google.qbd.heng.ink Open in urlscan Pro
23.247.131.142 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://google.qbd.heng.ink/
Submission Tags: @phishunt_io
Submission: On September 22 via api (September 22nd 2024, 6:28:22 pm UTC) from DE — Scanned from US

Summary HTTP 31 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 5 IPs in 1 countries across 4 domains to perform 31 HTTP transactions. The main IP is 23.247.131.142, located in United States and belongs to GCTL-AS-AP Gcc Cloud Technology Limited, HK. The main domain is google.qbd.heng.ink.
TLS certificate: Issued by R11 on September 22nd 2024. Valid for: 3 months.

This is the only time google.qbd.heng.ink was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
24	23.247.131.142 23.247.131.142	152705 (GCTL-AS-A...) (GCTL-AS-AP Gcc Cloud Technology Limited)
2	142.250.64.67 142.250.64.67	15169 (GOOGLE) (GOOGLE)
2	172.217.165.138 172.217.165.138	15169 (GOOGLE) (GOOGLE)
1	142.251.35.174 142.251.35.174	15169 (GOOGLE) (GOOGLE)
31	5

24 23.247.131.142 (United States)

ASN152705 (GCTL-AS-AP Gcc Cloud Technology Limited, HK)

google.qbd.heng.ink	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.64.67 (Plainview, United States)

ASN15169 (GOOGLE, US)
PTR: lga34s30-in-f3.1e100.net

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.165.138 (United States)

ASN15169 (GOOGLE, US)
PTR: lax30s03-in-f10.1e100.net

ogads-pa.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.251.35.174 (Queens, United States)

ASN15169 (GOOGLE, US)
PTR: lga25s78-in-f14.1e100.net

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
24	heng.ink google.qbd.heng.ink	688 KB
2	googleapis.com ogads-pa.googleapis.com — Cisco Umbrella Rank: 303	240 B
2	gstatic.com www.gstatic.com	81 KB
1	google.com apis.google.com — Cisco Umbrella Rank: 111 play.google.com Failed	42 KB
31	4

	Domain	Requested by
24	google.qbd.heng.ink	google.qbd.heng.ink
2	ogads-pa.googleapis.com	www.gstatic.com
2	www.gstatic.com	google.qbd.heng.ink
1	apis.google.com	www.gstatic.com
0	play.google.com Failed	www.gstatic.com
31	5

This site contains links to these domains. Also see Links.

Domain
mail.google.com
accounts.google.com
about.google
google.com
policies.google.com
support.google.com

Subject Issuer	Validity	Valid
google.qbd.heng.ink R11	`2024-09-22` - `2024-12-21`	3 months	crt.sh
*.gstatic.com WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
upload.video.google.com WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh
*.apis.google.com WR2	`2024-08-26` - `2024-11-18`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://google.qbd.heng.ink/
Frame ID: 8757B81E1B47EBA2B69219F2D491B662
Requests: 30 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Google

Page Statistics

31
Requests

94 %
HTTPS

0 %
IPv6

4
Domains

5
Subdomains

5
IPs

1
Countries

812 kB
Transfer

2101 kB
Size

3
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: https://mail.google.com/mail/&ogbl
Title: Gmail

Search URL Search Domain Scan URL

URL: https://accounts.google.com/ServiceLogin?hl=zh-CN&passive=true&continue=https://google.qbd.heng.ink/&ec=GAZAmgQ
Title: 登录

Search URL Search Domain Scan URL

URL: https://about.google/?utm_source=google-US&utm_medium=referral&utm_campaign=hp-footer&fg=1
Title: 关于 Google

Search URL Search Domain Scan URL

URL: https://google.com/search/howsearchworks/?fg=1
Title: Google 搜索的运作方式

Search URL Search Domain Scan URL

URL: https://policies.google.com/privacy?hl=zh-CN&fg=1
Title: 隐私权

Search URL Search Domain Scan URL

URL: https://policies.google.com/terms?hl=zh-CN&fg=1
Title: 条款

Search URL Search Domain Scan URL

URL: https://support.google.com/websearch/?p=ws_results_help&hl=zh-CN&fg=1
Title: 搜索帮助

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

31 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
google.qbd.heng.ink/ 192 KB
67 KB 1704ms
695ms Document
text/html 23.247.131.142
GCTL-AS-AP Gcc Cl...

