kr.buddysecret.com Open in urlscan Pro
188.114.96.3 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://kr.buddysecret.com/
Effective URL:
https://kr.buddysecret.com/
Submission: On December 02 via api (December 2nd 2023, 3:35:29 pm UTC) from US — Scanned from NL

Summary HTTP 142 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 34 IPs in 6 countries across 20 domains to perform 142 HTTP transactions. The main IP is 188.114.96.3, located in Amsterdam, Netherlands and belongs to CLOUDFLARENET, US. The main domain is kr.buddysecret.com.
TLS certificate: Issued by GTS CA 1P5 on November 5th 2023. Valid for: 3 months.

This is the only time kr.buddysecret.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 18	2a06:98c1:312... 2a06:98c1:3120::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	188.114.96.3 188.114.96.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	2a00:1450:400... 2a00:1450:4001:80b::2002	15169 (GOOGLE) (GOOGLE)
17	2a00:1450:400... 2a00:1450:4001:827::2008	15169 (GOOGLE) (GOOGLE)
2	142.250.185.194 142.250.185.194	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:831::200a	15169 (GOOGLE) (GOOGLE)
4	2606:4700:20:... 2606:4700:20::681a:6d3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.17.24.14 104.17.24.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	185.199.110.153 185.199.110.153	54113 (FASTLY) (FASTLY)
1	151.139.128.10 151.139.128.10	20446 (STACKPATH...) (STACKPATH-CDN)
1	5.161.35.131 5.161.35.131	213230 (HETZNER-C...) (HETZNER-CLOUD2-AS)
19	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:82a::200e	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f08... 2a03:2880:f084:105:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
3	2a00:1450:400... 2a00:1450:4001:82f::2001	15169 (GOOGLE) (GOOGLE)
7	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
2	173.194.76.155 173.194.76.155	15169 (GOOGLE) (GOOGLE)
2	172.217.18.3 172.217.18.3	15169 (GOOGLE) (GOOGLE)
9	37.157.6.243 37.157.6.243	198622 (ADFORM) (ADFORM)
4	142.250.185.129 142.250.185.129	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
6 8	172.217.16.194 172.217.16.194	15169 (GOOGLE) (GOOGLE)
3 7	104.18.36.155 104.18.36.155	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3 5	185.89.210.212 185.89.210.212	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2a03:2880:f17... 2a03:2880:f177:185:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	172.217.16.198 172.217.16.198	15169 (GOOGLE) (GOOGLE)
6	37.157.2.249 37.157.2.249	198622 (ADFORM) (ADFORM)
1	2a00:1450:400... 2a00:1450:4001:82f::2004	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:81c::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c00::9b	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80b::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:813::2003	15169 (GOOGLE) (GOOGLE)
142	34

18 2a06:98c1:3120::3 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

kr.buddysecret.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 188.114.96.3 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)

kr.buddysecret.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2a00:1450:4001:827::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f2.1e100.net

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:831::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700:20::681a:6d3 (United States)

ASN13335 (CLOUDFLARENET, US)

img.holaquiz.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.17.24.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.199.110.153 (United States)

ASN54113 (FASTLY, US)
PTR: cdn-185-199-110-153.github.com

superal.github.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.139.128.10 (United States)

ASN20446 (STACKPATH-CDN, US)
PTR: map3.hwcdn.net

p2e9r4n9.stackpathcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 5.161.35.131 (United States)

ASN213230 (HETZNER-CLOUD2-AS, DE)
PTR: static.131.35.161.5.clients.your-server.de

pfx.api.botman.ninja	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82a::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f084:105:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:82f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 173.194.76.155 (United States)

ASN15169 (GOOGLE, US)
PTR: ws-in-f155.1e100.net

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.18.3 (United States)

ASN15169 (GOOGLE, US)
PTR: fra02s19-in-f3.1e100.net

www.google.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 37.157.6.243 (Denmark)

ASN198622 (ADFORM, DK)

track.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.185.129 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f1.1e100.net

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 172.217.16.194 (United States) 6 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s08-in-f194.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.18.36.155 (None, ) 3 redirects

ASN13335 (CLOUDFLARENET, US)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 185.89.210.212 (Frankfurt am Main, Germany) 3 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f177:185:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.16.198 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s08-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 37.157.2.249 (Denmark)

ASN198622 (ADFORM, DK)

s1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:81c::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c00::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:813::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
32	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 102 a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 148	382 KB
25	buddysecret.com 1 redirects kr.buddysecret.com	206 KB
22	doubleclick.net 6 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 196 googleads.g.doubleclick.net — Cisco Umbrella Rank: 33 stats.g.doubleclick.net — Cisco Umbrella Rank: 75 cm.g.doubleclick.net — Cisco Umbrella Rank: 219 ad.doubleclick.net — Cisco Umbrella Rank: 139	233 KB
17	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 36	538 KB
15	adform.net track.adform.net — Cisco Umbrella Rank: 4289 s1.adform.net — Cisco Umbrella Rank: 8194	206 KB
7	casalemedia.com 3 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 578	4 KB
7	google.com region1.analytics.google.com — Cisco Umbrella Rank: 2693 www.google.com — Cisco Umbrella Rank: 2	851 B
5	adnxs.com 3 redirects ib.adnxs.com — Cisco Umbrella Rank: 229	4 KB
4	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 27 region1.google-analytics.com — Cisco Umbrella Rank: 2189	21 KB
4	holaquiz.com img.holaquiz.com	575 KB
3	google.nl www.google.nl — Cisco Umbrella Rank: 9642	578 B
3	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 29	4 KB
2	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 206	128 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 168	89 KB
1	gstatic.com fonts.gstatic.com	33 KB
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 98	185 B
1	botman.ninja pfx.api.botman.ninja	479 B
1	stackpathcdn.com p2e9r4n9.stackpathcdn.com — Cisco Umbrella Rank: 680449	7 KB
1	github.io superal.github.io — Cisco Umbrella Rank: 717230	3 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 204	11 KB
142	20

	Domain	Requested by
25	kr.buddysecret.com	1 redirects kr.buddysecret.com
21	pagead2.googlesyndication.com	kr.buddysecret.com pagead2.googlesyndication.com a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
17	www.googletagmanager.com	kr.buddysecret.com www.googletagmanager.com
9	track.adform.net	a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com s1.adform.net
8	cm.g.doubleclick.net	6 redirects googleads.g.doubleclick.net
8	tpc.googlesyndication.com	a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com
7	dsum-sec.casalemedia.com	3 redirects googleads.g.doubleclick.net
6	s1.adform.net	track.adform.net s1.adform.net a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com
6	region1.analytics.google.com	www.googletagmanager.com
6	googleads.g.doubleclick.net	pagead2.googlesyndication.com a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com
5	ib.adnxs.com	3 redirects googleads.g.doubleclick.net
4	img.holaquiz.com	kr.buddysecret.com
3	www.google.nl	kr.buddysecret.com
3	stats.g.doubleclick.net	www.googletagmanager.com www.google-analytics.com
3	a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
3	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
3	fonts.googleapis.com	kr.buddysecret.com
3	securepubads.g.doubleclick.net	kr.buddysecret.com securepubads.g.doubleclick.net
2	ad.doubleclick.net	a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com
2	www.googletagservices.com	a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com
2	connect.facebook.net	www.googletagmanager.com connect.facebook.net
1	fonts.gstatic.com	fonts.googleapis.com
1	www.google.com	kr.buddysecret.com
1	region1.google-analytics.com	www.googletagmanager.com
1	www.facebook.com	kr.buddysecret.com
1	pfx.api.botman.ninja	p2e9r4n9.stackpathcdn.com
1	p2e9r4n9.stackpathcdn.com	kr.buddysecret.com
1	superal.github.io	kr.buddysecret.com
1	cdnjs.cloudflare.com	kr.buddysecret.com
142	29

This site contains links to these domains. Also see Links.

Domain
www.instagram.com
www.facebook.com
twitter.com
kr.realtest.me

Subject Issuer	Validity	Valid
buddysecret.com GTS CA 1P5	`2023-11-05` - `2024-02-03`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
holaquiz.com E1	`2023-10-29` - `2024-01-27`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-07-03` - `2024-07-02`	a year	crt.sh
*.github.io DigiCert TLS RSA SHA256 2020 CA1	`2023-02-21` - `2024-03-20`	a year	crt.sh
*.stackpathcdn.com Sectigo RSA Domain Validation Secure Server CA	`2023-05-04` - `2024-05-30`	a year	crt.sh
pfx.api.botman.ninja R3	`2023-11-01` - `2024-01-30`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-09-10` - `2023-12-09`	3 months	crt.sh
*.google.nl GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
track.adform.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-06` - `2024-09-19`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh

This page contains 10 frames:

Primary Page: https://kr.buddysecret.com/
Frame ID: 72AD55518D9384F1D61585ECBDCF93FC
Requests: 79 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231129/r20190131/zrt_lookup_fy2021.html
Frame ID: 8E9AB13D401DDE1A62D557878DC45DEB
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9369680060196134&output=html&adk=1812271804&adf=3025194257&lmt=1701531301&plaf=7%3A2&plat=3%3A128%2C4%3A128%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1048576%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fkr.buddysecret.com%2F&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2&aslcwct=150&asacwct=25&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701531300660&bpp=2&bdt=1458&idt=453&shv=r20231129&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=5792905430820&frm=20&pv=2&ga_vid=694195853.1701531301&ga_sid=1701531301&ga_hid=939562636&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079265%2C42532523%2C44809316%2C31078297%2C44807749%2C44807763%2C44808149%2C44808285%2C44809072&oid=2&pvsid=338407066357502&tmod=1724056041&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=462
Frame ID: 6012E76C7FEE750974AD1D56E128B827
Requests: 1 HTTP requests in this frame

Frame: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 42449337227FEE2BF815AD37182D8A64
Requests: 1 HTTP requests in this frame

Frame: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 0767D73565D0A72736236D8CFF58C333
Requests: 24 HTTP requests in this frame

Frame: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 9B6B7B1F62044D9C5855085EE20FFC85
Requests: 22 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJyntKMDEM683_cDGJXN-f4BMAE&v=APEucNXYq8RBIuehpkEWFXaUJCcP9CxPAHZfiSRiO-s5FUIZGzfzKZhhXRuAKwGM7U-GybWrQUevH8bwZ53phKmLMjS4S0EFe3le2l8DOjkZKJfGAVUX_v5CcUWhVDxAEbDAar15oN4r2KueUNKj80V9NwyjnttAf_RHPEYEnifSV4msDI3azIE
Frame ID: 4DF51E776DBB72581322376B926E12B9
Requests: 5 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: 2FBBBB4D2C59CD3A287E05332B9F3A33
Requests: 3 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJyntKMDEM683_cDGJXN-f4BMAE&v=APEucNXjB2aZNbYNrLFqe2XDxL1ivxL_who9x_lPKQwexASEKCG2pBC3f7R6TrnRhYrnvpo7gto1l9wgOuD4F17pGZ1pYH8662JPo7a3FQJn3EoS0Z9F9c9Pa2HwSC31kN83BJjASwXrk31UpUJXQf4v7NJeQsciGa-kdxpos_lq0aFkzR-9ZgU
Frame ID: F69E3F721A41C5125322632C3EA7307F
Requests: 5 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: 3914080210438814EAD93FB00757B014
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

2023 우정 다이어리! 비밀 일기를 작성하려면 지금 친구들을 초대하세요.

Page URL History Show full URLs

http://kr.buddysecret.com/ HTTP 301
https://kr.buddysecret.com/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

AngularJS (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

\bangular.{0,32}\.js

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

142
Requests

94 %
HTTPS

55 %
IPv6

20
Domains

29
Subdomains

34
IPs

6
Countries

2441 kB
Transfer

5921 kB
Size

22
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://www.instagram.com/buddysecret2

Search URL Search Domain Scan URL

URL: https://www.facebook.com/Buddysecret1

Search URL Search Domain Scan URL

URL: https://twitter.com/BuddySecret1

Search URL Search Domain Scan URL

URL: https://kr.realtest.me/?utm_site_source=custom&utm_site_medium=ad&utm_site_campaign=user

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://kr.buddysecret.com/ HTTP 301
https://kr.buddysecret.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 69

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGtJw-ZN-b-0iHQrqOkJOL0&google_cver=1

Request Chain 70

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZWtOpWsAj6aYWo8VxR5zjAAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGtJw-ZN-b-0iHQrqOkJOL0&google_cver=1

Request Chain 71

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEHESeJcfukutgFLHdzSOAwc&google_cver=1

Request Chain 72

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTI4MDg3Mjc5Mjc0MzE5MjY1MQ%3D%3D

Request Chain 103

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGtJw-ZN-b-0iHQrqOkJOL0&google_cver=1

Request Chain 104

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZWtOpWsAj6aYWo8VxR5zjAAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGtJw-ZN-b-0iHQrqOkJOL0&google_cver=1

Request Chain 105

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEHESeJcfukutgFLHdzSOAwc&google_cver=1

Request Chain 106

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTI4MDg3Mjc5Mjc0MzE5MjY1MQ%3D%3D

142 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
kr.buddysecret.com/
Redirect Chain

http://kr.buddysecret.com/
https://kr.buddysecret.com/

22 KB
6 KB

820ms
470ms

Document
text/html

188.114.96.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://kr.buddysecret.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5f58e7c65bc382076dbf11f38bffa18b734b5a71d172207789a899f4730bd47a

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 82f4a3191ecabba3-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Sat, 02 Dec 2023 15:34:59 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Cxu2hZE3GG7bQzD4WJwDBsu50obzZKUvy7BBfQfkQrHE7dp2ap5AORcfX3RaopDH%2BmvDnMYDYcdD2Td6EEqGt1%2Fi30OfSDP8F3XvpUm6aiaXdUHcyFfqnFVJseVdX3Wepwe%2Fun0%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-host: as-hi-192-web
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Redirect headers

CF-RAY: 82f4a3155977910c-FRA
Cache-Control: max-age=3600
Connection: keep-alive
Date: Sat, 02 Dec 2023 15:34:58 GMT
Expires: Sat, 02 Dec 2023 16:34:58 GMT
Location: https://kr.buddysecret.com/
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7eEMFcTOq0ob3qWAk%2FWFq%2BSNeqXIPPiKGNvAEZypTfD0kb7zSq493W4wSQARaUT1N7bG4G6pyY2%2Fsh5JMhQCbWIMR3c3ciGRYnTyDzLqRydHwvwdXRKxfqEkeYxArzThScs64yaJyu3kDb0DHld34i8%3D"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
Vary: Accept-Encoding
alt-svc: h3=":443"; ma=86400

GET
H2 200 font-awesome.css
kr.buddysecret.com/public/css/ 30 KB
7 KB 517ms
516ms Stylesheet
text/css 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://kr.buddysecret.com/public/css/font-awesome.css?v=20231031_1

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c936bca314b30e3c48bbad667c920cac28e3e43b72f5f372c706e885a0aa2743

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-211-web
date: Sat, 02 Dec 2023 15:34:59 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 25 Sep 2023 10:00:28 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"b6da1-7823-6062c071e0700"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m9WNOneBZdnhJ6psrhzE2knziF3lqHPgw3R4e3ilTv7eOzgRJGp8yFEWqScaZs8snceWdzgqcoTNxNbMUNdhCMZEMMzRyLrP5wflkYRShuMmUUCHAYDG2FS%2Bex3XeAN5JG6Jb2Y%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
vary: Accept-Encoding
cf-ray: 82f4a31c1ac4bba3-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 bootstrap.css
kr.buddysecret.com/public/css/ 118 KB
20 KB 986ms
985ms Stylesheet
text/css 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://kr.buddysecret.com/public/css/bootstrap.css?v=20231031_1

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b1127616e70adcf895ad38ff2eeac1fa12419b6522f4c58df704d3dae8305d49

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-184-web
date: Sat, 02 Dec 2023 15:35:00 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 25 Sep 2023 10:00:28 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"b6be7-1d86f-6062c071e0700"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8MaFEd%2BFrYYA0HidM1x6tS8FQPxZgLGkfUl2v8ZIZshpINu949IxeWEluwUsBh5Yk7yd7GP8kpvZf%2BrV13MIC14eSu%2Bo63yljMAdWurK21mYKssq%2BJLLc4oNtUiQlKIHOMRQiYM%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
vary: Accept-Encoding
cf-ray: 82f4a31c1ac6bba3-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 common-spinner.css
kr.buddysecret.com/public/css/ 2 KB
731 B 362ms
361ms Stylesheet
text/css 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://kr.buddysecret.com/public/css/common-spinner.css?v=20231031_1

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3b6dfeb59f7464899e64068a09afaa80fdae61e9767a041f9bc60aae5362c599

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-123-web
date: Sat, 02 Dec 2023 15:34:59 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Fri, 22 Apr 2022 10:57:23 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"b6a85-6ff-5dd3c17586ac0"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jZE9xa20rE1c1Gt7%2FLmA4L95KuGlxDl3FzqmMJpd9muLaDgvjWWWk4sNZ8JsAZPgt9IyxQevsQdvHUHC%2BwmsRyCpcw04F6nSOILSuyiXxd8RgymXfH1szGelR7HQ3CuJcoHQKvU%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
vary: Accept-Encoding
cf-ray: 82f4a31c1acabba3-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 style.css
kr.buddysecret.com/public/css/surpriseforu/ 75 KB
13 KB 903ms
902ms Stylesheet
text/css 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://kr.buddysecret.com/public/css/surpriseforu/style.css?v=20231031_1

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

867d95c054a9f0b329b3844a818c83c5554faa7ea3464f26ba1699864b08d536

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-184-web
date: Sat, 02 Dec 2023 15:35:00 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Wed, 01 Nov 2023 04:09:17 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"b8b3c-12b0c-6090f6f50f540"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zwwXNL%2Fej6LhFdhQeaqglrAuLDE2aSfrXN6LWkRGdFXivjrknnWYfXrE47dTmHOkJ0yQ3nZujlJGQKkww0%2F4ceLuTbzFdP8NrGLjCM1h2FVvOQJhVfm0GuneJ3pDzqmZ9CbzKuA%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css
vary: Accept-Encoding
cf-ray: 82f4a31c1accbba3-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 91 KB
30 KB 389ms
186ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6dfd57a916a8cad100e3ec7a7cab09ea8b15e94a7dab3981f1910ea5083d37bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 15:35:00 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29894
x-xss-protection: 0
server: cafe
etag: 111 / 19693 / 31079857 / config-hash: 11152387477177976423
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sat, 02 Dec 2023 15:35:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 186 KB
68 KB 316ms
112ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-192512597-12

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5d4050c2783311b3ebc33027b89b7b43cd6f9dd85690cca861bcb7309471d08d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 15:35:00 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68918
x-xss-protection: 0
last-modified: Sat, 02 Dec 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 02 Dec 2023 15:35:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 187 KB
68 KB 401ms
197ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-126527512-14

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

819afc5089f4dab0c958e8913ca5686b9e0107d68a37b32aec3600becd233042

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 15:35:00 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 69094
x-xss-protection: 0
last-modified: Sat, 02 Dec 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 02 Dec 2023 15:35:00 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 150 KB
52 KB 421ms
69ms Script
text/javascript 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-9369680060196134

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

9a42a7067e1bc17436e85177da6caafe399bca159c92c6d28f2b99d3f266178a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://kr.buddysecret.com/
Origin: https://kr.buddysecret.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 15:35:00 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 52624
x-xss-protection: 0
server: cafe
etag: 7351458261180425277
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sat, 02 Dec 2023 15:35:00 GMT

GET
H2 200 css2
fonts.googleapis.com/ 32 KB
1 KB 162ms
30ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ff9a2be960794ffc4738368eeec7262cd5bf70316287f8d2f0c3790170cf1277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 02 Dec 2023 15:34:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 02 Dec 2023 13:38:25 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 02 Dec 2023 15:34:59 GMT

GET
H2 200 css2
fonts.googleapis.com/ 18 KB
946 B 190ms
59ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Poppins:ital,wght@0,100;0,200;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,400;1,500;1,600;1,700;1,800;1,900&display=swap

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a84cb06c27b7617c81b075bdb123e0e63e8da1b70feee763f86899a4fc3f3623

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 02 Dec 2023 15:34:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 02 Dec 2023 15:34:59 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 02 Dec 2023 15:34:59 GMT

GET
H2 200 BuddySecret_LOGONEW.png
img.holaquiz.com/public/site_content/quiz/ck_editor/images/meta/Surprise4u_2/ 240 KB
241 KB 714ms
349ms Image
image/png 2606:4700:20::681a:6d3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.holaquiz.com/public/site_content/quiz/ck_editor/images/meta/Surprise4u_2/BuddySecret_LOGONEW.png

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:6d3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7baed263e09ef3cc2cf23b357f390990fbc493f6a2d93893d0f31a875927dbb8

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-205-web
date: Sat, 02 Dec 2023 15:34:59 GMT
cf-cache-status: REVALIDATED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 245939
last-modified: Tue, 16 Mar 2021 12:50:54 GMT
server: cloudflare
etag: "16e0b7-3c0b3-5bda6d11b4780"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nORwXXJqB7UIM5jO6on%2B%2FOxqT5GuEB5Nvb07xoN7nnNYYXwyVAAK9WrEbUEIfydS4MM3fi0mLojtlX7MLgcUzOa4biI%2BIBo8ieJdOkFOvOV0uL14FQxFRYP6oOjSnNI0WgSyszi1qFMIxwW3T60%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
access-control-allow-credentials: true
accept-ranges: bytes
cf-ray: 82f4a31e5eb471b5-FRA

GET
H2 200 language-globe2.png
kr.buddysecret.com/public/images/surpriseforu/ 2 KB
2 KB 381ms
381ms Image
image/png 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://kr.buddysecret.com/public/images/surpriseforu/language-globe2.png

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

87293aa389c2ae3691ad691ca7848a875fb0c35bfe5ec8489f2e016f9dec4339

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-16-web
date: Sat, 02 Dec 2023 15:34:59 GMT
cf-cache-status: MISS
last-modified: Tue, 24 May 2022 11:43:54 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "b8e18-6b4-5dfc0789fb280"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WiwhVtS5%2B0ykMV8Yfu9z%2BrdcVW9JbXKGFm1hUvi9SzDDojpfagqFtEIdjxPvt4omH4c8i299HZdwH6mXr1Zy%2BA6RUZStl3IYmxXCGGBbKae0M0ZDrDR294IC2%2FaLhsRSy%2BF7RCc%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 82f4a31c1acdbba3-FRA
alt-svc: h3=":443"; ma=86400
content-length: 1716

GET
H2 200 Pink_insta.png
kr.buddysecret.com/public/images/surpriseforu/ 867 B
1 KB 367ms
367ms Image
image/png 188.114.96.3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://kr.buddysecret.com/public/images/surpriseforu/Pink_insta.png

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ab0a4fd818ae651b0b4da61889b0543363fee8a750aeb9dd38e77ce6917d11bf

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-123-web
date: Sat, 02 Dec 2023 15:34:59 GMT
cf-cache-status: MISS
last-modified: Tue, 24 May 2022 11:43:54 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "b8e12-363-5dfc0789fb280"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zoLSjb12stGzccMbw1K7PkMPeaMg7hk2fIMVo4aIkCc%2FqL5sd4VMR4alnjhbkYU%2F1sBAkLvNKbUwy4rDBuSo7bdbEQjiESHNtTSY4RU0dY5Y0NCKbjM87e5f7htEW7MM1fEDJLQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 82f4a31e7db0bba3-FRA
alt-svc: h3=":443"; ma=86400
content-length: 867

GET
H3 200 Pink_fb.png
kr.buddysecret.com/public/images/surpriseforu/ 428 B
1011 B 337ms
337ms Image
image/png 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://kr.buddysecret.com/public/images/surpriseforu/Pink_fb.png

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d98cb0a1e156fddbf20389dc37e2ed4860fe71e9a691e34e41f3ba9516b805ac

