wonderfulleafs.com Open in urlscan Pro
2606:4700:3033::6815:a6e Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://drozreport.com/ih2hy
Effective URL:
https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw
Submission: On April 14 via manual (April 14th 2022, 7:01:10 pm UTC) from US — Scanned from US

Summary HTTP 40 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 4 IPs in 1 countries across 4 domains to perform 40 HTTP transactions. The main IP is 2606:4700:3033::6815:a6e, located in United States and belongs to . The main domain is wonderfulleafs.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on April 9th 2022. Valid for: a year.

This is the only time wonderfulleafs.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Weightloss Scam (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:303... 2606:4700:3036::ac43:c521	() ()
34	2606:4700:303... 2606:4700:3033::6815:a6e	() ()
4	2606:4700::68... 2606:4700::6812:e234	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:303... 2606:4700:3036::ac43:a69f	() ()
1	2606:4700::68... 2606:4700::6812:e134	() ()
40	4

1 2606:4700:3036::ac43:c521 (United States) 1 redirects

ASN- ()

drozreport.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

34 2606:4700:3033::6815:a6e (United States)

ASN- ()

wonderfulleafs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6812:e234 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3036::ac43:a69f (United States)

ASN- ()

securemobileconnect.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:e134 (United States)

ASN- ()

onesignal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
34	wonderfulleafs.com wonderfulleafs.com	1 MB
5	onesignal.com cdn.onesignal.com — Cisco Umbrella Rank: 3059 onesignal.com — Cisco Umbrella Rank: 1122	83 KB
1	securemobileconnect.com securemobileconnect.com	1 KB
1	drozreport.com 1 redirects drozreport.com	1 KB
40	4

	Domain	Requested by
34	wonderfulleafs.com	wonderfulleafs.com
3	onesignal.com	cdn.onesignal.com
2	cdn.onesignal.com	wonderfulleafs.com cdn.onesignal.com
1	securemobileconnect.com	wonderfulleafs.com
1	drozreport.com	1 redirects
40	5

This site contains links to these domains. Also see Links.

Domain
web.opensecurelink.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-04-09` - `2023-04-09`	a year	crt.sh
*.securemobileconnect.com E1	`2022-02-21` - `2022-05-22`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw
Frame ID: 8706DF468C68D57204F4FB318656BBF1
Requests: 40 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Natures Only — Dr. Oz’s New Plan to Take Control of Your Health In 2022 | The Dr. Oz Show

Page URL History Show full URLs

http://drozreport.com/ih2hy HTTP 302
https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw Page URL

Detected technologies

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

OneSignal (Marketing automation) Expand

Overall confidence: 100%
Detected patterns

cdn\.onesignal\.com

Page Statistics

40
Requests

100 %
HTTPS

100 %
IPv6

4
Domains

5
Subdomains

4
IPs

1
Countries

1289 kB
Transfer

2228 kB
Size

3
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://web.opensecurelink.com/aff_c?offer_id=428&aff_id=3073&aff_click_id=&source=&aff_sub=jdog%20clicker6.csv&aff_sub2=&aff_sub3=cbd3&aff_sub4=88&aff_sub5=vzw

Search URL Search Domain Scan URL

URL: https://web.opensecurelink.com/aff_c?offer_id=428&aff_id=3073&aff_click_id=&source=&aff_sub=jdog%20clicker6.csv&aff_sub2=&aff_sub3=cbd3&aff_sub4=88&aff_sub5=vzw%20data-tracking-code=

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://drozreport.com/ih2hy HTTP 302
https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

40 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
wonderfulleafs.com/
Redirect Chain

http://drozreport.com/ih2hy
https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw

55 KB
13 KB

168ms
107ms

Document
text/html

2606:4700:3033::6815:a6e

General

Check archive.org

Show headers Download Go to

Full URL

https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3033::6815:a6e , United States, ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

2ea172b3e4e97c2247147aa4b750d0e447d7a091a0178e6f53a2c817bd07e7d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: no-store, no-cache, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 6fbeb025dd343300-EWR
content-encoding: br
content-type: text/html; charset=UTF-8
date: Thu, 14 Apr 2022 19:01:05 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
expires: Thu, 19 Nov 1981 08:52:00 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0nzyYN06f%2BCzm7duebNHAXNUuRy6wp0ZM0Y%2Bpc21YIsUFBkoeGGpGsLv0gdR6EmejR6gNVB0aJaACkhaPG62A5VZgbCK0Yy4Jw8s%2BnU0PcueCITOcNiPfuNSvii4Pfd73qWYaSN4%2B44C2n3sq8%2B4g2I%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

Redirect headers

CF-Cache-Status: DYNAMIC
CF-RAY: 6fbeb0231dba78e2-EWR
Cache-Control: no-cache,no-store
Connection: keep-alive
Content-Length: 0
Date: Thu, 14 Apr 2022 19:01:05 GMT
Expires: -1
Location: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Pragma: no-cache
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0RJjoXj7j6NOm80Jht7SQSl479tZIbvknpscLJmg7PEXDPpAbfbN1ayyLJ6dihBkVPcnBhWZiRToT8iS%2FFQ6V10MYpCQAcoVuyqE7fENhAY9dCmdwnJnzta61oVvdjxr1xQEuI2ivC6AGzLN0w%3D%3D"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
alt-svc: h2=":443"; ma=60

GET
H2 200 main.css
wonderfulleafs.com/css/ 666 KB
92 KB 42ms
41ms Stylesheet
text/css 2606:4700:3033::6815:a6e

General

Check archive.org

Show headers Download Go to

Full URL

https://wonderfulleafs.com/css/main.css

Requested by

Host: wonderfulleafs.com
URL: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3033::6815:a6e , United States, ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

58fd47c973c04e47074ca7ba6472c84114c5bdf49463627c203cbaee59310e7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:05 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5067
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Sat, 09 Apr 2022 03:50:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"625102a2-a670c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dn9hILokoLBVMy1bedavJk2IrwvzgE77uCGaYfJw9HAI07DqKu2w1yZ2CTzFutkjE8gaeCFcIH42XTclCbxIvUCKVbFV24eeqHJ3TnO3FLEAseg49cV%2BGiE8YgD8s4XczBsuSmAnSnrUERWKz0L9hFY%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 6fbeb026aebb3300-EWR

GET
H2 200 optanon.css
wonderfulleafs.com/css/ 29 KB
7 KB 29ms
29ms Stylesheet
text/css 2606:4700:3033::6815:a6e