General

Check archive.org

Show headers Download Go to

Full URL

https://google.qbd.heng.ink/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.247.131.142 , United States, ASN152705 (GCTL-AS-AP Gcc Cloud Technology Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

d75a77100acd77b29dc7e62142d66c65dccc1b54a67abddb5d8d44bb86133ea1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-Prefers-Color-Scheme Sec-CH-UA-Form-Factors Sec-CH-UA-Platform Sec-CH-UA-Platform-Version Sec-CH-UA-Full-Version Sec-CH-UA-Arch Sec-CH-UA-Model Sec-CH-UA-Bitness Sec-CH-UA-Full-Version-List Sec-CH-UA-WoW64
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: gzip
content-security-policy-report-only: object-src 'none';base-uri 'self';script-src 'nonce-mmwc4PZKsEP4wnqPde4TKw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
content-type: text/html; charset=UTF-8
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
date: Sun, 22 Sep 2024 18:21:51 GMT
expires: -1
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
permissions-policy: unload=()
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
server: nginx
strict-transport-security: max-age=31536000 max-age=31536000
vary: Accept-Encoding Accept-Encoding
x-frame-options: SAMEORIGIN
x-xss-protection: 0

GET
H2 200 m=cdos,hsm,jsa,mb4ZUb,d,csi,cEt90b,SNUn3,qddgKe,sTsDMc,dtl0hd,eHDfl
google.qbd.heng.ink/xjs/_/ss/k=xjs.hd.h1gT9808VR4.L.B1.O/am=JCkAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAACAAACAAAAAAAAAAKgIAEADACANgAgAAAAAAACAAAAwAAAAAAQAIAAAACwAAAAAAAAAQAQEQAAABFAAAAAACEAAEACKAAQoAAJECgC... 4 KB
2 KB 223ms
221ms Stylesheet
text/css 23.247.131.142
GCTL-AS-AP Gcc Cl...

General

Check archive.org

Show headers Download Go to

Full URL

https://google.qbd.heng.ink/xjs/_/ss/k=xjs.hd.h1gT9808VR4.L.B1.O/am=JCkAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAACAAACAAAAAAAAAAKgIAEADACANgAgAAAAAAACAAAAwAAAAAAQAIAAAACwAAAAAAAAAQAQEQAAABFAAAAAACEAAEACKAAQoAAJECgCEIhAAAAMAAAQAgAAwwDEFSAMAoQAAAAAABAgAgAAAAaAQgQAKCHQAAYAMIEAEAI6AEIAAAAAAAABIAAAAAAMEAGIAAAAAAAAIAMAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAQAFAAAAAAAAAAAAAAAAAAAAEA/d=1/ed=1/br=1/rs=ACT90oGOT_37bZ866DwnEshMfZBPqO07jw/m=cdos,hsm,jsa,mb4ZUb,d,csi,cEt90b,SNUn3,qddgKe,sTsDMc,dtl0hd,eHDfl

Requested by

Host: google.qbd.heng.ink
URL: https://google.qbd.heng.ink/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.247.131.142 , United States, ASN152705 (GCTL-AS-AP Gcc Cloud Technology Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

acb0d39f01a6b8f84a164ede3c32998280b8d0c5c59b9c494025e85e683e58fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-prefers-color-scheme: light
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://google.qbd.heng.ink/

Response headers

content-encoding: gzip
age: 104169
report-to: {"group":"gws-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws-team"}]}
x-content-type-options: nosniff
expires: Sun, 21 Sep 2025 00:47:51 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 22 Sep 2024 18:21:51 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding, Accept-Encoding, Origin
last-modified: Fri, 20 Sep 2024 18:37:12 GMT
strict-transport-security: max-age=31536000
cache-control: public, immutable, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="gws-team"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gws-team
x-xss-protection: 0
server: nginx

GET
H2 200 m=cdos,hsm,jsa,mb4ZUb,d,csi,cEt90b,SNUn3,qddgKe,sTsDMc,dtl0hd,eHDfl Show response
google.qbd.heng.ink/xjs/_/js/k=xjs.hd.en.W2-Wvkt2M60.es5.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAACAIUAAAAAAKAAAAAAAAAAAAAAAAAAACBAEARAIAAAEA4AAAIBAAAAEABEQAAARIAB5lAgCAAGACAAAAAIAAAEC... 1013 KB
409 KB 345ms
345ms Script
text/javascript 23.247.131.142
GCTL-AS-AP Gcc Cl...

