leaking.skin Open in urlscan Pro
2606:4700:3037::ac43:d05a Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://leaking.skin/
Effective URL:
https://leaking.skin/
Submission: On November 22 via api (November 22nd 2022, 10:15:45 pm UTC) from US — Scanned from US

Summary HTTP 24 Redirects Behaviour Indicators

Summary

This website contacted 8 IPs in 2 countries across 5 domains to perform 24 HTTP transactions. The main IP is 2606:4700:3037::ac43:d05a, located in United States and belongs to CLOUDFLARENET, US. The main domain is leaking.skin.
TLS certificate: Issued by E1 on November 20th 2022. Valid for: 3 months.

This is the only time leaking.skin was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic Scam (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 11	2606:4700:303... 2606:4700:3037::ac43:d05a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2607:f8b0:400... 2607:f8b0:4004:c1b::5f	15169 (GOOGLE) (GOOGLE)
1	2600:9000:208... 2600:9000:208f:3c00:7:68d6:a080:21	16509 (AMAZON-02) (AMAZON-02)
1	2607:f8b0:400... 2607:f8b0:4004:80a::200a	15169 (GOOGLE) (GOOGLE)
2	104.20.228.67 104.20.228.67	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2600:9000:219... 2600:9000:2199:b800:1b:9327:5500:21	16509 (AMAZON-02) (AMAZON-02)
2	2607:f8b0:400... 2607:f8b0:4004:832::2003	15169 (GOOGLE) (GOOGLE)
24	8

11 2606:4700:3037::ac43:d05a (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

leaking.skin	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4004:c1b::5f (Washington, United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:208f:3c00:7:68d6:a080:21 (United States)

ASN16509 (AMAZON-02, US)

d1j9qsxe04m2ki.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:80a::200a (Washington, United States)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.20.228.67 (Shahr, Iran, Islamic Republic Of)

ASN13335 (CLOUDFLARENET, US)

www.statcounter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.statcounter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2600:9000:2199:b800:1b:9327:5500:21 (United States)

ASN16509 (AMAZON-02, US)

dwmsurhf1svv8.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4004:832::2003 (Washington, United States)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	leaking.skin 1 redirects leaking.skin	299 KB
6	cloudfront.net d1j9qsxe04m2ki.cloudfront.net dwmsurhf1svv8.cloudfront.net	26 KB
3	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 43 ajax.googleapis.com — Cisco Umbrella Rank: 304	32 KB
2	gstatic.com fonts.gstatic.com Failed	30 KB
2	statcounter.com www.statcounter.com — Cisco Umbrella Rank: 12014 c.statcounter.com — Cisco Umbrella Rank: 8220	15 KB
24	5

	Domain	Requested by
11	leaking.skin	1 redirects leaking.skin
5	dwmsurhf1svv8.cloudfront.net	d1j9qsxe04m2ki.cloudfront.net
2	fonts.gstatic.com	leaking.skin fonts.googleapis.com
2	fonts.googleapis.com	leaking.skin
1	c.statcounter.com	www.statcounter.com
1	www.statcounter.com	leaking.skin
1	ajax.googleapis.com	leaking.skin
1	d1j9qsxe04m2ki.cloudfront.net	leaking.skin
24	8

This site contains no links.

Subject Issuer	Validity	Valid
*.leaking.skin E1	`2022-11-20` - `2023-02-18`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh
*.cloudfront.net Amazon	`2022-02-01` - `2023-01-31`	a year	crt.sh
us-dallas.statcounter.com Sectigo RSA Domain Validation Secure Server CA	`2021-11-06` - `2022-12-06`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2022-11-02` - `2023-01-25`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://leaking.skin/
Frame ID: 5F8D8B72450ECB652A94C8ED4B6E65A1
Requests: 24 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

ROBUX GENERATOR

Page URL History Show full URLs

http://leaking.skin/ HTTP 301
https://leaking.skin/ Page URL

Detected technologies

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Statcounter (Analytics) Expand

Overall confidence: 100%
Detected patterns

statcounter\.com/counter/counter

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

24
Requests

96 %
HTTPS

86 %
IPv6

5
Domains

8
Subdomains

8
IPs

2
Countries

400 kB
Transfer

529 kB
Size

4
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://leaking.skin/ HTTP 301
https://leaking.skin/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