General

Check archive.org

Show headers Download Go to

Full URL

https://wonderfulleafs.com/css/optanon.css

Requested by

Host: wonderfulleafs.com
URL: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3033::6815:a6e , United States, ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

c651bf84aeaf4a7ee424b9141f880bbd6fdef5a5b13a4abbbfe16c5c7487e1e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:05 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4801
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Sat, 09 Apr 2022 03:50:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"625102a2-75eb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oWh%2F7%2B9G3Oiym6l97U15NKiOJa4Z54NZoraNzYgudC9SMNbJyIGXucQHzaqUYtrOYzueXy%2BY4SABnsPQrf%2FrC9zBPJwLKzU4H1MHnhXKJDfYwLG4wRngrFNqiebhwkUHMxVCx9INPaJD9e%2BmXl22Oa0%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 6fbeb026aebd3300-EWR

GET
H2 200 en2.js Show response
wonderfulleafs.com/js/ 1 KB
902 B 27ms
27ms Script
application/javascript 2606:4700:3033::6815:a6e

General

Check archive.org

Show headers Download Go to

Full URL

https://wonderfulleafs.com/js/en2.js

Requested by

Host: wonderfulleafs.com
URL: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3033::6815:a6e , United States, ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

41c837664607a03d0114fcfd3656f27f85d742f789d0d53e8b597c3bfdd7e090

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:05 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4933
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Sat, 09 Apr 2022 03:50:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"625102a2-463"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=W63Tq75nMu7y9Na6R2BqWws4FYtNV1vHDdLDflX%2BkMm%2FYabJeJj4O0aq30ARptErEEvk7frSyj6UdLX6ouE1sq0pti1iLi%2FSfqYTJ61eoiP8%2FzFaTGVYvAmMdbeSRLC5GT76yuHfFXhmHeTASjD6qTU%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
cache-control: max-age=14400
cf-ray: 6fbeb026aebe3300-EWR

GET
H3 200 doctor-oz-logo.png
wonderfulleafs.com/images/ 50 KB
50 KB 32ms
31ms Image
image/png 2606:4700:3033::6815:a6e

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://wonderfulleafs.com/images/doctor-oz-logo.png

Requested by

Host: wonderfulleafs.com
URL: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:a6e , United States, ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

4ffe9e6639153f7dd05487eab1440afde4e5130f16b3c63a99d5f9e484cdad8b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:05 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2974
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 51080
x-xss-protection: 1; mode=block
last-modified: Sat, 09 Apr 2022 03:50:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "625102a2-c788"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FuRa0zB5DpzBC%2BavBW%2Bd%2BYZNXxM0pjYtJJJBilWlyM8gnJYIZe28F8yEGP7MYwnA%2BwY%2BGq235orCojH6tEQu07uVshiWtmMQqueVzqpSIHDZxfNFSCYGqXzGWYqfnpFtN%2BlvF4%2Frwpv3e7K1NowpkXQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6fbeb0271f1c17fd-EWR

GET
H3 200 doctor-oz-logo-small.png
wonderfulleafs.com/images/ 4 KB
5 KB 71ms
71ms Image
image/png 2606:4700:3033::6815:a6e

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://wonderfulleafs.com/images/doctor-oz-logo-small.png

Requested by

Host: wonderfulleafs.com
URL: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:a6e , United States, ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

bebd1cff3dc9e4531dc0c9c103ac928fdb5fac57081c72df1f85b3522032aa60

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:05 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2225
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4473
x-xss-protection: 1; mode=block
last-modified: Sat, 09 Apr 2022 03:50:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "625102a2-1179"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ibiZASZzBwrdMjiPZPtictj2UxMkdZdGeQn%2B%2FeoUcVm3Joe7dhiJ3Ryo8b4zGKYIxkycGMuRQLLVNU9Jv%2BCzABteJuPkPItoqFil8f186HCq8iKhbPVX12qvkhTjEWQRbmQL3l8yxB0NZcT%2Fsh366EI%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6fbeb0272f6817fd-EWR

GET
H3 200 Smart-Skin-MainNav-Takeover-Logo.png
wonderfulleafs.com/images/ 3 KB
4 KB 63ms
62ms Image
image/png 2606:4700:3033::6815:a6e

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://wonderfulleafs.com/images/Smart-Skin-MainNav-Takeover-Logo.png

Requested by

Host: wonderfulleafs.com
URL: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:a6e , United States, ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

a66c0cde2d9a77bb5ad4556a11982f5edd795ef0a52a66cf1075ab4e8e48d4b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:05 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2165
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 3359
x-xss-protection: 1; mode=block
last-modified: Sat, 09 Apr 2022 03:50:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "625102a2-d1f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nAm2muVjRc91deGAkG7qQpa4tXEVTjClcCIiReWOzSFaLIpQ6gqvN5vGn9nnxl9sAsS44dXFJ4hMFE7QSgnlFNwyft8tzTCPPaP0%2BvuIex%2FANqVGP%2FXH4Fxl2p0ODzYRPr4UYdZGxJ5ZTMBHpaFrFNQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6fbeb0273f8317fd-EWR

GET
H3 200 powered-by-sharecare.png
wonderfulleafs.com/images/ 3 KB
3 KB 63ms
60ms Image
image/png 2606:4700:3033::6815:a6e

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://wonderfulleafs.com/images/powered-by-sharecare.png

Requested by

Host: wonderfulleafs.com
URL: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:a6e , United States, ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

6c1a0397bfbb65501438aa972a005843602e127f2b0f5467d7c0d8fe9ae96752

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:05 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1984
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2664
x-xss-protection: 1; mode=block
last-modified: Sat, 09 Apr 2022 03:50:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "625102a2-a68"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fDRFrXTf5C2L1PWCjckCkU0izGSHDDk4eutS7OG8pyJVR8VRJolFOEAbTbVjqvYpFS5gUCAb9sxTVIdEx2CGIYQpwN2TlIUrV53XbVUDyj9Wo6KdFtZBQbtcDQC6kMwXwFPSy6vS9SzoQMgr9JUAgwE%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6fbeb0274f9017fd-EWR

GET
H3 200 photo_2020-01-09_15-37-08.jpg
wonderfulleafs.com/images/ 57 KB
57 KB 64ms
60ms Image
image/jpeg 2606:4700:3033::6815:a6e

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://wonderfulleafs.com/images/photo_2020-01-09_15-37-08.jpg