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-123-web
date: Sat, 02 Dec 2023 15:35:00 GMT
cf-cache-status: MISS
last-modified: Tue, 24 May 2022 11:43:54 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "b8e11-1ac-5dfc0789fb280"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lPoVy%2FSu7%2B359ioJEh3ejPuP8gU5w9BME8a6SGLdtf7kSvIQzZxgU%2BfGzh3FbcEite5xcuGK4dWPA0E33pHXB0zBfAjwsSxEvIzpmCRja5Nxa7PScNuQlqK6tXNWBiwthF2JLNC8GocyQdC6%2BY4FZGo%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 82f4a320caff3c87-CDG
alt-svc: h3=":443"; ma=86400
content-length: 428

GET
H3 200 Pink_twitter.png
kr.buddysecret.com/public/images/surpriseforu/ 829 B
1 KB 344ms
343ms Image
image/png 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://kr.buddysecret.com/public/images/surpriseforu/Pink_twitter.png

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f61c6c2848203266c231c5690c5871675a612d38df19946c9d3167dc5bf34e0c

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-211-web
date: Sat, 02 Dec 2023 15:35:00 GMT
cf-cache-status: MISS
last-modified: Tue, 24 May 2022 11:43:54 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "b8e13-33d-5dfc0789fb280"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pAv25SLEMe3Tv%2Fn5%2Bjpzjbb4etob13JShWZ%2F3f5Jq7wjSkXlmDDm1TvUHJ4wOtGO1c4SFbOaKoNtQ%2BhMmedtgXRrj2LLB5Yc%2B0HBsEsRJQLfTUIRwcYqQalrdYcIfTpo8xZ9VR1PQBbU5pWPBF9UR9M%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 82f4a3224d483c87-CDG
alt-svc: h3=":443"; ma=86400
content-length: 829

GET
H2 200 HolaQuiz-Category6045d5ec9a3e3.jpg
img.holaquiz.com/public/site_content/quiz/category/ 174 KB
175 KB 1602ms
1598ms Image
image/jpeg 2606:4700:20::681a:6d3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.holaquiz.com/public/site_content/quiz/category/HolaQuiz-Category6045d5ec9a3e3.jpg

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:6d3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

262235b53289354531ed1c656f88f05a2af65e78b3fc0e1018024e599f47f46b

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-205-web
date: Sat, 02 Dec 2023 15:35:01 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 178661
last-modified: Mon, 08 Mar 2021 07:44:44 GMT
server: cloudflare
etag: "cffe3-2b9e5-5bd019b705300"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BlG2o7XTDoyf%2BVwezZ6abPuaaxe%2BLbGl5YBKgQjdX3VYFzM7b2SL%2FDv258jYt9DFb5aaq8mVKZZm2nh0jKOkS%2BT7AAdT%2FxLBHz7u9oie1ZQQrwkWd%2FRn3c4CJri%2BP3YwZRHYr95d5PUu%2FTiuA00%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
access-control-allow-credentials: true
accept-ranges: bytes
cf-ray: 82f4a3224b6e71b5-FRA

GET
H2 200 HolaQuiz-Category652394206c6e7.png
img.holaquiz.com/public/site_content/quiz/category/ 104 KB
105 KB 1500ms
1497ms Image
image/png 2606:4700:20::681a:6d3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.holaquiz.com/public/site_content/quiz/category/HolaQuiz-Category652394206c6e7.png

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:6d3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b6fcf52da7b7725cba7568a798d4034232bd375a2a48ae9786da94c65a697795

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-205-web
date: Sat, 02 Dec 2023 15:35:01 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 106987
last-modified: Mon, 09 Oct 2023 05:48:16 GMT
server: cloudflare
etag: "334055-1a1eb-6074222f54800"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CRxh%2Fen%2BknFvfnAMesAOW%2Fz0Eqq6%2B70gsZaMi35W6DyOYSu7ZqT1wTV4k%2F8JKJ1s45uT%2BgzkT6M%2FDaXkdqfYTBMGezEDQ%2FX7YuKghzpGCvf35I1xq9uEYxAzApq5FlIR1%2F4%2F4xqpH6J7jJs8WGY%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
access-control-allow-credentials: true
accept-ranges: bytes
cf-ray: 82f4a3224b6f71b5-FRA

GET
H2 200 korea%20real%20test.png
img.holaquiz.com/public/site_content/quiz/ck_editor/images/ADS_CUSTOM/ 54 KB
54 KB 1500ms
1497ms Image
image/png 2606:4700:20::681a:6d3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.holaquiz.com/public/site_content/quiz/ck_editor/images/ADS_CUSTOM/korea%20real%20test.png

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:6d3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5c7ee55fa8687f9c8a3ac3866aaeb29531641f15faca744db916ec442f9dd8d7

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-205-web
date: Sat, 02 Dec 2023 15:35:00 GMT
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 54999
last-modified: Fri, 24 Mar 2023 07:37:16 GMT
server: cloudflare
etag: "1185e4-d6d7-5f7a0765a2300"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DZUDkWvA9ZViEFxcDw7umDi8F0J3dFX%2F3tTo8FvPTVqvlpBVcFY%2FRFdwweaLj1zX%2BwvvXqD8ApGM0ThTWw7DbhxXCohwARHF6a99%2BO07gkkMxM%2B6d7BDfPnbvLAG3wB7rlZIvfXaP%2BNABo%2BVWc8%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
access-control-allow-credentials: true
accept-ranges: bytes
cf-ray: 82f4a3224b7071b5-FRA

GET
H3 200 BlueFB.png
kr.buddysecret.com/public/images/surpriseforu/ 867 B
1 KB 347ms
344ms Image
image/png 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://kr.buddysecret.com/public/images/surpriseforu/BlueFB.png

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

00dd44415498e7c266af756fdf35c8743e4f6e853d476d01ded93d50404c3711

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-159-web
date: Sat, 02 Dec 2023 15:35:00 GMT
cf-cache-status: MISS
last-modified: Tue, 24 May 2022 11:43:54 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "b8e0c-363-5dfc0789fb280"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NbmRrY98DeUIsDQ4AzmtS47erpqlHURliqw0vcuDxAwfl75xxp1GVjWWx9mI5Esds5vtchpjgbEMYhLjppLAyStS4k5cPLkNgw2DRkxKKTN64wdcuN1MWvYjB9hcyunDeH9VMkVJfp63CdPU1YVssYM%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 82f4a3225d5f3c87-CDG
alt-svc: h3=":443"; ma=86400
content-length: 867

GET
H3 200 Blueinsta.png
kr.buddysecret.com/public/images/surpriseforu/ 2 KB
2 KB 377ms
374ms Image
image/png 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://kr.buddysecret.com/public/images/surpriseforu/Blueinsta.png

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9b37d726335bf66cf138264a88bd4faf1652194d417bf69c3115eb36d66d5590

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-159-web
date: Sat, 02 Dec 2023 15:35:00 GMT
cf-cache-status: MISS
last-modified: Tue, 24 May 2022 11:43:54 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "b8e0d-660-5dfc0789fb280"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PHSlqbl75x8%2FkWVedpOfSnWqyV11ZsCh2VseFEcDDVHk2zTovh1B2Can0y3dsjIZO2IE10fXBc07fI5rP%2F8X%2FZoxk%2F7iz2jk2wGCDKhg%2FVVn2jRa%2BEQivenDTdccdqWi4q20K73YWC%2BMcHuxOupNIZ0%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 82f4a3225d613c87-CDG
alt-svc: h3=":443"; ma=86400
content-length: 1632

GET
H3 200 Bluetwitter.png
kr.buddysecret.com/public/images/surpriseforu/ 1 KB
2 KB 451ms
449ms Image
image/png 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://kr.buddysecret.com/public/images/surpriseforu/Bluetwitter.png

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ecb2dbe5d73e1c489ea95d2cca25c8865e4b07c4b867da199341ba5ee20e87ef

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-16-web
date: Sat, 02 Dec 2023 15:35:00 GMT
cf-cache-status: MISS
last-modified: Tue, 24 May 2022 11:43:54 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "b8e0e-4d3-5dfc0789fb280"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cgMMEIYDxB%2FvkFOdnoJnDRIW2e6S2hGL%2FayIT%2BH9NIQxRxFEm%2B%2FZUmU%2FOH7ZOqQuMyCotzpU3L8K9SVTUi%2BxXU2qUog2JD13hrV%2BkR2syM4kJgv73G%2F7ynqLyOE9kgI9cih1maXJx94wgzvybfhQbUo%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 82f4a3225d623c87-CDG
alt-svc: h3=":443"; ma=86400
content-length: 1235

GET
H3 200 jquery.min.js Show response
kr.buddysecret.com/public/js/ 94 KB
34 KB 981ms
977ms Script
text/javascript 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://kr.buddysecret.com/public/js/jquery.min.js?v=20231030

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aec3d419d50f05781a96f223e18289aeb52598b5db39be82a7b71dc67d6a7947

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-192-web
date: Sat, 02 Dec 2023 15:35:01 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 04 Mar 2021 08:53:08 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"b6e36-176f8-5bcb218b0e500"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6MrlpxmXZA0vtd4gZaVpxbwuBdiLuTCI3omdoWfyec%2BM8EIVVM%2B3iBv84qdwwb3OBBv2MpH2r3g1nlQxZuenplJ4uJ5wixbUqBVL0lG93%2BcSwMHOaQT9QSOSveNWU7jkf5SmmPIVcW5RJ%2BVfC3kISAs%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
vary: Accept-Encoding
cf-ray: 82f4a3225d513c87-CDG
alt-svc: h3=":443"; ma=86400

GET
H3 200 bootstrap.js Show response
kr.buddysecret.com/public/js/ 34 KB
10 KB 1726ms
1722ms Script
text/javascript 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://kr.buddysecret.com/public/js/bootstrap.js?v=20231030

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

57f6d3807b91f5746bee342a67bb053029f637f59ed6afee9f224ab8ef394757

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-192-web
date: Sat, 02 Dec 2023 15:35:00 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 25 Sep 2023 10:00:28 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"b6e17-888e-6062c071e0700"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8oCPqLNFuY9MPQGxLgMXj%2FJYvcXInUgbAQI%2FiA57IcjDc1L76vPOJ0bpRyp8YkQ02rN1bRTbBTMZyayGuKB423%2FaHbcGDihgnDxYDil93CjWXDHmOlSqkJ0xyqmt8zzJJ85UPPBdYbz8T1uxIC6m90k%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
vary: Accept-Encoding
cf-ray: 82f4a3225d533c87-CDG
alt-svc: h3=":443"; ma=86400

GET
H3 200 angular.js Show response
kr.buddysecret.com/public/js/ 114 KB
41 KB 1994ms
1990ms Script
text/javascript 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://kr.buddysecret.com/public/js/angular.js?v=20231030

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c72c5cdb8ee97ed1e23f49f9cc0884c795f9c70e85a566453d9701f12cebfe9f

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-184-web
date: Sat, 02 Dec 2023 15:35:01 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 04 Mar 2021 08:53:08 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"b6e2d-1c61c-5bcb218b0e500"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O84NlTNPBFH4T2bFxrF%2FnX6Q%2BxC%2FQzWxcFbaOS21%2BmAL6%2B%2FeyBOVj33T8QF2PMzDP1Ee5g8R92s76vPLvjTrpHGJtAAXyrr7wJUB0kq7ZyWeTAxdhulUdZTG8hkC82ydgWBsjGTcUTNcvCfxbImEHJM%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
vary: Accept-Encoding
cf-ray: 82f4a3225d553c87-CDG
alt-svc: h3=":443"; ma=86400

GET
H3 200 angular-sanitize.js Show response
kr.buddysecret.com/public/js/ 21 KB
7 KB 536ms
532ms Script
text/javascript 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://kr.buddysecret.com/public/js/angular-sanitize.js?v=20231030

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

db668b70fd0021a224a50338fc80f62881fc5e678e84987ff62785d86ab3f320

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-211-web
date: Sat, 02 Dec 2023 15:35:00 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 04 Mar 2021 08:53:08 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"b6e2c-5536-5bcb218b0e500"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HZVmDnkXg7tuaLqLwTpmIbYNYLrHCCeanEih8Ni2YlwePAPKLU9KY8xVIubpo7biEbEXhonPZooDzadVRhPZ6U3%2FLR9HRJTq%2FuFBZw%2B0nTY9nIq0%2BicVw1SrXz8Uvyy9H218WGkE4MsDnKGePILr%2BiU%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
vary: Accept-Encoding
cf-ray: 82f4a3225d563c87-CDG
alt-svc: h3=":443"; ma=86400

GET
H3 200 site_api.js Show response
kr.buddysecret.com/public/js/ 269 B
696 B 345ms
342ms Script
text/javascript 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://kr.buddysecret.com/public/js/site_api.js?v=20231030

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2a7e4bf63bc70f8c050d0d52aea5b15dddaaf64fd51036cd996130cbb5f58b14

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-123-web
date: Sat, 02 Dec 2023 15:35:00 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Tue, 20 Jun 2023 11:03:44 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"b6efa-10d-5fe8d9ac50400"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FzwFrqr1qxCNur440%2F%2BzQPNxIa4xfs2QO%2BrwK01O3Lsa5D4uLRMeH0CC7DXwwoiO9xFRJ7A892OxjrpoPtDeEx5BcvKq22j7qseZpTim3nKMOP%2BkiQtHjxzzzrYYoIR3YD8yK%2FsMMudfmiXC%2F4NIC0o%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
vary: Accept-Encoding
cf-ray: 82f4a3225d593c87-CDG
alt-svc: h3=":443"; ma=86400

GET
H3 200 s_a_cont.js Show response
kr.buddysecret.com/public/js/ 97 KB
19 KB 2570ms
2566ms Script
text/javascript 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://kr.buddysecret.com/public/js/s_a_cont.js?v=20231030

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f5f2eab887fc0fd70b970b68a012bd5e52cbc791788e15fece50024dd40868de

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-16-web
date: Sat, 02 Dec 2023 15:35:00 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 26 Oct 2023 07:34:05 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"b6e2e-1839f-6089998b0b540"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J9P3z7%2Fi8e%2Ft4lA2S6zeePxNlQQY5JGVp8EEeYkEhPDfsIQBXGKcTIOAXYW0YbaLwGoB4d6kIKCjtFLJfLNMgz8VdYVDcCd4lFRAPhpIn2r4D0Eo%2FE83lOxGy4RaRUBKHPQCW5KzsQNrpktuvHECOKQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
vary: Accept-Encoding
cf-ray: 82f4a3225d5b3c87-CDG
alt-svc: h3=":443"; ma=86400

GET
H3 200 s_a_ser.js Show response
kr.buddysecret.com/public/js/ 6 KB
2 KB 372ms
369ms Script
text/javascript 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://kr.buddysecret.com/public/js/s_a_ser.js?v=20231030

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e04a40af8692b8e76780c014a3f5ad8d55d98fe8a6cd671bbebd32413117888d

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-184-web
date: Sat, 02 Dec 2023 15:35:00 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 09 Feb 2023 06:46:25 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"b6edc-198d-5f43ebd527240"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bbHXxjZT7%2B0fPOCvwS29yGA7DQFMGb4Kxu1gTIgHvp%2Bub%2BTHYFKoZR4CsFpY2qp3ctERpUpl5RYk90LM9IMZZs5NCCb7KiiuiaKyWO4Fk9xrvVK%2B7n8XycNoSIvDRngP6IZ67BcV6bshp8MnTAQ7%2BzM%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
vary: Accept-Encoding
cf-ray: 82f4a3225d5c3c87-CDG
alt-svc: h3=":443"; ma=86400

GET
H3 200 site.js Show response
kr.buddysecret.com/public/js/ 49 KB
12 KB 4950ms
4946ms Script
text/javascript 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://kr.buddysecret.com/public/js/site.js?v=20231030

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

874a57370535dbaac73cf5c47cce9611d4e8762b9d1821e73532e9c35a07f32f

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-211-web
date: Sat, 02 Dec 2023 15:35:00 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Fri, 18 Aug 2023 09:52:42 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"b6c19-c205-6032f7d5f2e80"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hsoXLXxdIslBDwDeQdPPDDkS6T29xpkB3E24ob%2FiTdb9BIpVDNTQ6%2FyTbD%2BzllPna6PuMQGqGDsrM%2Biu9UAMiFq94%2FfQ65LJC%2BKQ8zJL2SEjgcywcG2ovvdVfZxXqERcuX%2FbYTXZ5MkGItBXy6LBxGM%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
vary: Accept-Encoding
cf-ray: 82f4a3225d5e3c87-CDG
alt-svc: h3=":443"; ma=86400

GET
H2 200 html2canvas.min.js Show response
cdnjs.cloudflare.com/ajax/libs/html2canvas/0.4.1/ 36 KB
11 KB 373ms
28ms Script
application/javascript 104.17.24.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/html2canvas/0.4.1/html2canvas.min.js

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.24.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

737473b145a0fb2d97963ba71104b42ea59d434e17d43de3db67ddffc24200ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 15:35:00 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 215197
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 11066
last-modified: Mon, 04 May 2020 16:11:09 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e9d-9079"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wj4pAbnjdr%2FLfPvi4JVrK794n%2Bq2WOk8qO%2Fj0sfT5XtTWINTUUWtLoBnR8b2dK1yROfZPDq7%2Fr5fNPr9cdLfr2ylnK4HVYNi0U1yStUfBaOZe1CnFtYnVd1FC5IO1c8Kwqt3%2B6nU"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 82f4a3247b5e5c56-FRA
expires: Thu, 21 Nov 2024 15:35:00 GMT

GET
H2 200 canvas2image.js Show response
superal.github.io/canvas2image/ 8 KB
3 KB 358ms
18ms Script
application/javascript 185.199.110.153
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://superal.github.io/canvas2image/canvas2image.js
Requested by: Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.199.110.153 , United States, ASN54113 (FASTLY, US),
Reverse DNS: cdn-185-199-110-153.github.com
Software: GitHub.com /
Resource Hash: 9a03674bfe83fe09eee7aae6106943918be73a009be21468c2bdb1b4ce958fdc

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-fastly-request-id: 622bd5d69a2ca9f3382b23c39180d36e8acdb01c
date: Sat, 02 Dec 2023 15:35:00 GMT
content-encoding: gzip
via: 1.1 varnish
x-cache-hits: 7
age: 542
x-cache: HIT
x-proxy-cache: HIT
content-length: 2514
x-served-by: cache-ams21062-AMS
last-modified: Thu, 27 Oct 2016 14:01:12 GMT
server: GitHub.com
x-github-request-id: CC18:F954:291EB21:29B9E19:65540F68
x-timer: S1701531301.548955,VS0,VE0
etag: W/"581208a8-1fcf"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=600
permissions-policy: interest-cohort=()
accept-ranges: bytes
x-origin-cache: HIT
expires: Wed, 15 Nov 2023 00:32:39 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 196 KB
69 KB 464ms
261ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MBZ4PJR

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c1c58c2a842bb99940745b96c7f2db09da6af63e7950e44f585a4cba95deaf4a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 15:35:00 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 70546
x-xss-protection: 0
last-modified: Sat, 02 Dec 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 02 Dec 2023 15:35:00 GMT

GET
H/1.1 200
OK __pmon.min.js Show response
p2e9r4n9.stackpathcdn.com/ 19 KB
7 KB 67ms
19ms Script
application/javascript 151.139.128.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://p2e9r4n9.stackpathcdn.com/__pmon.min.js
Requested by: Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS: map3.hwcdn.net
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: fd15dccc78b33bb29115461ac9504869f4af29b5bdc93111b8ecff5d58469206

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Sat, 02 Dec 2023 15:35:00 GMT
Content-Encoding: gzip
Last-Modified: Wed, 09 Mar 2022 13:58:37 GMT
Server: Apache/2.4.41 (Ubuntu)
ETag: "4ba3-5d9c97e7e3e1f-gzip"
X-HW: 1701531300.cds324.am5.hn,1701531300.cds322.am5.c
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=84600, public
Access-Control-Allow-Credentials: true
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 6398

GET
H2 200 css2
fonts.googleapis.com/ 32 KB
1 KB 35ms
33ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ff9a2be960794ffc4738368eeec7262cd5bf70316287f8d2f0c3790170cf1277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Sat, 02 Dec 2023 15:35:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Sat, 02 Dec 2023 13:35:13 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sat, 02 Dec 2023 15:35:00 GMT

GET
H2 200 dip.html Show response
pfx.api.botman.ninja/ 55 B
479 B 340ms
103ms XHR
text/html 5.161.35.131
HETZNER-CLOUD2-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://pfx.api.botman.ninja/dip.html?ak=f8fe1ae5c2968a9d211e3fdad4e6be1ede137ae5&m=PFX&module=JSTAG&f=SCR&vis=4&ifp=0&burl=https%3A%2F%2Fkr.buddysecret.com%2F&uq=iVeTHd4GOwbe&ac=null&purl=&ih=1200&iw=1600&ow=1600&oh=1200&plf=Win32&cpu=undefined&lst=234lj4kl4dXfsDfkJitY323f6d3&aver=5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/119.0.6045.199%20Safari/537.36&uagt=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F119.0.6045.199%20Safari%2F537.36&cen=UTF-8&aname=Netscape&acod=Mozilla&cd=24&zi=undefined&nlang=en-US&ndrv=false&win=true&dnt=8&hco=4&plg=true&layer=0&nmt=0&nbo=Europe/Amsterdam&fsa=false&ch=1200&cw=1600&sh=1200&sw=1600&bld=24&actv=visible&acc=Intel%20Iris%20OpenGL%20Engine&gyro=undefined&pop=false&brl=0&brt=0&brh=0&brb=0&als=Intel%20Inc.&cam=undefined&bt=undefined&ce=true&dlmax=10&ntype=4g&ofw=0&ofh=0&s1=NA&s2=NA&s3=NA&s4=NA&s5=NA&s6=NA&hless=false&s7=NA&s8=NA&s9=NA&s10=NA&s11=NA&s12=NA&s13=NA&s14=NA&s15=NA&s16=NA&s17=NA&s18=NA&s19=NA&s20=NA
Requested by: Host: p2e9r4n9.stackpathcdn.com
URL: https://p2e9r4n9.stackpathcdn.com/__pmon.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 5.161.35.131 , United States, ASN213230 (HETZNER-CLOUD2-AS, DE),
Reverse DNS: static.131.35.161.5.clients.your-server.de
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 9a73ec51d0e62c2fdb04d631b841b43d1d61a18fd1c09ffc243db565ef05bbe4

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 15:35:00 GMT
content-encoding: gzip
last-modified: Mon, 08 Aug 2022 12:51:27 GMT
server: nginx/1.18.0 (Ubuntu)
etag: W/"62f106cf-37"
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
access-control-allow-origin: *
cache-control: max-age=86400
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires: Sun, 03 Dec 2023 15:35:00 GMT

GET
H3 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311150101/ 397 KB
134 KB 173ms
90ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311150101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-9369680060196134&plah=kr.buddysecret.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-9369680060196134

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2f57801fc473bae365e18b1a94f5eda055469897434efdbc5ab3ec7cccced202

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 15:35:00 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 137286
x-xss-protection: 0
server: cafe
etag: 1989366471094619387
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Sat, 02 Dec 2023 15:35:00 GMT

GET
H2 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231129/r20190131/ Frame 8E9A 9 KB
4 KB 447ms
33ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231129/r20190131/zrt_lookup_fy2021.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-9369680060196134

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9f6e245ec73203f99ecb888db309a2bdaf91f8696c1cebaa94e477a953fab30a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://kr.buddysecret.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

age: 66932
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4121
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 01 Dec 2023 20:59:29 GMT
etag: 12051592065903069241
expires: Fri, 15 Dec 2023 20:59:29 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311290101/ 432 KB
135 KB 69ms
68ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311290101/pubads_impl.js?cb=31079857

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fa40858bc00aa25239b434a313f9b30b4b604715b21395c0f278a3055cd31deb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 11:36:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14323
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 138184
x-xss-protection: 0
server: cafe
etag: 495798054771589180
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Sun, 01 Dec 2024 11:36:17 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 224 KB
79 KB 280ms
279ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-DBTY2304E3&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-192512597-12

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d25a8d464d13475253449b8ccb2a61273662080f2f25d1c682aff0177fb0b0cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 15:35:01 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 81153
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sat, 02 Dec 2023 15:35:01 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 600ms
21ms Script
text/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-192512597-12

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Sat, 02 Dec 2023 13:49:38 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 6323
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Sat, 02 Dec 2023 15:49:38 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 187 KB
68 KB 72ms
72ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-126527512-14&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-192512597-12