24 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
leaking.skin/
Redirect Chain

http://leaking.skin/
https://leaking.skin/

48 KB
12 KB

244ms
164ms

Document
text/html

2606:4700:3037::ac43:d05a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://leaking.skin/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3037::ac43:d05a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

650cd495d2c91a6acbd5be16ba1b6bd90e224eeaea91ab2b8e248cbc385a65c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 13031
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: public, max-age=0, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 76e50662ada2d9b9-MIA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 22 Nov 2022 22:15:38 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=F9MpYjDYRSBwF%2F2smPEH4evb3ILsOTtDSvIqRg%2FhutNPQSdbikzMJkdiRRDG%2Bk5s47wSDeszWNp6h0gv9oyKUL1vhZkQ3%2B9MbJCErP7nAMzg%2BBVuhBBt%2Bz7a1019MBrDyfT0MsSDenVlCN4%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-nf-request-id: 01GJGPJEGPKDF20WMP54ZAD0N2

Redirect headers

CF-RAY: 76e50661ddf99ae6-MIA
Cache-Control: max-age=3600
Connection: keep-alive
Date: Tue, 22 Nov 2022 22:15:38 GMT
Expires: Tue, 22 Nov 2022 23:15:38 GMT
Location: https://leaking.skin/
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1foDPjKMgBbyFHqikatnrdokePmTePpexWTG%2F4oVriCB9jMOmwpoYoe3Oq%2BxacrhF1umVoh70EX%2FWHUm47Mym9jouAhzmPjdz0G7l%2F4k1csbityQem%2BiyydALM7yEQox6ZcuopRjJ1StXS0%3D"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 css
fonts.googleapis.com/ 2 KB
1 KB 225ms
71ms Stylesheet
text/css 2607:f8b0:4004:c1b::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto

Requested by

Host: leaking.skin
URL: https://leaking.skin/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::5f Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

234b9bab83aa0c52e9e5192995427a2bc44876cf1a11545ed631f369b8dc6534

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://leaking.skin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 22 Nov 2022 22:15:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 22 Nov 2022 20:54:14 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 22 Nov 2022 22:15:39 GMT

GET
H2 200 css
fonts.googleapis.com/ 1 KB
513 B 227ms
73ms Stylesheet
text/css 2607:f8b0:4004:c1b::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Quicksand

Requested by

Host: leaking.skin
URL: https://leaking.skin/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::5f Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f53c990aded05a21d8400b1019eab4bd571c498c97db6c4da445668b9b62e2bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://leaking.skin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 22 Nov 2022 22:15:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 22 Nov 2022 21:07:34 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 22 Nov 2022 22:15:39 GMT

GET
H2 200 fc28201.js Show response
d1j9qsxe04m2ki.cloudfront.net/ 23 KB
7 KB 655ms
248ms Script
application/javascript 2600:9000:208f:3c00:7:68d6:a080:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1j9qsxe04m2ki.cloudfront.net/fc28201.js
Requested by: Host: leaking.skin
URL: https://leaking.skin/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:208f:3c00:7:68d6:a080:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 988df212c000f1c5b3043b9813ed991815089f0dac63ad094351eb372166f9ff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://leaking.skin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 21:48:52 GMT
content-encoding: gzip
via: 1.1 e1cdefd358f463eaddffcac2b749d60e.cloudfront.net (CloudFront)
last-modified: Sun, 30 Oct 2022 13:50:57 GMT
server: AmazonS3
x-amz-cf-pop: IAD79-C3
age: 1621
etag: W/"d0adadb877ad5f27d0c2a369cd5acb5e"
vary: Accept-Encoding
x-cache: Error from cloudfront
content-type: application/javascript
x-amz-cf-id: 79UvvdflzMbBuKWErawAPHm7nzBdYygWy9iUXNTwLrZ79pnmfTwfOA==

GET
H2 200 163833573237a45f5b9914ef60e115c1423ef51e50.png
leaking.skin/uploads/ 122 KB
123 KB 138ms
137ms Image
image/png 2606:4700:3037::ac43:d05a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://leaking.skin/uploads/163833573237a45f5b9914ef60e115c1423ef51e50.png

Requested by

Host: leaking.skin
URL: https://leaking.skin/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3037::ac43:d05a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

