dihaurefuidkuilopsee.life Open in urlscan Pro
104.21.96.1 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://xmo.qleak.click/
Effective URL:
https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=971
Submission: On December 16 via api (December 16th 2024, 7:55:57 pm UTC) from US — Scanned from FR

Summary HTTP 26 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 6 IPs in 2 countries across 4 domains to perform 26 HTTP transactions. The main IP is 104.21.96.1, located in and belongs to CLOUDFLARENET, US. The main domain is dihaurefuidkuilopsee.life.
TLS certificate: Issued by WE1 on December 1st 2024. Valid for: 3 months.

This is the only time dihaurefuidkuilopsee.life was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	172.67.203.106 172.67.203.106	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 6	172.67.217.77 172.67.217.77	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	104.21.96.1 104.21.96.1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	104.18.95.41 104.18.95.41	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	104.18.94.41 104.18.94.41	13335 (CLOUDFLAR...) (CLOUDFLARENET)
26	6

2 172.67.203.106 (United States)

ASN13335 (CLOUDFLARENET, US)

xmo.qleak.click	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 172.67.217.77 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

matomo.q1eak.click	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
n1kb.q1eak.click	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 104.21.96.1 (None, )

ASN13335 (CLOUDFLARENET, US)

dihaurefuidkuilopsee.life	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.95.41 (None, )

ASN13335 (CLOUDFLARENET, US)

challenges.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.94.41 (None, )

ASN13335 (CLOUDFLARENET, US)

challenges.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	dihaurefuidkuilopsee.life dihaurefuidkuilopsee.life	137 KB
6	q1eak.click 1 redirects matomo.q1eak.click n1kb.q1eak.click	27 KB
4	cloudflare.com challenges.cloudflare.com — Cisco Umbrella Rank: 3147	16 KB
2	qleak.click xmo.qleak.click	2 KB
26	4

	Domain	Requested by
11	dihaurefuidkuilopsee.life	dihaurefuidkuilopsee.life xmo.qleak.click
5	matomo.q1eak.click	xmo.qleak.click matomo.q1eak.click
4	challenges.cloudflare.com	dihaurefuidkuilopsee.life challenges.cloudflare.com
2	xmo.qleak.click
1	n1kb.q1eak.click	1 redirects
26	5

This site contains links to these domains. Also see Links.

Domain
www.cloudflare.com

Subject Issuer	Validity	Valid
qleak.click WE1	`2024-11-25` - `2025-02-23`	3 months	crt.sh
q1eak.click WE1	`2024-11-25` - `2025-02-23`	3 months	crt.sh
dihaurefuidkuilopsee.life WE1	`2024-12-01` - `2025-03-01`	3 months	crt.sh
challenges.cloudflare.com WE1	`2024-11-03` - `2025-02-01`	3 months	crt.sh

This page contains 3 frames:

Primary Page: https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=971
Frame ID: FB549CC0D3B1BD47E485C787E77D3EC7
Requests: 20 HTTP requests in this frame

Frame: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/m8jia/0x4AAAAAAADnOjc0PNeA8qVm/light/fbE/normal/auto/
Frame ID: 855FFBC52C4010C9C1FA16EB21D8C952
Requests: 1 HTTP requests in this frame

Frame: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/jip76/0x4AAAAAAADnOjc0PNeA8qVm/light/fbE/normal/auto/
Frame ID: 3A98A486F4EA4EFFC14FCC5F867E7943
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Un instant…

Page URL History Show full URLs

http://xmo.qleak.click/ HTTP 307
https://xmo.qleak.click/ Page URL
https://n1kb.q1eak.click/leak-id-VmZENXFJSmZsV0Y2NWxuV3FEUTNNUjhtajV5b0I2YXgxMG52eERnSmhneVl0dUxSeU9n... HTTP 302
https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=971 Page URL
https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=971 Page URL

Detected technologies

Matomo Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

piwik\.js|piwik\.php

Page Statistics

26
Requests

85 %
HTTPS

0 %
IPv6

4
Domains

5
Subdomains

6
IPs

2
Countries

181 kB
Transfer

420 kB
Size

6
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.cloudflare.com/?utm_source=challenge&utm_campaign=j
Title: Cloudflare

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://xmo.qleak.click/ HTTP 307
https://xmo.qleak.click/ Page URL
https://n1kb.q1eak.click/leak-id-VmZENXFJSmZsV0Y2NWxuV3FEUTNNUjhtajV5b0I2YXgxMG52eERnSmhneVl0dUxSeU9ncTVFemViemUxNlFOZw== HTTP 302
https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=971 Page URL
https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=971 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://xmo.qleak.click/ HTTP 307
https://xmo.qleak.click/

Request Chain 7

https://n1kb.q1eak.click/leak-id-VmZENXFJSmZsV0Y2NWxuV3FEUTNNUjhtajV5b0I2YXgxMG52eERnSmhneVl0dUxSeU9ncTVFemViemUxNlFOZw== HTTP 302
https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=971

26 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

200

/ Show response
xmo.qleak.click/
Redirect Chain

http://xmo.qleak.click/
https://xmo.qleak.click/

1 KB
1 KB

215ms
75ms

Document
text/html

172.67.203.106
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://xmo.qleak.click/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.203.106 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 925dddae5afb3b944af3a0f53bb8d11260b2c7e16f3b55056261256a876ac237

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8f313b817ac56edf-CDG
content-encoding: zstd
content-type: text/html; charset=utf-8
date: Mon, 16 Dec 2024 19:55:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9ZJJsxJbjeVMBlNLdptf0cG1h9PSjc8SasiC9aCskG5ApwK7p8XtdXILGIOeMl3R4qDMt5bcehc3c9ajG21Rk2rdeUWI8ZbngZdiXHax9suDlYlOgzEStTTP%2FHVcu5fSfyE%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=16437&min_rtt=16092&rtt_var=3765&sent=12&recv=10&lost=0&retrans=0&sent_bytes=4187&recv_bytes=4487&delivery_rate=34690&cwnd=12000&unsent_bytes=0&cid=525e227682861991&ts=159&x=1" cfExtPri cfHdrFlush;dur=0
vary: accept-encoding

