GET cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js
200 OK 28 kB URL GET HTTP/2 cdnjs.cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js
IP
Requested by https://dood.work/e/pcnyy07ay5sq
Certificate IssuerGoogle Trust Services
Subjectcdnjs.cloudflare.com
Fingerprint64:3F:50:40:E0:BD:89:CB:A9:C8:BE:E5:74:F6:9E:D6:2E:1A:32:02
ValidityTue, 26 Nov 2024 07:25:18 GMT - Mon, 24 Feb 2025 07:25:17 GMT
File type JavaScript source, ASCII text, with very long lines (65451)
Hash dc5e7f18c8d36ac1d3d4753a87c98d0a
c8e1c8b386dc5b7a9184c763c88d19a346eb3342
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
GET /ajax/libs/jquery/3.5.1/jquery.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dood.work/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 31 Dec 2024 10:16:00 GMT
content-type: application/javascript; charset=utf-8
content-length: 27958
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb09ed3-15d84"
last-modified: Mon, 04 May 2020 23:01:39 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 980939
expires: Sun, 21 Dec 2025 10:16:00 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O4jj0nD55ve%2FfbCqIBZQTTljInrwa6TMG6EKm%2BC9dPaXbiGslK7ARRsTalLCh%2FQc3iAwV%2FPwOQXTAmXbP28k3wsoozZ66FcC9B09j5Rlqj%2BFQDbiJm3MUzk77KuoSwTYTui0KBt8"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 8fa982fc6f14568d-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET cdnjs.cloudflare.com/ajax/libs/jquery-cookie/1.4.1/jquery.cookie.min.js
200 OK 591 B URL GET HTTP/2 cdnjs.cloudflare.com/ajax/libs/jquery-cookie/1.4.1/jquery.cookie.min.js
IP
Requested by https://dood.work/e/pcnyy07ay5sq
Certificate IssuerGoogle Trust Services
Subjectcdnjs.cloudflare.com
Fingerprint64:3F:50:40:E0:BD:89:CB:A9:C8:BE:E5:74:F6:9E:D6:2E:1A:32:02
ValidityTue, 26 Nov 2024 07:25:18 GMT - Mon, 24 Feb 2025 07:25:17 GMT
File type JavaScript source, ASCII text, with very long lines (1266)
Hash 4412bf8023109ee9eb1f1f226d391329
c273960aa874a87dd022b5e597887142f1b8e34f
d40efcac911d8964f3728eaa767de281306ff55ba9377435a3364d4d1e1613f6
GET /ajax/libs/jquery-cookie/1.4.1/jquery.cookie.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dood.work/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 31 Dec 2024 10:16:00 GMT
content-type: application/javascript; charset=utf-8
content-length: 591
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03ec1-514"
last-modified: Mon, 04 May 2020 16:11:45 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 883936
expires: Sun, 21 Dec 2025 10:16:00 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ujVaCJJIxRRThOfIXT7omnVrgnaJcwO5MvV4ioFfyCCjhDdvdidztXu81PXa17iXmEpmmQzoY34b63Ie2kzCBJI9%2B3A6PmcvbnwHYmpMi0eeWpuJo6UlpayQm7ajlpraH8cBa%2FEZ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 8fa982fc7f1c568d-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET i.doodcdn.co/ads/ad.js
200 OK 20 B IP
Requested by https://dood.work/e/pcnyy07ay5sq
Certificate IssuerGoogle Trust Services
Subjectdoodcdn.co
Fingerprint85:F9:AC:F1:05:04:E4:B0:96:10:9B:E5:E8:9B:D9:5C:A5:D3:93:16
ValidityTue, 26 Nov 2024 19:05:57 GMT - Mon, 24 Feb 2025 19:05:56 GMT
File type ASCII text, with no line terminators
Hash 69a305bcdc8e061bbd43294a477a3678
506582a1d912d546f5942d95ffae95ec7f4c37ce
8964d85afd6d5d84b97872464646809c952ab900cdf5c5d7c3b7b4bdb74202fa
GET /ads/ad.js HTTP/1.1
Host: i.doodcdn.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dood.work/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 31 Dec 2024 10:16:00 GMT
content-type: application/javascript
content-length: 20
last-modified: Mon, 03 Jan 2022 15:38:36 GMT
cache-control: public, max-age=2592000
expires: Wed, 31 Dec 2025 03:53:33 GMT
vary: User-Agent,Accept-Encoding
access-control-allow-origin: *
cf-cache-status: HIT
age: 11388
accept-ranges: bytes
server: cloudflare
cf-ray: 8fa982fcdf1756aa-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET i.doodcdn.co/img/no_video_3.svg
200 OK 2.8 kB URL GET HTTP/2 i.doodcdn.co/img/no_video_3.svg
IP
Requested by https://dood.work/e/pcnyy07ay5sq
Certificate IssuerGoogle Trust Services
Subjectdoodcdn.co
Fingerprint85:F9:AC:F1:05:04:E4:B0:96:10:9B:E5:E8:9B:D9:5C:A5:D3:93:16
ValidityTue, 26 Nov 2024 19:05:57 GMT - Mon, 24 Feb 2025 19:05:56 GMT
File type SVG Scalable Vector Graphics image
Hash 077bfdaa49ae4877a42611b739ec4752
a2f9e1222b7af9abc05122411ab8902efcc08ead
70d6a17097a8c27edfaad6740e11359d9363f3f04bff1b93483e29c25609fa6c
GET /img/no_video_3.svg HTTP/1.1
Host: i.doodcdn.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dood.work/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Tue, 31 Dec 2024 10:16:00 GMT
content-type: image/svg+xml
content-length: 2812
last-modified: Mon, 03 Jan 2022 15:38:36 GMT
etag: "61d3187c-afc"
expires: Wed, 29 Jan 2025 05:44:06 GMT
cache-control: public, max-age=2592000, no-transform
access-control-allow-origin: *
cf-cache-status: HIT
age: 22351
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 8fa982fcdf1856aa-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET static.doodcdn.co/js/embed3.js
200 OK 113 kB URL GET HTTP/2 static.doodcdn.co/js/embed3.js
IP
Requested by https://dood.work/e/pcnyy07ay5sq
Certificate IssuerGoogle Trust Services
Subjectdoodcdn.co
Fingerprint85:F9:AC:F1:05:04:E4:B0:96:10:9B:E5:E8:9B:D9:5C:A5:D3:93:16
ValidityTue, 26 Nov 2024 19:05:57 GMT - Mon, 24 Feb 2025 19:05:56 GMT
File type JavaScript source, Unicode text, UTF-8 text, with very long lines (27236)
Size 113 kB (112944 bytes)
Hash 49983e649382a6bfd9733ae69af88203
e2da77757b586c41f9fa0a30273b4b054830645b
0392c9a6af1cf5076ba83511b4b7cdb32b4409a0ea90cfdc16f3666f611634b8
GET /js/embed3.js HTTP/1.1
Host: static.doodcdn.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dood.work/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 31 Dec 2024 10:16:00 GMT
content-type: application/javascript
content-length: 112944
last-modified: Sun, 04 Feb 2024 08:20:24 GMT
etag: "65bf48c8-1b930"
expires: Wed, 29 Jan 2025 05:20:34 GMT
cache-control: public, max-age=2592000, no-transform
access-control-allow-origin: *
cf-cache-status: HIT
age: 31552
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 8fa982fcdbed56a9-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET cdnjs.cloudflare.com/ajax/libs/videojs-hotkeys/0.2.28/videojs.hotkeys.min.js
200 OK 1.6 kB URL GET HTTP/2 cdnjs.cloudflare.com/ajax/libs/videojs-hotkeys/0.2.28/videojs.hotkeys.min.js
IP
Requested by https://dood.work/e/pcnyy07ay5sq
Certificate IssuerGoogle Trust Services
Subjectcdnjs.cloudflare.com
Fingerprint64:3F:50:40:E0:BD:89:CB:A9:C8:BE:E5:74:F6:9E:D6:2E:1A:32:02
ValidityTue, 26 Nov 2024 07:25:18 GMT - Mon, 24 Feb 2025 07:25:17 GMT
File type JavaScript source, ASCII text, with very long lines (4505)
Hash f2ecb2bd8a424c8e8cf507ce8bd933c2
3cbc08ca052ea25c3b0834b9291a3ca1e9122e26
4c0745052abbb26087a707bb0a043b43c393674055ba2d4452ac89e6923eb099
GET /ajax/libs/videojs-hotkeys/0.2.28/videojs.hotkeys.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dood.work/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 31 Dec 2024 10:16:00 GMT
content-type: application/javascript; charset=utf-8
content-length: 1571
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "630ad3e5-623"
last-modified: Sun, 28 Aug 2022 02:33:09 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 889588
expires: Sun, 21 Dec 2025 10:16:00 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BNct72LXxr9SujVFPUywjxKpV79rDyupLn4n8IKceu%2F04cmrt2b43OwN8nancE32D%2FLys6SFt35%2BIoLFdQeDJFHSu%2BDg5FmL6eN6nXiT90Nq5l4NvSuOaTE46gs%2FtClS3Ita7hDa"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 8fa982fd1fb6568d-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET cdnjs.cloudflare.com/ajax/libs/video.js/7.21.5/video.min.js
200 OK 137 kB URL GET HTTP/2 cdnjs.cloudflare.com/ajax/libs/video.js/7.21.5/video.min.js
IP
Requested by https://dood.work/e/pcnyy07ay5sq
Certificate IssuerGoogle Trust Services
