WEBSITE ANALYSIS REPORT

http://crystaltreatmenteast.com/e/z4htnz03gjbm

06 Feb 2026 · 11:53:43.000 UTCpublic

Report tags: malicious clickfix
Submit tags

Request review

Malicious detection

4 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

11:53:16.795 GET 200 document 739 B 328 ms 1 alerts

11:53:17.194 GET 200 document 130.4 KB 320 ms 1 alerts

11:53:17.527 GET 200 stylesheet 2.4 KB 417 ms —

11:53:17.529 GET 200 stylesheet 264.3 KB 53 ms 1 alerts

11:53:17.556 GET 200 script 85.5 KB 34 ms —

11:53:17.558 GET 200 stylesheet 5.5 KB 45 ms 1 alerts

11:53:17.560 GET 200 script 1.7 KB 43 ms 1 alerts

11:53:17.561 GET 200 script 156.1 KB 67 ms 1 alerts

11:53:17.562 GET 200 script 81.2 KB 80 ms 1 alerts

11:53:17.667 GET 200 script 97.2 KB 110 ms —

11:53:17.668 GET 200 script 78.8 KB 12 ms —

11:53:17.670 GET 200 script 100.4 KB 42 ms 2 alerts

11:53:17.689 GET 200 script 455.3 KB 253 ms —

11:53:18.108 GET 200 xhr 126 B 154 ms —

11:53:18.112 GET 200 img 403 B 35 ms 1 alerts

11:53:18.114 GET 200 script 65.8 KB 41 ms 1 alerts

11:53:18.132 GET 200 script 334.9 KB 66 ms 1 alerts

11:53:18.133 GET 200 script 560.9 KB 80 ms 1 alerts

11:53:18.135 GET 200 font 19.7 KB 386 ms —

11:53:18.275 GET 200 script 5.0 KB 16 ms —

11:53:18.367 GET 200 img 6.9 KB 37 ms 1 alerts

11:53:18.369 GET 200 img 533 B 37 ms 1 alerts

11:53:18.383 GET 200 subdocument 926 B 17 ms —

11:53:18.610 GET 200 xhr 11.1 KB 113 ms 1 alerts

Transaction #02

Request / response

URL

GET HTTPS

https://lauradaydo.com/engine/storyboard/z4htnz03gjbm?t=0

IP / ASN

186.2.163.111

AS59692 · IQWeb FZ-LLC

Requested by: https://lauradaydo.com/e/z4htnz03gjbm

Resource information

File type: WebVTT subtitles, ASCII text
MIME type: text/vtt; charset=utf-8
First seen (UTC): 06 Feb 2026 · 11:53:50.322 UTC
Last seen (UTC): 06 Feb 2026 · 11:53:50.322 UTC
Times seen: 1

Size: 11.1 KB (11370 bytes)
MD5: b592283b47939a129b0b02f943f92c3d
SHA1: bb3aadd26fe90a7e2e6cde751f054345bcd5c495
SHA256: ea439b712fc6c50d09130363d187e6b6099b255ee3b3495447713fcd83ad2c31

Certificate information

Issuer: Let's Encrypt · R12
Subject: lauradaydo.com
Protocol / cipher: TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint: F0:39:62:19:37:B3:B6:8E:92:E5:08:63:81:F8:F8:94:1A:CF:B5:6F
Valid from: Tue, 13 Jan 2026 16:28:02 GMT
Valid until: Mon, 13 Apr 2026 16:28:01 GMT

Technology fingerprints

HSTS (Security)
DDoS-Guard (Security)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
DNS4EU Sinkholed	medium	Malicious