907ed23a8d4e655e0af328c3a680153d54fd7fea9f356532af25add1f9eb23d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://leaking.skin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-nf-request-id: 01GJG84YW2TG9VRQX61AHM74K0
date: Tue, 22 Nov 2022 22:15:39 GMT
strict-transport-security: max-age=31536000
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "2d5e861232ad021bf1b3935aadbd798f-ssl"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ERRuuXcZXPHebf414G5m7mwKDOwwHV3EhK5YjGBk%2BQXoD0uI5Xbi47p8GD4Eb2eaxBJU8H6u6xK7AZ3k5QU6rG3nc5W5AHF1F%2FiclBpWc8t7KIJBSNRIZv%2BMhzGBhg9tShrPI23q5AuMe%2Bk%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=14400, must-revalidate
accept-ranges: bytes
cf-ray: 76e506675c72d9b9-MIA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 125412

GET
H3 200 163694393036c59916b39a9f0841f8421163d57499.png
leaking.skin/uploads/ 17 KB
18 KB 115ms
115ms Image
image/png 2606:4700:3037::ac43:d05a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://leaking.skin/uploads/163694393036c59916b39a9f0841f8421163d57499.png

Requested by

Host: leaking.skin
URL: https://leaking.skin/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3037::ac43:d05a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3c9acc8be9f47d9493061e325d0ead8ec7a2f7927eb1dc373a71f67c7509e4d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://leaking.skin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-nf-request-id: 01GJ3PSXBDFPASXJWENM7WGQJB
date: Tue, 22 Nov 2022 22:15:39 GMT
strict-transport-security: max-age=31536000
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "82bfdae5157ece7a94f659cf62e4d1f8-ssl"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EeyYMoBO4YXPY%2FfYx%2B%2BrND%2BBCZfuCEg3oScbo7bOUCa5bvCkACeMETrbXFEOtPD7C3zjVC9kc6clHomm1hOMmHzsx8NWiUTrVcyHS7HlGU6yOGSBKOwm3S3hHgSyfk0JOvBnbmqJR1W6rx8%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=14400, must-revalidate
accept-ranges: bytes
cf-ray: 76e506681a349abd-MIA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 17392

GET
H3 200 1638335749ec319f8a4b3eba098e2f7afa23d723b0.png
leaking.skin/uploads/ 37 KB
38 KB 174ms
173ms Image
image/png 2606:4700:3037::ac43:d05a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://leaking.skin/uploads/1638335749ec319f8a4b3eba098e2f7afa23d723b0.png

Requested by

Host: leaking.skin
URL: https://leaking.skin/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3037::ac43:d05a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d7e79466b17a046578ed609e5d8d384b2b3bc17def0c0b96a2be143af3cff1a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://leaking.skin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-nf-request-id: 01GJ3PSXGS315CVVKA5R30Q577
date: Tue, 22 Nov 2022 22:15:39 GMT
strict-transport-security: max-age=31536000
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "c667456f4e6a86c22fd482d14cd85b26-ssl"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZsqwXc88%2FXJ5%2B%2FB5hq%2BOKpaYqOe5NFP3LpQ%2FO9mdm%2Forf2dxx75D2Xiu%2Fr5KpYi1ocVXyiczYXvw0Iiqy9DmSB3QFIu6AqZMkFn5rs3cHjZYMOxBSj%2BELD%2FCnXZ00NJZu1e3qae3fN4eOfI%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=14400, must-revalidate
accept-ranges: bytes
cf-ray: 76e506682a539abd-MIA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 37919

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/2.2.4/ 84 KB
30 KB 247ms
67ms Script
text/javascript 2607:f8b0:4004:80a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js

Requested by

Host: leaking.skin
URL: https://leaking.skin/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:80a::200a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://leaking.skin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Sun, 20 Nov 2022 15:35:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 196835
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30028
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 20 Nov 2023 15:35:04 GMT

GET
H2 200 counter.js Show response
www.statcounter.com/counter/ 43 KB
14 KB 321ms
57ms Script
application/javascript 104.20.228.67
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.statcounter.com/counter/counter.js
Requested by: Host: leaking.skin
URL: https://leaking.skin/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.228.67 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 38773f599cca495f0904c3d5a9981fc081b743a8d9aa106ed17e0d9b03ae6598

Request headers

accept-language: en-US,en;q=0.9
Referer: https://leaking.skin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 22:15:39 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 22 Nov 2022 10:15:48 GMT
server: cloudflare
age: 38872
etag: W/"637ca154-aa70"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=43200
cf-ray: 76e50669dd6cda6b-MIA
expires: Tue, 22 Nov 2022 23:27:47 GMT