General

Check archive.org

Show headers Download Go to

Full URL

https://google.qbd.heng.ink/xjs/_/js/k=xjs.hd.en.W2-Wvkt2M60.es5.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAACAIUAAAAAAKAAAAAAAAAAAAAAAAAAACBAEARAIAAAEA4AAAIBAAAAEABEQAAARIAB5lAgCAAGACAAAAAIAAAECgCAAAAgAAMAAAAAgAAAAAAFAAAAAAAAAAAAAAAAAAgAACAgAAAAAAAAAAAEAAAAAA6AEAAAAAAAAAAQAAAgQAMEAGIAAAAAAAAKAPAIIHwJDCAgAAAAAAAAAAAAAAAUgQzIUEFAQgAAAAAAAAAAAAAAAAAFLSxIUN/d=1/ed=1/dg=3/br=1/rs=ACT90oEY1tYvgXwgefQxzDIEBrRoO5U9KQ/ee=ALeJib:B8gLwd;AfeaP:TkrAjf;BMxAGc:E5bFse;BgS6mb:fidj5d;BjwMce:cXX2Wb;CxXAWb:YyRLvc;DULqB:RKfG5c;Dkk6ge:JZmW9e;DpcR3d:zL72xf;EABSZ:MXZt9d;ESrPQc:mNTJvc;EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;EnlcNd:WeHg4;F9mqte:UoRcbe;Fmv9Nc:O1Tzwc;G0KhTb:LIaoZ;G6wU6e:hezEbd;GleZL:J1A7Od;HMDDWe:G8QUdb;HoYVKb:PkDN7e;HqeXPd:cmbnH;IBADCc:RYquRb;IZrNqe:P8ha2c;IoGlCf:b5lhvb;IsdWVc:qzxzOb;JXS8fb:Qj0suc;JbMT3:M25sS;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;KOxcK:OZqGte;KQzWid:ZMKkN;KcokUb:KiuZBf;KpRAue:Tia57b;LBgRLc:SdcwHb,XVMNvd;LEikZe:byfTOb,lsjVmc;LXA8b:q7OdKd;LsNahb:ucGLNb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Np8Qkd:Dpx6qc;Nyt6ic:jn2sGd;OgagBe:cNTe0;OohIYe:mpEAQb;Pjplud:EEDORb,PoEs9b;Q1Ow7b:x5CSu;Q6C5kf:pfdZCe;QGR0gd:Mlhmy;R2kc8b:ALJqWb;R4IIIb:QWfeKf;R9Ulx:CR7Ufe;RDNBlf:zPRCJb;SLtqO:Kh1xYe;SMDL4c:fTfGO,fTfGO;SNUn3:ZwDk9d,x8cHvb;ScI3Yc:e7Hzgb,e7Hzgb;ShpF6e:N0pvGc;SzQQ3e:dNhofb;TxfV6d:YORN0b;U96pRd:FsR04;UBKJZ:LGDJGb;UDrY1c:eps46d;UVmjEd:EesRsb;UyG7Kb:wQd0G;V2HTTe:RolTY;VGRfx:VFqbr;VN6jIc:ddQyuf;VOcgDe:YquhTb;VsAqSb:PGf2Re;VxQ32b:k0XsBb;WCEKNd:I46Hvd;WDGyFe:jcVOxd;Wfmdue:g3MJlb;XUezZ:sa7lqb;YIZmRd:A1yn5d;YV5bee:IvPZ6d;YkQtAf:rx8ur;ZMvdv:PHFPjb;ZSH6tc:QAvyLe;ZWEUA:afR4Cf;a56pNe:JEfCwb;aAJE9c:WHW6Ef;aCJ9tf:qKftvc;aZ61od:arTwJ;af0EJf:ghinId;bDXwRe:UsyOtc;bcPXSc:gSZLJb;cEt90b:ws9Tlc;cFTWae:gT8qnd;coJ8e:KvoW8;dIoSBb:ZgGg9b;dLlj2:Qqt3Gf;daB6be:lMxGPd;dowIGb:ebZ3mb,ebZ3mb;dtl0hd:lLQWFe;eBAeSb:Ck63tb;eBZ5Nd:audvde;eHDfl:ofjVkb;eO3lse:nFClrf;euOXY:OZjbQ;g8nkx:U4MzKc;gaub4:TN6bMe;gtVSi:ekUOYd;h3MYod:cEt90b;hK67qb:QWEO5b;heHB1:sFczq;hjRo6e:F62sG;hsLsYc:Vl118;iFQyKf:QIhFr,vfuNJf;imqimf:jKGL2e;jY0zg:Q6tNgc;k2Qxcb:XY51pe;kCQyJ:ueyPK;kMFpHd:OTA3Ae;kbAm9d:MkHyGd;lOO0Vd:OTA3Ae;lkq0A:JyBE3e;nAFL3:NTMZac,s39S4;nJw4Gd:dPFZH;oGtAuc:sOXFj;oSUNyd:fTfGO,fTfGO;oUlnpc:RagDlc;okUaUd:wItadb;pKJiXd:VCenhc;pNsl2d:j9Yuyc;pXdRYb:JKoKVe;pj82le:mg5CW;qZx2Fc:j0xrE;qaS3gd:yiLg6e;qafBPd:sgY6Zb;qavrXe:zQzcXe;qddgKe:d7YSfd,x4FYXe;rQSrae:C6D5Fc;sTsDMc:kHVSUb;sZmdvc:rdGEfc;tH4IIe:Ymry6;tosKvd:ZCqP3;trZL0b:qY8PFe;uuQkY:u2V3ud;vGrMZ:lPJJ0c;vfVwPd:lcrkwe;w3bZCb:ZPGaIb;w4rSdf:XKiZ9;w9w86d:dt4g2b;wQlYve:aLUfP;wR5FRb:O1Gjze,TtcOte;wV5Pjc:L8KGxe;whEZac:F4AmNb;xBbsrc:NEW1Qc;ysNiMc:CpIBjd;yxTchf:KUM7Z;z97YGf:oug9te;zOsCQe:Ko78Df;zaIgPb:Qtpxbd/m=cdos,hsm,jsa,mb4ZUb,d,csi,cEt90b,SNUn3,qddgKe,sTsDMc,dtl0hd,eHDfl