Subjectcdnjs.cloudflare.com
Fingerprint64:3F:50:40:E0:BD:89:CB:A9:C8:BE:E5:74:F6:9E:D6:2E:1A:32:02
ValidityTue, 26 Nov 2024 07:25:18 GMT - Mon, 24 Feb 2025 07:25:17 GMT
File type JavaScript source, Unicode text, UTF-8 text, with very long lines (48459)
Size 137 kB (137405 bytes)
Hash d7fdaaab43bc993b85290c713fd2d289
46bf3d27b2cf38b0e999d3b0a7613011181c87f9
c9535ea3a4e0af22e960ac1e32d363a71029f31aa96b29fc894e111fee49329e
GET /ajax/libs/video.js/7.21.5/video.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dood.work/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 31 Dec 2024 10:16:00 GMT
content-type: application/javascript; charset=utf-8
content-length: 137405
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "64bb5c88-218bd"
last-modified: Sat, 22 Jul 2023 04:35:20 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 803231
expires: Sun, 21 Dec 2025 10:16:00 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N6hlsLGkHZCx5ZsrZ%2FHgbr8Zu9CciFfn5GuhQuoDYWvQmk0OXS%2BCkMvvwimCrJKmF32BfUo%2FaKIDlm2OrR2CSCGRJXb80ZhmooUywfto5UDFxu6GBEJk2uVHL0XVScly4WrL3VjP"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 8fa982fd1fbd568d-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET d18t35yyry2k49.cloudfront.net/?ryytd=919673
204 No Content 0 B URL GET HTTP/2 d18t35yyry2k49.cloudfront.net/?ryytd=919673
IP
Requested by https://dood.work/e/pcnyy07ay5sq
Certificate IssuerAmazon
Subject*.cloudfront.net
Fingerprint28:D3:87:79:3C:E8:8B:3C:D9:10:45:E5:F7:64:7A:6D:44:4E:5A:62
ValidityTue, 30 Jul 2024 00:00:00 GMT - Thu, 03 Jul 2025 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /?ryytd=919673 HTTP/1.1
Host: d18t35yyry2k49.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dood.work/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 204 No Content
date: Tue, 31 Dec 2024 10:16:00 GMT
access-control-allow-origin: *
cache-control: no-store, no-cache, proxy-revalidate, must-revalidate, private, no-transform
pragma: no-cache
x-cache: Miss from cloudfront
via: 1.1 0ca3a24436a7d86916b35130b21285a8.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN53-P2
x-amz-cf-id: IGTmHVaO-eOe9M-1RKcFKvHkHMlvZjRpYqMlYnnou5qR9QMWuZwEUw==
X-Firefox-Spdy: h2
GET dwellerfosset.shop/r67728b46c8767/70849
200 OK 20 B URL GET HTTP/1.1 dwellerfosset.shop/r67728b46c8767/70849
IP
Requested by https://dood.work/e/pcnyy07ay5sq
Certificate IssuerLet's Encrypt
Subjectdwellerfosset.shop
FingerprintA9:36:1F:93:AD:FD:40:5C:F5:2F:53:F6:29:6D:4D:9E:51:2C:6D:42
ValidityMon, 23 Dec 2024 07:10:21 GMT - Sun, 23 Mar 2025 07:10:20 GMT
File type gzip compressed data, from Unix
Hash 7029066c27ac6f5ef18d660d5741979a
46c6643f07aa7f6bfe7118de926b86defc5087c4
59869db34853933b239f1e2219cf7d431da006aa919635478511fabbfc8849d2
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /r67728b46c8767/70849 HTTP/1.1
Host: dwellerfosset.shop
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dood.work/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 31 Dec 2024 10:16:01 GMT
Content-Type: application/javascript; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
Accept-ch: sec-ch-ua-platform-version,sec-ch-ua-model,sec-ch-ua-full-version,sec-ch-ua-full-version-list
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://dood.work
Access-Control-Allow-Headers: content-type, megageocheckolololo, x-forwarded-for, x-requested-with, cache-control, pragma, expires
Access-Control-Max-Age: 600
Access-Control-Allow-Methods: GET, POST, OPTIONS
Set-Cookie: GL_UI4=eJw9jUtug0AQRPljJ4akJQ7gIxgUjL3MJivfAQ0zDZ4Ypq1mjJ3bZxIp2dUrPVV5nhcUL%2BAvyRrCm6hhe1R9s5dYojyUVVW%2BHSrZ151o%2BlJVTVnvYK3n1opuRBvBap4E29YuEWwGNMhatpIUZvDqrL%2FmYuhuIog7FkZlEE%2FOGDNIO6b7jFyEEBkxIaQfmrGnhzPEJzEEx72L2rjo7yCguQjzJ4hP2twe%2BSbx8jzx4Pk6CtsTT61WDuOBhULw32ElhcWB%2BAtShfPF0hWARtX%2B%2B7%2Bf8fizBonCRUuHZM%2FI38wATrY%3D; expires=Wed, 01-Jan-2025 10:16:01 GMT; Max-Age=86400; path=/; secure; SameSite=None
GL_GI10=eJwViE0KgzAUBvMeJVAqhY96AE%2BQamsXbmuXRReewGopgZBIEvtz%2B%2BpiBmaEEJwmYD0hqQpV5ao8qeJSgl7gpgUPFrJx%2FtP%2FQB6cn8HeYtcG47LazTYuf8BmbZDG%2Fmr0N%2BucmaN2NoAXtnX%2FMM%2FjrbuDJkng6FaHMRWgtzz8AV7hHdE%3D; expires=Wed, 01-Jan-2025 10:16:01 GMT; Max-Age=86400; path=/; secure; SameSite=None
Content-Encoding: gzip
Vary: Accept-Encoding
Strict-Transport-Security: max-age=1
X-Content-Type-Options: nosniff
GET img.doodcdn.co/snaps/k4g7134gimipgv89.jpg
200 OK 25 kB URL GET HTTP/2 img.doodcdn.co/snaps/k4g7134gimipgv89.jpg
IP
Requested by https://dood.work/e/pcnyy07ay5sq
Certificate IssuerGoogle Trust Services
Subjectdoodcdn.co
Fingerprint85:F9:AC:F1:05:04:E4:B0:96:10:9B:E5:E8:9B:D9:5C:A5:D3:93:16
ValidityTue, 26 Nov 2024 19:05:57 GMT - Mon, 24 Feb 2025 19:05:56 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 504x896, components 3
Hash ec5839e8fd2d22c1631539d366d88683
0e283100b2a857f6aa250542f52a95e04c7bd106
74dfccaa913d16436a46b725cffe96d1f229bd09f1df9df4c7fa224ea2b1f443
GET /snaps/k4g7134gimipgv89.jpg HTTP/1.1
Host: img.doodcdn.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dood.work/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Tue, 31 Dec 2024 10:16:01 GMT
content-type: image/jpeg
content-length: 24611
access-control-allow-origin: *
cache-control: max-age=1209600
cf-bgj: imgq:100,h2pri
cf-polished: origSize=24950
etag: "6749957e-6176"
expires: Tue, 14 Jan 2025 02:24:17 GMT
last-modified: Fri, 29 Nov 2024 10:20:46 GMT
cf-cache-status: HIT
accept-ranges: bytes
vary: Accept-Encoding
server: cloudflare
cf-ray: 8fa982fce8ea56c7-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET i.doodcdn.co/fonts/avertastd-regular-webfont.woff2
200 OK 24 kB URL GET HTTP/3 i.doodcdn.co/fonts/avertastd-regular-webfont.woff2
IP
Requested by https://dood.work/e/pcnyy07ay5sq
Certificate IssuerGoogle Trust Services
Subjectdoodcdn.co
Fingerprint85:F9:AC:F1:05:04:E4:B0:96:10:9B:E5:E8:9B:D9:5C:A5:D3:93:16
ValidityTue, 26 Nov 2024 19:05:57 GMT - Mon, 24 Feb 2025 19:05:56 GMT
File type Web Open Font Format (Version 2), TrueType, length 23812, version 1.524
Hash eb586e5a1b86dbf1c866e3ed80f9d18e
280ee78d19c017ab9335f769595e5157d3c4a343
714e70103deac0d67f52a6285c5fabee6088ce4d710ce7e74353503837038baf
GET /fonts/avertastd-regular-webfont.woff2 HTTP/1.1
Host: i.doodcdn.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://dood.work
DNT: 1
Connection: keep-alive
Referer: https://i.doodcdn.co/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Tue, 31 Dec 2024 10:16:01 GMT
content-type: font/woff2
content-length: 23812
last-modified: Mon, 03 Jan 2022 15:38:36 GMT
cache-control: max-age=2592000
expires: Wed, 29 Jan 2025 05:52:35 GMT
vary: User-Agent,Accept-Encoding
access-control-allow-origin: *
cf-cache-status: HIT
age: 21788
accept-ranges: bytes
priority: u=4,i=?0
server: cloudflare
cf-ray: 8fa983006ef1b503-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET du0pud0sdlmzf.cloudfront.net/?dupud=908057
200 OK 107 kB URL GET HTTP/2 du0pud0sdlmzf.cloudfront.net/?dupud=908057
IP
Requested by https://dood.work/e/pcnyy07ay5sq
Certificate IssuerAmazon
Subject*.cloudfront.net
Fingerprint28:D3:87:79:3C:E8:8B:3C:D9:10:45:E5:F7:64:7A:6D:44:4E:5A:62
ValidityTue, 30 Jul 2024 00:00:00 GMT - Thu, 03 Jul 2025 23:59:59 GMT
File type JavaScript source, Unicode text, UTF-8 text, with very long lines (38488)
Size 107 kB (106704 bytes)
Hash 58ae533d70fac6076964cbf5c20df08a
9b6954f295b7128bc84862359d21c6e3d6a1b3c6
7496e1d16def6df645225c307b25be863b8827713ec3389bf066b8683e8a9f5a
GET /?dupud=908057 HTTP/1.1
Host: du0pud0sdlmzf.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dood.work/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-length: 106704
date: Tue, 31 Dec 2024 10:16:00 GMT
access-control-allow-origin: *
cache-control: no-store, no-cache, proxy-revalidate, must-revalidate, private, no-transform
content-encoding: gzip
pragma: no-cache
x-cache: Miss from cloudfront
via: 1.1 36f6f4783c54484f0285e84da74ad1c6.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN53-P2