GET
H2 200 html.3108128.d8d8f.0.js Show response
dwmsurhf1svv8.cloudfront.net/public/external/v2/ 10 KB
10 KB 463ms
196ms Script
application/javascript 2600:9000:2199:b800:1b:9327:5500:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dwmsurhf1svv8.cloudfront.net/public/external/v2/html.3108128.d8d8f.0.js
Requested by: Host: d1j9qsxe04m2ki.cloudfront.net
URL: https://d1j9qsxe04m2ki.cloudfront.net/fc28201.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2199:b800:1b:9327:5500:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11 / PHP/7.4.11
Resource Hash: 09c9f2b368dcfefb8c37cfdb985e48369410e9765f403866fbe693b8acdc1d29

Request headers

accept-language: en-US,en;q=0.9
Referer: https://leaking.skin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 22:15:39 GMT
via: 1.1 6c1f5fbbdcc06a5ed4d317a0e3609f72.cloudfront.net (CloudFront)
server: Apache/2.4.46 () OpenSSL/1.0.2k-fips PHP/7.4.11
x-amz-cf-pop: IAD79-C1
x-powered-by: PHP/7.4.11
x-cache: Miss from cloudfront
content-type: application/javascript
x-amz-cf-id: BWX7et5utjZeLgH6byl5niUn8t-6mVj2Z74OmOYgqubG4qZqG2f-cw==

GET
H2 200 css_front.css
dwmsurhf1svv8.cloudfront.net/public/external/ 6 KB
7 KB 461ms
191ms Stylesheet
text/css 2600:9000:2199:b800:1b:9327:5500:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dwmsurhf1svv8.cloudfront.net/public/external/css_front.css
Requested by: Host: d1j9qsxe04m2ki.cloudfront.net
URL: https://d1j9qsxe04m2ki.cloudfront.net/fc28201.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2199:b800:1b:9327:5500:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11 /
Resource Hash: a7bd79b6fba60944ee3a9c153108ff0819d2db57850116ac7065a86db08af4ec

Request headers

accept-language: en-US,en;q=0.9
Referer: https://leaking.skin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 22:15:39 GMT
via: 1.1 6c1f5fbbdcc06a5ed4d317a0e3609f72.cloudfront.net (CloudFront)
last-modified: Tue, 23 Jun 2020 20:06:47 GMT
server: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11
x-amz-cf-pop: IAD79-C1
etag: "19c4-5a8c5e62e9d0a"
x-cache: Miss from cloudfront
content-type: text/css
accept-ranges: bytes
content-length: 6596
x-amz-cf-id: _ly-fAjtoxxiceWAKMk_PTdPCZJ0CCrU9DeWDrD416PJC3VvkD1DhA==

GET Pru33qjShpZSmG3z6VYwnRJtnKITppOI_IvcXXDNrsc.woff2
fonts.gstatic.com/s/roboto/v15/ 0
0

GET
H3 200 16383357225518b992f51c40380a49d967f2b0444e.png
leaking.skin/uploads/ 75 KB
76 KB 185ms
184ms Image
image/png 2606:4700:3037::ac43:d05a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://leaking.skin/uploads/16383357225518b992f51c40380a49d967f2b0444e.png

Requested by

Host: leaking.skin
URL: https://leaking.skin/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3037::ac43:d05a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aafeab425f2babc37d22e02fe7dd64351f5fe47a65b8d920fbffb625f5295805

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://leaking.skin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-nf-request-id: 01GJ3PSXRNZB5ZRGA8G7PAX96A
date: Tue, 22 Nov 2022 22:15:39 GMT
strict-transport-security: max-age=31536000
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "8ed3436fe50595784324853e64b3fb29-ssl"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tgX3lzd7FJPvd5reL6lsuKs3xJpydFnC4yIpWl8ETy5bNQG6q2%2FFAcr7cn5cWShHR4wkLMYZ97DIJ6t8zRB7FuhkKH4N%2F2lwl1NJc6VWalYK2Z4kLaJgT6kLficScPxi%2BS9CctqMEA1QdwY%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=14400, must-revalidate
accept-ranges: bytes
cf-ray: 76e506682a599abd-MIA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 76835