Redirect headers

Location: https://xmo.qleak.click/
Non-Authoritative-Reason: HttpsUpgrades

GET
H3 200 piwik.js Show response
matomo.q1eak.click/ 64 KB
23 KB 407ms
85ms Script
application/javascript 172.67.217.77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://matomo.q1eak.click/piwik.js
Requested by: Host: xmo.qleak.click
URL: https://xmo.qleak.click/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.217.77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d7fc375178c93a2fc15fd888e30170eedf4ef3d04497e7f951ab7bfe0c921693

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://xmo.qleak.click/

Response headers

content-encoding: zstd
cf-cache-status: HIT
etag: W/"64a9baf6-10132"
age: 21146689
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V5v%2BJMZzrwKh%2F4MKHH1SBjqJihokv%2F0nqN2UlYb77T6xvZaEZ3kaSXUTGPO6baa2SBAfkyc7mJ0%2BXt%2Bq%2BmjyVsfnsSumHny9jmHWdAefZBll3LUJWMk7Fsa39YPJowcsmnBhqfQ%3D"}],"group":"cf-nel","max_age":604800}
expires: Thu, 31 Dec 2037 23:55:55 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=30108&min_rtt=21767&rtt_var=19009&sent=14&recv=10&lost=0&retrans=0&sent_bytes=4221&recv_bytes=4375&delivery_rate=10081&cwnd=12000&unsent_bytes=0&cid=b2b321b0200d6539&ts=330&x=1", cfExtPri, cfHdrFlush;dur=0
date: Mon, 16 Dec 2024 19:55:42 GMT
content-type: application/javascript
last-modified: Sat, 08 Jul 2023 19:37:26 GMT
vary: Accept-Encoding
priority: u=3,i=?0
cache-control: max-age=315360000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 8f313b899b0a9987-CDG
server: cloudflare

POST
H3 204 piwik.php
matomo.q1eak.click/ 0
645 B 131ms
130ms Ping
text/html 172.67.217.77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://matomo.q1eak.click/piwik.php?action_name=&idsite=971&rec=1&r=470529&h=20&m=55&s=43&url=https%3A%2F%2Ftelegra.ph%2F-&urlref=https%3A%2F%2Ftelegra.ph%2F-&_id=bd465eac01b13ba3&_idn=1&send_image=0&_refts=1734378943&_ref=https%3A%2F%2Ftelegra.ph%2F-&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1600x1200&pv_id=bX5ahK&pf_net=143&pf_srv=72&pf_tfr=4&pf_dm1=634&uadata=%7B%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%7D
Requested by: Host: matomo.q1eak.click
URL: https://matomo.q1eak.click/piwik.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.217.77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=utf-8
Referer: https://xmo.qleak.click/

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kVuSpZ4WYY0E4hQ2E6i4UUw2rhtHV6%2BSlTh6bFvSGHG66u9PaZ69YuO3xupiaNG718E5o3h3yXwrHQY1sNs23V3%2BFptmhSPJF0CBX4AXqkrmbXPCGZeKtWdP0VQhxOMcrnCZzX4%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8f313b8b4d259987-CDG
access-control-allow-origin: https://xmo.qleak.click
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=34419&min_rtt=21767&rtt_var=6644&sent=39&recv=25&lost=0&retrans=1&sent_bytes=28499&recv_bytes=6351&delivery_rate=3094&cwnd=21600&unsent_bytes=0&cid=b2b321b0200d6539&ts=685&x=1", cfExtPri, cfHdrFlush;dur=0
date: Mon, 16 Dec 2024 19:55:43 GMT
content-type: text/html; charset=UTF-8
server: cloudflare
priority: u=4,i

POST
H3 204 piwik.php
matomo.q1eak.click/ 0
647 B 164ms
154ms Ping
text/html 172.67.217.77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://matomo.q1eak.click/piwik.php?action_name=&idsite=1&rec=1&r=939595&h=20&m=55&s=43&url=https%3A%2F%2Ftelegra.ph%2F-&urlref=https%3A%2F%2Ftelegra.ph%2F-&_id=61cd4a81de02f2b1&_idn=1&send_image=0&_refts=1734378943&_ref=https%3A%2F%2Ftelegra.ph%2F-&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1600x1200&pv_id=9b3YEE&pf_net=143&pf_srv=72&pf_tfr=4&pf_dm1=634&uadata=%7B%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%7D
Requested by: Host: matomo.q1eak.click
URL: https://matomo.q1eak.click/piwik.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.217.77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=utf-8
Referer: https://xmo.qleak.click/

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7gRouDJmGHkM9gzBKdoQ%2BrfhXjZnB7oO1zRYmKxP%2BKqsP9keoV5qV3m%2F2JeC5qZNrLonK7NnqUEXpP%2FBqAcRb1Q2IdDrg1Ru60AmigFa7RS2o3wdPZb6z98HiWcPmA6RO19LLRw%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8f313b8b9d6f9987-CDG
access-control-allow-origin: https://xmo.qleak.click
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=34419&min_rtt=21767&rtt_var=6644&sent=40&recv=25&lost=0&retrans=1&sent_bytes=29167&recv_bytes=6351&delivery_rate=3094&cwnd=21600&unsent_bytes=0&cid=b2b321b0200d6539&ts=716&x=1", cfExtPri, cfHdrFlush;dur=0
date: Mon, 16 Dec 2024 19:55:43 GMT
content-type: text/html; charset=UTF-8
server: cloudflare
priority: u=4,i

GET
H3 404 favicon.ico
xmo.qleak.click/ 571 B
819 B 77ms
77ms Other
text/html 172.67.203.106
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://xmo.qleak.click/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.203.106 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d50b9852ce176350c41f3a8b9bc01132659f8b18b9ccec1cdea6e98d28176daf

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://xmo.qleak.click/

Response headers

cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: MISS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Bt%2Bck8BEMxsHIwbCVp1i0SfjUEpppla4YFdDlR1pDowRTBlmXOQmyC4MOkyLHBUjiFVVxXE4POZ2ZPlfOFIBAyolHl05CVjoUcw4M8aNqpGrV1I4p4KW8pTgjAzGTnTs9tQ%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8f313b8b9f5f6edf-CDG
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=18994&min_rtt=16092&rtt_var=6554&sent=16&recv=13&lost=0&retrans=0&sent_bytes=5600&recv_bytes=5143&delivery_rate=51751&cwnd=12000&unsent_bytes=0&cid=525e227682861991&ts=1776&x=1", cfExtPri, cfHdrFlush;dur=0
date: Mon, 16 Dec 2024 19:55:43 GMT
content-type: text/html
vary: Accept-Encoding
server: cloudflare
priority: u=1,i