x-amz-cf-id: znl8YX_fqazM_W1Md2zETayEIitfgUJSs00fgBcEeZj1gtxNMpNo9A==
X-Firefox-Spdy: h2
GET i.doodcdn.com/theme_2/img/loader.svg
301 Moved Permanently 167 B URL GET HTTP/2 i.doodcdn.com/theme_2/img/loader.svg
IP
Requested by https://dood.work/e/pcnyy07ay5sq
Certificate IssuerGoogle Trust Services
Subjectdoodcdn.com
Fingerprint79:8F:56:D6:B6:A5:15:48:24:9C:0B:41:C7:D5:EB:C5:36:CF:E3:33
ValidityMon, 02 Dec 2024 13:52:36 GMT - Sun, 02 Mar 2025 13:52:35 GMT
File type HTML document, ASCII text, with CRLF line terminators
Hash 0104c301c5e02bd6148b8703d19b3a73
7436e0b4b1f8c222c38069890b75fa2baf9ca620
446a6087825fa73eadb045e5a2e9e2adf7df241b571228187728191d961dda1f
GET /theme_2/img/loader.svg HTTP/1.1
Host: i.doodcdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://i.doodcdn.co/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 301 Moved Permanently
date: Tue, 31 Dec 2024 10:16:01 GMT
content-type: text/html
content-length: 167
location: https://i.doodcdn.co/theme_2/img/loader.svg
cache-control: max-age=3600
expires: Tue, 31 Dec 2024 11:16:01 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Igfn53zOdXBvLjdRm3RE4MUSGhVP0bwFU7qLMwccfdjr7HwEbhO5zi2s5ZZ8jLI6pbu2hmgSIBrYWUDqSsn9AcJPoRy5X9FPGTXui8co2mF255m%2BT97wkBkACEYCPa4m"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8fa983021e3556c1-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=854&min_rtt=567&rtt_var=271&sent=7&recv=10&lost=0&retrans=0&sent_bytes=3271&recv_bytes=1204&delivery_rate=5870270&cwnd=254&unsent_bytes=0&cid=c0605393b5dd076d&ts=38&x=0"
X-Firefox-Spdy: h2
GET i.doodcdn.co/img/logo-s.png
200 OK 1.9 kB URL GET HTTP/3 i.doodcdn.co/img/logo-s.png
IP
Requested by https://dood.work/e/pcnyy07ay5sq
Certificate IssuerGoogle Trust Services
Subjectdoodcdn.co
Fingerprint85:F9:AC:F1:05:04:E4:B0:96:10:9B:E5:E8:9B:D9:5C:A5:D3:93:16
ValidityTue, 26 Nov 2024 19:05:57 GMT - Mon, 24 Feb 2025 19:05:56 GMT
File type RIFF (little-endian) data, Web/P image
Hash 8211fb3cc137d3e1c1e399b86476f951
136d8ef228959aa0cee12e5ed463b6e6a4fcf720
2577866b9d26cd6a4be764910f0913ae5b737ed1d130d635048051ebe15ae680
GET /img/logo-s.png HTTP/1.1
Host: i.doodcdn.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dood.work/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Tue, 31 Dec 2024 10:16:01 GMT
content-type: image/webp
content-length: 1932
access-control-allow-origin: *
cache-control: public, max-age=2592000, no-transform
cf-bgj: imgq:100,h2pri
cf-polished: origFmt=png, origSize=6212
content-disposition: inline; filename="logo-s.webp"
etag: "61d3187c-1844"
expires: Wed, 29 Jan 2025 07:33:44 GMT
last-modified: Mon, 03 Jan 2022 15:38:36 GMT
vary: Accept
cf-cache-status: HIT
age: 30978
accept-ranges: bytes
priority: u=4,i=?0
server: cloudflare
cf-ray: 8fa983026879b4ff-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET img.doodcdn.co/snaps/k4g7134gimipgv89.jpg
200 OK 25 kB URL GET HTTP/2 img.doodcdn.co/snaps/k4g7134gimipgv89.jpg
IP
Requested by https://dood.work/e/pcnyy07ay5sq
Certificate IssuerGoogle Trust Services
Subjectdoodcdn.co
Fingerprint85:F9:AC:F1:05:04:E4:B0:96:10:9B:E5:E8:9B:D9:5C:A5:D3:93:16
ValidityTue, 26 Nov 2024 19:05:57 GMT - Mon, 24 Feb 2025 19:05:56 GMT
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 504x896, components 3
Hash ec5839e8fd2d22c1631539d366d88683
0e283100b2a857f6aa250542f52a95e04c7bd106
74dfccaa913d16436a46b725cffe96d1f229bd09f1df9df4c7fa224ea2b1f443
GET /snaps/k4g7134gimipgv89.jpg HTTP/1.1
Host: img.doodcdn.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://dood.work
DNT: 1
Connection: keep-alive
Referer: https://dood.work/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Tue, 31 Dec 2024 10:16:01 GMT
content-type: image/jpeg
content-length: 24611
access-control-allow-origin: *
cache-control: max-age=1209600
cf-bgj: imgq:100,h2pri
cf-polished: origSize=24950
etag: "6749957e-6176"
expires: Tue, 14 Jan 2025 09:56:46 GMT
last-modified: Fri, 29 Nov 2024 10:20:46 GMT
cf-cache-status: HIT
accept-ranges: bytes
priority: u=3,i=?0
vary: Accept-Encoding
server: cloudflare
cf-ray: 8fa98301d8cbb503-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET jcdn.tsyndicate.com/ed85951b219e49ffa74b7b74a3c8089c.js
200 OK 2 B URL GET HTTP/2 jcdn.tsyndicate.com/ed85951b219e49ffa74b7b74a3c8089c.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://dood.work/e/pcnyy07ay5sq
Certificate IssuerLet's Encrypt
Subjectjcdn.tsyndicate.com
Fingerprint6A:69:85:9B:A5:0C:3E:C5:5C:A2:93:5B:98:B0:23:D1:B4:27:2C:C2
ValidityMon, 04 Nov 2024 03:04:59 GMT - Sun, 02 Feb 2025 03:04:58 GMT
Hash 99914b932bd37a50b983c5e7c90ae93b
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
GET /ed85951b219e49ffa74b7b74a3c8089c.js HTTP/1.1
Host: jcdn.tsyndicate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dood.work/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 31 Dec 2024 10:16:01 GMT
content-type: application/javascript; charset=utf-8
content-length: 2
server: nginx
x-request-id: 32f25385-4832-4796-bb11-57db6ef160f2
strict-transport-security: max-age=31536000 always
expires: Tue, 31 Dec 2024 10:21:01 GMT
cache-control: max-age=300
vary: Accept-Encoding
x-proxy-cache: HIT
x-cdn-host-id: ds9893
X-Firefox-Spdy: h2
GET rvisofoseveralyear.com/WEJzTjJ3fRA9DwoXFwBkNghBLVwsLiIgZGgmNABwPhoxf2toB1U6Wzx/Sn4KaHdEaEIxJk5/FCs2EjpHK39CaFs2JBxzFC5/QmABbGxAeBxsZAZzA342Ay9VZXNVPkYsLk5/BWt3RXoCaXRCeAtr
204 No Content 0 B URL GET HTTP/2 rvisofoseveralyear.com/WEJzTjJ3fRA9DwoXFwBkNghBLVwsLiIgZGgmNABwPhoxf2toB1U6Wzx/Sn4KaHdEaEIxJk5/FCs2EjpHK39CaFs2JBxzFC5/QmABbGxAeBxsZAZzA342Ay9VZXNVPkYsLk5/BWt3RXoCaXRCeAtr
IP
Requested by https://dood.work/e/pcnyy07ay5sq
Certificate IssuerGoogle Trust Services
Subjectrvisofoseveralyear.com
Fingerprint8C:A7:F3:B6:0B:62:C3:5C:53:3B:59:B3:A6:41:30:07:22:A0:0D:D3
ValidityFri, 08 Nov 2024 08:12:55 GMT - Thu, 06 Feb 2025 08:12:54 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /WEJzTjJ3fRA9DwoXFwBkNghBLVwsLiIgZGgmNABwPhoxf2toB1U6Wzx/Sn4KaHdEaEIxJk5/FCs2EjpHK39CaFs2JBxzFC5/QmABbGxAeBxsZAZzA342Ay9VZXNVPkYsLk5/BWt3RXoCaXRCeAtr HTTP/1.1
Host: rvisofoseveralyear.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dood.work/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 204 No Content
date: Tue, 31 Dec 2024 10:16:01 GMT
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zGoGvgst%2F%2ByZ1OtxFrAj7QCyw%2BsEqGy4SOdsVojQ%2FBEHam7Zgp34k%2B%2FlBv6OMw%2FEAuCQ9DnIARgD8XS9ZxdMHhP7%2BNjpfVNDQyLDlnjPz%2Bqkh1Bv%2B2Y3UPFYeGqEbSddu2ub%2FDqoh52m"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8fa98303ac79712d-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=1804&min_rtt=487&rtt_var=2291&sent=9&recv=12&lost=0&retrans=0&sent_bytes=3307&recv_bytes=1703&delivery_rate=5498734&cwnd=254&unsent_bytes=0&cid=fbf5dce6c10a264b&ts=159&x=0"
X-Firefox-Spdy: h2
GET rvisofoseveralyear.com/V1V3TVJ4ahQ+bzUSLSULAmwUGz47DxEhZwQAISVlAANOHwQPYVE5OzNoTn1jZWBPayI+MUp/a3EmAywmIiZKfHQ+OxEib3EjSnx8Z3tBfXxjcwJwY3EhByw1amRRPSYjOUp8ZWRgQXliZmNGemBu
204 No Content 0 B URL GET HTTP/2 rvisofoseveralyear.com/V1V3TVJ4ahQ+bzUSLSULAmwUGz47DxEhZwQAISVlAANOHwQPYVE5OzNoTn1jZWBPayI+MUp/a3EmAywmIiZKfHQ+OxEib3EjSnx8Z3tBfXxjcwJwY3EhByw1amRRPSYjOUp8ZWRgQXliZmNGemBu
IP
Requested by https://dood.work/e/pcnyy07ay5sq
Certificate IssuerGoogle Trust Services
Subjectrvisofoseveralyear.com
Fingerprint8C:A7:F3:B6:0B:62:C3:5C:53:3B:59:B3:A6:41:30:07:22:A0:0D:D3
ValidityFri, 08 Nov 2024 08:12:55 GMT - Thu, 06 Feb 2025 08:12:54 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /V1V3TVJ4ahQ+bzUSLSULAmwUGz47DxEhZwQAISVlAANOHwQPYVE5OzNoTn1jZWBPayI+MUp/a3EmAywmIiZKfHQ+OxEib3EjSnx8Z3tBfXxjcwJwY3EhByw1amRRPSYjOUp8ZWRgQXliZmNGemBu HTTP/1.1
Host: rvisofoseveralyear.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dood.work/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 204 No Content
date: Tue, 31 Dec 2024 10:16:02 GMT