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e5b2f0b7b8f27117d2d6d9ec82283b012729e33688862da0a8756c12a50b609a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 15:35:01 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 69207
x-xss-protection: 0
last-modified: Sat, 02 Dec 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 02 Dec 2023 15:35:01 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 277 KB
92 KB 1130ms
1130ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-21EKGFLRB3&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-126527512-14

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0bc5f2ed8018f1c6a9430cc38afe213b4a2de4c5fe3f66853c8d2d8b506e1c0d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 15:35:01 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 93894
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sat, 02 Dec 2023 15:35:01 GMT

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 6012 10 KB
5 KB 520ms
519ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9369680060196134&output=html&adk=1812271804&adf=3025194257&lmt=1701531301&plaf=7%3A2&plat=3%3A128%2C4%3A128%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1048576%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fkr.buddysecret.com%2F&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2&aslcwct=150&asacwct=25&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701531300660&bpp=2&bdt=1458&idt=453&shv=r20231129&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=5792905430820&frm=20&pv=2&ga_vid=694195853.1701531301&ga_sid=1701531301&ga_hid=939562636&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C31079265%2C42532523%2C44809316%2C31078297%2C44807749%2C44807763%2C44808149%2C44808285%2C44809072&oid=2&pvsid=338407066357502&tmod=1724056041&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=462

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311150101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-9369680060196134&plah=kr.buddysecret.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b5b95bb517cf5992803aa5e967867d45311c63dad20397261e87d34ed85d6dbe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://kr.buddysecret.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 4648
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 02 Dec 2023 15:35:01 GMT
expires: Sat, 02 Dec 2023 15:35:01 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 292 KB
95 KB 58ms
58ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-9QKBNZJYL1&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MBZ4PJR

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3a6e4170807d6efc5d636c0ef86a0520a0eb587e17fe85787d3ab9e4e82cc134

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 15:35:01 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 97238
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Sat, 02 Dec 2023 15:35:01 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 202 KB
54 KB 204ms
50ms Script
application/x-javascript 2a03:2880:f084:105:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MBZ4PJR

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:105:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), gamepad=(), keyboard-map=(), otp-credentials=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Sat, 02 Dec 2023 15:35:01 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 54273
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: ksPlxpVqqmkPlXhXRDonSlJbXaWPTalqkUVF2GOXiOpPhWSUNwnd67O0McOs+VuBHkJZmJ9xcmaWV171t0lofg==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 54 KB
17 KB 361ms
360ms Fetch
text/plain 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=338407066357502&correlator=2597402366766611&eid=31077976%2C31079832%2C31079784%2C31079857%2C31079525&output=ldjh&gdfp_req=1&vrg=202311290101&ptt=17&impl=fifs&iu_parts=38924784%2CBuddysecret_ATF_728x90%2CBuddysecret_BTF_728x90&enc_prev_ius=%2F0%2F1%2C%2F0%2F2&prev_iu_szs=728x90%2C728x90&ifi=2&sfv=1-0-40&sc=1&cookie_enabled=1&abxe=1&dt=1701531301328&lmt=1701531301&adxs=-12245933%2C-12245933&adys=-12245933%2C-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1%7C-1&ucis=1%7C2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fkr.buddysecret.com%2F&vis=1&psz=0x0%7C0x0&msz=0x0%7C0x0&fws=128%2C128&ohw=0%2C0&ga_vid=694195853.1701531301&ga_sid=1701531301&ga_hid=939562636&ga_fc=false&dlt=1701531299202&idt=2099&cust_params=page%3Dhome%26lang%3Dkr&adks=4059191980%2C3124581281&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311290101/pubads_impl.js?cb=31079857

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78f74c1c43a81ad01646a8fafa13391a87822b2b58c5550a4f97edf085efa594

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 15:35:01 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17028
x-xss-protection: 0
google-lineitem-id: -1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://kr.buddysecret.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 4244 6 KB
3 KB 241ms
84ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311290101/pubads_impl.js?cb=31079857

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://kr.buddysecret.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 02 Dec 2023 15:35:01 GMT
expires: Sun, 01 Dec 2024 15:35:01 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 collect
region1.analytics.google.com/g/ 0
256 B 109ms
18ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-9QKBNZJYL1&gtm=45je3bt0v899789978z8843104604&_p=1701531300196&_gaz=1&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=694195853.1701531301&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=Ag&_s=1&sid=1701531301&sct=1&seg=0&dl=https%3A%2F%2Fkr.buddysecret.com%2F&dt=2023%20%EC%9A%B0%EC%A0%95%20%EB%8B%A4%EC%9D%B4%EC%96%B4%EB%A6%AC!%20%EB%B9%84%EB%B0%80%20%EC%9D%BC%EA%B8%B0%EB%A5%BC%20%EC%9E%91%EC%84%B1%ED%95%98%EB%A0%A4%EB%A9%B4%20%EC%A7%80%EA%B8%88%20%EC%B9%9C%EA%B5%AC%EB%93%A4%EC%9D%84%20%EC%B4%88%EB%8C%80%ED%95%98%EC%84%B8%EC%9A%94.&en=page_view&_fv=1&_ss=1&tfd=3310
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-9QKBNZJYL1&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:01 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://kr.buddysecret.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
256 B 367ms
23ms Ping
text/plain 173.194.76.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-9QKBNZJYL1&cid=694195853.1701531301&gtm=45je3bt0v899789978z8843104604&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-9QKBNZJYL1&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 173.194.76.155 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: ws-in-f155.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:01 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://kr.buddysecret.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 a
www.googletagmanager.com/ 0
11 B 36ms
36ms Image
text/html 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-9QKBNZJYL1&v=3&t=t&pid=1849363381&cv=2&rv=3bt0&tc=20&es=1&e=gtm.init_consent&eid=-1&h=Ag&dl=kr.buddysecret.com%2F&tdp=G-9QKBNZJYL1;99789978;1;6;0&z=0

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 15:35:01 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 204 td
www.googletagmanager.com/ 0
15 B 41ms
40ms Image
image/gif 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.googletagmanager.com/td?id=G-9QKBNZJYL1&v=3&t=t&pid=1849363381&cv=2&rv=3bt0&tc=20&es=1&e=gtm.init_consent&eid=-1&h=Ag&dl=kr.buddysecret.com%2F&tdp=G-9QKBNZJYL1;99789978;1;6;0&z=0
Requested by: Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:01 GMT
server: Golfe2
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 a
www.googletagmanager.com/ 0
11 B 46ms
46ms Image
text/html 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-9QKBNZJYL1&v=3&t=t&pid=1849363381&cv=2&rv=3bt0&tc=20&es=1&e=gtm.init&eid=0&h=Ag&tr=1ogtgasend.1ogtreferralexclusion.1ogtsessiontimeout.1ogt1pdatav2.1ccdgafirst.1setproductsettings.1ogtgooglesignals.1ccdgaregscope.1ccdemdownload.1ccdemform.1ccdemoutboundclick.1ccdempageview.1ccdemscroll.1ccdemsitesearch.1ccdemvideo.1ccdconversionmarking.1ogteventcreate.1ccdautoredact.1ccdgalast&ti=2ogtgasend.2ogtreferralexclusion.2ogtsessiontimeout.2ogt1pdatav2.2ccdgafirst.2setproductsettings.2ogtgooglesignals.2ccdgaregscope.2ccdemdownload.2ccdemform.2ccdemoutboundclick.2ccdempageview.2ccdemscroll.2ccdemsitesearch.2ccdemvideo.2ccdconversionmarking.2ogteventcreate.2ccdautoredact.2ccdgalast&z=0

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 15:35:01 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 ga-audiences
www.google.nl/ads/ 42 B
408 B 395ms
45ms Image
image/gif 172.217.18.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.nl/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-9QKBNZJYL1&cid=694195853.1701531301&gtm=45je3bt0v899789978z8843104604&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l1&z=20168237

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.3 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra02s19-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 a
www.googletagmanager.com/ 0
11 B 71ms
71ms Image
text/html 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-9QKBNZJYL1&v=3&t=t&pid=1849363381&cv=2&rv=3bt0&tc=20&es=1&e=*&eid=1&u=AAAAAAAAAAAAACA&ut=Ag&h=Ag&epr=1G.2G.1G.2G&tr=1gct&ti=1gct&z=0

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 15:35:01 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 a
www.googletagmanager.com/ 0
11 B 45ms
45ms Image
text/html 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-9QKBNZJYL1&v=3&t=t&pid=1849363381&cv=2&rv=3bt0&tc=20&es=1&e=gtag.config&eid=3&u=AAAAAAAAAAAAACA&ut=Ag&h=Ag&z=0

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 15:35:01 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 a
www.googletagmanager.com/ 0
11 B 53ms
53ms Image
text/html 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-9QKBNZJYL1&v=3&t=t&pid=1849363381&cv=2&rv=3bt0&tc=20&es=1&e=gtag.config&eid=5&u=AAAAAAAAAAAAACA&ut=Ag&h=Ag&z=0

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 15:35:01 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

POST
H2 204 collect
region1.analytics.google.com/g/ 0
54 B 125ms
41ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-9QKBNZJYL1&gtm=45je3bt0v899789978&_p=1701531300196&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=694195853.1701531301&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AAg&_s=2&sid=1701531301&sct=1&seg=0&dl=https%3A%2F%2Fkr.buddysecret.com%2F&dt=2023%20%EC%9A%B0%EC%A0%95%20%EB%8B%A4%EC%9D%B4%EC%96%B4%EB%A6%AC!%20%EB%B9%84%EB%B0%80%20%EC%9D%BC%EA%B8%B0%EB%A5%BC%20%EC%9E%91%EC%84%B1%ED%95%98%EB%A0%A4%EB%A9%B4%20%EC%A7%80%EA%B8%88%20%EC%B9%9C%EA%B5%AC%EB%93%A4%EC%9D%84%20%EC%B4%88%EB%8C%80%ED%95%98%EC%84%B8%EC%9A%94.&en=page_location&_et=2&tfd=3317
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-9QKBNZJYL1&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:01 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://kr.buddysecret.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
54 B 124ms
41ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-9QKBNZJYL1&gtm=45je3bt0v899789978&_p=1701531300196&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=694195853.1701531301&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AkA&_s=3&sid=1701531301&sct=1&seg=0&dl=https%3A%2F%2Fkr.buddysecret.com%2F&dt=2023%20%EC%9A%B0%EC%A0%95%20%EB%8B%A4%EC%9D%B4%EC%96%B4%EB%A6%AC!%20%EB%B9%84%EB%B0%80%20%EC%9D%BC%EA%B8%B0%EB%A5%BC%20%EC%9E%91%EC%84%B1%ED%95%98%EB%A0%A4%EB%A9%B4%20%EC%A7%80%EA%B8%88%20%EC%B9%9C%EA%B5%AC%EB%93%A4%EC%9D%84%20%EC%B4%88%EB%8C%80%ED%95%98%EC%84%B8%EC%9A%94.&en=scroll&epn.percent_scrolled=90&_et=4&tfd=3318
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-9QKBNZJYL1&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:01 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://kr.buddysecret.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 0767 6 KB
3 KB 22ms
21ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311290101/pubads_impl.js?cb=31079857

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://kr.buddysecret.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 02 Dec 2023 15:35:01 GMT
expires: Sun, 01 Dec 2024 15:35:01 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 9B6B 6 KB
3 KB 21ms
20ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311290101/pubads_impl.js?cb=31079857

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://kr.buddysecret.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 02 Dec 2023 15:35:01 GMT
expires: Sun, 01 Dec 2024 15:35:01 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 4DF5 624 B
246 B 73ms
72ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJyntKMDEM683_cDGJXN-f4BMAE&v=APEucNXYq8RBIuehpkEWFXaUJCcP9CxPAHZfiSRiO-s5FUIZGzfzKZhhXRuAKwGM7U-GybWrQUevH8bwZ53phKmLMjS4S0EFe3le2l8DOjkZKJfGAVUX_v5CcUWhVDxAEbDAar15oN4r2KueUNKj80V9NwyjnttAf_RHPEYEnifSV4msDI3azIE

Requested by

Host: a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com
URL: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 02 Dec 2023 15:35:01 GMT
expires: Sat, 02 Dec 2023 15:35:01 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 0767 89 KB
31 KB 85ms
84ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com
URL: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 15:35:01 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Sat, 02 Dec 2023 15:35:01 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0767 42 B
63 B 55ms
55ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AMSdNFTBEHMP2aXLxDErG8gEqHovMYwpwIBJipiheRBb2ndJcpFpIKPbkW7w-_JS9kJ5vwlGVwM_H-JIDr4WNNLdBnNn75JSqy0eofhmYAtHUFECA

Requested by

Host: a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com
URL: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0767 0
20 B 56ms
55ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=13500963024797033057&x=1&ct=77

Requested by

Host: a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com
URL: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
track.adform.net/adfscript/ Frame 0767 2 KB
3 KB 97ms
26ms Script
text/javascript 37.157.6.243
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/adfscript/?bn=69707714;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=CjdlzpU5rZbqSF9KLgAfQlIU4tK27rHTAz_OIrxKs-MXv40EQASDJlbCQAWCRBMgBCakChxZyOYpCsj6oAwHIA5sEqgT7AU_Qc7VA5_5eTF2TobZT5fyCensyG-QSA_u82mlcbKPD1yWZk456c8MfY3B1q1TNB2ZH72oRjO4L9hYk2_TzvAb6JrLvQvYgsiRI-3cFOWCN-0AUblsCPHuC6oDO9gSN_l8y4PXPrPX1joEZr4PhQZTLgc7KZimy20fql0uakpFosGVVyiAv6NQJ8Qwh9ovYoskLDlk1Iea_ODMUuiZKwoFlecLU8b4pnt8TZH3uMnTYYJ5kiZSYEUU8nCw8UOCRG_aGSxnUpFlmHHy98v2zFMZcmuBriwIElBwT9iesZYwVnvdM_MrPk-OlcwAEEdQhm6bBK9BHfr-cn6GmwAT-ja2U0wTgBAOIBeaTp7tNkAYBoAZNgAelmqHSA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB0yAqoCOgKAQEi9_cE6WMG4qoaK8YIDgAoDmAsByAsBgAwBogwUKhIKEOS0sQLutbECtbixAru7sQKqDQJOTOINEwit6qqGivGCAxXSBeAKHVBKAQewE4HPyxXQEwDYEwrYFAHQFQH4FgGAFwHoFwE&ae=1&num=1&cid=CAQSTgDICaaNP0g7HbUZgiwzgXnE_r9tvKzpzkvX5lPLHLjYRy_h8ElkYK6TEf-Ap_LKjC1isVDZ-eh8VlaflipnMcNGhVyp4zGKdA3A2wNrOhgB&sig=AOD64_0FIJZ77eZhlP-l1ohc-fPnaziu1Q&client=ca-pub-2264225803283139&dbm_c=AKAmf-BRVSHeWP1HKDZA5mMz7drGl64oZz5rS0XQae3zxAY6loOXe9nAbI-fnennFa1H2yy546qDmju30g3GL1kJVaUtZh6BmNlt9wn2f9wxKdBgQ8Rp2ho3lSufkbG6CPRPkLxD5NatWRwqI4G-GVsQQd167lvfpqgGmnedMcHMbj0To7Vr3cg&cry=1&dbm_d=AKAmf-DBRMc4qKvB-4B3LR0s1qEcS3zrO5CnAgHW4MwmnqGp_uEbTjh_6wKfBHlahmzBDjtTkYle6gWqGHNkNfiINGL6jpUGE_fnK3e00kUf9keyOHudIyCM1vGdLtnbSfxuJiN4-1hOEVRzmbvYnjtcVHixacJxU6110t51lAgGdT4mS6l7ZWUiCiF1SdqTi7yfVFKCOrWW6Hd1mt-j7k7G6qQpbsh4sAFjbT6aorzCTR4OdajoBF9VBI2sFNTa4rFp42A5Ma5R1h3dCx1Pc2FLjcwZzWTspUoH45z7NJyb4NrXcTG79nsswnhGVbHOVyWChw0TA_3khjDunxrfaoy0vTwHj1d7sVxHQvI9x_VMciTeO9ATKWJd71rvYX4G1phidZw1v2_ShzgqHRVMHrAtuHa5Kym5bDtvJwMZ2-YbGbzJqYy9724HW-cZG6sM0fKI51muDNzwgBjL3Fq8Swx0ymwPRggIY3DglJB3hyjxpPmdW56-jjCT4bexAibaKB53cyXxjJjpjbqnXWrG_A2f0iUP5wMPeFzV9DIYByHODoFoppGrMFw&adurl=

Requested by

Host: a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com
URL: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.243 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

42055f25a4eecfde02b57c48b076f7b0ddffde0c372f285f8a4567e3a88759ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:01 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 2417
expires: -1

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/ Frame 0767 3 KB
1 KB 390ms
40ms Script
text/javascript 142.250.185.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/window_focus_fy2021.js

Requested by

Host: a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com
URL: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f1.1e100.net

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Fri, 01 Dec 2023 22:17:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 62245
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 15 Dec 2023 22:17:37 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/ Frame 0767 20 KB
9 KB 371ms
21ms Script
text/javascript 142.250.185.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com
URL: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f1.1e100.net

Software

cafe /

Resource Hash

09b186dc119230c8ab2c806d31bcc8dd4a0a2ba347165f35156422307b8e10ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Fri, 01 Dec 2023 20:02:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 70372
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8544
x-xss-protection: 0
server: cafe
etag: 17124069415086231762
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 15 Dec 2023 20:02:10 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0767 202 KB
64 KB 474ms
35ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com
URL: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1adb10c9a5878dd4306d66ff94ae27a07cbe47f57b34dec9a807e5d2d426eee0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 15:35:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65067
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701261208926228"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 02 Dec 2023 15:35:02 GMT

GET
H2 200 1248373189146307 Show response
connect.facebook.net/signals/config/ 133 KB
35 KB 157ms
157ms Script
application/x-javascript 2a03:2880:f084:105:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1248373189146307?v=2.9.138&r=stable&domain=kr.buddysecret.com

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f084:105:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

7cf5817bfa72ce680f9d8e793ec8b3892065b122ec7783cec50144708d649db1

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), gamepad=(), keyboard-map=(), otp-credentials=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Sat, 02 Dec 2023 15:35:01 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: Bovnq9hu53AiKd3EPM2i6jCiYKKaG0Fs4wf6YfLkAT5D6YvYgIZZNDxe99aYX/+UvI9tvfk08sWQS3T6if9lPA==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame 4DF5
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGtJw-ZN-b-0iHQrqOkJOL0&google_cver=1

43 B
340 B

35ms
35ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGtJw-ZN-b-0iHQrqOkJOL0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJyntKMDEM683_cDGJXN-f4BMAE&v=APEucNXYq8RBIuehpkEWFXaUJCcP9CxPAHZfiSRiO-s5FUIZGzfzKZhhXRuAKwGM7U-GybWrQUevH8bwZ53phKmLMjS4S0EFe3le2l8DOjkZKJfGAVUX_v5CcUWhVDxAEbDAar15oN4r2KueUNKj80V9NwyjnttAf_RHPEYEnifSV4msDI3azIE
Protocol: H2
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:01 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4Z2IW1PPxBGA2fR0Az79Lwk32UwR%2B21TqYvYDgLsBZ8xb%2BFNCYyCbpJS3Z9K9zmcPCRNte6BVG3Yg5GhK97cPvjKh3%2ByTF0ospuGz5jordLJ5KC7h2DB3t36xX51Gt35EXnlS%2BPvMXT%2Btg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 82f4a32d69159223-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:01 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGtJw-ZN-b-0iHQrqOkJOL0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 4DF5
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZWtOpWsAj6aYWo8VxR5zjAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGtJw-ZN-b-0iHQrqOkJOL0&google_cver=1

43 B
769 B

36ms
36ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGtJw-ZN-b-0iHQrqOkJOL0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJyntKMDEM683_cDGJXN-f4BMAE&v=APEucNXYq8RBIuehpkEWFXaUJCcP9CxPAHZfiSRiO-s5FUIZGzfzKZhhXRuAKwGM7U-GybWrQUevH8bwZ53phKmLMjS4S0EFe3le2l8DOjkZKJfGAVUX_v5CcUWhVDxAEbDAar15oN4r2KueUNKj80V9NwyjnttAf_RHPEYEnifSV4msDI3azIE
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:02 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8zEO4nJb5u8%2F12jK8nEjll%2FVQj5UfMOvQzDHZ5XXcPiZNBriL3K4z6UqORxWVNLEpaUKQ1ll8ArzNSk0YtdaWLNPqKfZ4y0YFkXJIx8HVxiyIAPCpQZMQfyp4y1iW3LrDN5PGzX6j062xg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 82f4a32dcd845d78-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:02 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGtJw-ZN-b-0iHQrqOkJOL0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 4DF5
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEHESeJcfukutgFLHdzSOAwc&google_cver=1

43 B
842 B

15ms
14ms

Image
image/gif

185.89.210.212
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEHESeJcfukutgFLHdzSOAwc&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJyntKMDEM683_cDGJXN-f4BMAE&v=APEucNXYq8RBIuehpkEWFXaUJCcP9CxPAHZfiSRiO-s5FUIZGzfzKZhhXRuAKwGM7U-GybWrQUevH8bwZ53phKmLMjS4S0EFe3le2l8DOjkZKJfGAVUX_v5CcUWhVDxAEbDAar15oN4r2KueUNKj80V9NwyjnttAf_RHPEYEnifSV4msDI3azIE

Protocol

Server

185.89.210.212 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:01 GMT
an-x-request-uuid: aff8039d-ddcf-4cda-9c7c-9cba43cc1f3e
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 95.211.199.151; 95.211.199.151; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:01 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEHESeJcfukutgFLHdzSOAwc&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 4DF5
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTI4MDg3Mjc5Mjc0MzE5MjY1MQ%3D%3D

170 B
243 B

30ms
30ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTI4MDg3Mjc5Mjc0MzE5MjY1MQ%3D%3D

