd2b
GET /css?family=Poppins:wght@300;400;500;600;700&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://daughablelea.com/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Wed, 08 Jan 2025 10:03:03 GMT
date: Wed, 08 Jan 2025 10:03:03 GMT
cache-control: private, max-age=86400
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| dfdgfruitie.xyz/adserver/yzfdmoan.js | 172.67.132.206 | 200 OK | 0 B |
URL GET HTTP/2dfdgfruitie.xyz/adserver/yzfdmoan.js IP172.67.132.206:443
Requested byhttps://daughablelea.com/s?0ymKGkau CertificateIssuerGoogle Trust Services Subjectdfdgfruitie.xyz Fingerprint59:9A:52:D1:BE:14:69:D3:AF:93:CC:88:52:E4:38:E6:08:E9:1A:D1 ValidityWed, 20 Nov 2024 21:43:53 GMT - Tue, 18 Feb 2025 21:43:52 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /adserver/yzfdmoan.js HTTP/1.1
Host: dfdgfruitie.xyz
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://daughablelea.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Wed, 08 Jan 2025 10:03:02 GMT
content-type: application/x-javascript
content-length: 0
last-modified: Fri, 03 Feb 2023 19:26:28 GMT
etag: "63dd5fe4-0"
cache-control: max-age=14400
cf-cache-status: HIT
age: 3522
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=waCsw51xNKlTT30YVE%2F9jpQDYR2iapoUnJxWLMiEJ%2B9SvIaLfcKOaBJAsTUGYhdDWVWF38tP85mWH%2FCoV5rv1n06XejRRTO2qCuj5MJRSDHse3AZRhgrRsVFonmt9W01PrY%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8feb5afc2fb80b06-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=663&min_rtt=605&rtt_var=136&sent=7&recv=10&lost=0&retrans=0&sent_bytes=3211&recv_bytes=1067&delivery_rate=6084033&cwnd=253&unsent_bytes=0&cid=2457f185ba69a369&ts=29&x=0"
X-Firefox-Spdy: h2
|
|
| undefined/aURVd1MIJjYabAh5N1EmGyhoUmEvYWcxN1grIE89X3EhQTwQLGFZMAUrIBM1Gys7A30HISFSYS8zAiIZBREAFGUlFSZENip0JzYEEXY0PxENHTtCJzMGAB0aA31wRRUoEBQOAwArEDoqGnwZEBIeJQEYJyoMNgMYAHQZPgsGNDAfFi4BEUM+PwMcOjUTHTM5Cxk0DzY4Hg8BQnZbAgQNAhkLO04GDT0MThovLDkuAFk9Fh0jXwgWABEnBxAAHygFZC4AHi4CMyQGDSwEGTkXD08wKgo+FgQFKgNFFR8NDTkGDQwEFQlYID08KSg3EDQ/ACVmPjcIHBAwNy9pE0c3KzA7IWEsdRlFNz4BHUIlCwIDQwoEMCw2OTgvGB5iKB0iMSEKKAcfN1ssLCEbO3U0JAIkDSw+dlsCGSViWSAHTmQ8d2xENRMgDC4STy4mGD0ZeSVPJz4TMhNiWg8 | 0.0.0.0 | | 0 B |
URL GET undefined/aURVd1MIJjYabAh5N1EmGyhoUmEvYWcxN1grIE89X3EhQTwQLGFZMAUrIBM1Gys7A30HISFSYS8zAiIZBREAFGUlFSZENip0JzYEEXY0PxENHTtCJzMGAB0aA31wRRUoEBQOAwArEDoqGnwZEBIeJQEYJyoMNgMYAHQZPgsGNDAfFi4BEUM+PwMcOjUTHTM5Cxk0DzY4Hg8BQnZbAgQNAhkLO04GDT0MThovLDkuAFk9Fh0jXwgWABEnBxAAHygFZC4AHi4CMyQGDSwEGTkXD08wKgo+FgQFKgNFFR8NDTkGDQwEFQlYID08KSg3EDQ/ACVmPjcIHBAwNy9pE0c3KzA7IWEsdRlFNz4BHUIlCwIDQwoEMCw2OTgvGB5iKB0iMSEKKAcfN1ssLCEbO3U0JAIkDSw+dlsCGSViWSAHTmQ8d2xENRMgDC4STy4mGD0ZeSVPJz4TMhNiWg8 IP0.0.0.0:0