Requested by

Host: google.qbd.heng.ink
URL: https://google.qbd.heng.ink/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.247.131.142 , United States, ASN152705 (GCTL-AS-AP Gcc Cloud Technology Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

ddb01ebdfade568bf5b7ccbf21d92f98da5371bdf59d3c577e8a7984b3981cac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-prefers-color-scheme: light
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://google.qbd.heng.ink/

Response headers

content-encoding: gzip
age: 34765
report-to: {"group":"gws-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws-team"}]}
x-content-type-options: nosniff
expires: Mon, 22 Sep 2025 08:48:50 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 22 Sep 2024 18:21:52 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding, Accept-Encoding, Origin
last-modified: Sun, 22 Sep 2024 05:10:29 GMT
strict-transport-security: max-age=31536000
cache-control: public, immutable, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="gws-team"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gws-team
x-xss-protection: 0
server: nginx

GET
H2 200 googlelogo_color_272x92dp.png
google.qbd.heng.ink/images/branding/googlelogo/1x/ 6 KB
6 KB 282ms
282ms Image
image/png 23.247.131.142
GCTL-AS-AP Gcc Cl...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://google.qbd.heng.ink/images/branding/googlelogo/1x/googlelogo_color_272x92dp.png

Requested by

Host: google.qbd.heng.ink
URL: https://google.qbd.heng.ink/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.247.131.142 , United States, ASN152705 (GCTL-AS-AP Gcc Cloud Technology Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

5776cd87617eacec3bc00ebcf530d1924026033eda852f706c1a675a98915826

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-prefers-color-scheme: light
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://google.qbd.heng.ink/

Response headers

strict-transport-security: max-age=31536000
cache-control: private, max-age=31536000
content-encoding: gzip
cross-origin-resource-policy: cross-origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
x-content-type-options: nosniff
expires: Sun, 22 Sep 2024 18:28:15 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
date: Sun, 22 Sep 2024 18:21:52 GMT
x-xss-protection: 0
content-type: image/png
vary: Accept-Encoding
server: nginx
last-modified: Tue, 22 Oct 2019 18:30:00 GMT