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8f2nkosV%2B1XQ4LACxhH4gaGkUe%2BiOWbXhfxByO0fPuElulpUAB4jj3%2BlHsP9Paj6Jt267uD5jU86fFSMBDNm33JNFBNtuQ7WJAySWJrkuc3pPKIR3rF6lWW%2BZmg3np5DEce57tkZBtCv"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8fa98303dcfa712d-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=1804&min_rtt=487&rtt_var=2291&sent=10&recv=12&lost=0&retrans=0&sent_bytes=3895&recv_bytes=1703&delivery_rate=5498734&cwnd=254&unsent_bytes=0&cid=fbf5dce6c10a264b&ts=173&x=0"
X-Firefox-Spdy: h2
GET rvisofoseveralyear.com/ZzhPb3FIBywcTDRCGQAjIm57LjdeQCwnBi9gfD1BBE8BNhVUW2kbGAMFdlhFVQx6SQEOXHJeSUFLOw4FEktyXlcOVikATEFOcl5fVxZ9QURBTXJeVxNILghMVh4/GwULBX5YQlIOe19AUQl4XkA
204 No Content 0 B URL GET HTTP/2 rvisofoseveralyear.com/ZzhPb3FIBywcTDRCGQAjIm57LjdeQCwnBi9gfD1BBE8BNhVUW2kbGAMFdlhFVQx6SQEOXHJeSUFLOw4FEktyXlcOVikATEFOcl5fVxZ9QURBTXJeVxNILghMVh4/GwULBX5YQlIOe19AUQl4XkA
IP
Requested by https://dood.work/e/pcnyy07ay5sq
Certificate IssuerGoogle Trust Services
Subjectrvisofoseveralyear.com
Fingerprint8C:A7:F3:B6:0B:62:C3:5C:53:3B:59:B3:A6:41:30:07:22:A0:0D:D3
ValidityFri, 08 Nov 2024 08:12:55 GMT - Thu, 06 Feb 2025 08:12:54 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ZzhPb3FIBywcTDRCGQAjIm57LjdeQCwnBi9gfD1BBE8BNhVUW2kbGAMFdlhFVQx6SQEOXHJeSUFLOw4FEktyXlcOVikATEFOcl5fVxZ9QURBTXJeVxNILghMVh4/GwULBX5YQlIOe19AUQl4XkA HTTP/1.1
Host: rvisofoseveralyear.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dood.work/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 204 No Content
date: Tue, 31 Dec 2024 10:16:02 GMT
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qou5iI%2FOsCQYsLC2r0WokcT2ZneemDe5SIaHCjzomb%2FZL7kNxbn90iZ8I%2FiK%2Barc3uH9UC9LCogTi1mtpzAg%2BVzBB%2FBXEKXbvjLieyUJRE2nMUFG51pYgieYxoe7gikavLppmkzAAP0J"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8fa98303cce2712d-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=1804&min_rtt=487&rtt_var=2291&sent=11&recv=12&lost=0&retrans=0&sent_bytes=4342&recv_bytes=1703&delivery_rate=5498734&cwnd=254&unsent_bytes=0&cid=fbf5dce6c10a264b&ts=176&x=0"
X-Firefox-Spdy: h2
GET bb361sd.cloudatacdn.com/favicon.ico?i
200 OK 15 kB URL GET HTTP/1.1 bb361sd.cloudatacdn.com/favicon.ico?i
IP
Requested by moz-nullprincipal:{5439b8a2-e816-4775-9989-26bc5fd959f4}?https://dood.work
Certificate IssuerSectigo Limited
Subject*.cloudatacdn.com
FingerprintD9:CB:D6:1F:B4:DA:36:1F:52:6C:5B:2E:68:48:4B:77:51:76:16:5B
ValidityWed, 31 Jul 2024 00:00:00 GMT - Thu, 31 Jul 2025 23:59:59 GMT
File type MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Hash 30d3656f43c817e38c3e7d70b2bfbdad
1aa43b43755e7cba5e145d0978517f7bedad7da6
a558a4796f60f07743027eec96b538b2e7758cca8c544ed796ff745837478555
GET /favicon.ico?i HTTP/1.1
Host: bb361sd.cloudatacdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Tue, 31 Dec 2024 10:16:02 GMT
Content-Type: image/vnd.microsoft.icon
Content-Length: 15406
Connection: keep-alive
Last-Modified: Sat, 29 Feb 2020 09:26:04 GMT
ETag: "3c2e-59fb38b06e300"
Accept-Ranges: bytes
Access-Control-Allow-Origin: *
GET dood.work/pass_md5/133864005-91-90-1735640160-d2e069bfb95408930aa4e25e2e1c90e7/sh8llcop7iv5rwoybuta7v35
200 OK 3.5 kB URL GET HTTP/2 dood.work/pass_md5/133864005-91-90-1735640160-d2e069bfb95408930aa4e25e2e1c90e7/sh8llcop7iv5rwoybuta7v35
IP
Requested by https://dood.work/e/pcnyy07ay5sq
Certificate IssuerGoogle Trust Services
Subjectdood.work
Fingerprint84:62:D1:51:0E:AC:4F:90:8D:50:FA:D2:3D:D5:91:7D:8C:D4:18:EF
ValidityFri, 22 Nov 2024 02:29:49 GMT - Thu, 20 Feb 2025 02:29:48 GMT
File type ASCII text, with no line terminators
Hash 70dfc1f05a67405bc816c6dd1f7f31e9
304102cfdf630145d990670356a4e60f91b5d5fc
fccdc47ad26b02fc45840b76c01aa0c95fdbb4a609dabbbe7beae12ca29387e7
GET /pass_md5/133864005-91-90-1735640160-d2e069bfb95408930aa4e25e2e1c90e7/sh8llcop7iv5rwoybuta7v35 HTTP/1.1
Host: dood.work
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: keep-alive
Referer: https://dood.work/e/pcnyy07ay5sq
Cookie: lang=1
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Tue, 31 Dec 2024 10:16:01 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VM%2FJpo16MfExieDHArgKx48SnhCmsWq8vUT7U80IitTunfzNW2rF0ekJteF0iJOProCBpkyeE1XEVTXyxqjlgJMbkIl6zlSsVfRZyd3T8kHXTDBGwJyDWXRFRA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8fa98301df9856c3-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=1580&min_rtt=548&rtt_var=1736&sent=23&recv=25&lost=0&retrans=0&sent_bytes=18667&recv_bytes=1342&delivery_rate=12083449&cwnd=257&unsent_bytes=0&cid=d22b8ea5c33cda51&ts=1534&x=0"
X-Firefox-Spdy: h2
GET i.doodcdn.co/theme_2/img/loader.svg
200 OK 1.6 kB URL GET HTTP/3 i.doodcdn.co/theme_2/img/loader.svg
IP
Requested by https://dood.work/e/pcnyy07ay5sq
Certificate IssuerGoogle Trust Services
Subjectdoodcdn.co
Fingerprint85:F9:AC:F1:05:04:E4:B0:96:10:9B:E5:E8:9B:D9:5C:A5:D3:93:16
ValidityTue, 26 Nov 2024 19:05:57 GMT - Mon, 24 Feb 2025 19:05:56 GMT
File type exported SGML document, ASCII text
Hash be00fc4a29d03016e78b28c9943e3f51
10f2025f5aa96706cc81e050eadfcaa9bcc55af5
eec2c40d8b1bb98306990239204d8b90ca030f0def0e00dfe3117ae42991e126
GET /theme_2/img/loader.svg HTTP/1.1
Host: i.doodcdn.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://i.doodcdn.co/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/3 200 OK
date: Tue, 31 Dec 2024 10:16:01 GMT
content-type: image/svg+xml
last-modified: Mon, 03 Jan 2022 15:43:40 GMT
cache-control: max-age=2592000
expires: Thu, 30 Jan 2025 01:49:26 GMT
access-control-allow-origin: *
cf-cache-status: HIT
age: 10098
priority: u=4,i=?0
vary: Accept-Encoding
server: cloudflare
cf-ray: 8fa983027892b4ff-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET du0pud0sdlmzf.cloudfront.net/2U1VqTEkwOgQqdic8DnFwY21aeX51JRgpL24xBSMtfSIFPiJ1PxkjJyNoATUPAywiAyVhPgcBHB5zHjYtbmVMICg9MldqLD02V31vMjEIcX11IRojIm4zAzgqKTQSJyc3cx8tdD46ECUlPzRPfg9me1ppe2N9En14dmYoaXtjOQMiPCtwWHwxa2M1en12Zi-hpe2MnHGl6EmxcYnl6cFh8LjY2ASNsYRNYfHhjZVt8eHZnWiogITAMIzF2Zyx1f31lTDl0Yg
200 OK 635 B URL GET HTTP/2 du0pud0sdlmzf.cloudfront.net/2U1VqTEkwOgQqdic8DnFwY21aeX51JRgpL24xBSMtfSIFPiJ1PxkjJyNoATUPAywiAyVhPgcBHB5zHjYtbmVMICg9MldqLD02V31vMjEIcX11IRojIm4zAzgqKTQSJyc3cx8tdD46ECUlPzRPfg9me1ppe2N9En14dmYoaXtjOQMiPCtwWHwxa2M1en12Zi-hpe2MnHGl6EmxcYnl6cFh8LjY2ASNsYRNYfHhjZVt8eHZnWiogITAMIzF2Zyx1f31lTDl0Yg
IP
Requested by https://epersaonwhois.com/cTBwZnAQUhMLTxANEkAFA1xNQ0I3FUIgFAQAABMUQUMUCh0LVl4FHB5FFAACHl4ESB4URFVUNkNlQTABJXUbET8WYQECGRIINAg2BmlCVxEUaEVXOiNXACpCRUgyNT0FViMvNiFZOlcgCVsaLAk/XzEyJSFxCREZMEkmDiAWUzIuMkRKOAwpBVIdMD04cxdfPR1UASo0QQImVUEHfRojORJoQVc5I18aLx1FSjEcFwB7JDcjO0kTVRMJCAQCNEUGNSUlHWAKNCAXV0kLFUBAAANCPwk1CEFFVB0/HxBoBAw/IH0ZNjMFRycuBwlRQitBFF5BVCoYHRgWFUN9Hi43HQY1CwgSaR4KRhJ2GF48G2lCJyM/Qyk0PihWOA4aK2YEXhU5ah4xGR5XOTIxPHkKIEIrSQhXFkIBHDI0HQApAVYbQx8IAExbCSAgCHg/CkIaXT0zPQ
Certificate IssuerAmazon
Subject*.cloudfront.net
Fingerprint28:D3:87:79:3C:E8:8B:3C:D9:10:45:E5:F7:64:7A:6D:44:4E:5A:62
ValidityTue, 30 Jul 2024 00:00:00 GMT - Thu, 03 Jul 2025 23:59:59 GMT
File type ASCII text, with very long lines (882), with no line terminators
Hash 3ce8c076249117e80c62fefb479e5e1a
56753bc8dc4bc16cf745618b06777c7f651a587b
271885cbfa302fbe26f3d2c44658fa4e566551631d26a43c82fadf5c835a2b08
GET /2U1VqTEkwOgQqdic8DnFwY21aeX51JRgpL24xBSMtfSIFPiJ1PxkjJyNoATUPAywiAyVhPgcBHB5zHjYtbmVMICg9MldqLD02V31vMjEIcX11IRojIm4zAzgqKTQSJyc3cx8tdD46ECUlPzRPfg9me1ppe2N9En14dmYoaXtjOQMiPCtwWHwxa2M1en12Zi-hpe2MnHGl6EmxcYnl6cFh8LjY2ASNsYRNYfHhjZVt8eHZnWiogITAMIzF2Zyx1f31lTDl0Yg HTTP/1.1
Host: du0pud0sdlmzf.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://epersaonwhois.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
content-length: 635
date: Tue, 31 Dec 2024 10:16:02 GMT
access-control-allow-origin: *
cache-control: max-age=31556926
content-encoding: gzip
x-cache: Miss from cloudfront
via: 1.1 36f6f4783c54484f0285e84da74ad1c6.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN53-P2
x-amz-cf-id: 85coThj2uqSt-QcM4fQraL6zxey8Han1sWItuvKEW223zmum45Z7Wg==