Requested by

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:01 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:01 GMT
an-x-request-uuid: 94dae70a-7979-44e6-afde-16c67e256344
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTI4MDg3Mjc5Mjc0MzE5MjY1MQ%3D%3D
x-proxy-origin: 95.211.199.151; 95.211.199.151; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0767 0
20 B 56ms
56ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=7580189905998&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0767 0
20 B 55ms
54ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=7580189905998&version=m202309260101&ct=77&x=1&cor=13500963024797032000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 0767 34 KB
19 KB 69ms
69ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AEgxEFNmGQAJOu2Xc6_fo3Lurg_IV-HAzTLEcF2wHbnRdLYe8rkiEmTn1Z3n9JXbtQ1akBsx07z5V63g8au0pPTriRCKN9ipMn5Dw0IRde_d2z4rsiCYKOz6y6Dw9sOD2FmsI7JBsrSfAfyObFiZOp7O4Nta8eh-_ic5igONi_Cu-GfRg&cry=1&dbm_d=AKAmf-CwFDml2wMd2-Rm5ZmGdv9T__5r1O1pC-8hLlT6HAvM2UW8X3x7awoxGwmPONoHZaN3Q7iE7an79RaTFyI7tSbl1e0Q7S58tev-R7LSiGTS-JzhCgb_11rneA4-KqD0vrN84tH5ZDIixzxFlneRsDIbX-uD4Us5bgNcpKxYlLhK9l8ais-nByGFa_LS6USmxWbwxr7T0F0htOs4SJKsfLL0NgKgdz5o6sq6o7-l1_aGcZ6Ct8jvHG4POsUngOO7Wc8DI0a4Wa1073fGuZdpff5Y6ecTWn0Z5HuJ-3zhlsgabVwm2cMCKDC0J5Ccm7DkMrCbgQn6h9IGvZD2qgn-eNmc9nf8S0xWyyDuqnfh1IGFoC8wdPvyTax4g_BkxMRNQUC9_597CG2Y97lV2ga6r8a8tmvAPbFZ_ZC21lbHGmqvi44rpcPGb1F1GGNuChqlPaQ-vkgbp34tMNtz1Q8p9JOpstyXciOIswD9aqtjLwBy9hswVPzcmCFcF9sq1Nzy6Z4Y91pojQfUJz-UGF6i5hIlCd0rzqtrBisQwdg4CvjZP1E6Ovf1oZIMgycs4Q5r1y9neWNnVDjiWkb3w6RNFQcdNzdkJ-IVS-YLQyqSSctLgsOH5F-cSQUoBhM0vACr_Q5ZQbhEajxJQ1YbOpJAVSbzTw4Pg4xsyrOacRGSNBdFJQftEx-fWxY-RtBMelI9VRBbrGlLcCObSQbF4GVhdRvn5pTAfZ50o8MYc8SycMYuLLBVbm3POWIKI1MfLcIvO1_OWhZBJYQbzy18dRyBfsgJN0wWCLjl2QDe8xan5US6jq_W4Nycv0R1gSU0-O3PsWr43W1HQVp3ucjTv-0tivYbiqzPgK8GA7rTqbOflspjCUd9CMFrvrHxvDqqbRg5uVQ_qSPzJ_lLJmPOylSrSOIPTAuQUz9INqZpuKcJWg0PlI48wJ7_1cu4x-ojQFtMaie5KIVlJaANdLYHH7n2aj5_HhKquJupFasUBbbHczKIik96iIMyl1958k1d6d-TcBabat6L9KTcs1zw2bll8xOvSsfX2NPm2hARS5p5brvHfawhK1S4jeAwjzLCSr7qAN6UqB4T1gij4hCOPCA_crxLG9BUtYytmpuMldtLvz2Z0a23orPwpSN3rGquxvoE57TUjljPgTcDZXa_OoEXQHepbLFcG6hrK-p6qFxYKuHi5VTTFsFvZx_I06IPC2JzO_CYMuHjKj4iCuTmi83rmooCa0ZSwvftEKOUjnLsEH2EOnsWpk2zgzlPblUqAuLqEBDAWYk5sJ3oJ-y_Iw_L8_evn0VIt-D2rtbNmikLtFPVDGENw1amsN6O_hh0h7NEAHX4jF-yAfwFPoeIySPkFebnL_6BSoMC3pZw1pjuJ_V_w2waEl1-3d7a0doZ6xizKXjMZ6UeYZ_RI2VWmsgDZ1kG6syzUIJBxzgUOQyfPmUGmed4TkwE8BBW4v07QnhvnFKlhqpG5pgxeyO9To4kBYGEWd50A5RR6Ekxs1FED_VZow5c2NlVmtVZvhE_wl8Hyj0_MibO009fej0QHAg7NK6q3yjZoot-15k4KcTk4sWCOsmGb74LPam6SadcuPjQ-UlMoEwIdBxWHdxn7JjGbzsXF5CgorJKnHvhapIxMzZYvai3qOquyO38b_-7d7A3PJJfFkjmxRaQFmmcwfJ_v9Dlc4m3uaNxEPxxnwYNn0i-cSQAenSxE1VeSOdzO24ZhUkw5pabiG3E82PoF5hMfB96ETAI8EW2JWb9sRwhIG8x_IDTK_6b0MiuKcW1V8ltX6xx3O-ulGhGFljzWHhIODnhMZvTaVkqkDyp3uu30aYJgD4UrmhOPjvoTXHPXUQwUCGIWvpbhp0PfGfeEl21B-3ttNkh0Icjf2kKByRKWTBCZRxN5mHGHtR6xPJ7Rnu5TgGKlsStc2XQ2G4zA3DTF_z09fnvPOeFLtB3Qc1ky5rJOhhuWXcvjsbcZR_1mLvBnFrNT6ftdvYjZPAEUGIxTJ4eW261yYaFQT8OpeDLuZpc8YUR8uc_9TtM16ztpQDK1UZsYVrbkRrvauEVQsmzxCf_ouOka2ebKc76PEh5Nd-N_6YI9MwmoLA8FZl_fI7IpNypV3tUahVa6L5sNCTKAB77VSmJ4Qd7mZkM5cPNR0m9Nb4zH37tAqivYgDlDixDER-WrX0yOHInuoX62EzenULM1vOZy20XmiNy1PSzGjJx0GMXpfuXbSiKf3APZ94Op3OgNq04dWHS4Xh2OGaePDLNqEf9pydQeM-s5o0-dUyDJJ1y3D5iPjjPcF_ny7QX0iXPNq8li3rd89UUOLP2jnS5TUd9Zebae9dp0K9S-kLMn9O8Z5EfoCHsYcC9i2ax_hUX-wz9utONkgoEWSJuMYJGHu9Y_S2tyHWBe3oWEmd3fm2r6ViJ-ONT8UM_cnz2dqXmh-8QwjSMORfvqxfqlH1OWVYOtfeIjuwjbCvmaHoQtuYrPYfW1bdyRr6mmRtFWyc96kbRCpMtD1vDlMC2OBr6707Yy4krlkjdunIi0YegaRUGwCt9zqOhy1Ow37kM39ipsAz9oG5WlCqWZWTwH_teY9Hm5AHxZAUlEVBoXFfYMmqfidczjIgpJpkR803BedaluuSGwE93JXhgraX_cajPFmIGJtnjiIyvEpzH80HTFcOcsE4aK6oGxxEo0QkuAKouFH36PmHioOeXc9gmofwfdg451hIle2YyjUmD3Z4PDiZ9KI4EZeAkY9cujq9pzDWAehkM4e9RL4qNgoTh1y5SxY1eCI1br0qYw3QcVseXabH_9VwZrx769O0O3j1n_-ky3W0OSTzCFfAWSO4NdkO-ld0nO3XmZ9DpTBaXnWX8-TVNBS3_4IyhV5V3xMhTma0zHF9-yZhy1FodKUTNC5jAD2DeDEa3Szgcmr09I8z6D7n_cwIl8nmKReZNF4GnYXhn88Gv8mSABo9Ryz2ztQNCnFpKP3WirLtqLy-m4GEN7XxMvIsHjIXULApi5tMzjwkL0AyEpcvmTntAEZu5IFumzCH8BVHJwrS-jEzZzg5QDJf83wVT-2PCCIdqQDzgtsbAaoWyi0oESQbvIkcxNqIGTM2SITLmTWb86D4gxbsTjLYA6CUtuEBMc4BfronQqSrNssWwsrAwbxL16wY7mwbA3t2GTTIriFriD4Znbdfjsu2FMHT2SbJ9o027LaQJcRwD9-m7mNbUuiRuePrShwW6z8BQkwiCpzXqpvGcwvB3dsyz8WjVylgprEXqNq7EGPOKdzobT15Bo7oQAwu3obuChwPPlHGpShB3eoyAFTrj7wMrLCN2Nes9_5xDVWrE0-Yq0mrsrB6XTmvwKMSJiL1jNALakeWFhHiW9S10LLmPI0JDMlfMfA9zI0-VBSlNpojG1Ayaw1sfMIiDjfrVTBHm4yyBxQqn1BT-6odCgmRSpaW9ftudb9mNIOV32-_Y9NuNsQWNvj0YhcGvwtqpu-OGudcAYHBLwTfYyI4v2zID6TRqz1Z0Xjvik7cED5BdJnw3cVJ-cRxfMyWjrQyykoD3nchGLNc_h_O6nyaGgHQaucqzw-G5afa4eBl0opYXeH9OkK-xIOGqHYglpjskaujXGW3m8CBtlKk279G5yE57bkMHu2XXEKMeqXeNSLY6lUa9lx5814E83Z68Y6WnA5RFvTCF24KwXa06qg6irUE1POobcpR685QMVUrmY-_dXZXkaWzvWHwPhS9UTFEAVa2RR72ERsvWuX3zNfLgVLYMw3xE6kvFIiBs0_WH3ruFhNyxNz9cQVO3W4ZuBO1f8gH3DajPZL4luummv24tJEciksRsc6yvZwyRaGc2IevEQvP2yfvm7Q2rtPz4HvGEx_Wppzk5u_qWLswU5JGO_64KXao0kx0ZQsiDM3ML2ia7ee_1Tkwkna2a4uhUAbYzv_BaphAkaw5DrRA5wRql-RZyDVyPD6NxtsecIXVt_lCep_twi4LOiC8G1zjIcFH5cK9sidQSB5FKeSkHJzpPznB8Eu4mQX0JFjIEtORtZH2pSjCKSUcQS9ytBPt04VrRte32VWe2jllogkyy7E8moSuKtQHRX3u1y5YIr68bZNS0G2pA_9-EyyhDBHfyeoowa34TTvcCpnCCmOqTMdomQkbTQGeO3mhHat_GtTJc6rLyvBo3FtrS_H_pduSLReUXm3C4I1RP_w8ALvW0x7W3uSWM4wo7GVD8dlMNMKTf2bloDZObIuloJfGEijtviD2JmtPwDocWOQ8dRDLAJ5xcDSz8IZJiB9xkmU0BjaRSpnji45gdNjiYFWdn9GBgKKqTMftkSMx25qeQDwhoE17O3m3vJDg4AHXaAymOnYKiLJ3N6DQNZbkljnWedKTDbxy074c7GL0xi0YLTxu3UBJBwEJ-XQnLWgtTqyTuy5jG-N4ZKzVdWE6IlrjeONLFsw0Tboen9WB66L-V5iQJbsVPvut4kJTFuwQ&cid=CAQSTgDICaaNP0g7HbUZgiwzgXnE_r9tvKzpzkvX5lPLHLjYRy_h8ElkYK6TEf-Ap_LKjC1isVDZ-eh8VlaflipnMcNGhVyp4zGKdA3A2wNrOhgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fkr.buddysecret.com%2F&ds=l&xdt=1&iif=1&cor=13500963024797032000&adk=250412560&idt=165&cac=0&dtd=7

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

17ee33b20c68cf3c36226dd4a5bfad53f0a4e11bc62ffcc072cf846f27ca7f5c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:01 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19903
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 160ms
21ms Image
text/plain 2a03:2880:f177:185:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1248373189146307&ev=PageView&dl=https%3A%2F%2Fkr.buddysecret.com%2F&rl=&if=false&ts=1701531302113&sw=1600&sh=1200&v=2.9.138&r=stable&a=tmSimo-GTM-WebTemplate&ec=0&o=4126&fbp=fb.1.1701531302113.1390748538&ler=empty&it=1701531301811&coo=false&tm=1&rqm=GET

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:185:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Sat, 02 Dec 2023 15:35:02 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231129/r20110914/ Frame 0767 31 KB
12 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231129/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AEgxEFNmGQAJOu2Xc6_fo3Lurg_IV-HAzTLEcF2wHbnRdLYe8rkiEmTn1Z3n9JXbtQ1akBsx07z5V63g8au0pPTriRCKN9ipMn5Dw0IRde_d2z4rsiCYKOz6y6Dw9sOD2FmsI7JBsrSfAfyObFiZOp7O4Nta8eh-_ic5igONi_Cu-GfRg&cry=1&dbm_d=AKAmf-CwFDml2wMd2-Rm5ZmGdv9T__5r1O1pC-8hLlT6HAvM2UW8X3x7awoxGwmPONoHZaN3Q7iE7an79RaTFyI7tSbl1e0Q7S58tev-R7LSiGTS-JzhCgb_11rneA4-KqD0vrN84tH5ZDIixzxFlneRsDIbX-uD4Us5bgNcpKxYlLhK9l8ais-nByGFa_LS6USmxWbwxr7T0F0htOs4SJKsfLL0NgKgdz5o6sq6o7-l1_aGcZ6Ct8jvHG4POsUngOO7Wc8DI0a4Wa1073fGuZdpff5Y6ecTWn0Z5HuJ-3zhlsgabVwm2cMCKDC0J5Ccm7DkMrCbgQn6h9IGvZD2qgn-eNmc9nf8S0xWyyDuqnfh1IGFoC8wdPvyTax4g_BkxMRNQUC9_597CG2Y97lV2ga6r8a8tmvAPbFZ_ZC21lbHGmqvi44rpcPGb1F1GGNuChqlPaQ-vkgbp34tMNtz1Q8p9JOpstyXciOIswD9aqtjLwBy9hswVPzcmCFcF9sq1Nzy6Z4Y91pojQfUJz-UGF6i5hIlCd0rzqtrBisQwdg4CvjZP1E6Ovf1oZIMgycs4Q5r1y9neWNnVDjiWkb3w6RNFQcdNzdkJ-IVS-YLQyqSSctLgsOH5F-cSQUoBhM0vACr_Q5ZQbhEajxJQ1YbOpJAVSbzTw4Pg4xsyrOacRGSNBdFJQftEx-fWxY-RtBMelI9VRBbrGlLcCObSQbF4GVhdRvn5pTAfZ50o8MYc8SycMYuLLBVbm3POWIKI1MfLcIvO1_OWhZBJYQbzy18dRyBfsgJN0wWCLjl2QDe8xan5US6jq_W4Nycv0R1gSU0-O3PsWr43W1HQVp3ucjTv-0tivYbiqzPgK8GA7rTqbOflspjCUd9CMFrvrHxvDqqbRg5uVQ_qSPzJ_lLJmPOylSrSOIPTAuQUz9INqZpuKcJWg0PlI48wJ7_1cu4x-ojQFtMaie5KIVlJaANdLYHH7n2aj5_HhKquJupFasUBbbHczKIik96iIMyl1958k1d6d-TcBabat6L9KTcs1zw2bll8xOvSsfX2NPm2hARS5p5brvHfawhK1S4jeAwjzLCSr7qAN6UqB4T1gij4hCOPCA_crxLG9BUtYytmpuMldtLvz2Z0a23orPwpSN3rGquxvoE57TUjljPgTcDZXa_OoEXQHepbLFcG6hrK-p6qFxYKuHi5VTTFsFvZx_I06IPC2JzO_CYMuHjKj4iCuTmi83rmooCa0ZSwvftEKOUjnLsEH2EOnsWpk2zgzlPblUqAuLqEBDAWYk5sJ3oJ-y_Iw_L8_evn0VIt-D2rtbNmikLtFPVDGENw1amsN6O_hh0h7NEAHX4jF-yAfwFPoeIySPkFebnL_6BSoMC3pZw1pjuJ_V_w2waEl1-3d7a0doZ6xizKXjMZ6UeYZ_RI2VWmsgDZ1kG6syzUIJBxzgUOQyfPmUGmed4TkwE8BBW4v07QnhvnFKlhqpG5pgxeyO9To4kBYGEWd50A5RR6Ekxs1FED_VZow5c2NlVmtVZvhE_wl8Hyj0_MibO009fej0QHAg7NK6q3yjZoot-15k4KcTk4sWCOsmGb74LPam6SadcuPjQ-UlMoEwIdBxWHdxn7JjGbzsXF5CgorJKnHvhapIxMzZYvai3qOquyO38b_-7d7A3PJJfFkjmxRaQFmmcwfJ_v9Dlc4m3uaNxEPxxnwYNn0i-cSQAenSxE1VeSOdzO24ZhUkw5pabiG3E82PoF5hMfB96ETAI8EW2JWb9sRwhIG8x_IDTK_6b0MiuKcW1V8ltX6xx3O-ulGhGFljzWHhIODnhMZvTaVkqkDyp3uu30aYJgD4UrmhOPjvoTXHPXUQwUCGIWvpbhp0PfGfeEl21B-3ttNkh0Icjf2kKByRKWTBCZRxN5mHGHtR6xPJ7Rnu5TgGKlsStc2XQ2G4zA3DTF_z09fnvPOeFLtB3Qc1ky5rJOhhuWXcvjsbcZR_1mLvBnFrNT6ftdvYjZPAEUGIxTJ4eW261yYaFQT8OpeDLuZpc8YUR8uc_9TtM16ztpQDK1UZsYVrbkRrvauEVQsmzxCf_ouOka2ebKc76PEh5Nd-N_6YI9MwmoLA8FZl_fI7IpNypV3tUahVa6L5sNCTKAB77VSmJ4Qd7mZkM5cPNR0m9Nb4zH37tAqivYgDlDixDER-WrX0yOHInuoX62EzenULM1vOZy20XmiNy1PSzGjJx0GMXpfuXbSiKf3APZ94Op3OgNq04dWHS4Xh2OGaePDLNqEf9pydQeM-s5o0-dUyDJJ1y3D5iPjjPcF_ny7QX0iXPNq8li3rd89UUOLP2jnS5TUd9Zebae9dp0K9S-kLMn9O8Z5EfoCHsYcC9i2ax_hUX-wz9utONkgoEWSJuMYJGHu9Y_S2tyHWBe3oWEmd3fm2r6ViJ-ONT8UM_cnz2dqXmh-8QwjSMORfvqxfqlH1OWVYOtfeIjuwjbCvmaHoQtuYrPYfW1bdyRr6mmRtFWyc96kbRCpMtD1vDlMC2OBr6707Yy4krlkjdunIi0YegaRUGwCt9zqOhy1Ow37kM39ipsAz9oG5WlCqWZWTwH_teY9Hm5AHxZAUlEVBoXFfYMmqfidczjIgpJpkR803BedaluuSGwE93JXhgraX_cajPFmIGJtnjiIyvEpzH80HTFcOcsE4aK6oGxxEo0QkuAKouFH36PmHioOeXc9gmofwfdg451hIle2YyjUmD3Z4PDiZ9KI4EZeAkY9cujq9pzDWAehkM4e9RL4qNgoTh1y5SxY1eCI1br0qYw3QcVseXabH_9VwZrx769O0O3j1n_-ky3W0OSTzCFfAWSO4NdkO-ld0nO3XmZ9DpTBaXnWX8-TVNBS3_4IyhV5V3xMhTma0zHF9-yZhy1FodKUTNC5jAD2DeDEa3Szgcmr09I8z6D7n_cwIl8nmKReZNF4GnYXhn88Gv8mSABo9Ryz2ztQNCnFpKP3WirLtqLy-m4GEN7XxMvIsHjIXULApi5tMzjwkL0AyEpcvmTntAEZu5IFumzCH8BVHJwrS-jEzZzg5QDJf83wVT-2PCCIdqQDzgtsbAaoWyi0oESQbvIkcxNqIGTM2SITLmTWb86D4gxbsTjLYA6CUtuEBMc4BfronQqSrNssWwsrAwbxL16wY7mwbA3t2GTTIriFriD4Znbdfjsu2FMHT2SbJ9o027LaQJcRwD9-m7mNbUuiRuePrShwW6z8BQkwiCpzXqpvGcwvB3dsyz8WjVylgprEXqNq7EGPOKdzobT15Bo7oQAwu3obuChwPPlHGpShB3eoyAFTrj7wMrLCN2Nes9_5xDVWrE0-Yq0mrsrB6XTmvwKMSJiL1jNALakeWFhHiW9S10LLmPI0JDMlfMfA9zI0-VBSlNpojG1Ayaw1sfMIiDjfrVTBHm4yyBxQqn1BT-6odCgmRSpaW9ftudb9mNIOV32-_Y9NuNsQWNvj0YhcGvwtqpu-OGudcAYHBLwTfYyI4v2zID6TRqz1Z0Xjvik7cED5BdJnw3cVJ-cRxfMyWjrQyykoD3nchGLNc_h_O6nyaGgHQaucqzw-G5afa4eBl0opYXeH9OkK-xIOGqHYglpjskaujXGW3m8CBtlKk279G5yE57bkMHu2XXEKMeqXeNSLY6lUa9lx5814E83Z68Y6WnA5RFvTCF24KwXa06qg6irUE1POobcpR685QMVUrmY-_dXZXkaWzvWHwPhS9UTFEAVa2RR72ERsvWuX3zNfLgVLYMw3xE6kvFIiBs0_WH3ruFhNyxNz9cQVO3W4ZuBO1f8gH3DajPZL4luummv24tJEciksRsc6yvZwyRaGc2IevEQvP2yfvm7Q2rtPz4HvGEx_Wppzk5u_qWLswU5JGO_64KXao0kx0ZQsiDM3ML2ia7ee_1Tkwkna2a4uhUAbYzv_BaphAkaw5DrRA5wRql-RZyDVyPD6NxtsecIXVt_lCep_twi4LOiC8G1zjIcFH5cK9sidQSB5FKeSkHJzpPznB8Eu4mQX0JFjIEtORtZH2pSjCKSUcQS9ytBPt04VrRte32VWe2jllogkyy7E8moSuKtQHRX3u1y5YIr68bZNS0G2pA_9-EyyhDBHfyeoowa34TTvcCpnCCmOqTMdomQkbTQGeO3mhHat_GtTJc6rLyvBo3FtrS_H_pduSLReUXm3C4I1RP_w8ALvW0x7W3uSWM4wo7GVD8dlMNMKTf2bloDZObIuloJfGEijtviD2JmtPwDocWOQ8dRDLAJ5xcDSz8IZJiB9xkmU0BjaRSpnji45gdNjiYFWdn9GBgKKqTMftkSMx25qeQDwhoE17O3m3vJDg4AHXaAymOnYKiLJ3N6DQNZbkljnWedKTDbxy074c7GL0xi0YLTxu3UBJBwEJ-XQnLWgtTqyTuy5jG-N4ZKzVdWE6IlrjeONLFsw0Tboen9WB66L-V5iQJbsVPvut4kJTFuwQ&cid=CAQSTgDICaaNP0g7HbUZgiwzgXnE_r9tvKzpzkvX5lPLHLjYRy_h8ElkYK6TEf-Ap_LKjC1isVDZ-eh8VlaflipnMcNGhVyp4zGKdA3A2wNrOhgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fkr.buddysecret.com%2F&ds=l&xdt=1&iif=1&cor=13500963024797032000&adk=250412560&idt=165&cac=0&dtd=7

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

43c9555701d17579571d962cfee37868f4769995820a96abf451623b0528c92c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Fri, 01 Dec 2023 23:19:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 58513
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11894
x-xss-protection: 0
server: cafe
etag: 8278194740845609983
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 15 Dec 2023 23:19:49 GMT

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 0767 41 KB
14 KB 53ms
23ms Script
text/javascript 142.250.185.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f1.1e100.net

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Fri, 01 Dec 2023 18:05:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 77394
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 30 Nov 2024 18:05:08 GMT

GET
H2 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMTUzMTMwMTk5NzUxMwogIHNlcnZlcl9pcDogMTM0MDYxNzEzCiAgcHJvY2Vzc19pZDogMzc0MTUwMDY3Mwp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTgyOTk5...
ad.doubleclick.net/ddm/activity/ Frame 0767 0
862 B 121ms
59ms Image
image/png 172.217.16.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMTUzMTMwMTk5NzUxMwogIHNlcnZlcl9pcDogMTM0MDYxNzEzCiAgcHJvY2Vzc19pZDogMzc0MTUwMDY3Mwp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTgyOTk5NQphZHZlcnRpc2VyX2RvbWFpbjogImh0dHBzOi8vbGVub3ZvLmNvbSIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IFZJRVcKaW1wcmVzc2lvbl9wcmlvcml0eTogMAppbXByZXNzaW9uX2V4cGlyeV9pbl9kYXlzOiAxNQpldmVudF9pbXByZXNzaW9uX2lkOiAxNTQ2MzI2MjM3Nzg0MzY4MDA4OApkZWJ1Z19rZXk6IDQ1MDc1NzUyOTUxNjY5NDgwNjUKaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUFJPRFVDVF9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAyCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fREFURQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICIyMDIzLTEyLTAyIgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9GTE9PRExJR0hUX0NPTkZJR19JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMTE4Mjk5OTUKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fQ09SRV9QTEFURk9STV9TRVJWSUNFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BMQVRGT1JNX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUVVFUllfQ09VTlRSWQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICJVUyIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBQ0VNRU5UX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzODE1NzcyMTQKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0FEVkVSVElTRVJfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDEwNTY0MzE2OTQKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0xJTkVfSVRFTV9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMjA3OTM5MDM1OTAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0NSRUFUSVZFX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiA1MzQ2Njg5NDkKICB9Cn0KYXJjaGV0eXBlX2lkOiAxMgphcmNoZXR5cGVfaWQ6IDEzCmFyY2hldHlwZV9pZDogMTQKYXJjaGV0eXBlX2lkOiAxNQphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vbGVub3ZvLmNvbSIKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL21vdG9yb2xhLmNvbSIKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL21vdG9yb2xhLmNhIgppbXByZXNzaW9uX2V2ZW50X3JlcG9ydGluZ193aW5kb3dfZGF5czogNApicm93c2VyX2F0dHJpYnV0aW9uX2FwaV9yZXF1ZXN0X3Byb2Nlc3NpbmdfYml0czogNzM4MTk3NTA0Cg