HTTP headers

Request headers

GET /engine/storyboard/z4htnz03gjbm?t=0 HTTP/1.1
Host: lauradaydo.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://lauradaydo.com/e/z4htnz03gjbm
Cookie: __ddg8_=jAEetf3uqgUR1meX; __ddg10_=1770378798; __ddg9_=91.90.42.154; __ddg1_=0nKfnEIcR0UfwjOpuQH6; XSRF-TOKEN=eyJpdiI6IlVpbGU1dDV0M3ArZG92MTdJY3V4YkE9PSIsInZhbHVlIjoiVmVlcVNHak1aSmUrTmUyQUY5blE5ajVGSmVBV25nTnJhQ20vQTUxNDFvWHZIc2xoRThWZ1lHUWtvcEt2ZGc2bURQczBmL3ZUQ1B0TjBRODR3UTFsOHhBcmJ2bVd2ZjJiMUs4dzc5eE4xRkxPbWFZWU9ocEEwUThKcWdMUHZxbkYiLCJtYWMiOiI4NDVjM2JhYTUyYzJiMGIxZTk4MGY2YmE2MWQ5NzMzOWM1YmM4MTIwYzhjYTc3NTkzM2VkZjFiNTAxNjZiYmRjIiwidGFnIjoiIn0%3D; voe_session=eyJpdiI6ImJ0Q1dGTS9Nd3BZWHpMaEVpeXA1ZHc9PSIsInZhbHVlIjoiQVRzWDRhWUM1NktoczNiZnN5T3lEWW1BMDNyOXNOYlBXOFp1dmJzS29MR2xZa0NCN21XN2J4SWY3cnFURVcyYWlzdjVnWnZaMzZlVG5zRDV3bDdQYmZDdE94N093Mm0vQllDRVZQQUhGa1NzQWxqcTAyUERUV2NXSUhzdDZLZDAiLCJtYWMiOiJkNjgzNzE0NmI1OWQ4NGFkNDUxYzdlOGZiZTdkOTE4NGExMmU1ZDc3NjZmYTYzOTg2NDI4NGJlYzkwZTFhNGUwIiwidGFnIjoiIn0%3D; UGVyc2lzdFN0b3JhZ2U=%7B%7D
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/2 200 OK
server: ddos-guard
set-cookie: __ddg8_=iGzRyg9MI2T7Snd9; Domain=.lauradaydo.com; Path=/; Expires=Fri, 06-Feb-2026 12:13:18 GMT
__ddg10_=1770378798; Domain=.lauradaydo.com; Path=/; Expires=Fri, 06-Feb-2026 12:13:18 GMT
__ddg9_=91.90.42.154; Domain=.lauradaydo.com; Path=/; Expires=Fri, 06-Feb-2026 12:13:18 GMT
XSRF-TOKEN=eyJpdiI6Ikl4WXZqekswSFZJK1dzemt6S0dxSFE9PSIsInZhbHVlIjoiQmRLckZaYjRSY1FRdWZKT3Z3KzFTZjNWL1Z1L0FBNnh0ZXE3L2ZiMnZzMXg0NFVQNDR4UVJTNXlFNTBoYkdURE1nazVSSlhuZ1FGZ25YbEcvOWhYdXNZdjNpTkhQckJMNlRTeEs1WEg5K0tHQjNETmVLUnZIa0hHOHk1c20xTHAiLCJtYWMiOiIwZmY0ZGZjYmMyMmU4ZmRlNWU0YjU2OGE4NDgyMWM2MTgyYWYxYjg0MGE1ZTUwODc1N2Y4MTg3OTVhMDcxZmUwIiwidGFnIjoiIn0%3D; expires=Fri, 06 Feb 2026 13:23:18 GMT; Max-Age=5400; path=/; secure; samesite=none; partitioned
voe_session=eyJpdiI6ImhPa2JKVHdhM2FCcU16cFYvS2hmSnc9PSIsInZhbHVlIjoiZ1RvVWFBQk03U2FPUGROSUhOM0FWZUZnVWhsNjBmU3ZHNVBQNzlwZVk3bDFHdjNta1dRTlJGb2w5dXM1NDYzNXcrL0ZWZkkvRkNnUzdzK1NhNnlaazM4R2haVGROSXV5NzhLME11V241QVhkWU03bnlPSzF4STd3dFo2TTRHYnQiLCJtYWMiOiI3YzE5OGNlNDVkOGNjZjY2YzI3YWIxM2JhYzcwMDY3YTBiNGVjNjYzMTI4MGMxMmZkNjRiOGYzZGJhODYzZWU0IiwidGFnIjoiIn0%3D; expires=Fri, 06 Feb 2026 13:23:18 GMT; Max-Age=5400; path=/; secure; httponly; samesite=none; partitioned
strict-transport-security: max-age=2628000
content-security-policy: upgrade-insecure-requests;
content-type: text/vtt; charset=utf-8
cache-control: no-cache, private
date: Fri, 06 Feb 2026 11:53:18 GMT
X-Firefox-Spdy: h2

11:53:18.624 GET 200 img 144.3 KB 255 ms 1 alerts

11:53:18.693 GET 200 script 548 B 18 ms —

11:53:18.721 GET 200 script 535 B 217 ms —

11:53:18.762 GET 200 img 198.3 KB 258 ms 1 alerts

11:53:18.869 GET 200 script 6.3 KB 19 ms —

11:53:18.900 GET 200 img 35.9 KB 118 ms —

11:53:20.925 GET 200 img 43 B 18 ms —

11:53:21.939 GET 200 img 43 B 18 ms —

http://crystaltreatmenteast.com/e/z4htnz03gjbm

Domain graph

Hostnames

Connections

Network requests

Transaction #02

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Display preferences

Go to…

Notifications

Full request body

Full screenshot

>http://crystaltreatmenteast.com/e/z4htnz03gjbm

[Domain graph]

Hostnames

Connections

[Network requests]

Transaction #02

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

http://crystaltreatmenteast.com/e/z4htnz03gjbm

Domain graph

Network requests