X-Firefox-Spdy: h2
GET dood.work/favicon.ico
200 OK 15 kB IP
Requested by https://dood.work/e/pcnyy07ay5sq
Certificate IssuerGoogle Trust Services
Subjectdood.work
Fingerprint84:62:D1:51:0E:AC:4F:90:8D:50:FA:D2:3D:D5:91:7D:8C:D4:18:EF
ValidityFri, 22 Nov 2024 02:29:49 GMT - Thu, 20 Feb 2025 02:29:48 GMT
File type MS Windows icon resource - 3 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Hash 30d3656f43c817e38c3e7d70b2bfbdad
1aa43b43755e7cba5e145d0978517f7bedad7da6
a558a4796f60f07743027eec96b538b2e7758cca8c544ed796ff745837478555
GET /favicon.ico HTTP/1.1
Host: dood.work
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dood.work/e/pcnyy07ay5sq
Cookie: lang=1
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 200 OK
date: Tue, 31 Dec 2024 10:16:02 GMT
content-type: image/x-icon
content-length: 15406
last-modified: Mon, 03 Jan 2022 15:38:36 GMT
etag: "61d3187c-3c2e"
expires: Thu, 16 Jan 2025 11:23:01 GMT
cache-control: public, max-age=2592000, no-transform
access-control-allow-origin: *
cf-cache-status: HIT
age: 1205581
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8o8pxeHBjJglxpUF%2FYUt9tFHY3YnDR7R%2FOSGk3pZbWpvRlFCKnFRXwj1p56mjIkVQGC%2BODShjhbWD2XcWIn4A3eNBkMXpnuC%2BTkcYc8BjLoY5P9nbo6dSh3a4A%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8fa98308b90556c3-OSL
server-timing: cfL4;desc="?proto=TCP&rtt=1321&min_rtt=459&rtt_var=1426&sent=26&recv=28&lost=0&retrans=0&sent_bytes=19259&recv_bytes=1459&delivery_rate=12083449&cwnd=257&unsent_bytes=0&cid=d22b8ea5c33cda51&ts=2584&x=0"
X-Firefox-Spdy: h2
GET accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&uilel=3&hl=en&service=mail
302 Found 0 B URL GET HTTP/2 accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&uilel=3&hl=en&service=mail
IP
Requested by https://dood.work/e/pcnyy07ay5sq
Certificate IssuerGoogle Trust Services
Subjectaccounts.google.com
Fingerprint69:38:7E:29:3C:FF:37:1E:96:50:B5:FA:A1:F2:98:30:3B:BE:E6:8D
ValidityMon, 02 Dec 2024 08:37:47 GMT - Mon, 24 Feb 2025 08:37:46 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&uilel=3&hl=en&service=mail HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dood.work/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
content-type: application/binary
set-cookie: __Host-GAPS=1:1Gg62uknjCosMUg6fEdjSvGXi9lScA:qbkLopC2y45-kdj5; Expires=Thu, 31-Dec-2026 10:16:02 GMT; Path=/; Secure; HttpOnly; Priority=HIGH
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Tue, 31 Dec 2024 10:16:02 GMT
location: https://accounts.google.com/InteractiveLogin?continue=https://www.google.com/favicon.ico&hl=en&passive=true&service=mail&uilel=3&ifkv=AeZLP9_o1czSOY5uDuAw9KuzVT06toyypDjRpSZdkAgsXfhIAhKYKhnWg27N0GofRCvia_m52cJBbg
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport, script-src 'nonce-chUVV9HV-Mx53dgZGWYJdA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsSigninPassiveLoginHttp/cspreport/allowlist
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: unsafe-none
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
server: ESF
content-length: 0
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET ukankingwithea.com/asd100.bin
200 OK 103 kB URL GET HTTP/2 ukankingwithea.com/asd100.bin
IP
Requested by https://dood.work/e/pcnyy07ay5sq
Certificate IssuerGoogle Trust Services
Subjectukankingwithea.com
Fingerprint72:95:BE:5B:B7:C6:8C:31:B9:5E:60:DA:66:68:99:88:EC:99:F6:E5
ValiditySun, 03 Nov 2024 13:54:20 GMT - Sat, 01 Feb 2025 13:54:19 GMT
Size 103 kB (102679 bytes)
Hash 106f83784fad60e4a6e34ca732b689ee
e91e38e2594d2095825ddb10c3b6feeb653e6f8d
968c4c9a81752f2a642cc8e00d9c9fc3df334091cd73814c47a8c75a23b4fa34
GET /asd100.bin HTTP/1.1
Host: ukankingwithea.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dood.work/
Origin: https://dood.work
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 31 Dec 2024 10:16:02 GMT
content-type: binary/octet-stream
access-control-allow-origin: https://dood.work
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-headers: X-Requested-With, content-type
cache-control: max-age=14400
cf-cache-status: HIT
age: 4715
last-modified: Tue, 31 Dec 2024 08:57:27 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K1ro2dVTWio6J6fprawWpe1px6%2BfTv4r8OcvkLYiaCX31m8EoJI4Uzqe3iwNK01Kt6z0OnIzMFV1b2R3UHXlmMupedLN8doLUJZBH1fU7R0CL3PG%2BhP%2BvSxXPh5tMOFw6va0e6Q%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8fa983093a4cb518-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=653&min_rtt=416&rtt_var=446&sent=8&recv=13&lost=0&retrans=0&sent_bytes=3293&recv_bytes=1349&delivery_rate=6798122&cwnd=254&unsent_bytes=0&cid=40d298f537edca08&ts=63&x=0"
X-Firefox-Spdy: h2
GET fastlycdn.com/ajax/libs/react/18.3.1/cjs/react.production.min.js
200 OK 137 kB URL GET HTTP/2 fastlycdn.com/ajax/libs/react/18.3.1/cjs/react.production.min.js
IP
Requested by https://dood.work/e/pcnyy07ay5sq
Certificate IssuerGoogle Trust Services
Subjectfastlycdn.com
FingerprintA7:41:83:91:20:BA:C4:A5:A6:03:58:CB:E5:A3:A1:51:F7:16:44:10
ValiditySun, 22 Dec 2024 03:19:32 GMT - Sat, 22 Mar 2025 04:19:29 GMT
File type JavaScript source, ASCII text, with very long lines (65536), with no line terminators
Size 137 kB (137271 bytes)
Hash 4f6bfb70659c4e69a8c64b0ab5d91654
6c71a1ed4086f1f8bd3480c75d45eeae4605220b
384aade1bb638dac512359c28e335e8d7f930d87229c54230aca5d22dfd17583
GET /ajax/libs/react/18.3.1/cjs/react.production.min.js HTTP/1.1
Host: fastlycdn.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dood.work/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 31 Dec 2024 10:16:00 GMT
content-type: text/javascript
etag: W/"4f6bfb70659c4e69a8c64b0ab5d91654"
last-modified: Thu, 24 Oct 2024 11:13:26 GMT
vary: Accept-Encoding
cache-control: max-age=86400
cf-cache-status: HIT
age: 86235
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qknKA22uJ9b4sgWYsb%2FsU9Ds%2B2Kzx7jn44Ez4xUDj2Xjtssa548KkCLWpF4Wuj44VZdi1GSM4zH45azMh1YFffPEvZiaNpEJasZ7B51BEo8VIz5488DY1pdDE8fRH80C"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8fa982fd1be1b50b-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=760&min_rtt=449&rtt_var=608&sent=7&recv=11&lost=0&retrans=0&sent_bytes=3262&recv_bytes=1207&delivery_rate=6304789&cwnd=254&unsent_bytes=0&cid=abb7c760f77a9025&ts=149&x=0"
X-Firefox-Spdy: h2
GET accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube
302 Found 0 B URL GET HTTP/2 accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube
IP
Requested by https://dood.work/e/pcnyy07ay5sq
Certificate IssuerGoogle Trust Services
Subjectaccounts.google.com
Fingerprint69:38:7E:29:3C:FF:37:1E:96:50:B5:FA:A1:F2:98:30:3B:BE:E6:8D
ValidityMon, 02 Dec 2024 08:37:47 GMT - Mon, 24 Feb 2025 08:37:46 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dood.work/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
content-type: application/binary
set-cookie: __Host-GAPS=1:sPajaFWgLN6tXiSofJvysKdKhvuB2Q:wj4ph7MVshtEtcfN; Expires=Thu, 31-Dec-2026 10:16:02 GMT; Path=/; Secure; HttpOnly; Priority=HIGH
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Tue, 31 Dec 2024 10:16:02 GMT
location: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=AeZLP99t8HMmh7FPdxv9ObR6Nu05FGkL5n5xQcamUrX62nAj3IRz41KSgNsngdjgmVd0de4tMd1_pg
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport, script-src 'nonce-I3vI5aeC8ZZqnjaPiH1Dsg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsSigninPassiveLoginHttp/cspreport/allowlist
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
server: ESF
content-length: 0
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET accounts.google.com/InteractiveLogin?continue=https://www.google.com/favicon.ico&hl=en&passive=true&service=mail&uilel=3&ifkv=AeZLP9_o1czSOY5uDuAw9KuzVT06toyypDjRpSZdkAgsXfhIAhKYKhnWg27N0GofRCvia_m52cJBbg
302 Found 420 B URL GET HTTP/2 accounts.google.com/InteractiveLogin?continue=https://www.google.com/favicon.ico&hl=en&passive=true&service=mail&uilel=3&ifkv=AeZLP9_o1czSOY5uDuAw9KuzVT06toyypDjRpSZdkAgsXfhIAhKYKhnWg27N0GofRCvia_m52cJBbg