Requested by

Host: a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com
URL: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f6.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:02 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0x628fc887529b8c4b0000000000000000","13":"0xade5152a914739770000000000000000","14":"0xdca3b3437e9a09e60000000000000000","15":"0x834a2f227b9243950000000000000000"},"debug_key":"4507575295166948065","debug_reporting":true,"destination":"https://lenovo.com","event_report_window":"345600","expiry":"1296000","filter_data":{"14":[],"21":[],"8":["11829995"]},"priority":"0","source_event_id":"15463262377843680088"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 bootstrap.js Show response
s1.adform.net/stoat/630/s1.adform.net/ Frame 0767 37 KB
17 KB 142ms
26ms Script
text/javascript 37.157.2.249
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/stoat/630/s1.adform.net/bootstrap.js
Requested by: Host: track.adform.net
URL: https://track.adform.net/adfscript/?bn=69707714;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=CjdlzpU5rZbqSF9KLgAfQlIU4tK27rHTAz_OIrxKs-MXv40EQASDJlbCQAWCRBMgBCakChxZyOYpCsj6oAwHIA5sEqgT7AU_Qc7VA5_5eTF2TobZT5fyCensyG-QSA_u82mlcbKPD1yWZk456c8MfY3B1q1TNB2ZH72oRjO4L9hYk2_TzvAb6JrLvQvYgsiRI-3cFOWCN-0AUblsCPHuC6oDO9gSN_l8y4PXPrPX1joEZr4PhQZTLgc7KZimy20fql0uakpFosGVVyiAv6NQJ8Qwh9ovYoskLDlk1Iea_ODMUuiZKwoFlecLU8b4pnt8TZH3uMnTYYJ5kiZSYEUU8nCw8UOCRG_aGSxnUpFlmHHy98v2zFMZcmuBriwIElBwT9iesZYwVnvdM_MrPk-OlcwAEEdQhm6bBK9BHfr-cn6GmwAT-ja2U0wTgBAOIBeaTp7tNkAYBoAZNgAelmqHSA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB0yAqoCOgKAQEi9_cE6WMG4qoaK8YIDgAoDmAsByAsBgAwBogwUKhIKEOS0sQLutbECtbixAru7sQKqDQJOTOINEwit6qqGivGCAxXSBeAKHVBKAQewE4HPyxXQEwDYEwrYFAHQFQH4FgGAFwHoFwE&ae=1&num=1&cid=CAQSTgDICaaNP0g7HbUZgiwzgXnE_r9tvKzpzkvX5lPLHLjYRy_h8ElkYK6TEf-Ap_LKjC1isVDZ-eh8VlaflipnMcNGhVyp4zGKdA3A2wNrOhgB&sig=AOD64_0FIJZ77eZhlP-l1ohc-fPnaziu1Q&client=ca-pub-2264225803283139&dbm_c=AKAmf-BRVSHeWP1HKDZA5mMz7drGl64oZz5rS0XQae3zxAY6loOXe9nAbI-fnennFa1H2yy546qDmju30g3GL1kJVaUtZh6BmNlt9wn2f9wxKdBgQ8Rp2ho3lSufkbG6CPRPkLxD5NatWRwqI4G-GVsQQd167lvfpqgGmnedMcHMbj0To7Vr3cg&cry=1&dbm_d=AKAmf-DBRMc4qKvB-4B3LR0s1qEcS3zrO5CnAgHW4MwmnqGp_uEbTjh_6wKfBHlahmzBDjtTkYle6gWqGHNkNfiINGL6jpUGE_fnK3e00kUf9keyOHudIyCM1vGdLtnbSfxuJiN4-1hOEVRzmbvYnjtcVHixacJxU6110t51lAgGdT4mS6l7ZWUiCiF1SdqTi7yfVFKCOrWW6Hd1mt-j7k7G6qQpbsh4sAFjbT6aorzCTR4OdajoBF9VBI2sFNTa4rFp42A5Ma5R1h3dCx1Pc2FLjcwZzWTspUoH45z7NJyb4NrXcTG79nsswnhGVbHOVyWChw0TA_3khjDunxrfaoy0vTwHj1d7sVxHQvI9x_VMciTeO9ATKWJd71rvYX4G1phidZw1v2_ShzgqHRVMHrAtuHa5Kym5bDtvJwMZ2-YbGbzJqYy9724HW-cZG6sM0fKI51muDNzwgBjL3Fq8Swx0ymwPRggIY3DglJB3hyjxpPmdW56-jjCT4bexAibaKB53cyXxjJjpjbqnXWrG_A2f0iUP5wMPeFzV9DIYByHODoFoppGrMFw&adurl=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.2.249 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: c9b3df2175f6b51e8c7ca74de67d096dad198f28de115078f9332fa3fb379ab5

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 15:35:02 GMT
content-encoding: gzip
last-modified: Fri, 17 Nov 2023 10:42:02 GMT
server: nginx
x-cache-status: UPDATING
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=100000
expires: Sat, 18 Nov 2023 15:27:20 GMT

GET
H2 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 2FBB 38 KB
13 KB 21ms
21ms Document
text/html 142.250.185.129
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.129 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f1.1e100.net

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

accept-ranges: bytes
age: 562582
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 26 Nov 2023 03:18:40 GMT
expires: Mon, 25 Nov 2024 03:18:40 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 collect
region1.google-analytics.com/g/ 0
45 B 19ms
18ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-DBTY2304E3&gtm=45je3bt0v9124146141&_p=1701531300196&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=694195853.1701531301&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EAAI&_s=1&sid=1701531302&sct=1&seg=0&dl=https%3A%2F%2Fkr.buddysecret.com%2F&dt=2023%20%EC%9A%B0%EC%A0%95%20%EB%8B%A4%EC%9D%B4%EC%96%B4%EB%A6%AC!%20%EB%B9%84%EB%B0%80%20%EC%9D%BC%EA%B8%B0%EB%A5%BC%20%EC%9E%91%EC%84%B1%ED%95%98%EB%A0%A4%EB%A9%B4%20%EC%A7%80%EA%B8%88%20%EC%B9%9C%EA%B5%AC%EB%93%A4%EC%9D%84%20%EC%B4%88%EB%8C%80%ED%95%98%EC%84%B8%EC%9A%94.&en=page_view&_fv=1&_ss=1&tfd=4169
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-DBTY2304E3&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:02 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://kr.buddysecret.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 2FBB 39 KB
15 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Fri, 01 Dec 2023 22:12:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 62544
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 30 Nov 2024 22:12:38 GMT

GET
H2 200 / Show response
track.adform.net/adfserve/ Frame 0767 8 KB
4 KB 27ms
27ms Script
text/javascript 37.157.6.243
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/adfserve/?CC=1&bn=69707714;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=CjdlzpU5rZbqSF9KLgAfQlIU4tK27rHTAz_OIrxKs-MXv40EQASDJlbCQAWCRBMgBCakChxZyOYpCsj6oAwHIA5sEqgT7AU_Qc7VA5_5eTF2TobZT5fyCensyG-QSA_u82mlcbKPD1yWZk456c8MfY3B1q1TNB2ZH72oRjO4L9hYk2_TzvAb6JrLvQvYgsiRI-3cFOWCN-0AUblsCPHuC6oDO9gSN_l8y4PXPrPX1joEZr4PhQZTLgc7KZimy20fql0uakpFosGVVyiAv6NQJ8Qwh9ovYoskLDlk1Iea_ODMUuiZKwoFlecLU8b4pnt8TZH3uMnTYYJ5kiZSYEUU8nCw8UOCRG_aGSxnUpFlmHHy98v2zFMZcmuBriwIElBwT9iesZYwVnvdM_MrPk-OlcwAEEdQhm6bBK9BHfr-cn6GmwAT-ja2U0wTgBAOIBeaTp7tNkAYBoAZNgAelmqHSA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB0yAqoCOgKAQEi9_cE6WMG4qoaK8YIDgAoDmAsByAsBgAwBogwUKhIKEOS0sQLutbECtbixAru7sQKqDQJOTOINEwit6qqGivGCAxXSBeAKHVBKAQewE4HPyxXQEwDYEwrYFAHQFQH4FgGAFwHoFwE&ae=1&num=1&cid=CAQSTgDICaaNP0g7HbUZgiwzgXnE_r9tvKzpzkvX5lPLHLjYRy_h8ElkYK6TEf-Ap_LKjC1isVDZ-eh8VlaflipnMcNGhVyp4zGKdA3A2wNrOhgB&sig=AOD64_0FIJZ77eZhlP-l1ohc-fPnaziu1Q&client=ca-pub-2264225803283139&dbm_c=AKAmf-BRVSHeWP1HKDZA5mMz7drGl64oZz5rS0XQae3zxAY6loOXe9nAbI-fnennFa1H2yy546qDmju30g3GL1kJVaUtZh6BmNlt9wn2f9wxKdBgQ8Rp2ho3lSufkbG6CPRPkLxD5NatWRwqI4G-GVsQQd167lvfpqgGmnedMcHMbj0To7Vr3cg&cry=1&dbm_d=AKAmf-DBRMc4qKvB-4B3LR0s1qEcS3zrO5CnAgHW4MwmnqGp_uEbTjh_6wKfBHlahmzBDjtTkYle6gWqGHNkNfiINGL6jpUGE_fnK3e00kUf9keyOHudIyCM1vGdLtnbSfxuJiN4-1hOEVRzmbvYnjtcVHixacJxU6110t51lAgGdT4mS6l7ZWUiCiF1SdqTi7yfVFKCOrWW6Hd1mt-j7k7G6qQpbsh4sAFjbT6aorzCTR4OdajoBF9VBI2sFNTa4rFp42A5Ma5R1h3dCx1Pc2FLjcwZzWTspUoH45z7NJyb4NrXcTG79nsswnhGVbHOVyWChw0TA_3khjDunxrfaoy0vTwHj1d7sVxHQvI9x_VMciTeO9ATKWJd71rvYX4G1phidZw1v2_ShzgqHRVMHrAtuHa5Kym5bDtvJwMZ2-YbGbzJqYy9724HW-cZG6sM0fKI51muDNzwgBjL3Fq8Swx0ymwPRggIY3DglJB3hyjxpPmdW56-jjCT4bexAibaKB53cyXxjJjpjbqnXWrG_A2f0iUP5wMPeFzV9DIYByHODoFoppGrMFw&adurl=;js=1;adfxid=1x;8289;set=en-US|en-US|1600X1200|0|0|0|24|8|3|7|1|;cmpgdpr=;cmpgdprconsent=;cmpgpp=;cmpgpp_sid=;fd=0|0&CREFURL=https%3A%2F%2Fkr.buddysecret.com

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/630/s1.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.243 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

4cb74615b21b09911ec2975ed347598ac7959394967b61b26482663126366e1d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:02 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 3829
expires: -1

GET
H2 200 Standard Show response
s1.adform.net/stoat/630/s1.adform.net/load/v/0.0.236/e/igSBggDQ/i/vCAv.IAAAAAUAA/r:AdConstructor:contents/ImageTag:types/ Frame 0767 85 KB
36 KB 38ms
38ms Script
text/javascript 37.157.2.249
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/stoat/630/s1.adform.net/load/v/0.0.236/e/igSBggDQ/i/vCAv.IAAAAAUAA/r:AdConstructor:contents/ImageTag:types/Standard
Requested by: Host: s1.adform.net
URL: https://s1.adform.net/stoat/630/s1.adform.net/bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.2.249 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: cbe7865410512e11935fb2051abdfc3f1d10dc8936066df03ab42829b1d5f6b3

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 15:35:02 GMT
content-encoding: gzip
last-modified: Fri, 17 Nov 2023 10:42:02 GMT
server: nginx
x-cache-status: STALE
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=100000
expires: Sat, 18 Nov 2023 15:27:21 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
208 B 28ms
28ms XHR
text/plain 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=939562636&t=pageview&_s=1&dl=https%3A%2F%2Fkr.buddysecret.com%2F&ul=en-us&de=UTF-8&dt=2023%20%EC%9A%B0%EC%A0%95%20%EB%8B%A4%EC%9D%B4%EC%96%B4%EB%A6%AC!%20%EB%B9%84%EB%B0%80%20%EC%9D%BC%EA%B8%B0%EB%A5%BC%20%EC%9E%91%EC%84%B1%ED%95%98%EB%A0%A4%EB%A9%B4%20%EC%A7%80%EA%B8%88%20%EC%B9%9C%EA%B5%AC%EB%93%A4%EC%9D%84%20%EC%B4%88%EB%8C%80%ED%95%98%EC%84%B8%EC%9A%94.&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAACAAI~&jid=297749063&gjid=928428841&cid=694195853.1701531301&tid=UA-192512597-12&_gid=1043314589.1701531302&_r=1&gtm=457e3bt0&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&jsscut=1&z=1746876378

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://kr.buddysecret.com/
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:02 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://kr.buddysecret.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
69 B 28ms
28ms XHR
text/plain 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=939562636&t=pageview&_s=1&dl=https%3A%2F%2Fkr.buddysecret.com%2F&ul=en-us&de=UTF-8&dt=2023%20%EC%9A%B0%EC%A0%95%20%EB%8B%A4%EC%9D%B4%EC%96%B4%EB%A6%AC!%20%EB%B9%84%EB%B0%80%20%EC%9D%BC%EA%B8%B0%EB%A5%BC%20%EC%9E%91%EC%84%B1%ED%95%98%EB%A0%A4%EB%A9%B4%20%EC%A7%80%EA%B8%88%20%EC%B9%9C%EA%B5%AC%EB%93%A4%EC%9D%84%20%EC%B4%88%EB%8C%80%ED%95%98%EC%84%B8%EC%9A%94.&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAACAAI~&jid=1761598908&gjid=448415434&cid=694195853.1701531301&tid=UA-126527512-14&_gid=1043314589.1701531302&_r=1&gtm=457e3bt0&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&jsscut=1&z=1758446163

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://kr.buddysecret.com/
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:02 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://kr.buddysecret.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 /
track.adform.net/csimpr/ Frame 0767 35 B
625 B 25ms
25ms Ping
image/gif 37.157.6.243
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/csimpr/?bn=69707714&csi=uSI-jyLqUohN-4j8Ltrzs7wAJGuzqrQu87yLA3Y6YWtruII-PWhzumPHCxkBJWVBdoHVSrP3tpHQqSmIX4ZEN7yOpNDfIsLF0

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/630/s1.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.243 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:02 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET, POST
content-type: image/gif
access-control-allow-origin: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires: -1

GET
H2 200 61437838.jpg
s1.adform.net/Banners/61437838/ Frame 0767 40 KB
41 KB 32ms
32ms Image
image/jpeg 37.157.2.249
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s1.adform.net/Banners/61437838/61437838.jpg?bv=1
Requested by: Host: a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com
URL: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.2.249 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 39d4e15782db1b5f3a3b5330e050d2d1bd20d679ae1d133e07a2543b2e76985e

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 15:35:02 GMT
last-modified: Mon, 20 Nov 2023 10:30:08 GMT
server: nginx
x-amz-request-id: tx000006deabe20e5279187-00656aba16-32959e94-default
etag: "e0b73245fd470b9c3b5784306562d968"
x-cache-status: STALE
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Range,Content-Length
x-rgw-object-type: Normal
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 41440

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
151 B 23ms
22ms XHR
text/plain 173.194.76.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-126527512-14&cid=694195853.1701531301&jid=1761598908&gjid=448415434&_gid=1043314589.1701531302&_u=YADAAUABAAAAACAAI~&z=1153649005

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

173.194.76.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ws-in-f155.1e100.net

Software

Golfe2 /

Resource Hash

122fac0ffbb44fb8bba0388baa11afc67faec3b223a06871a40dbcab4c6cc787

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://kr.buddysecret.com/
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Sat, 02 Dec 2023 15:35:02 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://kr.buddysecret.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
408 B 113ms
64ms Image
image/gif 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-126527512-14&cid=694195853.1701531301&jid=1761598908&_u=YADAAUABAAAAACAAI~&z=513580674

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.nl/ads/ 42 B
107 B 45ms
45ms Image
image/gif 172.217.18.3
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.nl/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-126527512-14&cid=694195853.1701531301&jid=1761598908&_u=YADAAUABAAAAACAAI~&z=513580674

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.3 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra02s19-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2FBB 0
20 B 57ms
57ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BQTIapU5rZYnxPJG99u8PgYqL-A0AAAAAOAHgBAI&bg=!cHOlczzNAAY3kmNgF5I7ADQBe5WfOLCDisvqY6ME5hETZEu0jPbbM31nJo9v9w7E-xvwCzSvOLCm5I1Nhfes16gd6r5JAgAAAElSAAAAAmgBBwoABtwQT8OM65kDC_VDF4bT8nmld4v0gTxcqldORR9ylMOj1lTwjIYfJuZECaJwpijmoKeVIj-Ps1tbSRAPR0-PnYxnvu0TP9m5IMSr3s_8pGPLz0cH8sXf5rDwooRoa9XO9FBJNKQhwqHQ7f1Y9VUNENYKIFb7aEzAk7BZ8rxOEm6spAg9Y6zp5MZt74JTZ4-gXhQ0LFsx7LSXYJRTnE_nBIdnPy3tKEIDGb00edHkSWifZqyOayiL8HFejJfdvp39w8-saZlAhlMlH-sg_VDQAOySydOFdtWsRLWhOBY_ynMggC5LbcRZnuQbARE28DJlyI1GK2VCr4E4--RzqSKHVyzARKD4D6SFF2Q8Gk03oI41YT5pk7er_8llt-eZvqcxjFCM19LH3x_d_g8lhEFF2XNetr-rqnCXicb0C6ACSCW2lFDlbpKwcMakutPc6LMx5OnxzFW_mFgv96-IlZtX4smyCsdONIUkuRN5_DhtaH7MwcE1XnXRW53XgNWxx3XFqFn77x742-vu4Eyme5Wvfw8VLbegSjNF7nRaBIDCSod_UStVJLUDEGZN6tNiAXlMI58nbDljJXg3qdtq3NfqdD9zAO5nyxHyOhvsyJmKpyaS_mf2HiwdKNTfLOtIT34H13VYjFjMrDxjmb_ST2SRoMfu4D74JTub0pzyZ6LR6LOzwEWAfZlGqNoSnfVYnLxPBVENli1TqyQZ0r3E2o4Um26Hc5XJvSdTw2zm_WAi7d_NbZb5ckeC-BSITaSPbDCRjQMhrSuvMTUiLf3b2i8Rlki-nEFPgb8jgq-h3NgGbP6dCdYN5eRx6z1eojBo0m1gueXE8xkF4_t7W914OeDYAWUO7hzx1uw6TD1N9VuXGc2Q9e9fw4sxYhsGgUWxZlsdeFvQOkw6U1EJxfqzz501UQhRYZEZ8CthT-WMC5DI7C1xoZHan9CvoYjTwpLqHhjCJDA_Z63W-0mDV-9LxckIOscfbKBDSWiahVPRkxLpywdyInha3TAH9xRUqjU-a1swlrdw3txCSmU5EQlDMHRyXU8QYuMx

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 a
www.googletagmanager.com/ 0
11 B 38ms
38ms Image
text/html 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-9QKBNZJYL1&v=3&t=t&pid=1849363381&cv=2&rv=3bt0&tc=20&e=gtag.config&eid=3&u=AgAAAAAAAAAAACA&ut=Ag&h=Ag&z=0

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 15:35:02 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame F69E 624 B
242 B 73ms
72ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJyntKMDEM683_cDGJXN-f4BMAE&v=APEucNXjB2aZNbYNrLFqe2XDxL1ivxL_who9x_lPKQwexASEKCG2pBC3f7R6TrnRhYrnvpo7gto1l9wgOuD4F17pGZ1pYH8662JPo7a3FQJn3EoS0Z9F9c9Pa2HwSC31kN83BJjASwXrk31UpUJXQf4v7NJeQsciGa-kdxpos_lq0aFkzR-9ZgU

Requested by

Host: a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com
URL: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sat, 02 Dec 2023 15:35:02 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 9B6B 89 KB
31 KB 88ms
87ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com
URL: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 15:35:02 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Sat, 02 Dec 2023 15:35:02 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9B6B 42 B
63 B 56ms
55ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AylGaTcIPVIKhdc_294vPXdJXI85YKjuZ74kWIqpLIRaTe-oy4SIwxp4EGcKptWwjPl7In7_pMM-7klRilr9LY7Pj5PGDR0rMJxN4hq1OFrVE73u4

Requested by

Host: a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com
URL: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9B6B 0
20 B 57ms
56ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=9527473037510485644&x=1&ct=77

Requested by

Host: a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com
URL: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
track.adform.net/adfscript/ Frame 9B6B 2 KB
3 KB 27ms
26ms Script
text/javascript 37.157.6.243
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/adfscript/?bn=69707714;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=C8u2ypU5rZbuSF9KLgAfQlIU4tK27rHTAz_OIrxKs-MXv40EQASDJlbCQAWCRBMgBCakChxZyOYpCsj6oAwHIA5sEqgT-AU_QQWLAC8lHrZkD5oqa9xs6RflXiV7NnowzJediI5TiqboENGNfYSINAkoP1MgsP7he1Hea6yQfj3X54LmGezb_AZnA7FeB0cKodHVkRA-26WBMKWjaOPQxQwnh9ZWKTIdJiT9IqOZ4Z1olkrS5VUjws2TaDQnIvm2p3H3QvoMd69VCK6v83Xilbsngv10SE3i43YVhGNbLAS2Q-5V6bOM0417xUYQSM2_hJ10vAFj19b4xrTYh7hx6hl7mC9bqiPoz3-OznLCGsaqse9wdjtW0xuwuPZQhQP6CTykLdxzqwVT52H4ZahWYbjIMtWq9PGI5SbNwhS272yqnZ_DlwAT-ja2U0wTgBAOIBeaTp7tNkAYBoAZNgAelmqHSA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB0yAqoCOgKAQEi9_cE6WMG4qoaK8YIDgAoDmAsByAsBgAwBogwUKhIKEOS0sQLutbECtbixAru7sQKqDQJOTOINEwiu6qqGivGCAxXSBeAKHVBKAQewE4HPyxXQEwDYEwrYFAHQFQH4FgGAFwHoFwE&ae=1&num=1&cid=CAQSTgDICaaNP0g7HbUZgiwzgXnE_r9tvKzpzkvX5lPLHLjYRy_h8ElkYK6TEf-Ap_LKjC1isVDZ-eh8VlaflipnMcNGhVyp4zGKdA3A2wNrOhgB&sig=AOD64_02uUjFONLEXqPeztJ95d_e90EH3g&client=ca-pub-2264225803283139&dbm_c=AKAmf-Dr8SazXlBaUzOgM1c4ykMATc24WWIkzAl01ebdLT1-NgAK7B6mu9gWauPcdx7fmmO4_FcwjlH89idDkRaJRIOt_55D9hSmJOkLe_r6SRgEUO3vJZvyk80MweSFem0kDiXkelHt1GxiEmFrgJ7WG6madQBCZc-fxJkuGNLj2SA2NgT7_yI&cry=1&dbm_d=AKAmf-Bir39ugM98LovK_5ugKPMWr5idl_kF8fcMg_HmRRX-9MWhgltHN0Bd_zqAGNtMlLl7xlZokO2zcwXnyRd5p2xxjNG_zsVQgqSUnDDo2a9WFphfBbNka-vocDEdP7EAkB8-UVN0d-qz8g9RgTrH5N3Q0Zc8gmFY9A0MNO7imGOhXaYF407FZLnzcuFGrNSmdWPiWVD3WehdcKJUNkDBDdc_RWpzkhh_zouG4bUCRPIiPeRBwGZD7F-wdkfc54S0oLORHvG0rX3RPMmM5wW1nxRnIgYJgiGC5tz6hieN5mpwOpeL77ehLjvjjide8troi4gBpb0PhPP7D7YVGgEwFEeKOoVk4ZGL0RhI7CNcqjftpSNHjinHyTxtwd5nulpmiomsZ5cZZKI3ViPQR3J9xD_WWRgm4hDrQ93SIg3JGt3JQtYC4gjVTxg7qgbhJBBmQDoW7_Nrn8FtfAW8I-B7iue4Hz-I3AAwUvkxq2ceSqEF_q6SV83yTLjFlYlXfNt-3mjQI_cIAi2orojxlXeE4OrOybFUg8FHNBWOLaqxpoDxQRyy-TU&adurl=