Requested by

Host: wonderfulleafs.com
URL: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:a6e , United States, ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

2379a76189c0b9488fb7febade453f6060b26157bfeb3663c7ea06a444d7c789

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:05 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2402
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 58119
x-xss-protection: 1; mode=block
last-modified: Sat, 09 Apr 2022 03:50:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "625102a2-e307"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=a9MBUfu8AakAkMNS2%2BCbvC4oOBsfiggcxmtsrEB6za1%2B9ei3VPj0ZT2jAvrFFYIGkDmLhY1DzJ9%2BNYTGESKe1UQecFq5rxgts1PLPYj6Zzgi1YmvWnCCLXnrgUkTWcPGhMjoREt798q7efLM7vGqATo%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6fbeb0274f9117fd-EWR

GET
H3 200 droz1.jpg
wonderfulleafs.com/images/ 88 KB
88 KB 98ms
94ms Image
image/jpeg 2606:4700:3033::6815:a6e

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://wonderfulleafs.com/images/droz1.jpg

Requested by

Host: wonderfulleafs.com
URL: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:a6e , United States, ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

c529d59b171382f4c85a45e50c473bf6bb7bc8952902762b7fa5e09f67fc4c2c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:05 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2484
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 89733
x-xss-protection: 1; mode=block
last-modified: Sat, 09 Apr 2022 03:50:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "625102a2-15e85"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=s8GQrM5mVhS5U71lILA4rK1c%2BkQfCwF5Gw13%2FB05C8r0yRsNcqO4fdZw3MeTMhkhSAnU03%2B%2Fk5WGcFv1%2F4%2FXJjzPCNtqqkk%2BxKlh5xoYrGFlnh3QLEEwuNoUC700Qw4YwhWnqTc6O%2BJqTh%2F4q1bNfFs%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6fbeb0274f9317fd-EWR

GET
H3 200 CBD-Oil-Testimonial-for-My-Panic-Attack-and-Social-Anxiety-263x300.jpg
wonderfulleafs.com/images/ 12 KB
13 KB 121ms
117ms Image
image/jpeg 2606:4700:3033::6815:a6e

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://wonderfulleafs.com/images/CBD-Oil-Testimonial-for-My-Panic-Attack-and-Social-Anxiety-263x300.jpg

Requested by

Host: wonderfulleafs.com
URL: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:a6e , United States, ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

d4e730980b14b141944005536f28f5092e367cef7bc1d78b409f43cec090f0e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:05 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1977
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 12779
x-xss-protection: 1; mode=block
last-modified: Sat, 09 Apr 2022 03:50:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "625102a2-31eb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9uADcO7jW21JpGdxxRUU7spknk%2BNcN3Eird%2FedhSjHBB%2FwECOMPOsTj7Am9DlCQf8K5oI7ZvDDg9xwUKUiadQxI2mPjwVI%2FIVJMrnlrvrjZ51ruibWNU1ao4SQzwJzwThXVn%2F4WkOVmbiRZ44E6Wuko%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6fbeb0274f9617fd-EWR

GET
H3 200 HappyHACCMan.jpg
wonderfulleafs.com/images/ 11 KB
12 KB 121ms
117ms Image
image/jpeg 2606:4700:3033::6815:a6e

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://wonderfulleafs.com/images/HappyHACCMan.jpg

Requested by

Host: wonderfulleafs.com
URL: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:a6e , United States, ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

65c50446ae3ec1cf77b8e71d703ac383f6babed6d1facf62f2ec228c30550d8f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:05 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2752
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 11494
x-xss-protection: 1; mode=block
last-modified: Sat, 09 Apr 2022 03:50:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "625102a2-2ce6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TBrq4DVJmXJIjTSO5uJCMrq5YMxtkrghS3nSSx9LZ6fYwEkBrozhFmJF7zn6%2B%2F2oszGtqvNudR65gDFg%2FA%2FYtahAauQz1v5HjKXqWefcEDPGTVwvLOT1cy4C1eK%2F3e545WwLthxcD6PJCebbOTOK6YU%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6fbeb0274f9917fd-EWR

GET
H3 200 sam-elliott-e1557189275471.jpg
wonderfulleafs.com/images/ 24 KB
24 KB 121ms
118ms Image
image/jpeg 2606:4700:3033::6815:a6e

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://wonderfulleafs.com/images/sam-elliott-e1557189275471.jpg

Requested by

Host: wonderfulleafs.com
URL: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:a6e , United States, ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

0e48a851744148120e20c50902cdea6f268c013eda78f87100d6cfa926ecce5c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:05 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3252
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 24142
x-xss-protection: 1; mode=block
last-modified: Sat, 09 Apr 2022 03:50:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "625102a2-5e4e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JGQ8UAu0T%2FhXmdnw0e6USmDiB7V%2B4T%2FsGxqx6xm3sQ8vGFt8LJCjrE47JVmH1xlwW9aLPVnLmzUGKLzdqky22O6m8fQRbMWAeh%2FJyvSnOdGeN8%2BSMFF%2B8b%2FUbDW9nfk1yIgXyrZ%2B76zVM%2BL9GZiDsfY%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6fbeb0274f9c17fd-EWR

GET
H3 200 694940094001_5850457368001_5850420935001-vs.jpg
wonderfulleafs.com/images/ 64 KB
64 KB 122ms
118ms Image
image/jpeg 2606:4700:3033::6815:a6e

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://wonderfulleafs.com/images/694940094001_5850457368001_5850420935001-vs.jpg

Requested by

Host: wonderfulleafs.com
URL: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:a6e , United States, ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

e8783a6e94254f7c6f710d69442152f7a3fdd5791fdd4e94bea126ad32e5c681

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:05 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3519
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 65086
x-xss-protection: 1; mode=block
last-modified: Sat, 09 Apr 2022 03:50:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "625102a2-fe3e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=le%2FmuRsh16ht7XasXrJqDFEe3%2BGrh3RpCsS0AYGUOfzCpPPBaG9MCdWo5oBSQg21eVINdoAZRR2i7Sno97pt5AdLouubAI4UYJDA6%2By8XYbv7InNUDVVBIRkyIC0MRBXSZn%2Br4fErohz2xYfPlwE8Ps%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6fbeb0274fa017fd-EWR

GET
H3 200 oz-feature.jpg
wonderfulleafs.com/images/ 140 KB
140 KB 139ms
135ms Image
image/jpeg 2606:4700:3033::6815:a6e