GET
H2 200 rs=AA2YrTsLNLz0yuqf5P8DIATtoY6Y9OIfsA Show response
www.gstatic.com/og/_/js/k=og.qtm.en_US.SmrN48URiWE.2019.O/rt=j/m=qabr,q_dnp,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qadd,qaid,qein,qhaw,qhba,qhbr,qhch,qhga,qhid,qhin/d=1/ed=1/ 215 KB
78 KB 359ms
40ms Script
text/javascript 142.250.64.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/og/_/js/k=og.qtm.en_US.SmrN48URiWE.2019.O/rt=j/m=qabr,q_dnp,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qadd,qaid,qein,qhaw,qhba,qhbr,qhch,qhga,qhid,qhin/d=1/ed=1/rs=AA2YrTsLNLz0yuqf5P8DIATtoY6Y9OIfsA

Requested by

Host: google.qbd.heng.ink
URL: https://google.qbd.heng.ink/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.64.67 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f3.1e100.net

Software

sffe /

Resource Hash

5182c16fe1fa5855f8383b28f7a211f86c8222bd5f339854096004d4aee73871

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://google.qbd.heng.ink/

Response headers

content-encoding: gzip
age: 347472
report-to: {"group":"one-google-eng","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/one-google-eng"}]}
x-content-type-options: nosniff
expires: Thu, 18 Sep 2025 17:57:04 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 18 Sep 2024 17:57:04 GMT
last-modified: Sun, 15 Sep 2024 01:31:57 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding, Origin
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="one-google-eng"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/one-google-eng
accept-ranges: bytes
content-length: 79794
x-xss-protection: 0
server: sffe

GET
H2 200 rs=AA2YrTvadD9shXxTakyf8LAJy5VfkOfYnQ
www.gstatic.com/og/_/ss/k=og.qtm.JZzyHWtDwd0.L.W.O/m=qcwid,d_b_gm3,d_wi_gm3,d_lo_gm3/excm=qaaw,qadd,qaid,qein,qhaw,qhba,qhbr,qhch,qhga,qhid,qhin/d=1/ed=1/ct=zgms/ 10 KB
3 KB 357ms
40ms Stylesheet
text/css 142.250.64.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/og/_/ss/k=og.qtm.JZzyHWtDwd0.L.W.O/m=qcwid,d_b_gm3,d_wi_gm3,d_lo_gm3/excm=qaaw,qadd,qaid,qein,qhaw,qhba,qhbr,qhch,qhga,qhid,qhin/d=1/ed=1/ct=zgms/rs=AA2YrTvadD9shXxTakyf8LAJy5VfkOfYnQ

Requested by

Host: google.qbd.heng.ink
URL: https://google.qbd.heng.ink/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.64.67 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f3.1e100.net

Software

sffe /

Resource Hash

f45f18083d92a9f4113b31d85274cf1b3db5b302872779f8a607ffbdaa173bfc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://google.qbd.heng.ink/

Response headers

content-encoding: gzip
age: 349094
report-to: {"group":"one-google-eng","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/one-google-eng"}]}
x-content-type-options: nosniff
expires: Thu, 18 Sep 2025 17:30:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 18 Sep 2024 17:30:02 GMT
last-modified: Fri, 13 Sep 2024 01:31:01 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding, Origin
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="one-google-eng"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/one-google-eng
accept-ranges: bytes
content-length: 2263
x-xss-protection: 0
server: sffe

GET
H2 200 desktop_searchbox_sprites318_hr.webp
google.qbd.heng.ink/images/searchbox/ 660 B
1 KB 300ms
300ms Image
image/webp 23.247.131.142
GCTL-AS-AP Gcc Cl...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://google.qbd.heng.ink/images/searchbox/desktop_searchbox_sprites318_hr.webp

Requested by

Host: google.qbd.heng.ink
URL: https://google.qbd.heng.ink/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.247.131.142 , United States, ASN152705 (GCTL-AS-AP Gcc Cloud Technology Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

73d788f86be22112bb53762545989c0f1bbdb7343161130952c9ba3834ff81e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-prefers-color-scheme: light
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://google.qbd.heng.ink/

Response headers

strict-transport-security: max-age=31536000
cache-control: private, max-age=31536000
cross-origin-resource-policy: cross-origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
x-content-type-options: nosniff
expires: Sun, 22 Sep 2024 18:28:15 GMT
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
content-length: 660
date: Sun, 22 Sep 2024 18:21:52 GMT
x-xss-protection: 0
content-type: image/webp
last-modified: Wed, 22 Apr 2020 22:00:00 GMT
server: nginx

POST
H2 204 gen_204
google.qbd.heng.ink/ 0
505 B 408ms
408ms Ping
text/plain 23.247.131.142
GCTL-AS-AP Gcc Cl...