Requested by

Host: a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com
URL: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.243 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

0bd527aed025462fa99887a2e074cb0b5333b90eab31632f9cd921703962a71d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:02 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 2419
expires: -1

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/ Frame 9B6B 3 KB
1 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/window_focus_fy2021.js

Requested by

Host: a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com
URL: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Fri, 01 Dec 2023 22:17:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 62245
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 15 Dec 2023 22:17:37 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/ Frame 9B6B 20 KB
8 KB 23ms
22ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231129/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com
URL: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

09b186dc119230c8ab2c806d31bcc8dd4a0a2ba347165f35156422307b8e10ff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Fri, 01 Dec 2023 20:02:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 70372
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8544
x-xss-protection: 0
server: cafe
etag: 17124069415086231762
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 15 Dec 2023 20:02:10 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9B6B 202 KB
64 KB 51ms
50ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com
URL: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1adb10c9a5878dd4306d66ff94ae27a07cbe47f57b34dec9a807e5d2d426eee0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 15:35:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65067
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701261208926228"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 02 Dec 2023 15:35:02 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame F69E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGtJw-ZN-b-0iHQrqOkJOL0&google_cver=1

43 B
739 B

49ms
49ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGtJw-ZN-b-0iHQrqOkJOL0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJyntKMDEM683_cDGJXN-f4BMAE&v=APEucNXjB2aZNbYNrLFqe2XDxL1ivxL_who9x_lPKQwexASEKCG2pBC3f7R6TrnRhYrnvpo7gto1l9wgOuD4F17pGZ1pYH8662JPo7a3FQJn3EoS0Z9F9c9Pa2HwSC31kN83BJjASwXrk31UpUJXQf4v7NJeQsciGa-kdxpos_lq0aFkzR-9ZgU
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:02 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NdmXqwFFzevYAsTRyAsHQmkdXC2rbqLwmHzypN4mPw%2BoOklZO%2BPXdfqptWI%2BYmJhdTVtEvbDT8Wgg522HlCBMtggrPoqEQ9OpyLu%2F5qIg8%2Bna%2FDzqBwfaKQXOCKAw8laI5hh8KAbu%2FRaYg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 82f4a3331ac45d78-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:02 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGtJw-ZN-b-0iHQrqOkJOL0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame F69E
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZWtOpWsAj6aYWo8VxR5zjAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGtJw-ZN-b-0iHQrqOkJOL0&google_cver=1

43 B
728 B

38ms
38ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGtJw-ZN-b-0iHQrqOkJOL0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJyntKMDEM683_cDGJXN-f4BMAE&v=APEucNXjB2aZNbYNrLFqe2XDxL1ivxL_who9x_lPKQwexASEKCG2pBC3f7R6TrnRhYrnvpo7gto1l9wgOuD4F17pGZ1pYH8662JPo7a3FQJn3EoS0Z9F9c9Pa2HwSC31kN83BJjASwXrk31UpUJXQf4v7NJeQsciGa-kdxpos_lq0aFkzR-9ZgU
Protocol: H3
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:02 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=451MnkxzIbUW1ECBqLRaz7XAsCl6eXlk1sh5yW8Du4lPiC2G67hEvXK6oGqBxyuPmtfIOCpM5J5EhIGycn9Sbszgs9c5dmLxI8leGKO8fwG025geRfDDdTwGJWdsZq1O9d2HhheJlD%2FxWA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 82f4a3335b085d78-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:02 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGtJw-ZN-b-0iHQrqOkJOL0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame F69E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEHESeJcfukutgFLHdzSOAwc&google_cver=1

43 B
844 B

15ms
15ms

Image
image/gif

185.89.210.212
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEHESeJcfukutgFLHdzSOAwc&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJyntKMDEM683_cDGJXN-f4BMAE&v=APEucNXjB2aZNbYNrLFqe2XDxL1ivxL_who9x_lPKQwexASEKCG2pBC3f7R6TrnRhYrnvpo7gto1l9wgOuD4F17pGZ1pYH8662JPo7a3FQJn3EoS0Z9F9c9Pa2HwSC31kN83BJjASwXrk31UpUJXQf4v7NJeQsciGa-kdxpos_lq0aFkzR-9ZgU

Protocol

Server

185.89.210.212 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:02 GMT
an-x-request-uuid: f3308b08-e515-4090-b66e-07856abfe479
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 95.211.199.151; 95.211.199.151; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:02 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEHESeJcfukutgFLHdzSOAwc&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F69E
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTI4MDg3Mjc5Mjc0MzE5MjY1MQ%3D%3D

170 B
188 B

30ms
30ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTI4MDg3Mjc5Mjc0MzE5MjY1MQ%3D%3D

Requested by

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f194.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:02 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:02 GMT
an-x-request-uuid: c61d302c-f658-4480-9a16-b6279faee523
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTI4MDg3Mjc5Mjc0MzE5MjY1MQ%3D%3D
x-proxy-origin: 95.211.199.151; 95.211.199.151; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9B6B 0
20 B 55ms
55ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=2909595742230&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:03 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9B6B 0
20 B 55ms
54ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=2909595742230&version=m202309260101&ct=77&x=1&cor=9527473037510486000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:03 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 9B6B 34 KB
19 KB 66ms
66ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Ap2dWJitC9PxXAuVqaUJvl32gM5VkPfQDXsJC6NpHBo1w-0ciDzE43bvD-rSmZqqJj302svCoVIHM3UOYl8PK-jjohGf6OqPcMGZVVL_dAfdi0qbJ83N6DERJJuqEUPf10BP78EkukSGX03IsWnYtm0Yo7ZtQhE8sliay7fWV4SS7P0dE&cry=1&dbm_d=AKAmf-ABhscH9EreFJMHS41YNgJDL2DtMU5hSIQ1a_MMDI6nl_v6sHhf56OweyMv35f7MP-1eyzaTPVZuf4ZWaMUDV5_o7vx63QDYnbwJn3SEMRIc2zpPAMzP21_GjeF7mTFI_BLCiVE8QVdTmsnLPOJuyNw064A_8q3aAZJLE3c_FJz3sVPpIPsLHONjIaOV6pxl8vK4NreAc17W4cqnEplgtplhZZX5K6NAXPXx_eHdnwawN1wurGeuWSON9VOUD3jKvDyIcp6NKxCMOMD30SWkyP1jhCnOSnldPIfrsl-J236xq19tpad9tHsj76Z6Z6-Kg2Z4F7UerqmsqG2ws5y4Vi05WhQQV3o5Wh0Qs_qppZ9IThbHiNSI8Jzf-VVWsjEKxwf6yF1eppi1pWCLdgX14_6NrDEGeArbeKQTLuCUW9YLPyFCH1sH6m6qw3enB8FuM0wPl0TFYnFNnoQSf_Bn8wkfy46-UP_SL8ku4dZy6d0ET86nXjuHTcuTUwZ6C2EyanY8c4ciGpiyTbAX_GLS3qfRFMEjtNqDWN9WDb0rWiS5U_5qMSi7uN3Hrt544l48qjFiRw2fMbXBeVS7yOcN8AlFx51SjTwwWmBx_yn8MRLrjwwt6FgYecEClVkcDBMG2oPt6QCVw0w7bTIMvF-f7eha3RoG6nf68LsMtMNaeeFuU327fjaGx8se13P9yMfWErJ_1GdKWDg5xUydHeyssw54pn2fAaS97jK-iuXnZtz7Em2Vqqmo7HzULCTCJwXd5-zvG_2nT3D5h_i53Tnz3d0KsPbI0UjX5YSk7LMIZt8JdZoW31QbBuX3IG2TxupCISJMvn9eZVM5OkUND1SzB_Wj7cc-JNBBRbbYseCUP9pbCCjnk4m1p0bGvqVfImvVBxY2BBJ2Y6PtRH-pXRpry3olw07aSH9Q2wPIg4CxrHHK7HtSuPJpVWBSHoGuOQseoBZuBjcsA9sPa6fuWImji3zIcJsbPlBkBKBcwYpLlixVU-E4dkp2qhELbimEphAidr7ti_SRx03w9SQv4_uy8z_boDcpGvEGAJ1n-Iay-ACPANW6sVjMz-bj9PKeHhWkhxAzTNW0bH_GkxKVgOAv0WNWvP0d2aZD9f6i84T0yjOSDP-aPecYhzt-ecj-zoE8lOBZJn9c394a1TlsiwdV_6Ss8JO_VYMrVYEpYbX206_gxQDE_7CKCwQn5Pak8pCE7CeZQeAu-fEb0L2FO6Nu1bCjA4_TwSSJ1XCedzt2xbJuUVVtiJlaeD8Shhtt1wWk9_yEO6e03kaQJvaTzpQ7F1tn2c368LuhUdCkZWjZJ8Zwfw0wOE7N19AJsAZBz2mlw6aDpFtr3vROeq1TOIc6hvowQRXsrpK0q4WrYxKS0lTNSYnho7I9cqTg1Yq2CuJEwKqjNUjOjgseNhcf_O-7_xC4s5g3KiP9gHpk764TRSlCXZwdY5gqk9wRySgK5Rfs4_-l2v0rgI9t8R4FbSO04r2TQZXzF5HSVYRzuIUmKvlQMwS2-Ml3s0Skoxi3Scjo44Wrz2HuEhPd3_TDA9AO9L2oDVXiqmfX7WEsz4EctoQ4idwSSZia_aPVdfhklYTlITkSxSMttLtclgG68hwXd6MsKaHDJkjEl9SUGXKG0eAXc-Jz8ZxzLrkoY3xusdk56FoqL23QEkLtw4eGYNotxDKe3Gb9LlTMNcUzsgCOuyd_FMwznUjO0zpWiiZdoJJH-KPrmbRAYqFMl0My_sI5pKDs9OIgHg5P4TnqXwesfvXOhryYy1p7e0IcnT1ubvpuLO-8VOTA0ncNy9lz6FbrYB2mhD3sl05CRARWoLGLVPu_T5c30cWQHtTQ3ZaUPt2clFOBcYA4QLWVVNH0a8Pj5Q4SRFfmKSCj5q-cWkZ56sWNfKldgswi3AfMRCOWJxrWDjcPaXPwYAnBE_E16LEaycjEs_I2senUAVv9Dl_hjuyiR4_j8h-xQqYBLvpvGPRNy7GNMAYpbqUvmo40BVTOGE8WSmnXgpylrOIPoOIHdGb_cOt2IS25n3SHtJhcnrMU5ZJPNs2ieRExD2iU6YQKvyAiCGCNAbu1rQY2fNutVUbFDRrgSuH-AbwrXZoBfoddvaX5cXKSRQhMlAfoxT8AgEvn9UE-tf4hm8ONkhRtp9XKj61R2tDGc9ZLCTOSxFhDSkEA6JTwxYYGMWoTatgKN2x8V1_XlvP9dd7JNkm-gX5iRcfWa4cPyGEk1UMK-OgPyAifBwXxN_A1tmAa91_ClazcK0iSEyTB2Mw4EH69FngtKjP5nZxKOiy-A2sxYCD5aH9xaEQKQVVe4IQ6fSfGw1L_Jqguo3y5g1udQcWzkb47hBjfpbZ9YBd8-WG4CDVjkVW0fAL8bHsbMB8hGMmo9RNr-CBEEXoXLUN218GdurfwSsPZwJWR9hcIR93EOwWB3DOWqUkfz6MJGMdpMYb317EfDd6ZIzWNjLZCcSbzfpm-6jVmkSNJwKkAw4QmdgKFkpjLQ8j13WgHkvvO6QSWjg6nJ43MZulty2Mr_LPp3FvDFukc8x7kB1AMrghm0zE5UNNQMkeqrK_0xj9WU3R_lDk-gA7_mbsQ_eY8U8czn_iYIpwOxBJ7lCRb1N0VxdU7R6IX5D2cxqSAdseMgOwnxPq4ZAAdmFmLJ5G_PaI6b_kmLMLQPXiLBBcok72Qcy3Ga40dcZaMwEB87sfv9CzbAtNs55-EwYAQDBUclpsGZJGtcvHQsdsDDNnDxHI0ekMm8tY6RjgSQa_GxDJYWyIrwWxD6hP1pkDdz3wSEJZt1e3HcRmZ5IwylifjnFWqUzXiFeaTFRx4Tygyo2ex-ZfmquYoNjLjYxLHUA_tDsD-nd-c7PhHHYYfOFUO9buwtW7rJSc_KpFPdms3BFm_1rulNDuVG1aBd79RRcmwzaanMT85YYjCxpUQ8-1LFrnCKfwWEpr2ZysG7KMkrfPYJdZhympTNYFXe5ighS8a1qoBfWAqZaZ37Ys9YkhHiwJyU6y4nlOniWFDkgvclTMMlBg95xA3AGG2u0bHQFeYPY9Ah6WIZfWXTknTzJmxUboG6LO6jw9rmzDvnVaMwlU90pvTG2Bn-QuWE80SOFnN0NotkGAcF_8hP3JyFfMsRNeR5XJYuMBBNowrSHu32qwvbqe3J3Ti4QfSl1ifAgnwv9BT5T1zoWifk8N_TujEZ7eQkD9uip0xacO0Ex_xLiJZwHGry3iSye0bRE4anm7bfgf9QCdbZ0CNIdIgnEWJ5JRQtne7wXNcflPnhBalHcpoprUV9JdOQ7xCVU-z2Wk9LgTtMymxF_L5Lkwhti1tSkLnFbItglx64_6hBGzCrBpRIcofZnqVh2O01I7v0kDs9RPigr8dijQj3dpWsDiSXb97Ai-p97eidWLDel9D2yZSkDClzO2wcwofn1mehAXYW12cP_MoELUI1AigWMCBaAK5XuSI0AaUAKaeNZBVyMJruySRUid8MQCtPZtty_ggAFiAhVNNxf6zk4gcn5njdtSvIaLXesUW_dB8oedjXME0VAvF94Y34RUpeAuXmCTPfHTn2RJV8fjBqeVS5BdcComqMJf6PhHkw6_lqJAmdsc9Vgdw4F1Jtehk8i2fBScdSRarFZD0ks--rltEaXaTcusgjn94JK-ttvHHOs-w2DK2q79z4mC3MXEPfhrC4QFRFgZxPBcMr2Mhz_gEHErCaWvntaD9GN3oZ05kuKdapl5rmyPyvpaWr5Yn_-zZxkPa5EDZLScjUvfj13RKRaJz5Sr_DBuLPvYjC0Yklco_BOcnInjTebn-l4Bfsvx6qXaRsz9y1iG4Ygn0i68Y2i0tZaUx7eWaihZ6XPK7nDIVMrNffBJthsx3GkSnOZcILq7oJZTN6rNmGkXgPTC46OGxGzTMzJ20UIYgcdS113jy5Ajh88krHdMsKRoVL9_qc_ks4ysHAk-a39ZADi9FpL51BM_0cVkuUvuLNF-fnlJlDUqRSNeEK8ybdHVqjOzRxAM3VwsCvcB-FCtUY3o27YsYAJfzaoWzSZyHXgknVd3akq2n2Fh2wdoqdgjV7F4RRECFrHesgt9BVrurPMHIEAVs2UhrA0W4OKUCBRQlvM17gwmkrhXFaiQrYR3wBuWEIEEzKg4a6mkCMFqu1YEIDK_jEG3pxse1tMWz4tjKUAEC4HBxbEbFY7WOCwvJ4fJLh7y74EotPbRVcS7dJ0h6ldJp-rfmnjuJwZsCVo9ryJdy3Op3MCQRdy-FKIL45lAzQykWQVfmbcd6hXEhAZkJpizEPp4y_-2YnyasHnJXEz9kkqGEm3Xhd-yKhui3j0teXK0jac0OeXmDZihNDON0b3KajfLw9mPbdk-Kgu46tx3lCYQkuAnGp-muYAo7rA3whBJIWYVRfXUSpiaryjQJ1xnATqEnztN1lxj6DmjdRGsqY7LKlXqruguhFlzC9PZGzL9ZFckvDURLcK4ptjd99riGG3AVQvdEAVixPwY&cid=CAQSTgDICaaNP0g7HbUZgiwzgXnE_r9tvKzpzkvX5lPLHLjYRy_h8ElkYK6TEf-Ap_LKjC1isVDZ-eh8VlaflipnMcNGhVyp4zGKdA3A2wNrOhgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fkr.buddysecret.com%2F&ds=l&xdt=1&iif=1&cor=9527473037510486000&adk=1964084972&idt=213&cac=0&dtd=7

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ce4915a3f3e8fb84cea5856ce7dabe5a765fb2df7aa8feeef1633cfb411363e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:03 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19882
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231129/r20110914/ Frame 9B6B 31 KB
12 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231129/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Ap2dWJitC9PxXAuVqaUJvl32gM5VkPfQDXsJC6NpHBo1w-0ciDzE43bvD-rSmZqqJj302svCoVIHM3UOYl8PK-jjohGf6OqPcMGZVVL_dAfdi0qbJ83N6DERJJuqEUPf10BP78EkukSGX03IsWnYtm0Yo7ZtQhE8sliay7fWV4SS7P0dE&cry=1&dbm_d=AKAmf-ABhscH9EreFJMHS41YNgJDL2DtMU5hSIQ1a_MMDI6nl_v6sHhf56OweyMv35f7MP-1eyzaTPVZuf4ZWaMUDV5_o7vx63QDYnbwJn3SEMRIc2zpPAMzP21_GjeF7mTFI_BLCiVE8QVdTmsnLPOJuyNw064A_8q3aAZJLE3c_FJz3sVPpIPsLHONjIaOV6pxl8vK4NreAc17W4cqnEplgtplhZZX5K6NAXPXx_eHdnwawN1wurGeuWSON9VOUD3jKvDyIcp6NKxCMOMD30SWkyP1jhCnOSnldPIfrsl-J236xq19tpad9tHsj76Z6Z6-Kg2Z4F7UerqmsqG2ws5y4Vi05WhQQV3o5Wh0Qs_qppZ9IThbHiNSI8Jzf-VVWsjEKxwf6yF1eppi1pWCLdgX14_6NrDEGeArbeKQTLuCUW9YLPyFCH1sH6m6qw3enB8FuM0wPl0TFYnFNnoQSf_Bn8wkfy46-UP_SL8ku4dZy6d0ET86nXjuHTcuTUwZ6C2EyanY8c4ciGpiyTbAX_GLS3qfRFMEjtNqDWN9WDb0rWiS5U_5qMSi7uN3Hrt544l48qjFiRw2fMbXBeVS7yOcN8AlFx51SjTwwWmBx_yn8MRLrjwwt6FgYecEClVkcDBMG2oPt6QCVw0w7bTIMvF-f7eha3RoG6nf68LsMtMNaeeFuU327fjaGx8se13P9yMfWErJ_1GdKWDg5xUydHeyssw54pn2fAaS97jK-iuXnZtz7Em2Vqqmo7HzULCTCJwXd5-zvG_2nT3D5h_i53Tnz3d0KsPbI0UjX5YSk7LMIZt8JdZoW31QbBuX3IG2TxupCISJMvn9eZVM5OkUND1SzB_Wj7cc-JNBBRbbYseCUP9pbCCjnk4m1p0bGvqVfImvVBxY2BBJ2Y6PtRH-pXRpry3olw07aSH9Q2wPIg4CxrHHK7HtSuPJpVWBSHoGuOQseoBZuBjcsA9sPa6fuWImji3zIcJsbPlBkBKBcwYpLlixVU-E4dkp2qhELbimEphAidr7ti_SRx03w9SQv4_uy8z_boDcpGvEGAJ1n-Iay-ACPANW6sVjMz-bj9PKeHhWkhxAzTNW0bH_GkxKVgOAv0WNWvP0d2aZD9f6i84T0yjOSDP-aPecYhzt-ecj-zoE8lOBZJn9c394a1TlsiwdV_6Ss8JO_VYMrVYEpYbX206_gxQDE_7CKCwQn5Pak8pCE7CeZQeAu-fEb0L2FO6Nu1bCjA4_TwSSJ1XCedzt2xbJuUVVtiJlaeD8Shhtt1wWk9_yEO6e03kaQJvaTzpQ7F1tn2c368LuhUdCkZWjZJ8Zwfw0wOE7N19AJsAZBz2mlw6aDpFtr3vROeq1TOIc6hvowQRXsrpK0q4WrYxKS0lTNSYnho7I9cqTg1Yq2CuJEwKqjNUjOjgseNhcf_O-7_xC4s5g3KiP9gHpk764TRSlCXZwdY5gqk9wRySgK5Rfs4_-l2v0rgI9t8R4FbSO04r2TQZXzF5HSVYRzuIUmKvlQMwS2-Ml3s0Skoxi3Scjo44Wrz2HuEhPd3_TDA9AO9L2oDVXiqmfX7WEsz4EctoQ4idwSSZia_aPVdfhklYTlITkSxSMttLtclgG68hwXd6MsKaHDJkjEl9SUGXKG0eAXc-Jz8ZxzLrkoY3xusdk56FoqL23QEkLtw4eGYNotxDKe3Gb9LlTMNcUzsgCOuyd_FMwznUjO0zpWiiZdoJJH-KPrmbRAYqFMl0My_sI5pKDs9OIgHg5P4TnqXwesfvXOhryYy1p7e0IcnT1ubvpuLO-8VOTA0ncNy9lz6FbrYB2mhD3sl05CRARWoLGLVPu_T5c30cWQHtTQ3ZaUPt2clFOBcYA4QLWVVNH0a8Pj5Q4SRFfmKSCj5q-cWkZ56sWNfKldgswi3AfMRCOWJxrWDjcPaXPwYAnBE_E16LEaycjEs_I2senUAVv9Dl_hjuyiR4_j8h-xQqYBLvpvGPRNy7GNMAYpbqUvmo40BVTOGE8WSmnXgpylrOIPoOIHdGb_cOt2IS25n3SHtJhcnrMU5ZJPNs2ieRExD2iU6YQKvyAiCGCNAbu1rQY2fNutVUbFDRrgSuH-AbwrXZoBfoddvaX5cXKSRQhMlAfoxT8AgEvn9UE-tf4hm8ONkhRtp9XKj61R2tDGc9ZLCTOSxFhDSkEA6JTwxYYGMWoTatgKN2x8V1_XlvP9dd7JNkm-gX5iRcfWa4cPyGEk1UMK-OgPyAifBwXxN_A1tmAa91_ClazcK0iSEyTB2Mw4EH69FngtKjP5nZxKOiy-A2sxYCD5aH9xaEQKQVVe4IQ6fSfGw1L_Jqguo3y5g1udQcWzkb47hBjfpbZ9YBd8-WG4CDVjkVW0fAL8bHsbMB8hGMmo9RNr-CBEEXoXLUN218GdurfwSsPZwJWR9hcIR93EOwWB3DOWqUkfz6MJGMdpMYb317EfDd6ZIzWNjLZCcSbzfpm-6jVmkSNJwKkAw4QmdgKFkpjLQ8j13WgHkvvO6QSWjg6nJ43MZulty2Mr_LPp3FvDFukc8x7kB1AMrghm0zE5UNNQMkeqrK_0xj9WU3R_lDk-gA7_mbsQ_eY8U8czn_iYIpwOxBJ7lCRb1N0VxdU7R6IX5D2cxqSAdseMgOwnxPq4ZAAdmFmLJ5G_PaI6b_kmLMLQPXiLBBcok72Qcy3Ga40dcZaMwEB87sfv9CzbAtNs55-EwYAQDBUclpsGZJGtcvHQsdsDDNnDxHI0ekMm8tY6RjgSQa_GxDJYWyIrwWxD6hP1pkDdz3wSEJZt1e3HcRmZ5IwylifjnFWqUzXiFeaTFRx4Tygyo2ex-ZfmquYoNjLjYxLHUA_tDsD-nd-c7PhHHYYfOFUO9buwtW7rJSc_KpFPdms3BFm_1rulNDuVG1aBd79RRcmwzaanMT85YYjCxpUQ8-1LFrnCKfwWEpr2ZysG7KMkrfPYJdZhympTNYFXe5ighS8a1qoBfWAqZaZ37Ys9YkhHiwJyU6y4nlOniWFDkgvclTMMlBg95xA3AGG2u0bHQFeYPY9Ah6WIZfWXTknTzJmxUboG6LO6jw9rmzDvnVaMwlU90pvTG2Bn-QuWE80SOFnN0NotkGAcF_8hP3JyFfMsRNeR5XJYuMBBNowrSHu32qwvbqe3J3Ti4QfSl1ifAgnwv9BT5T1zoWifk8N_TujEZ7eQkD9uip0xacO0Ex_xLiJZwHGry3iSye0bRE4anm7bfgf9QCdbZ0CNIdIgnEWJ5JRQtne7wXNcflPnhBalHcpoprUV9JdOQ7xCVU-z2Wk9LgTtMymxF_L5Lkwhti1tSkLnFbItglx64_6hBGzCrBpRIcofZnqVh2O01I7v0kDs9RPigr8dijQj3dpWsDiSXb97Ai-p97eidWLDel9D2yZSkDClzO2wcwofn1mehAXYW12cP_MoELUI1AigWMCBaAK5XuSI0AaUAKaeNZBVyMJruySRUid8MQCtPZtty_ggAFiAhVNNxf6zk4gcn5njdtSvIaLXesUW_dB8oedjXME0VAvF94Y34RUpeAuXmCTPfHTn2RJV8fjBqeVS5BdcComqMJf6PhHkw6_lqJAmdsc9Vgdw4F1Jtehk8i2fBScdSRarFZD0ks--rltEaXaTcusgjn94JK-ttvHHOs-w2DK2q79z4mC3MXEPfhrC4QFRFgZxPBcMr2Mhz_gEHErCaWvntaD9GN3oZ05kuKdapl5rmyPyvpaWr5Yn_-zZxkPa5EDZLScjUvfj13RKRaJz5Sr_DBuLPvYjC0Yklco_BOcnInjTebn-l4Bfsvx6qXaRsz9y1iG4Ygn0i68Y2i0tZaUx7eWaihZ6XPK7nDIVMrNffBJthsx3GkSnOZcILq7oJZTN6rNmGkXgPTC46OGxGzTMzJ20UIYgcdS113jy5Ajh88krHdMsKRoVL9_qc_ks4ysHAk-a39ZADi9FpL51BM_0cVkuUvuLNF-fnlJlDUqRSNeEK8ybdHVqjOzRxAM3VwsCvcB-FCtUY3o27YsYAJfzaoWzSZyHXgknVd3akq2n2Fh2wdoqdgjV7F4RRECFrHesgt9BVrurPMHIEAVs2UhrA0W4OKUCBRQlvM17gwmkrhXFaiQrYR3wBuWEIEEzKg4a6mkCMFqu1YEIDK_jEG3pxse1tMWz4tjKUAEC4HBxbEbFY7WOCwvJ4fJLh7y74EotPbRVcS7dJ0h6ldJp-rfmnjuJwZsCVo9ryJdy3Op3MCQRdy-FKIL45lAzQykWQVfmbcd6hXEhAZkJpizEPp4y_-2YnyasHnJXEz9kkqGEm3Xhd-yKhui3j0teXK0jac0OeXmDZihNDON0b3KajfLw9mPbdk-Kgu46tx3lCYQkuAnGp-muYAo7rA3whBJIWYVRfXUSpiaryjQJ1xnATqEnztN1lxj6DmjdRGsqY7LKlXqruguhFlzC9PZGzL9ZFckvDURLcK4ptjd99riGG3AVQvdEAVixPwY&cid=CAQSTgDICaaNP0g7HbUZgiwzgXnE_r9tvKzpzkvX5lPLHLjYRy_h8ElkYK6TEf-Ap_LKjC1isVDZ-eh8VlaflipnMcNGhVyp4zGKdA3A2wNrOhgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fkr.buddysecret.com%2F&ds=l&xdt=1&iif=1&cor=9527473037510486000&adk=1964084972&idt=213&cac=0&dtd=7