POST
H3 204 piwik.php
matomo.q1eak.click/ 0
646 B 101ms
99ms Ping
text/html 172.67.217.77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://matomo.q1eak.click/piwik.php?idgoal=1&idsite=971&rec=1&r=431148&h=20&m=55&s=43&url=https%3A%2F%2Ftelegra.ph%2F-&urlref=https%3A%2F%2Ftelegra.ph%2F-&_id=bd465eac01b13ba3&_idn=0&send_image=0&_refts=1734378943&_ref=https%3A%2F%2Ftelegra.ph%2F-&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1600x1200&pv_id=bX5ahK&uadata=%7B%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%7D
Requested by: Host: matomo.q1eak.click
URL: https://matomo.q1eak.click/piwik.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.217.77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=utf-8
Referer: https://xmo.qleak.click/

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pYy7awmo41Kr6goYV%2FMJDbxR2BJpp7Wh3NZFn5aOdQFmHfYv2aGm%2FkNJ9J50VyKOfSeSJ6vnoUpC6qnHADiwm5CbCMq6UGD8ZOnR%2BmiipZZQNYdO5r5XWNIj3FOR6sOIAakV2dM%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8f313b906b209987-CDG
access-control-allow-origin: https://xmo.qleak.click
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=34806&min_rtt=21767&rtt_var=4430&sent=44&recv=29&lost=0&retrans=2&sent_bytes=30561&recv_bytes=7787&delivery_rate=6046&cwnd=21600&unsent_bytes=0&cid=b2b321b0200d6539&ts=1441&x=1", cfExtPri, cfHdrFlush;dur=0
date: Mon, 16 Dec 2024 19:55:44 GMT
content-type: text/html; charset=UTF-8
server: cloudflare
priority: u=4,i

POST
H3 400 piwik.php
matomo.q1eak.click/ 410 B
1 KB 79ms
76ms Ping
text/html 172.67.217.77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://matomo.q1eak.click/piwik.php?idgoal=1&idsite=1&rec=1&r=018344&h=20&m=55&s=43&url=https%3A%2F%2Ftelegra.ph%2F-&urlref=https%3A%2F%2Ftelegra.ph%2F-&_id=61cd4a81de02f2b1&_idn=0&send_image=0&_refts=1734378943&_ref=https%3A%2F%2Ftelegra.ph%2F-&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1600x1200&pv_id=9b3YEE&uadata=%7B%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%7D
Requested by: Host: matomo.q1eak.click
URL: https://matomo.q1eak.click/piwik.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 172.67.217.77 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=utf-8
Referer: https://xmo.qleak.click/

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xgMJN0zEhJ5e5RUvFiDYAO5UFg3CaIrIRn7NtI0qtXz6qd8AwgEWjPSpOL8iD%2Fp605mrBgxx3M%2Bbh5ZJngYXlojgq6zyjlKnlJ6WhCwETGqZ0nVsDKecgA5bZxbP0L9e4fE16dU%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 8f313b906b249987-CDG
access-control-allow-origin: https://xmo.qleak.click
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=34806&min_rtt=21767&rtt_var=4430&sent=45&recv=29&lost=0&retrans=2&sent_bytes=31230&recv_bytes=7787&delivery_rate=6046&cwnd=21600&unsent_bytes=0&cid=b2b321b0200d6539&ts=1442&x=1", cfExtPri, cfHdrFlush;dur=0
date: Mon, 16 Dec 2024 19:55:44 GMT
content-type: text/html; charset=UTF-8
server: cloudflare
priority: u=4,i

GET
H3

403

/ Show response
dihaurefuidkuilopsee.life/
Redirect Chain

https://n1kb.q1eak.click/leak-id-VmZENXFJSmZsV0Y2NWxuV3FEUTNNUjhtajV5b0I2YXgxMG52eERnSmhneVl0dUxSeU9ncTVFemViemUxNlFOZw==
https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=971

9 KB
8 KB

145ms
82ms

Document
text/html

104.21.96.1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=971

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.96.1 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

588c4458dfeb7798b8bbb7f53b15b0e9ffe7d033802fa26af31892c106e4e730

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://xmo.qleak.click/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
alt-svc: h3=":443"; ma=86400
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-chl-out: yhaYojxmkH1eZR+5l2ms6yXAPk6sGhS0rfyKlAjL9CkToOAOhnmYRXZagh53OYwEr3e4ZHLY7HKGW5L4W+OC0rMkAcrAMbzPUuyWQ+BSJhWSWG/BE+bLCYFyyJJo1lQMcXyZfrUg8e96TyYpelTXtA==$gMyFwUIbchBdAsgRN6d20Q==
cf-mitigated: challenge
cf-ray: 8f313b94c9203d11-CDG
content-encoding: zstd
content-type: text/html; charset=UTF-8
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
date: Mon, 16 Dec 2024 19:55:44 GMT
expires: Thu, 01 Jan 1970 00:00:01 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w3tLAuVlnG30w%2Bkw%2BVUdxM2Dku25RDavLE33GqwQMXsfJfseuloKoBinBsiU%2BjFm95a%2F7J7DgGgJgY8%2B1%2FfpV2eWBtcbywMOxivJqFUM7dABhRx49zC4dKDdfoFobuKL%2FUWaM53npHvLGr1Z"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-content-options: nosniff
x-frame-options: SAMEORIGIN

Redirect headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8f313b942aa49e75-CDG
content-type: text/html; charset=UTF-8
date: Mon, 16 Dec 2024 19:55:44 GMT
location: https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=971
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
priority: u=0,i
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=65DKKEjYBkd7QgL9I2HX%2FpKq5DoIV%2Bassv8FEcSh2zWzkyDr2o7a84Zdmfj%2BR7mtog50eUvs7JfRk4M19pZ1%2BRsrljh9zjvMo5wdhiz4HEYP7HoFShVAUVYZnw5YwVlUKnl2"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-timing: cfL4;desc="?proto=QUIC&rtt=17418&min_rtt=17195&rtt_var=6607&sent=11&recv=8&lost=0&retrans=0&sent_bytes=4152&recv_bytes=4492&delivery_rate=151403&cwnd=12000&unsent_bytes=0&cid=250f388b1922f02e&ts=129&x=1" cfExtPri cfHdrFlush;dur=0