IP
Requested by https://dood.work/e/pcnyy07ay5sq
Certificate IssuerGoogle Trust Services
Subjectaccounts.google.com
Fingerprint69:38:7E:29:3C:FF:37:1E:96:50:B5:FA:A1:F2:98:30:3B:BE:E6:8D
ValidityMon, 02 Dec 2024 08:37:47 GMT - Mon, 24 Feb 2025 08:37:46 GMT
File type HTML document, ASCII text, with very long lines (390)
Hash 1bc05869cb42f4c41f7bd0203e62128e
2021ea7f8b9ac870470b8f28ed0c81ce63299f93
3093537af46385effa37dc5280d9842e584d01b14700d1e25b2de9d61055655e
GET /InteractiveLogin?continue=https://www.google.com/favicon.ico&hl=en&passive=true&service=mail&uilel=3&ifkv=AeZLP9_o1czSOY5uDuAw9KuzVT06toyypDjRpSZdkAgsXfhIAhKYKhnWg27N0GofRCvia_m52cJBbg HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dood.work/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 302 Found
content-type: text/html; charset=UTF-8
set-cookie: __Host-GAPS=1:xKyykvQFa4ZlwNSOG1Z6q341YM9yQA:mvPupU4lsOzA3-yK;Path=/;Expires=Thu, 31-Dec-2026 10:16:02 GMT;Secure;HttpOnly;Priority=HIGH
x-frame-options: DENY
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Tue, 31 Dec 2024 10:16:02 GMT
location: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=AeZLP9_Scmgr5XocfFIijr0hGTPyT-48CSaH6FM9Nl_UeYpLYa0dqVRnqhnu8xn0ybjdncNfK7pfcg&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1780373337%3A1735640162949777&ddm=1
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: script-src 'nonce-iOgyliPAQfdWzPZzJ4-orQ' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport, require-trusted-types-for 'script';report-uri /cspreport
cross-origin-opener-policy-report-only: same-origin; report-to="coop_gse_qebhlk"
report-to: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 420
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=AeZLP99t8HMmh7FPdxv9ObR6Nu05FGkL5n5xQcamUrX62nAj3IRz41KSgNsngdjgmVd0de4tMd1_pg
302 Found 424 B URL GET HTTP/2 accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=AeZLP99t8HMmh7FPdxv9ObR6Nu05FGkL5n5xQcamUrX62nAj3IRz41KSgNsngdjgmVd0de4tMd1_pg
IP
Requested by https://dood.work/e/pcnyy07ay5sq
Certificate IssuerGoogle Trust Services
Subjectaccounts.google.com
Fingerprint69:38:7E:29:3C:FF:37:1E:96:50:B5:FA:A1:F2:98:30:3B:BE:E6:8D
ValidityMon, 02 Dec 2024 08:37:47 GMT - Mon, 24 Feb 2025 08:37:46 GMT
File type HTML document, ASCII text, with very long lines (393)
Hash 8a1b26ad6525345246337e28411723c2
b4991d69b87e6732a30f0bddb9c62e065379c1ff
5d213c6ee05b42fc7e7bda3411e98031006093e6be5c183c8cfe94a4431428ee
GET /InteractiveLogin?continue=https://www.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=AeZLP99t8HMmh7FPdxv9ObR6Nu05FGkL5n5xQcamUrX62nAj3IRz41KSgNsngdjgmVd0de4tMd1_pg HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dood.work/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers
HTTP/2 302 Found
content-type: text/html; charset=UTF-8
set-cookie: __Host-GAPS=1:vKunrlNOW6poGckHVLDWbr3k_AiV1Q:oBd4fOKLTsVRCssB;Path=/;Expires=Thu, 31-Dec-2026 10:16:02 GMT;Secure;HttpOnly;Priority=HIGH
x-frame-options: DENY
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Tue, 31 Dec 2024 10:16:02 GMT
location: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=AeZLP9_2LTvz2abD5Nyb_Yfss3vx1qGJf-MI6uObtE_1bPNjf_pCP15ei_tGwEQBtQvW-0dxU0xoGw&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S121429233%3A1735640162971388&ddm=1
strict-transport-security: max-age=31536000; includeSubDomains
report-to: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}
content-security-policy: require-trusted-types-for 'script';report-uri /cspreport, script-src 'nonce-ab42tcacjJ1AVTv4HfaTXg' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport
cross-origin-opener-policy-report-only: same-origin; report-to="coop_gse_qebhlk"
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 424
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET epersaonwhois.com/cTBwZnAQUhMLTxANEkAFA1xNQ0I3FUIgFAQAABMUQUMUCh0LVl4FHB5FFAACHl4ESB4URFVUNkNlQTABJXUbET8WYQECGRIINAg2BmlCVxEUaEVXOiNXACpCRUgyNT0FViMvNiFZOlcgCVsaLAk/XzEyJSFxCREZMEkmDiAWUzIuMkRKOAwpBVIdMD04cxdfPR1UASo0QQImVUEHfRojORJoQVc5I18aLx1FSjEcFwB7JDcjO0kTVRMJCAQCNEUGNSUlHWAKNCAXV0kLFUBAAANCPwk1CEFFVB0/HxBoBAw/IH0ZNjMFRycuBwlRQitBFF5BVCoYHRgWFUN9Hi43HQY1CwgSaR4KRhJ2GF48G2lCJyM/Qyk0PihWOA4aK2YEXhU5ah4xGR5XOTIxPHkKIEIrSQhXFkIBHDI0HQApAVYbQx8IAExbCSAgCHg/CkIaXT0zPQ
200 OK 3.0 kB URL GET HTTP/2 epersaonwhois.com/cTBwZnAQUhMLTxANEkAFA1xNQ0I3FUIgFAQAABMUQUMUCh0LVl4FHB5FFAACHl4ESB4URFVUNkNlQTABJXUbET8WYQECGRIINAg2BmlCVxEUaEVXOiNXACpCRUgyNT0FViMvNiFZOlcgCVsaLAk/XzEyJSFxCREZMEkmDiAWUzIuMkRKOAwpBVIdMD04cxdfPR1UASo0QQImVUEHfRojORJoQVc5I18aLx1FSjEcFwB7JDcjO0kTVRMJCAQCNEUGNSUlHWAKNCAXV0kLFUBAAANCPwk1CEFFVB0/HxBoBAw/IH0ZNjMFRycuBwlRQitBFF5BVCoYHRgWFUN9Hi43HQY1CwgSaR4KRhJ2GF48G2lCJyM/Qyk0PihWOA4aK2YEXhU5ah4xGR5XOTIxPHkKIEIrSQhXFkIBHDI0HQApAVYbQx8IAExbCSAgCHg/CkIaXT0zPQ
IP
Requested by https://dood.work/e/pcnyy07ay5sq
Certificate IssuerAmazon
Subjectepersaonwhois.com
Fingerprint2A:76:57:CC:97:F3:DA:90:20:DA:B1:37:0D:34:21:01:60:8C:47:D8
ValidityWed, 13 Nov 2024 00:00:00 GMT - Fri, 12 Dec 2025 23:59:59 GMT
File type HTML document, ASCII text, with very long lines (3068), with no line terminators
Hash a360752ff73cf68cb21a5072f8303cb7
af7a949d54a475a641a2384190691d5692326e27
ce84604322d2f53c2bdda759ace825b449d03ff0054d0b961085b77ece0cbd30
GET /cTBwZnAQUhMLTxANEkAFA1xNQ0I3FUIgFAQAABMUQUMUCh0LVl4FHB5FFAACHl4ESB4URFVUNkNlQTABJXUbET8WYQECGRIINAg2BmlCVxEUaEVXOiNXACpCRUgyNT0FViMvNiFZOlcgCVsaLAk/XzEyJSFxCREZMEkmDiAWUzIuMkRKOAwpBVIdMD04cxdfPR1UASo0QQImVUEHfRojORJoQVc5I18aLx1FSjEcFwB7JDcjO0kTVRMJCAQCNEUGNSUlHWAKNCAXV0kLFUBAAANCPwk1CEFFVB0/HxBoBAw/IH0ZNjMFRycuBwlRQitBFF5BVCoYHRgWFUN9Hi43HQY1CwgSaR4KRhJ2GF48G2lCJyM/Qyk0PihWOA4aK2YEXhU5ah4xGR5XOTIxPHkKIEIrSQhXFkIBHDI0HQApAVYbQx8IAExbCSAgCHg/CkIaXT0zPQ HTTP/1.1
Host: epersaonwhois.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dood.work/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/html
content-length: 1195
date: Tue, 31 Dec 2024 10:16:02 GMT
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List
set-cookie: AWSALB=kkfC0006LPxxL7Q7L1vKhzdk7GaJkeapK3lg4Y/mydLTt7nb4HFwF942rUjj5uIeJIkwoMRVt/hGcrMzI3OhAiBosVXd2ewgYxO40LpN5p7AYOQI5eoI+jZuZb7w; Expires=Tue, 07 Jan 2025 10:16:02 GMT; Path=/
AWSALBCORS=kkfC0006LPxxL7Q7L1vKhzdk7GaJkeapK3lg4Y/mydLTt7nb4HFwF942rUjj5uIeJIkwoMRVt/hGcrMzI3OhAiBosVXd2ewgYxO40LpN5p7AYOQI5eoI+jZuZb7w; Expires=Tue, 07 Jan 2025 10:16:02 GMT; Path=/; SameSite=None
server: openresty/1.17.8.2
cache-control: no-store, no-cache, must-revalidate, no-transform
pragma: no-cache
p3p: CP="NID DSP ALL COR"
content-encoding: gzip
x-cache: Miss from cloudfront
via: 1.1 04c4f064943f75498361739eb063cb7a.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: SPBW44u5GwSaz6iQRxz6Knd4NwcvdMbAONxATk9xjOlH1EUaqvcwfg==
X-Firefox-Spdy: h2
GET i.doodcdn.co/css/embed.css
200 OK 80 kB URL GET HTTP/2 i.doodcdn.co/css/embed.css
IP
Requested by https://dood.work/e/pcnyy07ay5sq
Certificate IssuerGoogle Trust Services
Subjectdoodcdn.co
Fingerprint85:F9:AC:F1:05:04:E4:B0:96:10:9B:E5:E8:9B:D9:5C:A5:D3:93:16
ValidityTue, 26 Nov 2024 19:05:57 GMT - Mon, 24 Feb 2025 19:05:56 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /css/embed.css HTTP/1.1
Host: i.doodcdn.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dood.work/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 31 Dec 2024 10:16:00 GMT
content-type: text/css
last-modified: Mon, 03 Jan 2022 15:38:36 GMT
vary: Accept-Encoding
etag: W/"61d3187c-13812"
expires: Wed, 29 Jan 2025 07:15:35 GMT
cache-control: public, max-age=2592000, no-transform
access-control-allow-origin: *
content-encoding: gzip
cf-cache-status: HIT
age: 29934
server: cloudflare
cf-ray: 8fa982fcef2356aa-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET cdn.tsyndicate.com/sdk/v1/p.js
200 OK 12 kB URL GET HTTP/2 cdn.tsyndicate.com/sdk/v1/p.js
IP
ASN #39572 DataWeb Global Group B.V.