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://wonderfulleafs.com/images/oz-feature.jpg

Requested by

Host: wonderfulleafs.com
URL: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:a6e , United States, ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

902344788c8900dcee803e4055683da19776bcd36eeb23f1eb688e9eb5ca7160

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:05 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2400
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 143137
x-xss-protection: 1; mode=block
last-modified: Sat, 09 Apr 2022 03:50:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "625102a2-22f21"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=x6YP7Ld6i8Dujr5ZQTbpsJqHB7DnnubBFNIIJsj8%2BiZXsNAmD42V00IddiOnTj86Xrl9tT3ckQIdwwrYjviN53ZfZVvCOOHLiHCiOyxmdXSv35cIxV%2BsANO8rpTkbwEzIhGsbAX4ti6cYpazDL2ceAs%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6fbeb0274fa617fd-EWR

GET
H3 200 naturesonly.png
wonderfulleafs.com/images/product/ 318 KB
318 KB 157ms
153ms Image
image/png 2606:4700:3033::6815:a6e

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://wonderfulleafs.com/images/product/naturesonly.png

Requested by

Host: wonderfulleafs.com
URL: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:a6e , United States, ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

6b78fa6b65f103f7003b2e7b718112009d92d98d918e6d2e09e56b6fb974d319

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:05 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4136
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 325194
x-xss-protection: 1; mode=block
last-modified: Sat, 09 Apr 2022 03:50:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "625102a2-4f64a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4mlsbmLeoQf0ic1TwZdCIdKfZsd7TxWx29vZ9gTgHvDlDPAfAtJlnJxaCEK6z7QluwFYN8qRnB57qWMnvdj5hRcq4UQPGd3CRR62L6MLkJgBq%2FqEGLTwLgzeMD726n0ke%2Ba%2BG9t7nR%2BJK1DfzWCo81c%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6fbeb0274fab17fd-EWR

GET
H3 200 prof10.jpg
wonderfulleafs.com/images/ 2 KB
3 KB 181ms
177ms Image
image/jpeg 2606:4700:3033::6815:a6e

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://wonderfulleafs.com/images/prof10.jpg

Requested by

Host: wonderfulleafs.com
URL: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:a6e , United States, ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

ab0d6ca856c3af2377dc800b8e4866d86749ce277a87073df6c49eb1d02be767

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:05 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3707
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2472
x-xss-protection: 1; mode=block
last-modified: Sat, 09 Apr 2022 03:50:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "625102a2-9a8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MS2n4Rp0CMXrwZbWLnEmD1SFJKneZmoSTAgWzqXsz14MH%2FdfnVWlSRAhfD0FFm7tVnpasFMDD02mZvCPNCqiWqKtqrK7yP6iYaZQGiNdDuyGn%2Ff23DYrIRh4xYOwKRZ5Fh6UqbRgbEK6MYW%2FqcB7lw8%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6fbeb0274fb017fd-EWR

GET
H3 200 prof2.jpg
wonderfulleafs.com/images/ 2 KB
3 KB 181ms
177ms Image
image/jpeg 2606:4700:3033::6815:a6e

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://wonderfulleafs.com/images/prof2.jpg

Requested by

Host: wonderfulleafs.com
URL: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:a6e , United States, ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

1cb5d9ce505a301b6312b9e73e8f4562f6f11f9f309f3258007ae8007abcd4ad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:05 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3235
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2443
x-xss-protection: 1; mode=block
last-modified: Sat, 09 Apr 2022 03:50:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "625102a2-98b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gCJudkEVYClEdcXq0qDJ2u7foSYNBQcqkqoNceHTo%2FAZA1IsJuDMFNK82sCQCKM%2BrptzIZHbqNt7KZ3qjofm4lFYUBTUieB0fmvzi4NbXHwJm9APEFKBxG1zy%2B2XlVO59ObGdwxkicGcVsN4SLFynZo%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6fbeb0274fb517fd-EWR

GET
H3 200 pp2.jpg
wonderfulleafs.com/images/ 13 KB
14 KB 182ms
178ms Image
image/jpeg 2606:4700:3033::6815:a6e

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://wonderfulleafs.com/images/pp2.jpg

Requested by

Host: wonderfulleafs.com
URL: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:a6e , United States, ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

79a3b0af421c0e4d2f02dc0e777b823100527ea9e28ae1345d3a19a35ede2105

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:05 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2746
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 13602
x-xss-protection: 1; mode=block
last-modified: Sat, 09 Apr 2022 03:50:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "625102a2-3522"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fXk00SuiRn7XDjG%2FppCcnZwfvtkrE8r6gR5NVnnDIyexcZDxTVZ7W6NSq7uz70X5JnFOtp4kk6%2FJzE5DCy7s3mBXlWjI71NhDDmA7RseRa%2BePZWBOmybxwJk2Og03UfKoTVgWFkAdR8miDVePjSNOc0%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6fbeb0274fbb17fd-EWR

GET
H3 200 prof5.jpg
wonderfulleafs.com/images/ 2 KB
3 KB 182ms
178ms Image
image/jpeg 2606:4700:3033::6815:a6e

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://wonderfulleafs.com/images/prof5.jpg

Requested by

Host: wonderfulleafs.com
URL: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:a6e , United States, ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

e0b4e806d14a848b60771ce921ae209b40037f6f003fd7533c122aaa4d4d7fa2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:05 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1923
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2232
x-xss-protection: 1; mode=block
last-modified: Sat, 09 Apr 2022 03:50:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "625102a2-8b8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EOuuStNlx5hjs6wkd2YqX%2F0yNMlzaxI6Jq4KRpKDRqlMx8hEwtBVj6ybzybjPSWU4%2FfIJ4uZLnSmiFF76gbbiqFmDQv3veoDX4oq00%2Byq6gVGAmaz4ZrtZzuIFYDDSQ2JuXY%2FtCI08q34ovsoVeNhRk%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6fbeb0274fbe17fd-EWR

GET
H3 200 prof6.jpg
wonderfulleafs.com/images/ 2 KB
2 KB 183ms
179ms Image
image/jpeg 2606:4700:3033::6815:a6e

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://wonderfulleafs.com/images/prof6.jpg

Requested by

Host: wonderfulleafs.com
URL: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:a6e , United States, ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