GET
H3 200 16383357267b972c278a2de4736b2142ce016479c1.png
leaking.skin/uploads/ 9 KB
9 KB 131ms
127ms Image
image/png 2606:4700:3037::ac43:d05a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://leaking.skin/uploads/16383357267b972c278a2de4736b2142ce016479c1.png

Requested by

Host: leaking.skin
URL: https://leaking.skin/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3037::ac43:d05a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

08b3d574bd1f5bb2b7bf5dcb910ff347136e8845131837435501fce41ff8e5f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://leaking.skin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-nf-request-id: 01GJ3PSXQER16Y3K6R7WNA61BF
date: Tue, 22 Nov 2022 22:15:39 GMT
strict-transport-security: max-age=31536000
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "87c4243bfa196c2fa8b8e68f07c91f3d-ssl"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FLPwrPQ4FjNKyBVmETCvjC0MRLGxwEW9%2BXmg4c%2Fv%2Bbslv0yuyt6HjPv3RdnOLTfGYH7ljWKROyqTZBXhpPdouUFsrcUnZwVMZoT5BFFUG2nvCyGk8NLfVfW%2FtAYclncQIG7RGEe8f4EXZ94%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=14400, must-revalidate
accept-ranges: bytes
cf-ray: 76e506683aa59abd-MIA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 8953

GET
H3 200 163833575236b5105b5160433f3fab425000ac74f9.png
leaking.skin/uploads/ 8 KB
9 KB 144ms
140ms Image
image/png 2606:4700:3037::ac43:d05a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://leaking.skin/uploads/163833575236b5105b5160433f3fab425000ac74f9.png

Requested by

Host: leaking.skin
URL: https://leaking.skin/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3037::ac43:d05a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ca14458e3240648f3087d744d31c8917a8629879d70a16ba9cd7feb732502fed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://leaking.skin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-nf-request-id: 01GJ3PSXSFYN1NBTBEHT6K97DR
date: Tue, 22 Nov 2022 22:15:39 GMT
strict-transport-security: max-age=31536000
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "2f4ef4be21b5979a50d654d73436b67d-ssl"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HO4bPsWIW700G7UWpPe4ioPpWRmneDtVZARhZzNqpEPMmSoVMbpjgmOSQpyaNr1RD1dZZEWfG1kja6rx3c7rDijwTJVWIQcLY9EMTdE2X8g74nQuPmxlw0%2BtI73EKPyFzd9PrPR7k6UFIBU%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=14400, must-revalidate
accept-ranges: bytes
cf-ray: 76e506683aa79abd-MIA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 8544

GET
H3 200 16383357519da7c82fce4482c7278899c8f702eb24.png
leaking.skin/uploads/ 6 KB
7 KB 129ms
128ms Image
image/png 2606:4700:3037::ac43:d05a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://leaking.skin/uploads/16383357519da7c82fce4482c7278899c8f702eb24.png

Requested by

Host: leaking.skin
URL: https://leaking.skin/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3037::ac43:d05a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

67af93a422346c5bb330786025419e72324b76aae6e384378f7c8e1ec30fa059

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://leaking.skin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-nf-request-id: 01GJ3PSXSQPKWPCJP5FK3DG0JT
date: Tue, 22 Nov 2022 22:15:39 GMT
strict-transport-security: max-age=31536000
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "dd22e460f42e44cd287e02897714fb21-ssl"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rLfkfEce03N%2BXHN1RcBm8uMa7vNmWXR9w%2BTVKG7oqUq%2FbAJfpbQ4%2FBxy9FFRjot1Yt6seSVnQyTIaYKf%2FB8%2Fd3co139uks2NZCvHBUahJjRp0AvUkV2Z8fFnJmIom22uVhPtUK3lwxSTIMI%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=14400, must-revalidate
accept-ranges: bytes
cf-ray: 76e506683aac9abd-MIA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 6458

GET
H2 200 6xK-dSZaM9iE8KbpRA_LJ3z8mH9BOJvgkP8o58a-wg.woff2
fonts.gstatic.com/s/quicksand/v30/ 14 KB
14 KB 332ms
76ms Font
font/woff2 2607:f8b0:4004:832::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/quicksand/v30/6xK-dSZaM9iE8KbpRA_LJ3z8mH9BOJvgkP8o58a-wg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Quicksand

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:832::2003 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e36165510050fc4ef1d87cc430dd4d1d0f6a705c5f4aa7b3a97493921884bb05