Requested byhttps://daughablelea.com/s?0ymKGkau
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| Quad9 DNS | malicious | Sinkholed |
GET /aURVd1MIJjYabAh5N1EmGyhoUmEvYWcxN1grIE89X3EhQTwQLGFZMAUrIBM1Gys7A30HISFSYS8zAiIZBREAFGUlFSZENip0JzYEEXY0PxENHTtCJzMGAB0aA31wRRUoEBQOAwArEDoqGnwZEBIeJQEYJyoMNgMYAHQZPgsGNDAfFi4BEUM+PwMcOjUTHTM5Cxk0DzY4Hg8BQnZbAgQNAhkLO04GDT0MThovLDkuAFk9Fh0jXwgWABEnBxAAHygFZC4AHi4CMyQGDSwEGTkXD08wKgo+FgQFKgNFFR8NDTkGDQwEFQlYID08KSg3EDQ/ACVmPjcIHBAwNy9pE0c3KzA7IWEsdRlFNz4BHUIlCwIDQwoEMCw2OTgvGB5iKB0iMSEKKAcfN1ssLCEbO3U0JAIkDSw+dlsCGSViWSAHTmQ8d2xENRMgDC4STy4mGD0ZeSVPJz4TMhNiWg8 HTTP/1.1
Host: undefined
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://daughablelea.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
|
|
| ukankingwithea.com/asd100.bin | 104.21.96.1 | 200 OK | 102 kB |
URL GET HTTP/2ukankingwithea.com/asd100.bin IP104.21.96.1:443
Requested byhttps://daughablelea.com/s?0ymKGkau CertificateIssuerGoogle Trust Services Subjectukankingwithea.com FingerprintE8:14:F0:35:7D:16:C6:75:8B:49:F3:D0:CD:D7:52:BF:0E:4A:BA:B8 ValidityWed, 01 Jan 2025 13:14:55 GMT - Tue, 01 Apr 2025 14:13:37 GMT
Size102 kB (102400 bytes) Hash4c6426ac7ef186464ecbb0d81cbfcb1e 5a6918eebd9d635e8f632e3ef34e3792b1b5ec13 f627ca4c2c322f15db26152df306bd4f983f0146409b81a4341b9b340c365a16
GET /asd100.bin HTTP/1.1
Host: ukankingwithea.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://daughablelea.com/
Origin: https://daughablelea.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Wed, 08 Jan 2025 10:03:02 GMT
content-type: binary/octet-stream
access-control-allow-origin: https://daughablelea.com
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-headers: X-Requested-With, content-type
cache-control: max-age=14400
cf-cache-status: HIT
age: 5698
last-modified: Wed, 08 Jan 2025 08:28:04 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DzjJ9V4RWmvxjX86wBUtKlQaWrV2KPJS8XR6rEWsNtEWsUXGcTyaGym0649SmoJ3UxNYC22MHvI4snvYfiQTuO2Aomr23DFqc7HMlcTQa7XxguIdkQI2TwGXgvkrExJxKtnE4pg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8feb5aff49655699-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=911&min_rtt=492&rtt_var=855&sent=8&recv=12&lost=0&retrans=0&sent_bytes=3294&recv_bytes=1282&delivery_rate=7086460&cwnd=254&unsent_bytes=0&cid=9d4ac34037bc7c2a&ts=73&x=0"
X-Firefox-Spdy: h2
|
|