7ebf0402ee62bae00a6ded482e97c47ed1cf74b9fa6a602fd4d57b376ddd539a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:05 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2220
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1814
x-xss-protection: 1; mode=block
last-modified: Sat, 09 Apr 2022 03:50:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "625102a2-716"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AY58%2BgkP4zx%2BxD1E7VRPM5RBjhPA5ATD4jxlWVFboiCt7zPD9jIjxda1%2BCyYeMIGAhn6fw7HrdiWSglD6SyW9gSEXoHe%2B%2BgddGQzlFGVqWebgmLtxmO%2BnKp9ZIvwZanXUmEx6xt37ArYet6AYvPZMb0%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6fbeb0274fc117fd-EWR

GET
H3 200 pp5.jpg
wonderfulleafs.com/images/ 13 KB
14 KB 183ms
179ms Image
image/jpeg 2606:4700:3033::6815:a6e

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://wonderfulleafs.com/images/pp5.jpg

Requested by

Host: wonderfulleafs.com
URL: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:a6e , United States, ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

074c3fee1b061ff55a401621ad8c073e912425b70bf05ba2f1c57622d8f00668

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:05 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1626
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 13249
x-xss-protection: 1; mode=block
last-modified: Sat, 09 Apr 2022 03:50:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "625102a2-33c1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=x%2BpUb%2BRMcU1c5b3LIzQgSo5LYkEAyz1AGOlFD7X9A7D%2FCyW9wJODSSKWJLsYw7%2Fh4%2BwsHkAQUtGhmUMi1eAK2UPKvOTfgZ%2FrnMNWw9ErihmVdR5P1bRk2tUSOd41pzcY%2FfBm2BYMnnwQ2qpD1eO172w%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6fbeb0274fc617fd-EWR

GET
H3 200 prof8.jpg
wonderfulleafs.com/images/ 3 KB
3 KB 186ms
182ms Image
image/jpeg 2606:4700:3033::6815:a6e

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://wonderfulleafs.com/images/prof8.jpg

Requested by

Host: wonderfulleafs.com
URL: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:a6e , United States, ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

888dccfa93119ce00f9cc4764d37af91a95a3e55fbe1a4da510d4bcc579ddaba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:05 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2427
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 2717
x-xss-protection: 1; mode=block
last-modified: Sat, 09 Apr 2022 03:50:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "625102a2-a9d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2F5rk7g%2BlZllZHr5Zg2sBSiMHU97nkzRP9jNz1J9bqbzY3MPw1m4W0A2O3cIYOl37ajbbiQvCjXHlkKsx%2FytMYY10JLKqQlOpXjsdBEJ%2FGOyaBLAGZoEHzxvbOmbmD3bJBhZk5iTo5bpKTDumEJSH8Yg%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6fbeb0274fcc17fd-EWR

GET
H3 200 pp6.jpg
wonderfulleafs.com/images/ 11 KB
12 KB 186ms
182ms Image
image/jpeg 2606:4700:3033::6815:a6e

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://wonderfulleafs.com/images/pp6.jpg

Requested by

Host: wonderfulleafs.com
URL: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:a6e , United States, ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

596492fc8fdb5fc82f4a85b54b4a52ed6596f4f8d75d5e04808dfa4cb1688d7e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:05 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1503
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 11573
x-xss-protection: 1; mode=block
last-modified: Sat, 09 Apr 2022 03:50:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "625102a2-2d35"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5JYiUrSqLziQZT03D1RBtospd24dIGLwjRPssdZc3zTawZPz%2FOtSW86926wvJlVJb1XZXRlt7duvM0Q7WdZ0alUsKsxt93Iu8YlWsKmWs%2BwZe3N3BYcwOlVsrJjhopZ7EFqBs0TxskKcw547M%2F1QDB4%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6fbeb0274fd317fd-EWR

GET
H3 200 511771039.jpg
wonderfulleafs.com/images/ 1 KB
2 KB 186ms
183ms Image
image/jpeg 2606:4700:3033::6815:a6e

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://wonderfulleafs.com/images/511771039.jpg

Requested by

Host: wonderfulleafs.com
URL: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:a6e , United States, ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

947a568a0ea6373c979c4606c9846c9020c8dada4c8957ee34abb9336c480bc6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:05 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2983
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1364
x-xss-protection: 1; mode=block
last-modified: Sat, 09 Apr 2022 03:50:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "625102a2-554"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zdxb8MkGqe99Psl46NHmpvDhKRPo8DxZuIw80EA6MZ07OnA9F3H6nGp5bR7Tob9y3d%2BMebhFvijS3HsJLgju6vX13rIcbebK5IR3VvPnslG%2FJ7m9qBB6Fcr1%2FE%2F7qIjTFvGVb1ecT323Wou8XEPjTcM%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6fbeb0274fd517fd-EWR

GET
H3 200 ayurvedic-body-start-720x480.jpg
wonderfulleafs.com/images/ 2 KB
2 KB 186ms
183ms Image
image/jpeg 2606:4700:3033::6815:a6e

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://wonderfulleafs.com/images/ayurvedic-body-start-720x480.jpg

Requested by

Host: wonderfulleafs.com
URL: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:a6e , United States, ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

75c73228a616c89e9212295a82f861b6a8a37a1ef013acff1cc2330f8e76a00e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:05 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1345
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1938
x-xss-protection: 1; mode=block
last-modified: Sat, 09 Apr 2022 03:50:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "625102a2-792"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=01lS99WlOajRT3bib0CtEZXiu5RS5J19Fzia%2Bq%2BUtQHzFYf6Ad0u2g%2BM1nfFDEgia%2BbjNua7vuQdOHLI6ezPM0AS2S2ULBYjK2RtY10AJFkNAO9m2ARfTyAn%2B%2BLjZuLYUoT5mxPpgoYm7DH%2F6xld%2FLI%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6fbeb0274fda17fd-EWR

GET
H3 200 4_113_LeakyGut_720.jpg
wonderfulleafs.com/images/ 1 KB
2 KB 187ms
183ms Image
image/jpeg 2606:4700:3033::6815:a6e

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://wonderfulleafs.com/images/4_113_LeakyGut_720.jpg

Requested by

Host: wonderfulleafs.com
URL: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:a6e , United States, ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

91dfb0ad3a52c36c2e82dcb561250a22ccff3d87a0461f3f35c2401f99cf8450

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:05 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1502
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1374
x-xss-protection: 1; mode=block
last-modified: Sat, 09 Apr 2022 03:50:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "625102a2-55e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9YVoU%2BV5haiWAu4yKkY%2FHNtCz7P3y9efrsYxBZkdJwxUs5qs4RarudZqm1axNCOC1Ul3CqLSiqT%2Frb%2F8923dQ31hnVQym98xaM2uQQKMcd%2BcYC4njozuPPYNaVMLjRK2vEEYx2y9tneAT2ZIS90Wr10%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6fbeb0274fdf17fd-EWR