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://leaking.skin
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Mon, 21 Nov 2022 21:33:48 GMT
x-content-type-options: nosniff
age: 88911
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13888
x-xss-protection: 0
last-modified: Mon, 18 Jul 2022 19:12:09 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 21 Nov 2023 21:33:48 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 323ms
68ms Font
font/woff2 2607:f8b0:4004:832::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:832::2003 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://leaking.skin
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 13:44:00 GMT
x-content-type-options: nosniff
age: 30699
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 22 Nov 2023 13:44:00 GMT

GET
H3 200 16681375499ff73c43e7645db066d6d1ac71532ae9.png
leaking.skin/uploads/ 6 KB
6 KB 244ms
243ms Image
image/png 2606:4700:3037::ac43:d05a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://leaking.skin/uploads/16681375499ff73c43e7645db066d6d1ac71532ae9.png

Requested by

Host: leaking.skin
URL: https://leaking.skin/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3037::ac43:d05a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

248bbf0c91d2efdadabdfc3203caa8752d5dd1cab9b97bee9905883baa171ca2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://leaking.skin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-nf-request-id: 01GJ3PSXQPBEWWMEZEM9GC3Q8X
date: Tue, 22 Nov 2022 22:15:39 GMT
strict-transport-security: max-age=31536000
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "78e34345c196a50db607e6ebba3eae0e-ssl"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=a%2Be3RwAKUEeRrbxtOZjqQjv3%2BIZ8mgo4H0053pVAQgrjBiQVJ32D%2F1kjGEl9NbP2tf53D6OIwiPF6xhyVfMyq0CpKd1V1If2eSn5ZSbuto1UErzsNEdFLCs8hFbXpRUPvybOlthCigwO6fU%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=14400, must-revalidate
accept-ranges: bytes
cf-ray: 76e506689ba39abd-MIA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 6010

GET
H2 200 t.php Show response
c.statcounter.com/ 192 B
567 B 128ms
93ms XHR
application/json 104.20.228.67
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.statcounter.com/t.php?sc_project=12811462&u1=9BDE876D96874FBC6B485A954BA420DD&java=1&security=bd5af2a1&sc_snum=1&sess=a8f3c4&p=0&rcat=d&rdom=d&rdomg=new&bb=1&jg=new&rr=1.1.1.1.1.1.1.1.1&resolution=1600&h=1200&camefrom=&u=https%3A//leaking.skin/&t=ROBUX%20GENERATOR&invisible=1&sc_rum_e_s=1410&sc_rum_e_e=1416&sc_rum_f_s=0&sc_rum_f_e=1404&get_config=true
Requested by: Host: www.statcounter.com
URL: https://www.statcounter.com/counter/counter.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.228.67 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eb2697b60c526a1d4980e0874700e7c2b4f43bb9292770f71bb4bb972506e415

Request headers

accept-language: en-US,en;q=0.9
Referer: https://leaking.skin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 22:15:39 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
content-type: application/json
access-control-allow-origin: https://leaking.skin
p3p: policyref="http://www.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"
access-control-allow-credentials: true
cf-ray: 76e5066a7eafda6b-MIA
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 css.css
dwmsurhf1svv8.cloudfront.net/public/clockers/PrimeApps/ 1010 B
1 KB 191ms
185ms Stylesheet
text/css 2600:9000:2199:b800:1b:9327:5500:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dwmsurhf1svv8.cloudfront.net/public/clockers/PrimeApps/css.css
Requested by: Host: d1j9qsxe04m2ki.cloudfront.net
URL: https://d1j9qsxe04m2ki.cloudfront.net/fc28201.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2199:b800:1b:9327:5500:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.48 () OpenSSL/1.0.2k-fips PHP/7.4.11 /
Resource Hash: a7081a117335212b9e7f2e348f7369a64423d51db1666310b3451e7375f0b7de

Request headers

accept-language: en-US,en;q=0.9
Referer: https://leaking.skin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 22:15:40 GMT
via: 1.1 6c1f5fbbdcc06a5ed4d317a0e3609f72.cloudfront.net (CloudFront)
last-modified: Fri, 10 Apr 2020 22:29:00 GMT
server: Apache/2.4.48 () OpenSSL/1.0.2k-fips PHP/7.4.11
x-amz-cf-pop: IAD79-C1
etag: "3f2-5a2f7428ae907"
x-cache: Miss from cloudfront
content-type: text/css
accept-ranges: bytes
content-length: 1010
x-amz-cf-id: uA_9Fa9yYwpJ6rGChPInnaSTUkw2N8gyGS-Vh6uxO7tzz-ZuLXP1aQ==