GET
H3 200 v1 Show response
dihaurefuidkuilopsee.life/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/ 93 KB
37 KB 42ms
25ms Script
application/javascript 104.21.96.1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dihaurefuidkuilopsee.life/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8f313b94c9203d11
Requested by: Host: dihaurefuidkuilopsee.life
URL: https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=971
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.96.1 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 09b4872df6cd0884c8eb07dc29f978f80e648d7c9683993dccf136680196a2f8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=971&__cf_chl_rt_tk=uU0U4PShKLHjRzmfRJ.CG3akq9OEnrFgr328eYGzj4I-1734378944-1.0.1.1-3CdzAdD4TgHLA9i8rSfkZgdMHYAlH2m2uwsdEcJC4Ns

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-encoding: zstd
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NL9qJscEm4hM%2BvCBwKsVJYXwR2Ic9NY1FR5lOKLjfToJ%2FLSba3lraCXZyLbp4v%2BmVcrmLVpUQxXM9aF73dzFrxGOro%2FsCvQfoLA2YbnnwzhHMha7SwYBDrp7Ix83gzJFjfxOGR3HYLMf13JF"}],"group":"cf-nel","max_age":604800}
cf-ray: 8f313b9649223d11-CDG
alt-svc: h3=":443"; ma=86400
date: Mon, 16 Dec 2024 19:55:45 GMT
content-type: application/javascript; charset=UTF-8
server: cloudflare

GET 0ba456db-35a2-4b6d-9341-3e1626d621f8
https://dihaurefuidkuilopsee.life/ Frame 0
0

GET
H3 200 api.js Show response
challenges.cloudflare.com/turnstile/v0/b/787bc399e22f/ 47 KB
16 KB 102ms
48ms Script
application/javascript 104.18.95.41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://challenges.cloudflare.com/turnstile/v0/b/787bc399e22f/api.js?onload=WXqDk4&render=explicit
Requested by: Host: dihaurefuidkuilopsee.life
URL: https://dihaurefuidkuilopsee.life/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8f313b94c9203d11
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.95.41 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5aac9e52f80011983676c03ad8120e0369e651e6357d0b05054026a3bc8ec32d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://dihaurefuidkuilopsee.life
Referer

Response headers

server: cloudflare
cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public
content-encoding: br
cross-origin-resource-policy: cross-origin
cf-ray: 8f313b97e8507906-CDG
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 16 Dec 2024 19:55:45 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Tue, 10 Dec 2024 17:31:41 GMT
vary: Accept-Encoding
priority: u=3,i=?0

GET
H3 403 favicon.ico
dihaurefuidkuilopsee.life/ 7 KB
7 KB 25ms
17ms Image
text/html 104.21.96.1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dihaurefuidkuilopsee.life/favicon.ico

Requested by

Host: dihaurefuidkuilopsee.life
URL: https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=971

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.96.1 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

578bbdb8f5605f8c33486bc815f05ead84d6599e0537e71d7b95a7e05ceb6216

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=971

Response headers

content-encoding: zstd
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Pv1gCE9AGyg%2FAGCjJQ%2BsRJMLN4O8giGFzOff%2BgxOm8Z%2BNVGF4unvqg32U4XtQfY7VvTjegHzVn4ZozSOWXVEj1TurUZpr7dpH4pDfF%2FWVcj6ezhCPyHhdLH3qg8qo7cQw4rHIZjf9pMbeajT"}],"group":"cf-nel","max_age":604800}
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
expires: Thu, 01 Jan 1970 00:00:01 GMT
alt-svc: h3=":443"; ma=86400
x-content-options: nosniff
date: Mon, 16 Dec 2024 19:55:45 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: IUSEsvgjj9guUKDt+xEMWQR+gz1OFU8JYiqI+mPyqZVSp3+b9OGWU7WUx7bXvTb+V/gRopnuSUcCiqvatY8EOslAQDMbGomiBvr8Q+o/FJmaLY/Q7iD8UNZCmJKg71EN8Tq77TiTfy/mqqmhPdL7jg==$28rDgtBSEd03zZm9lbiBCQ==
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cross-origin-opener-policy: same-origin
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-resource-policy: same-origin
referrer-policy: same-origin
cf-ray: 8f313b97d92a3d11-CDG
cross-origin-embedder-policy: require-corp
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
origin-agent-cluster: ?1
server: cloudflare

POST
H3 200 zrMdhMnfTgq6pH5HBnHywT0.hMQlv0tD6st3OftNf3I-1734378944-1.2.1.1-VoFmXpeCrze9jRcKXEx8COicidVUeEWtz3edbzHVCa2U3cKLf8RIzaHymtk8D4Ni Show response
dihaurefuidkuilopsee.life/cdn-cgi/challenge-platform/h/b/flow/ov1/172958284:1734376505:SxclH4leyZV9mPQvosOVjZ2cL87jGM3ZoMRCl-qcj3Q/8f313b94c9203d11/ 13 KB
9 KB 62ms
60ms XHR
text/plain 104.21.96.1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dihaurefuidkuilopsee.life/cdn-cgi/challenge-platform/h/b/flow/ov1/172958284:1734376505:SxclH4leyZV9mPQvosOVjZ2cL87jGM3ZoMRCl-qcj3Q/8f313b94c9203d11/zrMdhMnfTgq6pH5HBnHywT0.hMQlv0tD6st3OftNf3I-1734378944-1.2.1.1-VoFmXpeCrze9jRcKXEx8COicidVUeEWtz3edbzHVCa2U3cKLf8RIzaHymtk8D4Ni
Requested by: Host: dihaurefuidkuilopsee.life
URL: https://dihaurefuidkuilopsee.life/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8f313b94c9203d11
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.96.1 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e9290c58cd215c0401ee00ca817a6ad83b2b5d108a5cc63c1857cd1d7c0f0693

Request headers

Referer: https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=971
CF-Chl-RetryAttempt: 0
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
CF-Challenge: zrMdhMnfTgq6pH5HBnHywT0.hMQlv0tD6st3OftNf3I-1734378944-1.2.1.1-VoFmXpeCrze9jRcKXEx8COicidVUeEWtz3edbzHVCa2U3cKLf8RIzaHymtk8D4Ni