Requested by https://dood.work/e/pcnyy07ay5sq
Certificate IssuerLet's Encrypt
Subjectcdn.tsyndicate.com
FingerprintEE:56:65:1A:EE:E1:0D:40:CD:9B:4A:D1:8C:34:85:70:0B:67:65:C4
ValidityThu, 05 Dec 2024 06:33:22 GMT - Wed, 05 Mar 2025 06:33:21 GMT
File type JavaScript source, ASCII text, with very long lines (12135)
Hash 704756ea6eb5feeb1b4104f7f3f65357
50b2ef7afde010ea3b39848f036a8455aa32505c
8705424142c9706d6462742aa1517e5cc63263d0cf5496922e7187ab3393f45d
GET /sdk/v1/p.js HTTP/1.1
Host: cdn.tsyndicate.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dood.work/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 31 Dec 2024 10:16:01 GMT
content-type: application/javascript; charset=utf-8
server: nginx
last-modified: Thu, 05 Dec 2024 13:39:47 GMT
etag: W/"6751ad23-2fb3"
x-robots-tag: noindex, nofollow
content-encoding: gzip
cache-control: max-age=172800
expires: Thu, 02 Jan 2025 10:16:01 GMT
vary: Accept-Encoding
x-proxy-cache: HIT
x-cdn-host-id: ah1742,ds9201
X-Firefox-Spdy: h2
GET undefined/MkE1SVVTI1YkalN8V28gQC0IbGd0ZAcPMUdxRTwxAjJRJThIJxsqOV00US8nXS9BZztXNRB7E1AlYR8SZDtkHgJbJk0KInQifCQ6fBBSD2VrNnMdB2YQTBw+WhN+HT1jFgUAJXgXDB0NSBQBHjJnCHEbPVwMBBgwfRBvDgNVCFgcZHwDZQ0YeBNnBCR8LVoaFnUATB49awhRehNkBGMtYms5fAgDejIDHiILIn4jIWQUdCoUaylFDxB6E1sBFAIEUXoceg9NC2VocFIqAkgMQwwAUQdlJG1xClIHLFEmVnoQehNbGzJ/EFEbDHwQTT1nVClzARdhbHAwA0p0VBBnZDhnPgMBG0IbEHAZUTAXWRdhBSxkE3B4OhdzdyoyaztxARcHA3MHFFdzbG8/QS5bOWh5DmYPNGovB3o2djBS
0 B URL GET undefined/MkE1SVVTI1YkalN8V28gQC0IbGd0ZAcPMUdxRTwxAjJRJThIJxsqOV00US8nXS9BZztXNRB7E1AlYR8SZDtkHgJbJk0KInQifCQ6fBBSD2VrNnMdB2YQTBw+WhN+HT1jFgUAJXgXDB0NSBQBHjJnCHEbPVwMBBgwfRBvDgNVCFgcZHwDZQ0YeBNnBCR8LVoaFnUATB49awhRehNkBGMtYms5fAgDejIDHiILIn4jIWQUdCoUaylFDxB6E1sBFAIEUXoceg9NC2VocFIqAkgMQwwAUQdlJG1xClIHLFEmVnoQehNbGzJ/EFEbDHwQTT1nVClzARdhbHAwA0p0VBBnZDhnPgMBG0IbEHAZUTAXWRdhBSxkE3B4OhdzdyoyaztxARcHA3MHFFdzbG8/QS5bOWh5DmYPNGovB3o2djBS
IP
Requested by https://dood.work/e/pcnyy07ay5sq
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /MkE1SVVTI1YkalN8V28gQC0IbGd0ZAcPMUdxRTwxAjJRJThIJxsqOV00US8nXS9BZztXNRB7E1AlYR8SZDtkHgJbJk0KInQifCQ6fBBSD2VrNnMdB2YQTBw+WhN+HT1jFgUAJXgXDB0NSBQBHjJnCHEbPVwMBBgwfRBvDgNVCFgcZHwDZQ0YeBNnBCR8LVoaFnUATB49awhRehNkBGMtYms5fAgDejIDHiILIn4jIWQUdCoUaylFDxB6E1sBFAIEUXoceg9NC2VocFIqAkgMQwwAUQdlJG1xClIHLFEmVnoQehNbGzJ/EFEbDHwQTT1nVClzARdhbHAwA0p0VBBnZDhnPgMBG0IbEHAZUTAXWRdhBSxkE3B4OhdzdyoyaztxARcHA3MHFFdzbG8/QS5bOWh5DmYPNGovB3o2djBS HTTP/1.1
Host: undefined
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dood.work/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
GET undefined/TlpYTjIvODsjDS9nOmhHPDZlawAIf2oIVjtqKDtWfik8Il80PHYtXiEvPChAITQsYFwrLn18dC05NBxfGgw/HH05PSoURRdjGSBwJgs1GGcrHRobeAwLNx5Zdi0bHXt2AhsDeB4gFhtiJg8xAFUEKhUnY3sQNQMCCT0vI3AaYgADAx89EA1eIgs2B3kCHgEYUxsbNwBaCCoOfEF7HDIUUCsCbAl4DzE1FGAfYx0nBicfITl8ByAgG3sfPi8AYH4vHDd3fh9rCGcNaGktaAsUfXx0Lxw3PWR9ImEfYBQePnxVKwoJKQYHHDwjZCQMPxxzOgs9FgMMHDNjfGtoHi9zDzMJfQYUCWoEeygCHhZoIgMpHmALf2oIcRkyKQB1FA0+CVoNAA4UCigPGiVzDQspCEgHEBYWAw8fNHcFKjESN3d9GChoWD01Nj4PGjM5GgUcDQwaYxcAMw
0 B URL GET undefined/TlpYTjIvODsjDS9nOmhHPDZlawAIf2oIVjtqKDtWfik8Il80PHYtXiEvPChAITQsYFwrLn18dC05NBxfGgw/HH05PSoURRdjGSBwJgs1GGcrHRobeAwLNx5Zdi0bHXt2AhsDeB4gFhtiJg8xAFUEKhUnY3sQNQMCCT0vI3AaYgADAx89EA1eIgs2B3kCHgEYUxsbNwBaCCoOfEF7HDIUUCsCbAl4DzE1FGAfYx0nBicfITl8ByAgG3sfPi8AYH4vHDd3fh9rCGcNaGktaAsUfXx0Lxw3PWR9ImEfYBQePnxVKwoJKQYHHDwjZCQMPxxzOgs9FgMMHDNjfGtoHi9zDzMJfQYUCWoEeygCHhZoIgMpHmALf2oIcRkyKQB1FA0+CVoNAA4UCigPGiVzDQspCEgHEBYWAw8fNHcFKjESN3d9GChoWD01Nj4PGjM5GgUcDQwaYxcAMw
IP
Requested by https://dood.work/e/pcnyy07ay5sq
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert Quad9 DNS malicious Sinkholed
GET /TlpYTjIvODsjDS9nOmhHPDZlawAIf2oIVjtqKDtWfik8Il80PHYtXiEvPChAITQsYFwrLn18dC05NBxfGgw/HH05PSoURRdjGSBwJgs1GGcrHRobeAwLNx5Zdi0bHXt2AhsDeB4gFhtiJg8xAFUEKhUnY3sQNQMCCT0vI3AaYgADAx89EA1eIgs2B3kCHgEYUxsbNwBaCCoOfEF7HDIUUCsCbAl4DzE1FGAfYx0nBicfITl8ByAgG3sfPi8AYH4vHDd3fh9rCGcNaGktaAsUfXx0Lxw3PWR9ImEfYBQePnxVKwoJKQYHHDwjZCQMPxxzOgs9FgMMHDNjfGtoHi9zDzMJfQYUCWoEeygCHhZoIgMpHmALf2oIcRkyKQB1FA0+CVoNAA4UCigPGiVzDQspCEgHEBYWAw8fNHcFKjESN3d9GChoWD01Nj4PGjM5GgUcDQwaYxcAMw HTTP/1.1
Host: undefined
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dood.work/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
GET accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=AeZLP9_Scmgr5XocfFIijr0hGTPyT-48CSaH6FM9Nl_UeYpLYa0dqVRnqhnu8xn0ybjdncNfK7pfcg&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1780373337%3A1735640162949777&ddm=1
403 Forbidden 0 B URL GET HTTP/3 accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=AeZLP9_Scmgr5XocfFIijr0hGTPyT-48CSaH6FM9Nl_UeYpLYa0dqVRnqhnu8xn0ybjdncNfK7pfcg&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1780373337%3A1735640162949777&ddm=1
IP
Requested by https://dood.work/e/pcnyy07ay5sq
Certificate IssuerGoogle Trust Services
Subject*.google.com
Fingerprint36:7C:F6:D0:DA:DB:45:E1:80:A6:76:D2:C1:A5:38:1A:0B:8D:99:4E
ValidityMon, 02 Dec 2024 08:35:57 GMT - Mon, 24 Feb 2025 08:35:56 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=AeZLP9_Scmgr5XocfFIijr0hGTPyT-48CSaH6FM9Nl_UeYpLYa0dqVRnqhnu8xn0ybjdncNfK7pfcg&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1780373337%3A1735640162949777&ddm=1 HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dood.work/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 403 Forbidden
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Tue, 31 Dec 2024 10:16:03 GMT
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
strict-transport-security: max-age=31536000; includeSubDomains
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
content-security-policy: script-src 'nonce-7-lTRWTPozuRZvpCdq96dA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com https://support.google.com/inapp/ https://www.google.com/tools/feedback/ https://www.gstatic.com/inproduct_help/ https://www.gstatic.com/support/content/;report-uri /v3/signin/_/AccountsSignInUi/cspreport/allowlist, require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreport
content-security-policy-report-only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://www.google.com/recaptcha/api.js https://translate.google.com/translate_a/element.js https://ajax.googleapis.com/ajax/libs/jquery/3.6.4/jquery.min.js https://www.google.com/tools/feedback/load.js https://www.google.com/tools/feedback/open.js https://www.google.com/tools/feedback/open_to_help_guide_lazy.js https://www.google.com/tools/feedback/help_api.js https://www.gstatic.com/inproduct_help/service/lazy.min.js https://www.gstatic.com/inproduct_help/api/main.min.js https://www.gstatic.com/inproduct_help/chatsupport/chatsupport_button_v2.js https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js https://www.gstatic.com/uservoice/feedback/client/web/live/ https://www.google.com/tools/feedback/chat_load.js https://www.gstatic.com/uservoice/surveys/resources/prod/js/survey/ https://www.gstatic.com/feedback/js/ghelp/ https://www.gstatic.com/_/mss/boq-one-google/_/ https://www.gstatic.com/og/_/js/ https://apis.google.com/js/api.js https://apis.google.com/js/client.js https://www.googletagmanager.com/gtag/js https://www.google-analytics.com/analytics.js https://www.googletagmanager.com/gtag/destination https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.1PNB2j8wR4U.es5.O/ https://apis.google.com/_/scs/abc-static/_/js/ https://translate.googleapis.com/_/translate_http/_/js/ https://www.gstatic.com/recaptcha/releases/;report-uri /v3/signin/_/AccountsSignInUi/cspreport/fine-allowlist
report-to: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}
cross-origin-opener-policy-report-only: same-origin; report-to="AccountsSignInUi"
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=AeZLP9_2LTvz2abD5Nyb_Yfss3vx1qGJf-MI6uObtE_1bPNjf_pCP15ei_tGwEQBtQvW-0dxU0xoGw&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S121429233%3A1735640162971388&ddm=1
403 Forbidden 0 B URL GET HTTP/3 accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=AeZLP9_2LTvz2abD5Nyb_Yfss3vx1qGJf-MI6uObtE_1bPNjf_pCP15ei_tGwEQBtQvW-0dxU0xoGw&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S121429233%3A1735640162971388&ddm=1
IP
Requested by https://dood.work/e/pcnyy07ay5sq
Certificate IssuerGoogle Trust Services
Subject*.google.com
Fingerprint36:7C:F6:D0:DA:DB:45:E1:80:A6:76:D2:C1:A5:38:1A:0B:8D:99:4E
ValidityMon, 02 Dec 2024 08:35:57 GMT - Mon, 24 Feb 2025 08:35:56 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=AeZLP9_2LTvz2abD5Nyb_Yfss3vx1qGJf-MI6uObtE_1bPNjf_pCP15ei_tGwEQBtQvW-0dxU0xoGw&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S121429233%3A1735640162971388&ddm=1 HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dood.work/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 403 Forbidden
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Tue, 31 Dec 2024 10:16:03 GMT
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
strict-transport-security: max-age=31536000; includeSubDomains
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
report-to: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only: same-origin; report-to="AccountsSignInUi"