GET
H3 200 metabolism-type-start-720x480.jpg
wonderfulleafs.com/images/ 2 KB
2 KB 187ms
184ms Image
image/jpeg 2606:4700:3033::6815:a6e

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://wonderfulleafs.com/images/metabolism-type-start-720x480.jpg

Requested by

Host: wonderfulleafs.com
URL: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:a6e , United States, ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

ac8ff35b4cad40410456b17b27aa21affe0483571c588167a7cff659f74e6c90

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:05 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2972
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1905
x-xss-protection: 1; mode=block
last-modified: Sat, 09 Apr 2022 03:50:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "625102a2-771"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pt8dRb0d1zpfA%2BMewckKpQ8iIfHqH2YSODj%2BVobokJ%2BXzaMoNKmjL4HWCXzuNrCo3i%2F4nhC90Gw2uGcD4oLcSFXGh0ViC3NSNP4Sr75qAFz6Hyq7Wd8Lb7KhFuhuXDlvaxpumQgskLdRJCM0nF%2BgeUM%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6fbeb0274fe317fd-EWR

GET
H3 200 Feature_IBS_03.jpg
wonderfulleafs.com/images/ 4 KB
5 KB 187ms
184ms Image
image/jpeg 2606:4700:3033::6815:a6e

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://wonderfulleafs.com/images/Feature_IBS_03.jpg

Requested by

Host: wonderfulleafs.com
URL: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:a6e , United States, ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

e21746296fdaca1a9baf26ac8d267ec4888386ff631451a9f55f1a38717bdcce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:05 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 6665
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4567
x-xss-protection: 1; mode=block
last-modified: Sat, 09 Apr 2022 03:50:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "625102a2-11d7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=n7NgrpaSGRR4HW%2BqgmC3FQ1lX2lxim%2FrJHbQZwXAWVgla%2BJPj5WqK4dIHNxvMVOlIC0OPNHYd6PtdASc5xZPg3ROrHsbsx2oupfzSFdoAoOyAg4mOUrgIlaQfsufMSoqz%2Bg5ifK4SAe0K%2B9LH3R99M8%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6fbeb0274fe417fd-EWR

GET
H3 200 oz%20at%20ocean.jpg
wonderfulleafs.com/images/ 5 KB
6 KB 187ms
184ms Image
image/jpeg 2606:4700:3033::6815:a6e

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://wonderfulleafs.com/images/oz%20at%20ocean.jpg

Requested by

Host: wonderfulleafs.com
URL: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:a6e , United States, ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

4a928a624656a7d4413aa782f1cb7d8e98ce04f42f794d79b36143998098d2f4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:05 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2219
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 5333
x-xss-protection: 1; mode=block
last-modified: Sat, 09 Apr 2022 03:50:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "625102a2-14d5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ShmqaDtf8OAXb89M1RPkmjTBogl8a3U1GVnb%2FsYoJxQ3ts2vEPT3xYelUEP5WCycvF2Mqf89%2BQ9tVxaI5NaVC3DI%2B1%2BR9JPD5aoQ%2Bl3PDQB4KZFGavjI%2F7rMx3j81vUZrBLsQcbj%2BJ%2F2OZWSh89M5NY%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6fbeb0274fe517fd-EWR

GET
H3 200 font-awesome.min.css
wonderfulleafs.com/css/ 30 KB
7 KB 41ms
41ms Stylesheet
text/css 2606:4700:3033::6815:a6e

General

Check archive.org

Show headers Download Go to

Full URL

https://wonderfulleafs.com/css/font-awesome.min.css

Requested by

Host: wonderfulleafs.com
URL: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:a6e , United States, ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:05 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1921
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
last-modified: Sat, 09 Apr 2022 03:50:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"625102a2-7918"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=98aTGpNmvCNRUSpvZKYdMtgiME3Qr4xPBCv3%2FIX9Gl%2FPRHSC6FQrDfMpBlS%2BE41hb0Mh2aggv1z%2FQX%2FF2KJ6%2Bhv9VQSQ%2BRQfK7bZxR%2FwfrJwwJ4jtXLnjh6wzhDqnidrkgwdt8HgmXzP4ukomSNgDzM%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=14400
cf-ray: 6fbeb026de9417fd-EWR

GET
H2 200 OneSignalSDK.js Show response
cdn.onesignal.com/sdks/ 9 KB
3 KB 85ms
36ms Script
application/javascript 2606:4700::6812:e234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js
Requested by: Host: wonderfulleafs.com
URL: https://wonderfulleafs.com/js/en2.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5df9eee36a61ef8f89d39c04ff402ded30aa9c627b6ef2134f55fa0e8b537153

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:05 GMT
content-encoding: br
cf-cache-status: HIT
server: cloudflare
age: 3532
etag: W/"a393ad4e03deeab316f7121a80708ce6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 6fbeb02788969e02-EWR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Sun, 17 Apr 2022 19:01:05 GMT

GET
H2 200 / Show response
securemobileconnect.com/api/push/external_v2/ 1013 B
1 KB 149ms
87ms Script
application/javascript 2606:4700:3036::ac43:a69f

General

Check archive.org

Show headers Download Go to

Full URL

https://securemobileconnect.com/api/push/external_v2/?key=3dawv70tE2EJRSbJ&url=wonderfulleafs.com&n=9994

Requested by

Host: wonderfulleafs.com
URL: https://wonderfulleafs.com/js/en2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3036::ac43:a69f , United States, ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

eb6d8d5140ee33621d4aad60f5fbaae05d1ed912233df966afbf4d8ec32cb800

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:05 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-ratelimit-remaining: 59
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6kiA1UfDR8wfvD79%2ByBhi9vZ4Ju4WP5vyzxr0vcgOZNus3wI%2F5GrbLBAAZo9%2B9JoPMQlJ9uKgbxLoV52dnzrcMQuGk2eP1l9dHvVXILVumL5ONI96tHaXIIwJN2DNvRXl0juZ%2FGuSoZ7cKdxaNuEOoE37jvttg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
cache-control: no-cache, private
x-ratelimit-limit: 60
cf-ray: 6fbeb027ab628c41-EWR