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SYhGZ0sJI2VzqgPBJbWCjo2nmW7pkZg8FIiMfD8oVy0U6VTPXERlooLNrtV5bFrpm%2F2r0FoFJqWRxBDVRfdrGw0QHVBt5N4QwLGa64pSh6sEwJFT1qVX15AF2%2BdjCQ9Agxyab3KYFBGjw6n6"}],"group":"cf-nel","max_age":604800}
cf-ray: 8f313b98c92c3d11-CDG
alt-svc: h3=":443"; ma=86400
date: Mon, 16 Dec 2024 19:55:45 GMT
content-type: text/plain; charset=UTF-8
cf-chl-gen: mnHd0apBCC+mfHmaFzVEGfOwce6KQ0pI4Gv9CrOslsGPYZmVn2Ac0AHrvZ2df7pie43FdqqKkX8=$e06W5OWjUR3dF6BB
server: cloudflare

GET
H3 403 favicon.ico
dihaurefuidkuilopsee.life/ 7 KB
6 KB 47ms
46ms Other
text/html 104.21.96.1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dihaurefuidkuilopsee.life/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.96.1 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fc003f684883fccde554f3d8ffa0f983961fc9700d87742493a0b0863dee341d

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=971

Response headers

content-encoding: zstd
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WHwH53s7PWCO9EN0re%2F0sNOKUJbxWXictMvA%2F3SWoLGOeoyCh2i4os7DVzSl7oQR%2BLK7Ue53%2F7QyLy2zziAux17W%2BzX7vom9BsuNWr26BYillk4HBi%2FC5bXi9hFUpeJZXyDv86aC2byCo%2BpG"}],"group":"cf-nel","max_age":604800}
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
expires: Thu, 01 Jan 1970 00:00:01 GMT
alt-svc: h3=":443"; ma=86400
x-content-options: nosniff
date: Mon, 16 Dec 2024 19:55:45 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: WtFMlercRRhfXjgpxILJKMLTBOWROW/RGiz9iVPrVrfi/urxAKIwuNQ1w8EP4Rg+OeVsszdsFwSfhrkzpxMHK56QtWQ5/d4984VAA4QFm0oxucNgBlln1ZhWuEC9dcLXXPMC4BMpuJu95JBREK4k+g==$Lx/ddN7V74zxGqCI0Gr/sw==
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cross-origin-opener-policy: same-origin
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-resource-policy: same-origin
referrer-policy: same-origin
cf-ray: 8f313b98c92d3d11-CDG
cross-origin-embedder-policy: require-corp
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
origin-agent-cluster: ?1
server: cloudflare

GET 0361cfa8-1167-4659-bcbd-d955068176e2
https://dihaurefuidkuilopsee.life/ Frame 0
0

GET
H3 200 /
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/m8jia/0x4AAAAAAADnOjc0PNeA8qVm/light/fbE/normal/auto/ Frame 855F 0
0 50ms
27ms Document
text/html 104.18.94.41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/m8jia/0x4AAAAAAADnOjc0PNeA8qVm/light/fbE/normal/auto/

Requested by

Host: challenges.cloudflare.com
URL: https://challenges.cloudflare.com/turnstile/v0/b/787bc399e22f/api.js?onload=WXqDk4&render=explicit

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.94.41 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-src https://challenges.cloudflare.com/; base-uri 'self'

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
alt-svc: h3=":443"; ma=86400
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 8f313b9989d43c9e-CDG
content-encoding: br
content-security-policy: frame-src https://challenges.cloudflare.com/; base-uri 'self'
content-type: text/html; charset=UTF-8
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
date: Mon, 16 Dec 2024 19:55:45 GMT
document-policy: js-profiling
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
priority: u=0,i
referrer-policy: same-origin
server: cloudflare
server-timing: cfExtPri

POST
H3 200 zrMdhMnfTgq6pH5HBnHywT0.hMQlv0tD6st3OftNf3I-1734378944-1.2.1.1-VoFmXpeCrze9jRcKXEx8COicidVUeEWtz3edbzHVCa2U3cKLf8RIzaHymtk8D4Ni Show response
dihaurefuidkuilopsee.life/cdn-cgi/challenge-platform/h/b/flow/ov1/172958284:1734376505:SxclH4leyZV9mPQvosOVjZ2cL87jGM3ZoMRCl-qcj3Q/8f313b94c9203d11/ 2 KB
3 KB 56ms
54ms XHR
text/html 104.21.96.1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dihaurefuidkuilopsee.life/cdn-cgi/challenge-platform/h/b/flow/ov1/172958284:1734376505:SxclH4leyZV9mPQvosOVjZ2cL87jGM3ZoMRCl-qcj3Q/8f313b94c9203d11/zrMdhMnfTgq6pH5HBnHywT0.hMQlv0tD6st3OftNf3I-1734378944-1.2.1.1-VoFmXpeCrze9jRcKXEx8COicidVUeEWtz3edbzHVCa2U3cKLf8RIzaHymtk8D4Ni
Requested by: Host: dihaurefuidkuilopsee.life
URL: https://dihaurefuidkuilopsee.life/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8f313b94c9203d11
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.96.1 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 12d3c894877b7b23f98e94a1fdf754aef89d03be5b1162b494bf4a6d7178df9e

Request headers

Referer: https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=971
CF-Chl-RetryAttempt: 0
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
CF-Challenge: zrMdhMnfTgq6pH5HBnHywT0.hMQlv0tD6st3OftNf3I-1734378944-1.2.1.1-VoFmXpeCrze9jRcKXEx8COicidVUeEWtz3edbzHVCa2U3cKLf8RIzaHymtk8D4Ni