content-security-policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreport, script-src 'nonce-qqlzXCx6aBLOiRBg_JTBFg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com https://support.google.com/inapp/ https://www.google.com/tools/feedback/ https://www.gstatic.com/inproduct_help/ https://www.gstatic.com/support/content/;report-uri /v3/signin/_/AccountsSignInUi/cspreport/allowlist
content-security-policy-report-only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://www.google.com/recaptcha/api.js https://translate.google.com/translate_a/element.js https://ajax.googleapis.com/ajax/libs/jquery/3.6.4/jquery.min.js https://www.google.com/tools/feedback/load.js https://www.google.com/tools/feedback/open.js https://www.google.com/tools/feedback/open_to_help_guide_lazy.js https://www.google.com/tools/feedback/help_api.js https://www.gstatic.com/inproduct_help/service/lazy.min.js https://www.gstatic.com/inproduct_help/api/main.min.js https://www.gstatic.com/inproduct_help/chatsupport/chatsupport_button_v2.js https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js https://www.gstatic.com/uservoice/feedback/client/web/live/ https://www.google.com/tools/feedback/chat_load.js https://www.gstatic.com/uservoice/surveys/resources/prod/js/survey/ https://www.gstatic.com/feedback/js/ghelp/ https://www.gstatic.com/_/mss/boq-one-google/_/ https://www.gstatic.com/og/_/js/ https://apis.google.com/js/api.js https://apis.google.com/js/client.js https://www.googletagmanager.com/gtag/js https://www.google-analytics.com/analytics.js https://www.googletagmanager.com/gtag/destination https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.1PNB2j8wR4U.es5.O/ https://apis.google.com/_/scs/abc-static/_/js/ https://translate.googleapis.com/_/translate_http/_/js/ https://www.gstatic.com/recaptcha/releases/;report-uri /v3/signin/_/AccountsSignInUi/cspreport/fine-allowlist
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET isolatedovercomepasted.com/aas/r45d/vki/1941940/d69b5b55.js
200 OK 148 kB URL GET HTTP/2 isolatedovercomepasted.com/aas/r45d/vki/1941940/d69b5b55.js
IP
Requested by https://dood.work/e/pcnyy07ay5sq
Certificate IssuerBuypass AS-983163327
Subject
Fingerprint9E:22:B6:98:C8:68:79:52:6A:D7:31:98:81:E7:59:59:45:14:CB:33
ValidityFri, 20 Sep 2024 14:45:38 GMT - Tue, 18 Mar 2025 22:59:00 GMT
File type JavaScript source, ASCII text, with very long lines (64971)
Size 148 kB (147664 bytes)
Hash ffb2320c4fe3b4ef28280b0a7b31381b
4dc82e799b047ab99c1e80961295a2f148758455
cc0f6721ee3eb86004c330d481e645a26b0bbacb297776047b466bd4e27ebe0c
GET /aas/r45d/vki/1941940/d69b5b55.js HTTP/1.1
Host: isolatedovercomepasted.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://dood.work/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
server: nginx
date: Tue, 31 Dec 2024 10:16:01 GMT
content-type: application/javascript; charset=utf-8
last-modified: Tue, 24 Dec 2024 15:33:50 GMT
vary: Accept-Encoding
etag: W/"676ad45e-24176"
x-js-ab2: current
timing-allow-origin: *
accept-ch: sec-ch-ua-wow64,sec-ch-ua-full-version-list,sec-ch-ua,sec-ch-ua-platform,sec-ch-ua-mobile,sec-ch-ua-full-version,sec-ch-ua-platform-version,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-model,sec-ch-width,sec-ch-viewport-width,sec-ch-viewport-height,sec-ch-dpr,sec-ch-device-memory,sec-ch-rtt,sec-ch-prefers-color-scheme,sec-ch-prefers-reduced-motion,sec-ch-prefers-reduced-transparency,sec-ch-prefers-contrast,sec-ch-forced-colors,sec-ch-prefers-reduced-data
content-encoding: gzip
X-Firefox-Spdy: h2
GET i.doodcdn.co/get_slides/530/k4g7134gimipgv89.jpg
200 OK 3.2 kB URL GET HTTP/3 i.doodcdn.co/get_slides/530/k4g7134gimipgv89.jpg
IP
Requested by https://dood.work/e/pcnyy07ay5sq
Certificate IssuerGoogle Trust Services
Subjectdoodcdn.co
Fingerprint85:F9:AC:F1:05:04:E4:B0:96:10:9B:E5:E8:9B:D9:5C:A5:D3:93:16
ValidityTue, 26 Nov 2024 19:05:57 GMT - Mon, 24 Feb 2025 19:05:56 GMT
File type ASCII text, with very long lines (3268), with no line terminators
Hash dd35e3414ee00fb12df52e53d13cb178
9d49da5d42ffe1638f59fc2492872b1089884b4a
beaa146f9ee2c3029fde843f244887ef1b6df4acde35b21612ff4e92fba798eb
GET /get_slides/530/k4g7134gimipgv89.jpg HTTP/1.1
Host: i.doodcdn.co
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://dood.work
DNT: 1
Connection: keep-alive
Referer: https://dood.work/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
date: Tue, 31 Dec 2024 10:16:01 GMT
content-type: text/vtt
access-control-allow-origin: *
last-modified: Tue, 31 Dec 2024 09:56:39 GMT
cache-control: max-age=86400
cf-cache-status: HIT
priority: u=3,i=?0
vary: Accept-Encoding
server: cloudflare
cf-ray: 8fa98302696eb503-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
GET dood.work/e/pcnyy07ay5sq
200 OK 39 kB URL User Request GET HTTP/2 IP
Certificate IssuerGoogle Trust Services
Subjectdood.work
Fingerprint84:62:D1:51:0E:AC:4F:90:8D:50:FA:D2:3D:D5:91:7D:8C:D4:18:EF
ValidityFri, 22 Nov 2024 02:29:49 GMT - Thu, 20 Feb 2025 02:29:48 GMT
File type HTML document, ASCII text, with very long lines (38864), with no line terminators
Hash 4c59b70634e94048cd17ee50b9ed39f0
47e65329744b79e414f62cfb161c96bdc385995f
edb36e17b53856cf6ab260db2a78f5c8d5ff3213c5cd2f7848a156561fb06098
Analyzer Verdict Alert urlquery suspicious Suspicious - Anti-debugging code
GET /e/pcnyy07ay5sq HTTP/1.1
Host: dood.work
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 31 Dec 2024 10:16:00 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
expires: Mon, 30 Dec 2024 10:16:00 GMT
set-cookie: lang=1; domain=.dood.work; path=/; HttpOnly
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JB%2BpSw%2B8wcjW%2BwSdfXZgCGszosaaRwaOhJ30r9vpYQcmTeCw41mIgBMVpCxKbdF2yN1%2BpSjJltDc1PkgaaUVDXEBC4VZSWNSvKSCdkwT10xN3HXJU7kY039NBA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8fa982f8bf1f56c3-OSL
content-encoding: br
server-timing: cfL4;desc="?proto=TCP&rtt=5797&min_rtt=599&rtt_var=10256&sent=8&recv=11&lost=0&retrans=0&sent_bytes=3192&recv_bytes=1124&delivery_rate=6830188&cwnd=254&unsent_bytes=0&cid=d22b8ea5c33cda51&ts=90&x=0"
X-Firefox-Spdy: h2
GET ukankingwithea.com/
200 OK 27 B IP
Requested by https://dood.work/e/pcnyy07ay5sq
Certificate IssuerGoogle Trust Services
Subjectukankingwithea.com
Fingerprint72:95:BE:5B:B7:C6:8C:31:B9:5E:60:DA:66:68:99:88:EC:99:F6:E5
ValiditySun, 03 Nov 2024 13:54:20 GMT - Sat, 01 Feb 2025 13:54:19 GMT
File type ASCII text, with no line terminators
Hash 1ed8a7317a2b0d3700089d49d7109452
66f40bbeb431a830a1978ff89b477bfa9d600ecd
eae05cbb94e756e16c2144b02d2f48a0be53e23ae0668bdfd4de34bd89f5da85
GET / HTTP/1.1
Host: ukankingwithea.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dood.work/
Origin: https://dood.work
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 31 Dec 2024 10:16:02 GMT
content-type: text/plain
set-cookie: csu=1079271699096634@1@1735640162; Max-Age=31104000; Secure; SameSite=None
access-control-allow-origin: https://dood.work
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-headers: X-Requested-With, content-type
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2vkEpk6uKxiPHK4VXHUjtRl6%2BNB5SFfN7rEjZjz%2FrQliRxPBL2HkzvrzJ%2Fp2QCRs7HtAae75ct2OIYFyr4%2BrJk3C0qIX6wDBUj3HTmAbzQIIW7sJLpZToWm%2F8hv5KErdvPzwMHM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8fa983093a52b518-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=1447&min_rtt=416&rtt_var=1144&sent=164&recv=52&lost=0&retrans=0&sent_bytes=211217&recv_bytes=1417&delivery_rate=8227272&cwnd=154&unsent_bytes=0&cid=40d298f537edca08&ts=171&x=0"
X-Firefox-Spdy: h2
GET ukankingwithea.com/
200 OK 27 B IP
Requested by https://dood.work/e/pcnyy07ay5sq
Certificate IssuerGoogle Trust Services
Subjectukankingwithea.com
Fingerprint72:95:BE:5B:B7:C6:8C:31:B9:5E:60:DA:66:68:99:88:EC:99:F6:E5
ValiditySun, 03 Nov 2024 13:54:20 GMT - Sat, 01 Feb 2025 13:54:19 GMT
File type ASCII text, with no line terminators
Hash bc950a3cd91966ca279887ff5db60549
e012edbb124491cc2d947846fcfa994e5a3e0991
031bde0155f0a190dc1ec3777d2da651fe14411829f468b2b2d087397645c92e
GET / HTTP/1.1
Host: ukankingwithea.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://dood.work/
Origin: https://dood.work
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Tue, 31 Dec 2024 10:16:02 GMT
content-type: text/plain
set-cookie: csu=1603968225555390@1@1735640162; Max-Age=31104000; Secure; SameSite=None
access-control-allow-origin: https://dood.work
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-headers: X-Requested-With, content-type
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fnjB%2FEqj2vQwsA4yNu3II7abLQUUoG%2FQ3bF7ZkW5SRESoI6uXWk5I6zTIP09BdHdeKR%2BlbhFYBx9IDPKEt7Br41irulofDZ4TRUFL8T4z3HfS2r5ZlFK15YTQO5OuxcZSdfHxsw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 8fa983095a75b518-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=2016&min_rtt=416&rtt_var=1996&sent=168&recv=53&lost=0&retrans=1&sent_bytes=211848&recv_bytes=1417&delivery_rate=8227272&cwnd=154&unsent_bytes=0&cid=40d298f537edca08&ts=194&x=0"
X-Firefox-Spdy: h2
172.67.73.218
64.233.162.84
141.94.143.87
212.117.186.92