GET
H3 200 rebrand.png
wonderfulleafs.com/images/ 78 KB
79 KB 177ms
177ms Image
image/png 2606:4700:3033::6815:a6e

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://wonderfulleafs.com/images/rebrand.png

Requested by

Host: wonderfulleafs.com
URL: https://wonderfulleafs.com/css/main.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:a6e , United States, ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

93816b5f14f3258d54083058fb86e3b33a37e362cd9fe6a54ab63a0c8c092d12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/css/main.css
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:05 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1917
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 79869
x-xss-protection: 1; mode=block
last-modified: Sat, 09 Apr 2022 03:50:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "625102a2-137fd"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LmSpcifh4tSFFgzZ2R1zL9Ftdf%2F0btFZKe%2BXBs5ZK4iNycCDKNCBeO1oUPPdQfUnJ9s0o%2BzfpzX8svUgufCgZ2eICToYn%2BfhqptLFnVceV23ggx9Gk3tB6LOpXGS1MR2NY3xlWu6gluzucdy6IVyA1E%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6fbeb0274fe717fd-EWR

GET
H3 200 icons.png
wonderfulleafs.com/images/ 138 KB
139 KB 179ms
179ms Image
image/png 2606:4700:3033::6815:a6e

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://wonderfulleafs.com/images/icons.png

Requested by

Host: wonderfulleafs.com
URL: https://wonderfulleafs.com/css/main.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:a6e , United States, ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

a6b4082c9aa8e461ca7a584f54c2d6a56aed4cc14de796982acb606698e9c6be

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/css/main.css
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:05 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1504
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 141606
x-xss-protection: 1; mode=block
last-modified: Sat, 09 Apr 2022 03:50:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "625102a2-22926"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wRn7aey4NR%2BFxQn1EHszJRt4TurHt1VSeXzQ4sTzqlR%2BWbOkm0Ey7aKCgSSCGobY1JLa1%2FFKBWW9WPF8BBuRdYeoa2EhUQFRNSwzULI3bg%2Fp88CH7NGadScXzDj7agb0%2B%2FkWUPdpqVbWzgTzXMpMX0U%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6fbeb0274fe817fd-EWR

GET
H3 200 OneSignalPageSDKES6.js Show response
cdn.onesignal.com/sdks/ 283 KB
68 KB 107ms
51ms Script
application/javascript 2606:4700::6812:e234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151513
Requested by: Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalSDK.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7512bf3b9ec62642bc0800d0ca3c5b8b37a1384814cc7a29d31f6823740fd403

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:05 GMT
content-encoding: br
cf-cache-status: HIT
server: cloudflare
age: 2822
etag: W/"0e269028feac530d16f00d8dad8ece74"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 6fbeb0284bde8c2a-EWR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Sun, 17 Apr 2022 19:01:05 GMT

GET
H2 200 web Show response
onesignal.com/api/v1/sync/d75f0663-bfaa-4d47-934d-8c8e7090a9a1/ 3 KB
2 KB 52ms
39ms Script
text/javascript 2606:4700::6812:e234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/api/v1/sync/d75f0663-bfaa-4d47-934d-8c8e7090a9a1/web?callback=__jp0

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151513

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b1c6427a90501ead91a4a0aaafa64370b653246b2fdc8781137301e679ff8a96

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:06 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
x-permitted-cross-domain-policies: none
age: 944
cf-polished: origSize=3070
status: 200 OK
x-envoy-upstream-service-time: 62
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
x-request-id: 21790b47-f9ab-459e-95cf-4a512c968642
x-runtime: 0.060801
referrer-policy: strict-origin-when-cross-origin
cf-bgj: minify
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"713bea131159442937cd2f0938b83452"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-download-options: noopen
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=3600
cf-ray: 6fbeb0291c429e02-EWR
access-control-allow-headers: SDK-Version
expires: Thu, 14 Apr 2022 20:01:06 GMT

GET
H3 200 OneSignalSDKStyles.css
onesignal.com/sdks/ 82 KB
9 KB 34ms
34ms Stylesheet
text/css 2606:4700::6812:e234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://onesignal.com/sdks/OneSignalSDKStyles.css?v=2
Requested by: Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151513
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:e234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:06 GMT
content-encoding: br
cf-cache-status: HIT
server: cloudflare
age: 2853
etag: W/"4e9aaefffd5f8ae7dc83361aa2294190"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=2592000
cf-ray: 6fbeb0297f1c8c2a-EWR
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Sat, 14 May 2022 19:01:06 GMT

GET
H3 200 icon Show response
onesignal.com/api/v1/apps/d75f0663-bfaa-4d47-934d-8c8e7090a9a1/ 134 B
607 B 97ms
72ms Fetch
application/json 2606:4700::6812:e134

General

Check archive.org

Show headers Download Go to

Full URL

https://onesignal.com/api/v1/apps/d75f0663-bfaa-4d47-934d-8c8e7090a9a1/icon

Requested by

Host: cdn.onesignal.com
URL: https://cdn.onesignal.com/sdks/OneSignalPageSDKES6.js?v=151513

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:e134 , United States, ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

f11799747bde611ed5876b02f1be61a903c9cc701a799e48b5e2f4e9aaa205fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:06 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
x-permitted-cross-domain-policies: none
status: 200 OK
x-envoy-upstream-service-time: 13
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
x-request-id: ae329899-3325-49b3-ba3c-15db5608fd58
x-runtime: 0.011631
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"f11799747bde611ed5876b02f1be61a9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-download-options: noopen
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=0, private, must-revalidate
cf-ray: 6fbeb029edace6d8-EWR
access-control-allow-headers: SDK-Version

GET
H3 200 push_icon.gif
wonderfulleafs.com/images/ 14 KB
15 KB 43ms
43ms Image
image/gif 2606:4700:3033::6815:a6e

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://wonderfulleafs.com/images/push_icon.gif

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:a6e , United States, ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

c0b6da75213822915b913b547863fbf877312b625f9e0ca141c49ea24995b525

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://wonderfulleafs.com/?a=3073&sub1=jdog+clicker6.csv&sub2=&sub3=cbd3&sub4=88&sub5=vzw
User-Agent: Mozilla/5.0 (Android 11; Mobile; LG-M255; rv:90.0) Gecko/90.0 Firefox/90.0