Response headers

cf-chl-out: 0A2YZdsB6oO6boNQyQod1O+bUmP8WuJf+4lIfFvpSyQ5bsvECwUTVhklKxv4pU8Gckep5OHECB6R08r1rO0z/IsdSJxR4LhvMEM+n1sVK6NGasxgvvzLjY0=$VsnUKOERECDX3tbS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Snv12oL1Cyo1xRcUvXw8058qf8OERxhv9mwDZwd0b7GS6bBiJbkB81MHLYxkGTnQZRV6Xynv9x23obj9zah1IckDb1MIhDBi2ZMXjDPcTH2hppontMgc5HjIobna5tfhvCpcnG4QTmSiJUZN"}],"group":"cf-nel","max_age":604800}
cf-ray: 8f313ba889663d11-CDG
alt-svc: h3=":443"; ma=86400
cf-chl-out-s: rOdB/SFYBkhxLnGA/F6HI9hcJMCXhELQPzpFGUSfJEUancD3rE6zMAR4hsoknlGEpSbkQGgU3zReSb7fj3rulcFt+k6ycnLIFayphscJvBZIY5goaFyUbT8mv65cuQ//IbXxP6h1EDylTiDMqv6J/Ow80WmLY0rFsQ4MCu4EvC9/BMfkwPrtgQArSZ+9s3ljgnliWZVkRSGiKlq5J/vD6uteCntvBHqArCVqon5wKJLy8lP3nlqxGUN+I62OLczElQPtuU0LswBHECg7rlWIBdrc7a/lDGxuj5MO0dBdNoj0vvwcuHf6WMH+RAxH3Tw/Yza98X3ZeJIfg4+M1kf9NGANgx0pcMI4Ao/4HX/EdRywDkNpDqISVDKyFLoyXaB2smH/evSvxCfEfrdoJ/Z2WGVh06SfpILW565g3HLqPwqNs3Qov1dYFNFthXcTck89EyQLWoBHbujYEkHkNBsUeF9tWVVSEtVnp4GMQj1XHqO4JvDwy5p9gKwq3P1WulCcNTXb/Q==$iTlF8eMG+uaO/t56
date: Mon, 16 Dec 2024 19:55:47 GMT
content-type: text/html; charset=UTF-8
server: cloudflare

GET
H3 403 Primary Request / Show response
dihaurefuidkuilopsee.life/ 7 KB
6 KB 31ms
30ms Document
text/html 104.21.96.1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=971

Requested by

Host: xmo.qleak.click
URL: https://xmo.qleak.click/

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.96.1 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bf16103d78cf602753bfbbdba7a83f13094e1d79e3bad366d8a3071fbd85aa87

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=971
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
alt-svc: h3=":443"; ma=86400
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-chl-out: W5DQ0tM94bSIQog2gzGy3/7qFtqJuaNJq+HPl/E0UfV6uwRY9/HjYCbjlYQeBUNNseM6Hff0HQLGXelQFYvsVUUzJkwVxRFs1VwRByU2DteaInZSoNQwrhY59MyjiTTQnNnbVqcbAP9oklVmAwsAdA==$7C9eI+OJXMTa9ZgAWKKusA==
cf-mitigated: challenge
cf-ray: 8f313bb5e98b3d11-CDG
content-encoding: zstd
content-type: text/html; charset=UTF-8
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
date: Mon, 16 Dec 2024 19:55:50 GMT
expires: Thu, 01 Jan 1970 00:00:01 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HIEEQV7g3tHd28PNAd550QfRnSjRYAsD7DGoPJ2ZdVzVxb00OgSSKdu6fFhng%2FjxGNG76m3JyytmpRRWxuvENFROd%2BbmLwAbNz10ZRzdVZvgSj48NZ3q6KmOejFm4ruBEQIE0jF3wV9paOTK"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-content-options: nosniff
x-frame-options: SAMEORIGIN

GET
H3 200 v1 Show response
dihaurefuidkuilopsee.life/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/ 95 KB
38 KB 37ms
37ms Script
application/javascript 104.21.96.1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dihaurefuidkuilopsee.life/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8f313bb5e98b3d11
Requested by: Host: dihaurefuidkuilopsee.life
URL: https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=971
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.96.1 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 40b7237cda11ec1f5141ff3befa2d90025def5759eced3210f48611f99217e7d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=971&__cf_chl_rt_tk=Nkp80FVTvhq59YUXFhjbwL7dY.7vo2LCxpymGaB9rc8-1734378950-1.0.1.1-ONUCznBQyPONplGhO5hLOBTLxohGO1PqcX98jz0C.hU

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-encoding: zstd
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sOiMegx4QJJlEKlBRoQl9Ncqzi8glc31AOifbi2dAmMwto2nIhAKJr%2FEfFVzoOumpzqZH1REEvs1q%2FIe5%2FGNX5GAxxZvpHUXboEMYGDb%2BhUa4efAH3YjhTjM5fuexBI1918dOlKdddA1oisq"}],"group":"cf-nel","max_age":604800}
cf-ray: 8f313bb6c9983d11-CDG
alt-svc: h3=":443"; ma=86400
date: Mon, 16 Dec 2024 19:55:50 GMT
content-type: application/javascript; charset=UTF-8
server: cloudflare

GET 1f706302-876f-46a8-95de-55b9c0c1a59d
https://dihaurefuidkuilopsee.life/ Frame 0
0

GET
H3 200 api.js Show response
challenges.cloudflare.com/turnstile/v0/b/787bc399e22f/ 47 KB
0 0ms
0ms Script
application/javascript 104.18.95.41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://challenges.cloudflare.com/turnstile/v0/b/787bc399e22f/api.js?onload=WXqDk4&render=explicit
Requested by: Host: dihaurefuidkuilopsee.life
URL: https://dihaurefuidkuilopsee.life/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8f313bb5e98b3d11
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.18.95.41 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5aac9e52f80011983676c03ad8120e0369e651e6357d0b05054026a3bc8ec32d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://dihaurefuidkuilopsee.life
Referer

Response headers

server: cloudflare
cache-control: max-age=31536000, stale-if-error=10800, stale-while-revalidate=31536000, public
content-encoding: br
cross-origin-resource-policy: cross-origin
cf-ray: 8f313b97e8507906-CDG
access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Mon, 16 Dec 2024 19:55:45 GMT
content-type: application/javascript; charset=UTF-8
last-modified: Tue, 10 Dec 2024 17:31:41 GMT
vary: Accept-Encoding
priority: u=3,i=?0

GET
H3 403 favicon.ico
dihaurefuidkuilopsee.life/ 7 KB
7 KB 30ms
30ms Image
text/html 104.21.96.1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dihaurefuidkuilopsee.life/favicon.ico

Requested by

Host: dihaurefuidkuilopsee.life
URL: https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=971

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.96.1 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f4c7066946f165c3b44a81c60daa6b9be89e0c7548725c18ee990b2952cf5252