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

43c9555701d17579571d962cfee37868f4769995820a96abf451623b0528c92c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Fri, 01 Dec 2023 23:19:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 58514
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11894
x-xss-protection: 0
server: cafe
etag: 8278194740845609983
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 15 Dec 2023 23:19:49 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 9B6B 41 KB
14 KB 42ms
42ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Fri, 01 Dec 2023 18:05:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 77395
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 30 Nov 2024 18:05:08 GMT

GET
H2 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMTUzMTMwMzAxODMyNgogIHNlcnZlcl9pcDogMTgyNDY3MTUxCiAgcHJvY2Vzc19pZDogMTg0NjM2MzI1MAp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTgyOTk5...
ad.doubleclick.net/ddm/activity/ Frame 9B6B 0
502 B 59ms
59ms Image
image/png 172.217.16.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMTUzMTMwMzAxODMyNgogIHNlcnZlcl9pcDogMTgyNDY3MTUxCiAgcHJvY2Vzc19pZDogMTg0NjM2MzI1MAp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTgyOTk5NQphZHZlcnRpc2VyX2RvbWFpbjogImh0dHBzOi8vbGVub3ZvLmNvbSIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IFZJRVcKaW1wcmVzc2lvbl9wcmlvcml0eTogMAppbXByZXNzaW9uX2V4cGlyeV9pbl9kYXlzOiAxNQpldmVudF9pbXByZXNzaW9uX2lkOiA3MzY3ODc5NzczNzMwMjY0NTA4CmRlYnVnX2tleTogMTA5MDQ0MDMyNzA4NTc0ODg2NTQKaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUFJPRFVDVF9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAyCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fREFURQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICIyMDIzLTEyLTAyIgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9GTE9PRExJR0hUX0NPTkZJR19JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMTE4Mjk5OTUKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fQ09SRV9QTEFURk9STV9TRVJWSUNFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BMQVRGT1JNX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUVVFUllfQ09VTlRSWQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICJVUyIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBQ0VNRU5UX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzODE1NzcyMTQKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0FEVkVSVElTRVJfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDEwNTY0MzE2OTQKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0xJTkVfSVRFTV9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMjA3OTM5MDM1OTAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0NSRUFUSVZFX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiA1MzQ2Njg5NDkKICB9Cn0KYXJjaGV0eXBlX2lkOiAxMgphcmNoZXR5cGVfaWQ6IDEzCmFyY2hldHlwZV9pZDogMTQKYXJjaGV0eXBlX2lkOiAxNQphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vbGVub3ZvLmNvbSIKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL21vdG9yb2xhLmNvbSIKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL21vdG9yb2xhLmNhIgppbXByZXNzaW9uX2V2ZW50X3JlcG9ydGluZ193aW5kb3dfZGF5czogNApicm93c2VyX2F0dHJpYnV0aW9uX2FwaV9yZXF1ZXN0X3Byb2Nlc3NpbmdfYml0czogNzM4MTk3NTA0Cg

Requested by

Host: a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com
URL: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f6.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:03 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0x628fc887529b8c4b0000000000000000","13":"0xade5152a914739770000000000000000","14":"0xdca3b3437e9a09e60000000000000000","15":"0x834a2f227b9243950000000000000000"},"debug_key":"10904403270857488654","debug_reporting":true,"destination":"https://lenovo.com","event_report_window":"345600","expiry":"1296000","filter_data":{"14":[],"21":[],"8":["11829995"]},"priority":"0","source_event_id":"7367879773730264508"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 bootstrap.js Show response
s1.adform.net/stoat/630/s1.adform.net/ Frame 9B6B 37 KB
17 KB 33ms
33ms Script
text/javascript 37.157.2.249
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/stoat/630/s1.adform.net/bootstrap.js
Requested by: Host: track.adform.net
URL: https://track.adform.net/adfscript/?bn=69707714;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=C8u2ypU5rZbuSF9KLgAfQlIU4tK27rHTAz_OIrxKs-MXv40EQASDJlbCQAWCRBMgBCakChxZyOYpCsj6oAwHIA5sEqgT-AU_QQWLAC8lHrZkD5oqa9xs6RflXiV7NnowzJediI5TiqboENGNfYSINAkoP1MgsP7he1Hea6yQfj3X54LmGezb_AZnA7FeB0cKodHVkRA-26WBMKWjaOPQxQwnh9ZWKTIdJiT9IqOZ4Z1olkrS5VUjws2TaDQnIvm2p3H3QvoMd69VCK6v83Xilbsngv10SE3i43YVhGNbLAS2Q-5V6bOM0417xUYQSM2_hJ10vAFj19b4xrTYh7hx6hl7mC9bqiPoz3-OznLCGsaqse9wdjtW0xuwuPZQhQP6CTykLdxzqwVT52H4ZahWYbjIMtWq9PGI5SbNwhS272yqnZ_DlwAT-ja2U0wTgBAOIBeaTp7tNkAYBoAZNgAelmqHSA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB0yAqoCOgKAQEi9_cE6WMG4qoaK8YIDgAoDmAsByAsBgAwBogwUKhIKEOS0sQLutbECtbixAru7sQKqDQJOTOINEwiu6qqGivGCAxXSBeAKHVBKAQewE4HPyxXQEwDYEwrYFAHQFQH4FgGAFwHoFwE&ae=1&num=1&cid=CAQSTgDICaaNP0g7HbUZgiwzgXnE_r9tvKzpzkvX5lPLHLjYRy_h8ElkYK6TEf-Ap_LKjC1isVDZ-eh8VlaflipnMcNGhVyp4zGKdA3A2wNrOhgB&sig=AOD64_02uUjFONLEXqPeztJ95d_e90EH3g&client=ca-pub-2264225803283139&dbm_c=AKAmf-Dr8SazXlBaUzOgM1c4ykMATc24WWIkzAl01ebdLT1-NgAK7B6mu9gWauPcdx7fmmO4_FcwjlH89idDkRaJRIOt_55D9hSmJOkLe_r6SRgEUO3vJZvyk80MweSFem0kDiXkelHt1GxiEmFrgJ7WG6madQBCZc-fxJkuGNLj2SA2NgT7_yI&cry=1&dbm_d=AKAmf-Bir39ugM98LovK_5ugKPMWr5idl_kF8fcMg_HmRRX-9MWhgltHN0Bd_zqAGNtMlLl7xlZokO2zcwXnyRd5p2xxjNG_zsVQgqSUnDDo2a9WFphfBbNka-vocDEdP7EAkB8-UVN0d-qz8g9RgTrH5N3Q0Zc8gmFY9A0MNO7imGOhXaYF407FZLnzcuFGrNSmdWPiWVD3WehdcKJUNkDBDdc_RWpzkhh_zouG4bUCRPIiPeRBwGZD7F-wdkfc54S0oLORHvG0rX3RPMmM5wW1nxRnIgYJgiGC5tz6hieN5mpwOpeL77ehLjvjjide8troi4gBpb0PhPP7D7YVGgEwFEeKOoVk4ZGL0RhI7CNcqjftpSNHjinHyTxtwd5nulpmiomsZ5cZZKI3ViPQR3J9xD_WWRgm4hDrQ93SIg3JGt3JQtYC4gjVTxg7qgbhJBBmQDoW7_Nrn8FtfAW8I-B7iue4Hz-I3AAwUvkxq2ceSqEF_q6SV83yTLjFlYlXfNt-3mjQI_cIAi2orojxlXeE4OrOybFUg8FHNBWOLaqxpoDxQRyy-TU&adurl=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.2.249 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: c9b3df2175f6b51e8c7ca74de67d096dad198f28de115078f9332fa3fb379ab5

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 15:35:03 GMT
content-encoding: gzip
last-modified: Fri, 17 Nov 2023 10:42:02 GMT
server: nginx
x-cache-status: STALE
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=100000
expires: Sat, 18 Nov 2023 15:27:20 GMT

GET
H2 200 / Show response
track.adform.net/adfserve/ Frame 9B6B 8 KB
4 KB 27ms
27ms Script
text/javascript 37.157.6.243
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/adfserve/?bn=69707714;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=C8u2ypU5rZbuSF9KLgAfQlIU4tK27rHTAz_OIrxKs-MXv40EQASDJlbCQAWCRBMgBCakChxZyOYpCsj6oAwHIA5sEqgT-AU_QQWLAC8lHrZkD5oqa9xs6RflXiV7NnowzJediI5TiqboENGNfYSINAkoP1MgsP7he1Hea6yQfj3X54LmGezb_AZnA7FeB0cKodHVkRA-26WBMKWjaOPQxQwnh9ZWKTIdJiT9IqOZ4Z1olkrS5VUjws2TaDQnIvm2p3H3QvoMd69VCK6v83Xilbsngv10SE3i43YVhGNbLAS2Q-5V6bOM0417xUYQSM2_hJ10vAFj19b4xrTYh7hx6hl7mC9bqiPoz3-OznLCGsaqse9wdjtW0xuwuPZQhQP6CTykLdxzqwVT52H4ZahWYbjIMtWq9PGI5SbNwhS272yqnZ_DlwAT-ja2U0wTgBAOIBeaTp7tNkAYBoAZNgAelmqHSA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB0yAqoCOgKAQEi9_cE6WMG4qoaK8YIDgAoDmAsByAsBgAwBogwUKhIKEOS0sQLutbECtbixAru7sQKqDQJOTOINEwiu6qqGivGCAxXSBeAKHVBKAQewE4HPyxXQEwDYEwrYFAHQFQH4FgGAFwHoFwE&ae=1&num=1&cid=CAQSTgDICaaNP0g7HbUZgiwzgXnE_r9tvKzpzkvX5lPLHLjYRy_h8ElkYK6TEf-Ap_LKjC1isVDZ-eh8VlaflipnMcNGhVyp4zGKdA3A2wNrOhgB&sig=AOD64_02uUjFONLEXqPeztJ95d_e90EH3g&client=ca-pub-2264225803283139&dbm_c=AKAmf-Dr8SazXlBaUzOgM1c4ykMATc24WWIkzAl01ebdLT1-NgAK7B6mu9gWauPcdx7fmmO4_FcwjlH89idDkRaJRIOt_55D9hSmJOkLe_r6SRgEUO3vJZvyk80MweSFem0kDiXkelHt1GxiEmFrgJ7WG6madQBCZc-fxJkuGNLj2SA2NgT7_yI&cry=1&dbm_d=AKAmf-Bir39ugM98LovK_5ugKPMWr5idl_kF8fcMg_HmRRX-9MWhgltHN0Bd_zqAGNtMlLl7xlZokO2zcwXnyRd5p2xxjNG_zsVQgqSUnDDo2a9WFphfBbNka-vocDEdP7EAkB8-UVN0d-qz8g9RgTrH5N3Q0Zc8gmFY9A0MNO7imGOhXaYF407FZLnzcuFGrNSmdWPiWVD3WehdcKJUNkDBDdc_RWpzkhh_zouG4bUCRPIiPeRBwGZD7F-wdkfc54S0oLORHvG0rX3RPMmM5wW1nxRnIgYJgiGC5tz6hieN5mpwOpeL77ehLjvjjide8troi4gBpb0PhPP7D7YVGgEwFEeKOoVk4ZGL0RhI7CNcqjftpSNHjinHyTxtwd5nulpmiomsZ5cZZKI3ViPQR3J9xD_WWRgm4hDrQ93SIg3JGt3JQtYC4gjVTxg7qgbhJBBmQDoW7_Nrn8FtfAW8I-B7iue4Hz-I3AAwUvkxq2ceSqEF_q6SV83yTLjFlYlXfNt-3mjQI_cIAi2orojxlXeE4OrOybFUg8FHNBWOLaqxpoDxQRyy-TU&adurl=;js=1;adfxid=2x;8302;set=en-US|en-US|1600X1200|0|0|0|24|8|3|7|1|;cmpgdpr=;cmpgdprconsent=;cmpgpp=;cmpgpp_sid=;fd=0|0&CREFURL=https%3A%2F%2Fkr.buddysecret.com

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/630/s1.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.243 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

0218f686dbbd9e5628049ae3be2c389384a4e7cd30bfd7ce42e46619930f8823

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:03 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 3837
expires: -1

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 3914 38 KB
13 KB 21ms
20ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

accept-ranges: bytes
age: 562583
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 26 Nov 2023 03:18:40 GMT
expires: Mon, 25 Nov 2024 03:18:40 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 Standard Show response
s1.adform.net/stoat/630/s1.adform.net/load/v/0.0.236/e/igSBggDQ/i/vCAv.IAAAAAUAA/r:AdConstructor:contents/ImageTag:types/ Frame 9B6B 85 KB
36 KB 36ms
35ms Script
text/javascript 37.157.2.249
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/stoat/630/s1.adform.net/load/v/0.0.236/e/igSBggDQ/i/vCAv.IAAAAAUAA/r:AdConstructor:contents/ImageTag:types/Standard
Requested by: Host: s1.adform.net
URL: https://s1.adform.net/stoat/630/s1.adform.net/bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.2.249 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: cbe7865410512e11935fb2051abdfc3f1d10dc8936066df03ab42829b1d5f6b3

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 15:35:03 GMT
content-encoding: gzip
last-modified: Fri, 17 Nov 2023 10:42:02 GMT
server: nginx
x-cache-status: STALE
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=100000
expires: Sat, 18 Nov 2023 15:27:21 GMT

GET
H2 200 61437838.jpg
s1.adform.net/Banners/61437838/ Frame 9B6B 40 KB
41 KB 31ms
31ms Image
image/jpeg 37.157.2.249
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s1.adform.net/Banners/61437838/61437838.jpg?bv=1
Requested by: Host: s1.adform.net
URL: https://s1.adform.net/stoat/630/s1.adform.net/load/v/0.0.236/e/igSBggDQ/i/vCAv.IAAAAAUAA/r:AdConstructor:contents/ImageTag:types/Standard
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.2.249 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 39d4e15782db1b5f3a3b5330e050d2d1bd20d679ae1d133e07a2543b2e76985e

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 15:35:03 GMT
last-modified: Mon, 20 Nov 2023 10:30:08 GMT
server: nginx
x-amz-request-id: tx000006deabe20e5279187-00656aba16-32959e94-default
etag: "e0b73245fd470b9c3b5784306562d968"
x-cache-status: STALE
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Range,Content-Length
x-rgw-object-type: Normal
cache-control: public, max-age=604800
accept-ranges: bytes
content-length: 41440

POST
H2 200 /
track.adform.net/csimpr/ Frame 9B6B 35 B
616 B 26ms
26ms Ping
image/gif 37.157.6.243
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/csimpr/?bn=69707714&csi=SGhJqhTelSWCnUzRSUnTbcsQEBbXoztssZk4hiTTVJEJDwKV3Zer3NdFzidJftMJrXNJ8e-ZiFnK6pptwuDarN6vWmW1dlSa0

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/630/s1.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.243 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET, POST
content-type: image/gif
access-control-allow-origin: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires: -1

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 3914 39 KB
15 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Fri, 01 Dec 2023 22:12:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 62545
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 30 Nov 2024 22:12:38 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
45 B 19ms
19ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-21EKGFLRB3&gtm=45je3bt0v882275148&_p=1701531300196&_gaz=1&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=694195853.1701531301&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EAAI&_s=1&sid=1701531303&sct=1&seg=0&dl=https%3A%2F%2Fkr.buddysecret.com%2F&dt=2023%20%EC%9A%B0%EC%A0%95%20%EB%8B%A4%EC%9D%B4%EC%96%B4%EB%A6%AC!%20%EB%B9%84%EB%B0%80%20%EC%9D%BC%EA%B8%B0%EB%A5%BC%20%EC%9E%91%EC%84%B1%ED%95%98%EB%A0%A4%EB%A9%B4%20%EC%A7%80%EA%B8%88%20%EC%B9%9C%EA%B5%AC%EB%93%A4%EC%9D%84%20%EC%B4%88%EB%8C%80%ED%95%98%EC%84%B8%EC%9A%94.&en=page_view&_fv=1&_ss=1&tfd=5444
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-21EKGFLRB3&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:03 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://kr.buddysecret.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 collect
stats.g.doubleclick.net/g/ 0
17 B 23ms
23ms Ping
text/plain 2a00:1450:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-21EKGFLRB3&cid=694195853.1701531301&gtm=45je3bt0v882275148&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-21EKGFLRB3&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:03 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://kr.buddysecret.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.nl/ads/ 42 B
63 B 46ms
46ms Image
image/gif 2a00:1450:4001:80b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.nl/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-21EKGFLRB3&cid=694195853.1701531301&gtm=45je3bt0v882275148&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l1&z=735626718

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:03 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 a
www.googletagmanager.com/ 0
11 B 29ms
29ms Image
text/html 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-9QKBNZJYL1&v=3&t=t&pid=1849363381&cv=2&rv=3bt0&tc=20&e=gtag.config&eid=5&u=AgAAAAAAAAAAACA&ut=Ag&h=Ag&z=0

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 15:35:03 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0767 0
20 B 55ms
55ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=7580189905998&version=m202309260101&ct=77&x=1&cor=13500963024797032000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:03 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3914 0
20 B 57ms
57ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BD5oop05rZZaPAc_0gAfyiLXwBgAAAAA4AeAEAg&bg=!hoWlhcrNAAY3kmNgF5I7ADQBe5WfOBclmRM6wMAbCHENkLUQaJDCK8m3puSCBevOutOrtj-8NITmAuFkXr6v_hl3rP6TAgAAAFJSAAAAAWgBBwoAclSLbdwK4yc36A1473eNxz0I8e9nJdyC3Zq4XNN-Bs_yX0S4HbKAhm8F1PmKXLBfIhzc2QelKPqYP_jCxqXe2ITFUdBl1ebUsA-JLg1FZyGJMp07wFYb4vyK0Uba6Y_-dbVzIHnukWDm_YlPGnh6KiiDE5kDDSf3m1PRmWrC1mUalpo14XsddR6hA0QmsN-OoZUpr2Dg8toMZCUmHjLNYQSandsfTtqbETZKDAd4gpT_pXDEzR53asj3Pn_Bj0jQJmOsG5Hh8jaP8cktycXlLloGuHO4tgs4nNmWPg5KQwUo94fNQN5leDKiJuHk7IoQ0yjYgGIuP_CV5_irtBaB4Rk5FyJuag_RUNPZQb7PxxZZdV7DrdJ-oo2Y5OZnR2qsZTCtjXoLcFdF1Jx-9BxcWxPl-tUOpfDdbE4ftvpT3WrlxOqgEDqqw6eB4JHRixpBImGBa59G_t-lDGX0CifJdLP2WJ9TZUMlNyttX6GHs_-dSec9gkSdZOC_Ge12qffZ8urzcnMlDBiRhVAd_7XCNk0G9fW7PTWvo9e-_58hDE0HOUhvN8zPg-KOuLigNk5K5fsfueFmfV686a5wQSdRCe88tC9D-7t6cs8xva2ITZoNrCkvdKtjlHK1Pp9EEaNPODmssTHWzjkpxHVH6KvcIAU23LmDXxqqpMyCxyfsuu0QJgmAVrPTmWG-wj-tprw3cKw-BRSyuFEDeLKCURiCt3NxsdCWp1KunuHQKS6ZjTICEcdaZtuZ-4WuWi-8AT7qWf92eXRrIRVy73borVUCjL0R9XXZpZlPSC8GaTGOQmRt1hp7DJJY2F8HM3rayNhGv-TwXFGfquH-Q3berkQcl3K71ccWX2zOcSXBGNLVhCdOXZxw7Czx_Ie9G6LF64t40VksFWITUkB6zBCurjMmsGH4gdgUU_mqdxmhGbo2J0fD7Ogily2shqYAmnD68HaQKcnkVF64vJAxDwsbUf9CXoN3YAnbqeEJGtCHKL759i-_LIjX_yrY2h3IMx1y689oUKiJM1FRUuVFyPBxAEJ7wyaekcPk8c8f-lKf3Tp7QaoEn8bypHui9R6d3SpjCQaJZIw-KFjDrdA1mkGpKoBclTztujsSDTr47WCjOcM68BmUqITeai8KdjP3eYavkI-J9D32ZkVD7aZGDFFj-SP8dougfq4wiy81OjeZ8rkdHOPFEgY