GET
H2 200 guid Show response
dwmsurhf1svv8.cloudfront.net/public/ 0
276 B 186ms
185ms Script
text/html 2600:9000:2199:b800:1b:9327:5500:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dwmsurhf1svv8.cloudfront.net/public/guid?cpguid=gbk3b7uea&e=ll&t=1669155340525
Requested by: Host: d1j9qsxe04m2ki.cloudfront.net
URL: https://d1j9qsxe04m2ki.cloudfront.net/fc28201.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2199:b800:1b:9327:5500:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11 / PHP/7.4.11
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://leaking.skin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 22:15:40 GMT
via: 1.1 6c1f5fbbdcc06a5ed4d317a0e3609f72.cloudfront.net (CloudFront)
server: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11
x-amz-cf-pop: IAD79-C1
x-powered-by: PHP/7.4.11
x-cache: Miss from cloudfront
content-type: text/html; charset=UTF-8
content-length: 0
x-amz-cf-id: KSvqHh7ihcLxmVHlK6CMqWbUtC5EN5miDB2ZOKsU2saXq_270uoptA==

GET
H2 200 check.php Show response
dwmsurhf1svv8.cloudfront.net/public/external/ 78 B
371 B 187ms
187ms Script
application/javascript 2600:9000:2199:b800:1b:9327:5500:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dwmsurhf1svv8.cloudfront.net/public/external/check.php?it=3108128&time=1669155342050
Requested by: Host: d1j9qsxe04m2ki.cloudfront.net
URL: https://d1j9qsxe04m2ki.cloudfront.net/fc28201.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2199:b800:1b:9327:5500:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11 / PHP/7.4.11
Resource Hash: 9ef4a63fc5e0a14a7301d693d65d6acfc44cdf14853c4a20890198f2d5e52e3b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://leaking.skin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

date: Tue, 22 Nov 2022 22:15:42 GMT
via: 1.1 6c1f5fbbdcc06a5ed4d317a0e3609f72.cloudfront.net (CloudFront)
server: Apache/2.4.51 () OpenSSL/1.0.2k-fips PHP/7.4.11
x-amz-cf-pop: IAD79-C1
x-powered-by: PHP/7.4.11
x-cache: Miss from cloudfront
content-type: application/javascript
content-length: 78
x-amz-cf-id: FEa8C3m4luaO8F0S1qN8tYMnPRO_9hhfcL1I8FYJhvk373swn2Gcdg==

GET
H3 200 160654779319118d636b2ea3b4779800f01d8c318a.png
leaking.skin/uploads/ 1000 B
1 KB 114ms
113ms Image
image/png 2606:4700:3037::ac43:d05a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://leaking.skin/uploads/160654779319118d636b2ea3b4779800f01d8c318a.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3037::ac43:d05a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c14e3e468b2556b4188299956d6aa2214acdb74dc7cdc275aeaa9e7ead5932e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://leaking.skin/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.110 Safari/537.36

Response headers

x-nf-request-id: 01GJ3PT2NYTXYJ5SNRPZXZRFJH
date: Tue, 22 Nov 2022 22:15:44 GMT
strict-transport-security: max-age=31536000
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "3ea1fa75a1bc29a207c78db497a7cf8e-ssl"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mK%2BYuK%2B4LROjxZucI6D9zKLF8Zrjjmqg%2BmhbAtQecZEcOtEWXatTBvJ7mZhLi6VnXAv9GGtH9WhstnVWkMwwlCe7d9XUYr8rHkXn38XMX0Ao36zXod%2BpO9dt0vFd%2BlGlCLgQCjrz2gY65I0%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: public, max-age=14400, must-revalidate
accept-ranges: bytes
cf-ray: 76e50687ebc29abd-MIA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1000

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: fonts.gstatic.com
URL: http://fonts.gstatic.com/s/roboto/v15/Pru33qjShpZSmG3z6VYwnRJtnKITppOI_IvcXXDNrsc.woff2

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic Scam (Online)