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=971

Response headers

content-encoding: zstd
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BexJpwQRD8n%2BLIhScZb8J8m91pzeV8pszo%2Ff6x%2BYNGIles%2Fu78JWLtMh04tmiZ%2FAE0vvKnW%2FnKMUnqQ3fp7FkP4hCYBWuGncEpTCr9w1R94000JZkirSKZybLiQFS1h9nehowY%2FuxtjjkapH"}],"group":"cf-nel","max_age":604800}
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
expires: Thu, 01 Jan 1970 00:00:01 GMT
alt-svc: h3=":443"; ma=86400
x-content-options: nosniff
date: Mon, 16 Dec 2024 19:55:50 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: tyENF9WYfTTPsKyuuaft2jb5BbTqe5kZ9K+YoN3abCtS/X2njdvB1mbvivPYICKs18y1XxHnTS93QOcFzsYOX0Q5FLCg0bBaUy9fFmmmImW/Ai6Z03yYLtcHwIQ5Ra57qHhK6Vg+NHVVn/fns3Jyow==$oua3ZQ0yv403r+ntkbPurQ==
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cross-origin-opener-policy: same-origin
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-resource-policy: same-origin
referrer-policy: same-origin
cf-ray: 8f313bb7a9993d11-CDG
cross-origin-embedder-policy: require-corp
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
origin-agent-cluster: ?1
server: cloudflare

POST
H3 200 .YaE0fJDwEVZkCE6EnYngQ8yzWuAISChkHcg7pwneMs-1734378950-1.2.1.1-OuK012eCdkU9gpnlx6uNhT4VIiF5Uake7IFad2XY8GS.jpWefffIQ.27GD4JL59y Show response
dihaurefuidkuilopsee.life/cdn-cgi/challenge-platform/h/b/flow/ov1/1562964955:1734376521:d_2vgrNXeLXpqAdt09eJEPCmoABYlir_g9Vzl02e0ZI/8f313bb5e98b3d11/ 13 KB
9 KB 42ms
40ms XHR
text/plain 104.21.96.1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://dihaurefuidkuilopsee.life/cdn-cgi/challenge-platform/h/b/flow/ov1/1562964955:1734376521:d_2vgrNXeLXpqAdt09eJEPCmoABYlir_g9Vzl02e0ZI/8f313bb5e98b3d11/.YaE0fJDwEVZkCE6EnYngQ8yzWuAISChkHcg7pwneMs-1734378950-1.2.1.1-OuK012eCdkU9gpnlx6uNhT4VIiF5Uake7IFad2XY8GS.jpWefffIQ.27GD4JL59y
Requested by: Host: dihaurefuidkuilopsee.life
URL: https://dihaurefuidkuilopsee.life/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8f313bb5e98b3d11
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.96.1 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 151ece3f6203a28346e431bd1b570955864e231d7705574fbb2989f23f1be211

Request headers

Referer: https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=971
CF-Chl-RetryAttempt: 0
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
CF-Challenge: .YaE0fJDwEVZkCE6EnYngQ8yzWuAISChkHcg7pwneMs-1734378950-1.2.1.1-OuK012eCdkU9gpnlx6uNhT4VIiF5Uake7IFad2XY8GS.jpWefffIQ.27GD4JL59y

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6gayxRmWBD3OoBikG%2B0rIXwNy61F4wCBNE%2FFBbjkqnMQt6nR7q82g1QS5S8XRe3w1U6ZGJhGK%2FhiI0g39zEXBNOXc3Slpe%2FaQiiRAcyh%2BV2RBZ4FwPjhjJvObIFYHF6O1we3Q01MAgltEWFQ"}],"group":"cf-nel","max_age":604800}
cf-ray: 8f313bb8899a3d11-CDG
alt-svc: h3=":443"; ma=86400
date: Mon, 16 Dec 2024 19:55:50 GMT
content-type: text/plain; charset=UTF-8
cf-chl-gen: qYhrwiCgJNblv1W1NP59ij1IRmr+fFXD5venahspchiq6+hfqSEhDu20RB8lgKK18RW2DJdM0qA=$FMk6SOpJ7Ms2EF+B
server: cloudflare

GET
H3 200 /
challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/jip76/0x4AAAAAAADnOjc0PNeA8qVm/light/fbE/normal/auto/ Frame 3A98 0
0 36ms
36ms Document
text/html 104.18.94.41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/jip76/0x4AAAAAAADnOjc0PNeA8qVm/light/fbE/normal/auto/

Requested by

Host: challenges.cloudflare.com
URL: https://challenges.cloudflare.com/turnstile/v0/b/787bc399e22f/api.js?onload=WXqDk4&render=explicit

Protocol

Security

QUIC, , AES_128_GCM

Server

104.18.94.41 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-src https://challenges.cloudflare.com/; base-uri 'self'

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
alt-svc: h3=":443"; ma=86400
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray: 8f313bbc4d593c9e-CDG
content-encoding: br
content-security-policy: frame-src https://challenges.cloudflare.com/; base-uri 'self'
content-type: text/html; charset=UTF-8
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: cross-origin
date: Mon, 16 Dec 2024 19:55:51 GMT
document-policy: js-profiling
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
priority: u=0,i
referrer-policy: same-origin
server: cloudflare
server-timing: cfExtPri

GET
H3 403 favicon.ico
dihaurefuidkuilopsee.life/ 7 KB
6 KB 35ms
34ms Other
text/html 104.21.96.1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://dihaurefuidkuilopsee.life/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

104.21.96.1 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

59abfc84e56f51ee94115d0d74dbf64fb51744e351a1f802754eabd6b3863fae

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=971

Response headers

content-encoding: zstd
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WtLzJ0%2BYxYGw8S0%2BiLWrtGj0SRFDutyRtBA1KMHk48PYfSeONnS3cRNfLbn1iducTgGxIa%2BA4cOxwtlaE9UJU2PD8jsl%2BzwKcjTsKMVaUfhPo6EDsSYr09VgoEhIf%2F0pLEbmBGdGG2cf%2BCmD"}],"group":"cf-nel","max_age":604800}
critical-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
expires: Thu, 01 Jan 1970 00:00:01 GMT
alt-svc: h3=":443"; ma=86400
x-content-options: nosniff
date: Mon, 16 Dec 2024 19:55:51 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: PQtFknVwb1cybizyK2W+7iJMzBElSh2tD2LK0fOOFhNajonlQ2iUhr4Y3bWRKWRd28gHyPJijF/qE+2X/NI6ysstiJFiKrCsSp7SXfWQw7PxzX2qBfpAqd+8nL+zCND/1JQtBzZfcWEpMbYbiD8jfQ==$ZRAILQcWDL1o/eQBmTo2sw==
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cross-origin-opener-policy: same-origin
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-resource-policy: same-origin
referrer-policy: same-origin
cf-ray: 8f313bbc29a13d11-CDG
cross-origin-embedder-policy: require-corp
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
origin-agent-cluster: ?1
server: cloudflare