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:03 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 a
www.googletagmanager.com/ 0
11 B 36ms
36ms Image
text/html 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-9QKBNZJYL1&v=3&t=t&pid=1849363381&cv=2&rv=3bt0&tc=20&es=1&e=*&eid=17&u=AgAAAAAAAAAAACA&ut=Ag&h=Ag&z=0

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 15:35:04 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9B6B 0
20 B 57ms
56ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=2909595742230&version=m202309260101&ct=77&x=1&cor=9527473037510486000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 paper_background.png
kr.buddysecret.com/public/images/surpriseforu/ 28 KB
0 835ms
835ms Image
image/png 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://kr.buddysecret.com/public/images/surpriseforu/paper_background.png

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/public/css/surpriseforu/style.css?v=20231031_1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/public/css/surpriseforu/style.css?v=20231031_1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-159-web
date: Sat, 02 Dec 2023 15:35:06 GMT
cf-cache-status: MISS
last-modified: Thu, 04 Mar 2021 08:53:08 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "b8d3c-10c370-5bcb218b0e500"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Kxkgt3XvRK3kEg2uTiWzlez%2BUrO08UNzrHFd8%2F94Wu%2FYOFYa%2FzlXXYI8vHt1xwtmGgCs4dpb6w3HYKj3ejtm6skRBwswW1%2Fu9Ipz%2BLVmDsuU6khhSLDhytxJI5j9%2BCfQ0YcldUsTnYXOL3WvFDNi%2F6I%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 82f4a3423a1d3c87-CDG
alt-svc: h3=":443"; ma=86400
content-length: 1098608

GET
H2 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v26/ 32 KB
33 KB 71ms
21ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v26/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb2f90081933c0f2475883ca2c5cfee94e96d7314a09433fffc42e37f4cffd3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://kr.buddysecret.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 07:18:49 GMT
x-content-type-options: nosniff
age: 29776
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33092
x-xss-protection: 0
last-modified: Wed, 13 Sep 2023 22:51:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 01 Dec 2024 07:18:49 GMT

GET
H3 200 hearts.png
kr.buddysecret.com/public/images/surpriseforu/ 4 KB
5 KB 338ms
337ms Image
image/png 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://kr.buddysecret.com/public/images/surpriseforu/hearts.png

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/public/css/surpriseforu/style.css?v=20231031_1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

78ca0005131ba25ff6cd2b6c2f9c877550411b65ce8d3ea2dfd5853f97ed70ad

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/public/css/surpriseforu/style.css?v=20231031_1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-211-web
date: Sat, 02 Dec 2023 15:35:05 GMT
cf-cache-status: MISS
last-modified: Thu, 04 Mar 2021 08:53:08 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "b8d2e-11ff-5bcb218b0e500"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SUDPRZ2G6JwsV2%2BVYprGK%2FptSEdxqXEw8LBWUtBemztoaztBKIAUZT3Daz5AQzlp7rDd6h6XIsc4vZ%2FGbcFu87ttGpxZAPfJTLtTqVyGdLD6%2BjN0CHPZa8aBpC%2FfYxMXqMnKsMEaR0fqC1kmlg3%2FpPs%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 82f4a3423a223c87-CDG
alt-svc: h3=":443"; ma=86400
content-length: 4607

GET
H3 200 spiral.png
kr.buddysecret.com/public/images/surpriseforu/ 17 KB
18 KB 487ms
487ms Image
image/png 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://kr.buddysecret.com/public/images/surpriseforu/spiral.png

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/public/css/surpriseforu/style.css?v=20231031_1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

00af79d58e8976a1ddd7a3476b34d7d88d8da5e0221316d0af6430319760cf91

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/public/css/surpriseforu/style.css?v=20231031_1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-184-web
date: Sat, 02 Dec 2023 15:35:05 GMT
cf-cache-status: MISS
last-modified: Thu, 04 Mar 2021 08:53:08 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "b8d45-441b-5bcb218b0e500"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=A4EqwKxT6esULrUub4bhBkpA9RtePl1wCswE1ZY%2FFEFQOzLf0f7RImfqTkDzwYrY6SKnmdG2nz4x7bjSoY6B5Cl1J9UFrx%2FWHYJ6dztEjeN9dOA2GCWDdw03phrVuzP5pEqKC%2F0X4SQZ8VVJMd6S0hE%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 82f4a3423a253c87-CDG
alt-svc: h3=":443"; ma=86400
content-length: 17435

GET
H3 200 tape.png
kr.buddysecret.com/public/images/surpriseforu/ 12 KB
0 427ms
427ms Image
image/png 2a06:98c1:3120::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://kr.buddysecret.com/public/images/surpriseforu/tape.png

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/public/css/surpriseforu/style.css?v=20231031_1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/public/css/surpriseforu/style.css?v=20231031_1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

server-host: as-hi-27-web
date: Sat, 02 Dec 2023 15:35:05 GMT
cf-cache-status: MISS
last-modified: Fri, 30 Jul 2021 13:38:56 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "b8b47-3644-5c857574e1c00"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zR99cZLu%2B70GaGEO6SURp4vJfkLt86GhPwMIf2ymnkvvTbxisBJGkd1d%2BOSxZy%2B9czwfeNMjVdqNG5byF8PyqmfJPfLg%2FT00vLjW89U%2F9VV0OvRnNvzB%2FwCTPP3ZpNFYEgVfRCB%2B45eJXaGW25we2vA%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
vary: Accept-Encoding
accept-ranges: bytes
cf-ray: 82f4a3423a263c87-CDG
alt-svc: h3=":443"; ma=86400
content-length: 13892

GET fontawesome.woff
kr.buddysecret.com/public/fonts/ 0
0

GET
DATA 200
OK truncated
/ Frame 0767 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 32a2aabefb7ab6dce864eadb66a2f826514c28431b94d4004becb6301c2f6170

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 9B6B 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2720a7561d0fbd36274649c1ed24ddca152ae17d172b645864b81c444ec24379

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 a
www.googletagmanager.com/ 0
11 B 36ms
36ms Image
text/html 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?id=G-9QKBNZJYL1&v=3&t=t&pid=1849363381&cv=2&rv=3bt0&tc=20&es=1&e=gtm.dom&eid=18&u=AgAAAAAAAAAAACA&ut=Ag&h=Ag&z=0

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 15:35:05 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 0767 42 B
174 B 59ms
59ms Fetch
image/gif 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjss-me9bsjJVQIhVSmtKPNn7_4VnSGCtBO9SYFTVLDKiTu6kSRn4JB9-Hec0Fr9YKXeofdbUetiATsClEAc7mVPdo1luKbCU1fUbXOIeS00xOOR9OyIMBwQNDQdbg82rqW4&sai=AMfl-YS97cyiS-nUdA2nezYr2l-OGd18sWwlwm7kbd-ZzYZUYLINUUxLA9B_cWfHAhu-SoEOiAtOEgvCzX1stm_g1QwQeKD8KwtJ0xGi_a9kJ0e7Ghpag-CfsBP12G3EEfMGMDtAmz414T9nIBbaEAUvXdoFO-LfL5DgQS8&sig=Cg0ArKJSzBVD4f5ZTjmFEAE&cid=CAQSTgDICaaNP0g7HbUZgiwzgXnE_r9tvKzpzkvX5lPLHLjYRy_h8ElkYK6TEf-Ap_LKjC1isVDZ-eh8VlaflipnMcNGhVyp4zGKdA3A2wNrOhgB&id=lidar2&mcvt=1000&p=0,0,90,728&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231129&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=4059191980&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1701531301766&rpt=657&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:06 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 collect
region1.analytics.google.com/g/ 0
17 B 19ms
18ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-9QKBNZJYL1&gtm=45je3bt0v899789978&_p=1701531300196&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=694195853.1701531301&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AAg&_s=4&sid=1701531301&sct=1&seg=0&dl=https%3A%2F%2Fkr.buddysecret.com%2F&dt=2023%20%EC%9A%B0%EC%A0%95%20%EB%8B%A4%EC%9D%B4%EC%96%B4%EB%A6%AC!%20%EB%B9%84%EB%B0%80%20%EC%9D%BC%EA%B8%B0%EB%A5%BC%20%EC%9E%91%EC%84%B1%ED%95%98%EB%A0%A4%EB%A9%B4%20%EC%A7%80%EA%B8%88%20%EC%B9%9C%EA%B5%AC%EB%93%A4%EC%9D%84%20%EC%B4%88%EB%8C%80%ED%95%98%EC%84%B8%EC%9A%94.&en=page_location&epn.percent_scrolled=90&_et=1&tfd=8319
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-9QKBNZJYL1&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:06 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://kr.buddysecret.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 /
track.adform.net/serving/unload/ Frame 0767 35 B
625 B 26ms
25ms Ping
image/gif 37.157.6.243
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/serving/unload/?version=15&unload=6634509799110303359@@69707714,60089060516035889,100|1200|0|0|0|0|0|0|0||41|1|||||1|0|0|nC5tnVuaoWBcPlakbYq96cgKtXAZHXjMC-a_820mS3rrPc6WKhCHGfL_QlhaeLlf0|||11||0|0|

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/630/s1.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.243 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:06 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET, POST
content-type: image/gif
access-control-allow-origin: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires: -1

POST
H2 200 /
track.adform.net/serving/unload/ Frame 0767 35 B
625 B 26ms
25ms Ping
image/gif 37.157.6.243
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/serving/unload/?version=15&unload=6634509799110303359@@69707714,60089060516035889,100|1999|0|0|0|0|0|0|0||68|1|||||1|0|0|nC5tnVuaoWBcPlakbYq96cgKtXAZHXjMC-a_820mS3rrPc6WKhCHGfL_QlhaeLlf0|||01||0|0|

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/630/s1.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.243 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:07 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET, POST
content-type: image/gif
access-control-allow-origin: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires: -1

POST
H2 200 /
track.adform.net/serving/unload/ Frame 9B6B 35 B
625 B 26ms
25ms Ping
image/gif 37.157.6.243
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/serving/unload/?version=15&unload=6634509799110303359@@69707714,1057161042583849159,0|0|0|0|0|0|0|0|0||0|1|||||1|0|0|nC5tnVuaoWDxBx_RTJEBJ8gKtXAZHXjM0-BzRedEkVMJ3WLsZxQhofL_QlhaeLlf0|||11||0|0|

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/630/s1.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.243 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com/
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:08 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET, POST
content-type: image/gif
access-control-allow-origin: https://a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires: -1

POST
H3 204 collect
region1.analytics.google.com/g/ 0
17 B 20ms
19ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-21EKGFLRB3&gtm=45je3bt0v882275148&_p=1701531300196&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=694195853.1701531301&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EEAI&_s=2&sid=1701531303&sct=1&seg=0&dl=https%3A%2F%2Fkr.buddysecret.com%2F&dt=2023%20%EC%9A%B0%EC%A0%95%20%EB%8B%A4%EC%9D%B4%EC%96%B4%EB%A6%AC!%20%EB%B9%84%EB%B0%80%20%EC%9D%BC%EA%B8%B0%EB%A5%BC%20%EC%9E%91%EC%84%B1%ED%95%98%EB%A0%A4%EB%A9%B4%20%EC%A7%80%EA%B8%88%20%EC%B9%9C%EA%B5%AC%EB%93%A4%EC%9D%84%20%EC%B4%88%EB%8C%80%ED%95%98%EC%84%B8%EC%9A%94.&en=scroll&epn.percent_scrolled=90&_et=4&tfd=10448
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-21EKGFLRB3&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://kr.buddysecret.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Dec 2023 15:35:08 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://kr.buddysecret.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: kr.buddysecret.com
URL: https://kr.buddysecret.com/public/fonts/fontawesome.woff?v=4.7.0

Verdicts & Comments Add Verdict or Comment

234 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

22 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
kr.buddysecret.com/	1970-01-20 17:22:03	Name: __bqs Value: aHR0cHMlM0ElMkYlMkZrci5idWRkeXNlY3JldC5jb20lMkYmdXE9aVZlVEhkNEdPd2Jl
.buddysecret.com/	1970-01-21 02:14:51	Name: _ga_9QKBNZJYL1 Value: GS1.1.1701531301.1.0.1701531301.60.0.0
.buddysecret.com/	1970-01-21 02:00:27	Name: __gads Value: ID=6b5c04544a2316a2:T=1701531301:RT=1701531301:S=ALNI_MZfYL5f7yWf0JMk5QoRnKrc3iZy3g
.buddysecret.com/	1970-01-21 02:00:27	Name: __gpi Value: UID=00000d0196dc6ff6:T=1701531301:RT=1701531301:S=ALNI_MbEa34cXg13G1wStAMiGVyaLGK8_w
.doubleclick.net/	1970-01-21 02:00:27	Name: IDE Value: AHWqTUmJIkYQEuQpI811VnU7R2Xh0aaTBiaXhrIV6lxxZh-nYxcjomaKgQSGq50F
.adform.net/	1970-01-20 17:23:29	Name: C Value: 1
.adnxs.com/	1970-01-20 18:48:27	Name: uuid2 Value: 1280872792743192651
.casalemedia.com/	1970-01-21 01:24:27	Name: CMID Value: ZWtOpWsAj6aYWo8VxR5zjAAA
.casalemedia.com/	1970-01-20 18:48:27	Name: CMPS Value: 3368
.casalemedia.com/	1970-01-20 18:48:27	Name: CMPRO Value: 3368
.doubleclick.net/	1970-01-20 20:58:03	Name: APC Value: AfxxVi6_saRjq7oJh7Y2W6qGZAEJ85DXPe2GW53ikEsCRMfk5nShnw
.buddysecret.com/	1970-01-20 18:48:27	Name: _fbp Value: fb.1.1701531302113.1390748538
.doubleclick.net/	1970-01-20 17:22:03	Name: ar_debug Value: 1
.buddysecret.com/	1970-01-21 02:14:51	Name: _ga_DBTY2304E3 Value: GS1.1.1701531302.1.0.1701531302.0.0.0
.adform.net/	1970-01-20 18:05:15	Name: uid Value: 6634509799110303359
.adform.net/	1970-01-20 16:48:56	Name: TPC Value: 1701531302298
.buddysecret.com/	1970-01-20 16:40:17	Name: _gid Value: GA1.2.1043314589.1701531302
.buddysecret.com/	1970-01-20 16:38:51	Name: _gat_gtag_UA_192512597_12 Value: 1
.buddysecret.com/	1970-01-20 16:38:51	Name: _gat_gtag_UA_126527512_14 Value: 1
.adnxs.com/	1970-01-20 18:48:27	Name: anj Value: dTM7k!M41.D>6NRF']wIg2E>:k@(lR!]tbW8i_iqf!oN/@E'zz<Z0Q(keA^R6Ar-d(A5bs-J[fPAxsrr?dJ7`V/TD._PlZ[C[-kX-GBF`O
.buddysecret.com/	1970-01-21 02:14:51	Name: _ga Value: GA1.1.694195853.1701531301
.buddysecret.com/	1970-01-21 02:14:51	Name: _ga_21EKGFLRB3 Value: GS1.1.1701531303.1.0.1701531303.60.0.0

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a726cddcc3a880e6286af6bcadd522d5.safeframe.googlesyndication.com
ad.doubleclick.net
cdnjs.cloudflare.com
cm.g.doubleclick.net
connect.facebook.net
dsum-sec.casalemedia.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
ib.adnxs.com
img.holaquiz.com
kr.buddysecret.com
p2e9r4n9.stackpathcdn.com
pagead2.googlesyndication.com
pfx.api.botman.ninja
region1.analytics.google.com
region1.google-analytics.com
s1.adform.net
securepubads.g.doubleclick.net
stats.g.doubleclick.net
superal.github.io
tpc.googlesyndication.com
track.adform.net
www.facebook.com
www.google-analytics.com
www.google.com
www.google.nl
www.googletagmanager.com
www.googletagservices.com
kr.buddysecret.com
104.17.24.14
104.18.36.155
142.250.185.129
142.250.185.194
151.139.128.10
172.217.16.194
172.217.16.198
172.217.18.3
173.194.76.155
185.199.110.153
185.89.210.212
188.114.96.3
2001:4860:4802:34::36
2606:4700:20::681a:6d3
2a00:1450:4001:80b::2002
2a00:1450:4001:80b::2003
2a00:1450:4001:80e::2002
2a00:1450:4001:813::2003
2a00:1450:4001:81c::2001
2a00:1450:4001:827::2002
2a00:1450:4001:827::2008
2a00:1450:4001:82a::200e
2a00:1450:4001:82b::2002
2a00:1450:4001:82f::2001
2a00:1450:4001:82f::2004
2a00:1450:4001:831::200a
2a00:1450:400c:c00::9b
2a03:2880:f084:105:face:b00c:0:3
2a03:2880:f177:185:face:b00c:0:25de
2a06:98c1:3120::3
37.157.2.249
37.157.6.243
5.161.35.131
00af79d58e8976a1ddd7a3476b34d7d88d8da5e0221316d0af6430319760cf91
00dd44415498e7c266af756fdf35c8743e4f6e853d476d01ded93d50404c3711
0218f686dbbd9e5628049ae3be2c389384a4e7cd30bfd7ce42e46619930f8823
09b186dc119230c8ab2c806d31bcc8dd4a0a2ba347165f35156422307b8e10ff
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0bc5f2ed8018f1c6a9430cc38afe213b4a2de4c5fe3f66853c8d2d8b506e1c0d
0bd527aed025462fa99887a2e074cb0b5333b90eab31632f9cd921703962a71d
0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec
122fac0ffbb44fb8bba0388baa11afc67faec3b223a06871a40dbcab4c6cc787
17ee33b20c68cf3c36226dd4a5bfad53f0a4e11bc62ffcc072cf846f27ca7f5c
1adb10c9a5878dd4306d66ff94ae27a07cbe47f57b34dec9a807e5d2d426eee0
262235b53289354531ed1c656f88f05a2af65e78b3fc0e1018024e599f47f46b
2720a7561d0fbd36274649c1ed24ddca152ae17d172b645864b81c444ec24379
2a7e4bf63bc70f8c050d0d52aea5b15dddaaf64fd51036cd996130cbb5f58b14
2f57801fc473bae365e18b1a94f5eda055469897434efdbc5ab3ec7cccced202
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
32a2aabefb7ab6dce864eadb66a2f826514c28431b94d4004becb6301c2f6170
38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642
39d4e15782db1b5f3a3b5330e050d2d1bd20d679ae1d133e07a2543b2e76985e
3a6e4170807d6efc5d636c0ef86a0520a0eb587e17fe85787d3ab9e4e82cc134
3b6dfeb59f7464899e64068a09afaa80fdae61e9767a041f9bc60aae5362c599
3e136e77083bfc6ef14ffc5abd19da89a82bf12fc0cda3c603e01582b93303c8
42055f25a4eecfde02b57c48b076f7b0ddffde0c372f285f8a4567e3a88759ae
435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f
43c9555701d17579571d962cfee37868f4769995820a96abf451623b0528c92c
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4cb74615b21b09911ec2975ed347598ac7959394967b61b26482663126366e1d
57f6d3807b91f5746bee342a67bb053029f637f59ed6afee9f224ab8ef394757
5c7ee55fa8687f9c8a3ac3866aaeb29531641f15faca744db916ec442f9dd8d7
5d4050c2783311b3ebc33027b89b7b43cd6f9dd85690cca861bcb7309471d08d
5f58e7c65bc382076dbf11f38bffa18b734b5a71d172207789a899f4730bd47a
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6dfd57a916a8cad100e3ec7a7cab09ea8b15e94a7dab3981f1910ea5083d37bd
737473b145a0fb2d97963ba71104b42ea59d434e17d43de3db67ddffc24200ac
78ca0005131ba25ff6cd2b6c2f9c877550411b65ce8d3ea2dfd5853f97ed70ad
78f74c1c43a81ad01646a8fafa13391a87822b2b58c5550a4f97edf085efa594
7baed263e09ef3cc2cf23b357f390990fbc493f6a2d93893d0f31a875927dbb8
7cf5817bfa72ce680f9d8e793ec8b3892065b122ec7783cec50144708d649db1
819afc5089f4dab0c958e8913ca5686b9e0107d68a37b32aec3600becd233042
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
867d95c054a9f0b329b3844a818c83c5554faa7ea3464f26ba1699864b08d536
87293aa389c2ae3691ad691ca7848a875fb0c35bfe5ec8489f2e016f9dec4339
874a57370535dbaac73cf5c47cce9611d4e8762b9d1821e73532e9c35a07f32f
9a03674bfe83fe09eee7aae6106943918be73a009be21468c2bdb1b4ce958fdc
9a42a7067e1bc17436e85177da6caafe399bca159c92c6d28f2b99d3f266178a
9a73ec51d0e62c2fdb04d631b841b43d1d61a18fd1c09ffc243db565ef05bbe4
9b37d726335bf66cf138264a88bd4faf1652194d417bf69c3115eb36d66d5590
9f6e245ec73203f99ecb888db309a2bdaf91f8696c1cebaa94e477a953fab30a
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a84cb06c27b7617c81b075bdb123e0e63e8da1b70feee763f86899a4fc3f3623
ab0a4fd818ae651b0b4da61889b0543363fee8a750aeb9dd38e77ce6917d11bf
aec3d419d50f05781a96f223e18289aeb52598b5db39be82a7b71dc67d6a7947
b1127616e70adcf895ad38ff2eeac1fa12419b6522f4c58df704d3dae8305d49
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b5b95bb517cf5992803aa5e967867d45311c63dad20397261e87d34ed85d6dbe
b6fcf52da7b7725cba7568a798d4034232bd375a2a48ae9786da94c65a697795
bb2f90081933c0f2475883ca2c5cfee94e96d7314a09433fffc42e37f4cffd3b
c1c58c2a842bb99940745b96c7f2db09da6af63e7950e44f585a4cba95deaf4a
c72c5cdb8ee97ed1e23f49f9cc0884c795f9c70e85a566453d9701f12cebfe9f
c936bca314b30e3c48bbad667c920cac28e3e43b72f5f372c706e885a0aa2743
c9b3df2175f6b51e8c7ca74de67d096dad198f28de115078f9332fa3fb379ab5
cbe7865410512e11935fb2051abdfc3f1d10dc8936066df03ab42829b1d5f6b3
ce4915a3f3e8fb84cea5856ce7dabe5a765fb2df7aa8feeef1633cfb411363e5
d25a8d464d13475253449b8ccb2a61273662080f2f25d1c682aff0177fb0b0cc
d98cb0a1e156fddbf20389dc37e2ed4860fe71e9a691e34e41f3ba9516b805ac
db668b70fd0021a224a50338fc80f62881fc5e678e84987ff62785d86ab3f320
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e04a40af8692b8e76780c014a3f5ad8d55d98fe8a6cd671bbebd32413117888d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5b2f0b7b8f27117d2d6d9ec82283b012729e33688862da0a8756c12a50b609a
eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987
ecb2dbe5d73e1c489ea95d2cca25c8865e4b07c4b867da199341ba5ee20e87ef
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f5f2eab887fc0fd70b970b68a012bd5e52cbc791788e15fece50024dd40868de
f61c6c2848203266c231c5690c5871675a612d38df19946c9d3167dc5bf34e0c
fa40858bc00aa25239b434a313f9b30b4b604715b21395c0f278a3055cd31deb
fd15dccc78b33bb29115461ac9504869f4af29b5bdc93111b8ecff5d58469206
ff9a2be960794ffc4738368eeec7262cd5bf70316287f8d2f0c3790170cf1277

kr.buddysecret.com Open in urlscan Pro 188.114.96.3 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

142 Requests

94 %HTTPS

55 %IPv6

20 Domains

29 Subdomains

34 IPs

6 Countries

2441 kBTransfer

5921 kBSize

22 Cookies

4 Outgoing links

Page URL History

Redirected requests

142 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

kr.buddysecret.com Open in urlscan Pro
188.114.96.3 Public Scan

Screenshot
Live screenshot

Full Image

142
Requests

94 %
HTTPS

55 %
IPv6

20
Domains

29
Subdomains

34
IPs

6
Countries

2441 kB
Transfer

5921 kB
Size

22
Cookies

142 HTTP transactions
2 data transactions