38 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
leaking.skin/	1970-01-20 07:53:39	Name: _cpguid Value: gbk3b7uea
.leaking.skin/	1970-01-20 17:15:15	Name: sc_is_visitor_unique Value: rx12811462.1669155340.9BDE876D96874FBC6B485A954BA420DD.1.1.1.1.1.1.1.1.1
.statcounter.com/	1970-01-20 17:15:15	Name: is_unique Value: sc12811462.1669155339.0
.statcounter.com/	1970-01-20 17:15:15	Name: is_visitor_unique Value: 1669155339274483058

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://leaking.skin/(Line 1093) Message: Mixed Content: The page at 'https://leaking.skin/' was loaded over HTTPS, but requested an insecure font 'http://fonts.gstatic.com/s/roboto/v15/Pru33qjShpZSmG3z6VYwnRJtnKITppOI_IvcXXDNrsc.woff2'. This request has been blocked; the content must be served over HTTPS.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
c.statcounter.com
d1j9qsxe04m2ki.cloudfront.net
dwmsurhf1svv8.cloudfront.net
fonts.googleapis.com
fonts.gstatic.com
leaking.skin
www.statcounter.com
fonts.gstatic.com
104.20.228.67
2600:9000:208f:3c00:7:68d6:a080:21
2600:9000:2199:b800:1b:9327:5500:21
2606:4700:3037::ac43:d05a
2607:f8b0:4004:80a::200a
2607:f8b0:4004:832::2003
2607:f8b0:4004:c1b::5f
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
08b3d574bd1f5bb2b7bf5dcb910ff347136e8845131837435501fce41ff8e5f5
09c9f2b368dcfefb8c37cfdb985e48369410e9765f403866fbe693b8acdc1d29
234b9bab83aa0c52e9e5192995427a2bc44876cf1a11545ed631f369b8dc6534
248bbf0c91d2efdadabdfc3203caa8752d5dd1cab9b97bee9905883baa171ca2
38773f599cca495f0904c3d5a9981fc081b743a8d9aa106ed17e0d9b03ae6598
3c9acc8be9f47d9493061e325d0ead8ec7a2f7927eb1dc373a71f67c7509e4d8
650cd495d2c91a6acbd5be16ba1b6bd90e224eeaea91ab2b8e248cbc385a65c8
67af93a422346c5bb330786025419e72324b76aae6e384378f7c8e1ec30fa059
907ed23a8d4e655e0af328c3a680153d54fd7fea9f356532af25add1f9eb23d3
988df212c000f1c5b3043b9813ed991815089f0dac63ad094351eb372166f9ff
9ef4a63fc5e0a14a7301d693d65d6acfc44cdf14853c4a20890198f2d5e52e3b
a7081a117335212b9e7f2e348f7369a64423d51db1666310b3451e7375f0b7de
a7bd79b6fba60944ee3a9c153108ff0819d2db57850116ac7065a86db08af4ec
aafeab425f2babc37d22e02fe7dd64351f5fe47a65b8d920fbffb625f5295805
c14e3e468b2556b4188299956d6aa2214acdb74dc7cdc275aeaa9e7ead5932e8
ca14458e3240648f3087d744d31c8917a8629879d70a16ba9cd7feb732502fed
d7e79466b17a046578ed609e5d8d384b2b3bc17def0c0b96a2be143af3cff1a2
e36165510050fc4ef1d87cc430dd4d1d0f6a705c5f4aa7b3a97493921884bb05
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eb2697b60c526a1d4980e0874700e7c2b4f43bb9292770f71bb4bb972506e415
f53c990aded05a21d8400b1019eab4bd571c498c97db6c4da445668b9b62e2bd
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

leaking.skin Open in urlscan Pro 2606:4700:3037::ac43:d05a Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

24 Requests

96 %HTTPS

86 %IPv6

5 Domains

8 Subdomains

8 IPs

2 Countries

400 kBTransfer

529 kBSize

4 Cookies

0 Outgoing links

Page URL History

Redirected requests

24 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

38 JavaScript Global Variables

4 Cookies

1 Console Messages

Security Headers

Indicators

leaking.skin Open in urlscan Pro
2606:4700:3037::ac43:d05a Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

24
Requests

96 %
HTTPS

86 %
IPv6

5
Domains

8
Subdomains

8
IPs

2
Countries

400 kB
Transfer

529 kB
Size

4
Cookies

24 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!