GET bb8ffdca-fc29-47b5-ad56-6869c655e3c9
https://dihaurefuidkuilopsee.life/ Frame 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: dihaurefuidkuilopsee.life
URL: blob:https://dihaurefuidkuilopsee.life/0ba456db-35a2-4b6d-9341-3e1626d621f8

Domain: dihaurefuidkuilopsee.life
URL: blob:https://dihaurefuidkuilopsee.life/0361cfa8-1167-4659-bcbd-d955068176e2

Domain: dihaurefuidkuilopsee.life
URL: blob:https://dihaurefuidkuilopsee.life/1f706302-876f-46a8-95de-55b9c0c1a59d

Domain: dihaurefuidkuilopsee.life
URL: blob:https://dihaurefuidkuilopsee.life/bb8ffdca-fc29-47b5-ad56-6869c655e3c9

Verdicts & Comments Add Verdict or Comment

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
xmo.qleak.click/	1970-01-21 06:09:06	Name: _pk_ref.971.595a Value: %5B%22%22%2C%22%22%2C1734378943%2C%22https%3A%2F%2Ftelegra.ph%2F-%22%5D
xmo.qleak.click/	1970-01-21 11:12:14	Name: _pk_id.971.595a Value: bd465eac01b13ba3.1734378943.
xmo.qleak.click/	1970-01-21 01:46:20	Name: _pk_ses.971.595a Value: 1
xmo.qleak.click/	1970-01-21 06:09:06	Name: _pk_ref.1.595a Value: %5B%22%22%2C%22%22%2C1734378943%2C%22https%3A%2F%2Ftelegra.ph%2F-%22%5D
xmo.qleak.click/	1970-01-21 11:12:14	Name: _pk_id.1.595a Value: 61cd4a81de02f2b1.1734378943.
xmo.qleak.click/	1970-01-21 01:46:20	Name: _pk_ses.1.595a Value: 1

8 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://xmo.qleak.click/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://matomo.q1eak.click/piwik.php?idgoal=1&idsite=1&rec=1&r=018344&h=20&m=55&s=43&url=https%3A%2F%2Ftelegra.ph%2F-&urlref=https%3A%2F%2Ftelegra.ph%2F-&_id=61cd4a81de02f2b1&_idn=0&send_image=0&_refts=1734378943&_ref=https%3A%2F%2Ftelegra.ph%2F-&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1600x1200&pv_id=9b3YEE&uadata=%7B%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%7D Message: Failed to load resource: the server responded with a status of 400 ()
network	error	URL: https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=971 Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://dihaurefuidkuilopsee.life/favicon.ico Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://dihaurefuidkuilopsee.life/favicon.ico Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://dihaurefuidkuilopsee.life/?s=157&t1=895&t2=&t4=971 Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://dihaurefuidkuilopsee.life/favicon.ico Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://dihaurefuidkuilopsee.life/favicon.ico Message: Failed to load resource: the server responded with a status of 403 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

challenges.cloudflare.com
dihaurefuidkuilopsee.life
matomo.q1eak.click
n1kb.q1eak.click
xmo.qleak.click
dihaurefuidkuilopsee.life
104.18.94.41
104.18.95.41
104.21.96.1
172.67.203.106
172.67.217.77
09b4872df6cd0884c8eb07dc29f978f80e648d7c9683993dccf136680196a2f8
12d3c894877b7b23f98e94a1fdf754aef89d03be5b1162b494bf4a6d7178df9e
151ece3f6203a28346e431bd1b570955864e231d7705574fbb2989f23f1be211
40b7237cda11ec1f5141ff3befa2d90025def5759eced3210f48611f99217e7d
578bbdb8f5605f8c33486bc815f05ead84d6599e0537e71d7b95a7e05ceb6216
588c4458dfeb7798b8bbb7f53b15b0e9ffe7d033802fa26af31892c106e4e730
59abfc84e56f51ee94115d0d74dbf64fb51744e351a1f802754eabd6b3863fae
5aac9e52f80011983676c03ad8120e0369e651e6357d0b05054026a3bc8ec32d
925dddae5afb3b944af3a0f53bb8d11260b2c7e16f3b55056261256a876ac237
bf16103d78cf602753bfbbdba7a83f13094e1d79e3bad366d8a3071fbd85aa87
d50b9852ce176350c41f3a8b9bc01132659f8b18b9ccec1cdea6e98d28176daf
d7fc375178c93a2fc15fd888e30170eedf4ef3d04497e7f951ab7bfe0c921693
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9290c58cd215c0401ee00ca817a6ad83b2b5d108a5cc63c1857cd1d7c0f0693
f4c7066946f165c3b44a81c60daa6b9be89e0c7548725c18ee990b2952cf5252
fc003f684883fccde554f3d8ffa0f983961fc9700d87742493a0b0863dee341d

dihaurefuidkuilopsee.life Open in urlscan Pro 104.21.96.1 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

26 Requests

85 %HTTPS

0 %IPv6

4 Domains

5 Subdomains

6 IPs

2 Countries

181 kBTransfer

420 kBSize

6 Cookies

1 Outgoing links

Page URL History

Redirected requests

26 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

21 JavaScript Global Variables

6 Cookies

8 Console Messages

Indicators

dihaurefuidkuilopsee.life Open in urlscan Pro
104.21.96.1 Public Scan

Screenshot
Live screenshot

Full Image

26
Requests

85 %
HTTPS

0 %
IPv6

4
Domains

5
Subdomains

6
IPs

2
Countries

181 kB
Transfer

420 kB
Size

6
Cookies

26 HTTP transactions
0 data transactions