Response headers

date: Thu, 14 Apr 2022 19:01:06 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 4828
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 14555
x-xss-protection: 1; mode=block
last-modified: Sat, 09 Apr 2022 03:50:58 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "625102a2-38db"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QTom0WGAGFLwsOEPD1UixVewondwF5Bwj%2BvnSEeknz8ifHX%2FoVWYKM61ReDYlh5EcFEpV4YUwBezRKCST7Sg8%2B4FhefCZNN7wdVUKGIusURIZD2ZD4w01vPq1ANM0PHqI8mqhZkEa8haNEPzIg8PE%2BY%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 6fbeb02a6f3517fd-EWR

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Weightloss Scam (Online)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
drozreport.com/	1969-12-31 23:59:59	Name: .AspNetCore.Session Value: CfDJ8CR4mzCC83dMmj7xsRnIVr0KZbUK81N5qHjaJ10YPTFifqHN2LXdhS13jDt1U%2BTcnT%2FTuCeS3M8zSLzu2LImq4c4wy8ljxDyGcA7nz%2FrYaWsls8xYBPH%2BGPYRQ7KxJ%2B8jdkj4jJzfJoP%2FEc23ftBxKLg2bVH6ph6yMz5tuCdjXDQ
drozreport.com/	1969-12-31 23:59:59	Name: SERVERID Value: 9cddff754903387d92eabe7cad05b4d1\|1649962865\|1649962865
wonderfulleafs.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 6mbp6fu5bl77dfsp43cftuqvki

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.onesignal.com
drozreport.com
onesignal.com
securemobileconnect.com
wonderfulleafs.com
2606:4700:3033::6815:a6e
2606:4700:3036::ac43:a69f
2606:4700:3036::ac43:c521
2606:4700::6812:e134
2606:4700::6812:e234
074c3fee1b061ff55a401621ad8c073e912425b70bf05ba2f1c57622d8f00668
0e48a851744148120e20c50902cdea6f268c013eda78f87100d6cfa926ecce5c
1cb5d9ce505a301b6312b9e73e8f4562f6f11f9f309f3258007ae8007abcd4ad
2379a76189c0b9488fb7febade453f6060b26157bfeb3663c7ea06a444d7c789
2ea172b3e4e97c2247147aa4b750d0e447d7a091a0178e6f53a2c817bd07e7d1
41c837664607a03d0114fcfd3656f27f85d742f789d0d53e8b597c3bfdd7e090
4a928a624656a7d4413aa782f1cb7d8e98ce04f42f794d79b36143998098d2f4
4ffe9e6639153f7dd05487eab1440afde4e5130f16b3c63a99d5f9e484cdad8b
58fd47c973c04e47074ca7ba6472c84114c5bdf49463627c203cbaee59310e7d
596492fc8fdb5fc82f4a85b54b4a52ed6596f4f8d75d5e04808dfa4cb1688d7e
5df9eee36a61ef8f89d39c04ff402ded30aa9c627b6ef2134f55fa0e8b537153
65c50446ae3ec1cf77b8e71d703ac383f6babed6d1facf62f2ec228c30550d8f
6b78fa6b65f103f7003b2e7b718112009d92d98d918e6d2e09e56b6fb974d319
6c1a0397bfbb65501438aa972a005843602e127f2b0f5467d7c0d8fe9ae96752
7512bf3b9ec62642bc0800d0ca3c5b8b37a1384814cc7a29d31f6823740fd403
75c73228a616c89e9212295a82f861b6a8a37a1ef013acff1cc2330f8e76a00e
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
79a3b0af421c0e4d2f02dc0e777b823100527ea9e28ae1345d3a19a35ede2105
7ebf0402ee62bae00a6ded482e97c47ed1cf74b9fa6a602fd4d57b376ddd539a
888dccfa93119ce00f9cc4764d37af91a95a3e55fbe1a4da510d4bcc579ddaba
902344788c8900dcee803e4055683da19776bcd36eeb23f1eb688e9eb5ca7160
91dfb0ad3a52c36c2e82dcb561250a22ccff3d87a0461f3f35c2401f99cf8450
93816b5f14f3258d54083058fb86e3b33a37e362cd9fe6a54ab63a0c8c092d12
947a568a0ea6373c979c4606c9846c9020c8dada4c8957ee34abb9336c480bc6
a66c0cde2d9a77bb5ad4556a11982f5edd795ef0a52a66cf1075ab4e8e48d4b6
a6b4082c9aa8e461ca7a584f54c2d6a56aed4cc14de796982acb606698e9c6be
ab0d6ca856c3af2377dc800b8e4866d86749ce277a87073df6c49eb1d02be767
ac8ff35b4cad40410456b17b27aa21affe0483571c588167a7cff659f74e6c90
b1c6427a90501ead91a4a0aaafa64370b653246b2fdc8781137301e679ff8a96
bebd1cff3dc9e4531dc0c9c103ac928fdb5fac57081c72df1f85b3522032aa60
c0b6da75213822915b913b547863fbf877312b625f9e0ca141c49ea24995b525
c529d59b171382f4c85a45e50c473bf6bb7bc8952902762b7fa5e09f67fc4c2c
c651bf84aeaf4a7ee424b9141f880bbd6fdef5a5b13a4abbbfe16c5c7487e1e7
d4e730980b14b141944005536f28f5092e367cef7bc1d78b409f43cec090f0e0
db7e0b393e175f19922fefbdcaa2866fca209c521d01cc834ae06cbf8d0f91b7
e0b4e806d14a848b60771ce921ae209b40037f6f003fd7533c122aaa4d4d7fa2
e21746296fdaca1a9baf26ac8d267ec4888386ff631451a9f55f1a38717bdcce
e8783a6e94254f7c6f710d69442152f7a3fdd5791fdd4e94bea126ad32e5c681
eb6d8d5140ee33621d4aad60f5fbaae05d1ed912233df966afbf4d8ec32cb800
f11799747bde611ed5876b02f1be61a903c9cc701a799e48b5e2f4e9aaa205fb

wonderfulleafs.com Open in urlscan Pro 2606:4700:3033::6815:a6e Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

40 Requests

100 %HTTPS

100 %IPv6

4 Domains

5 Subdomains

4 IPs

1 Countries

1289 kBTransfer

2228 kBSize

3 Cookies

2 Outgoing links

Page URL History

Redirected requests

40 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

wonderfulleafs.com Open in urlscan Pro
2606:4700:3033::6815:a6e Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

40
Requests

100 %
HTTPS

100 %
IPv6

4
Domains

5
Subdomains

4
IPs

1
Countries

1289 kB
Transfer

2228 kB
Size

3
Cookies

40 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!