General

Check archive.org

Show headers Download Go to

Full URL

https://google.qbd.heng.ink/gen_204?s=webhp&t=cap&atyp=csi&ei=v2HwZoGsAbrj2roP4v2GyQ0&rt=wsrt.1704,cbs.34,cbt.295,hst.32,prt.282&imn=10&ima=1&imad=0&imac=0&wh=1200&opi=89978449

Requested by

Host: google.qbd.heng.ink
URL: https://google.qbd.heng.ink/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.247.131.142 , United States, ASN152705 (GCTL-AS-AP Gcc Cloud Technology Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	object-src 'none';base-uri 'self';script-src 'nonce-WTdtDb__I2ibiXsOFWn-7Q' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://google.qbd.heng.ink/
sec-ch-prefers-color-scheme: light
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

strict-transport-security: max-age=31536000
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-WTdtDb__I2ibiXsOFWn-7Q' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
permissions-policy: unload=()
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 22 Sep 2024 18:21:52 GMT
x-xss-protection: 0
server: nginx
x-frame-options: SAMEORIGIN

POST
H2 204 gen_204
google.qbd.heng.ink/ 0
506 B 268ms
268ms Ping
text/plain 23.247.131.142
GCTL-AS-AP Gcc Cl...

General

Check archive.org

Show headers Download Go to

Full URL

https://google.qbd.heng.ink/gen_204?s=webhp&t=aft&atyp=csi&ei=v2HwZoGsAbrj2roP4v2GyQ0&rt=wsrt.1704,aft.501,afti.501,cbs.34,cbt.295,hst.32,prt.282&imn=10&ima=1&imad=0&imac=0&wh=1200&aftie=NF&aft=1&aftp=1200&opi=89978449

Requested by

Host: google.qbd.heng.ink
URL: https://google.qbd.heng.ink/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.247.131.142 , United States, ASN152705 (GCTL-AS-AP Gcc Cloud Technology Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	object-src 'none';base-uri 'self';script-src 'nonce-AtSjL_5wgQCdByzrs-7dMA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://google.qbd.heng.ink/
sec-ch-prefers-color-scheme: light
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

strict-transport-security: max-age=31536000
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-AtSjL_5wgQCdByzrs-7dMA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
permissions-policy: unload=()
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 22 Sep 2024 18:21:52 GMT
x-xss-protection: 0
server: nginx
x-frame-options: SAMEORIGIN

OPTIONS
H2 200 GetAsyncData
ogads-pa.googleapis.com/$rpc/google.internal.onegoogle.asyncdata.v1.AsyncDataService/ 0
0 349ms
19ms Preflight
text/html 172.217.165.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ogads-pa.googleapis.com/$rpc/google.internal.onegoogle.asyncdata.v1.AsyncDataService/GetAsyncData

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.165.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lax30s03-in-f10.1e100.net

Software

ESF /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-goog-api-key,x-user-agent
Access-Control-Request-Method: POST
Origin: https://google.qbd.heng.ink
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: content-type,x-goog-api-key,x-user-agent
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: https://google.qbd.heng.ink
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html
date: Sun, 22 Sep 2024 18:28:16 GMT
server: ESF
server-timing: gfet4t7; dur=15
vary: origin referer x-origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H2 200 GetAsyncData Show response
ogads-pa.googleapis.com/$rpc/google.internal.onegoogle.asyncdata.v1.AsyncDataService/ 53 B
240 B 26ms
22ms XHR
application/json+protobuf 172.217.165.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ogads-pa.googleapis.com/$rpc/google.internal.onegoogle.asyncdata.v1.AsyncDataService/GetAsyncData

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.SmrN48URiWE.2019.O/rt=j/m=qabr,q_dnp,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qadd,qaid,qein,qhaw,qhba,qhbr,qhch,qhga,qhid,qhin/d=1/ed=1/rs=AA2YrTsLNLz0yuqf5P8DIATtoY6Y9OIfsA

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.165.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lax30s03-in-f10.1e100.net

Software

ESF /

Resource Hash

2b4b20e1fa834bf64509e94dd18eca0865abc217fcb62e769d6b6002084236a7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

X-Goog-Api-Key: AIzaSyCbsbvGCe7C9mCtdaTycZB2eUFuzsYKG_E
X-User-Agent: grpc-web-javascript/0.1
Referer: https://google.qbd.heng.ink/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/json+protobuf

Response headers

cache-control: private
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
content-encoding: gzip
x-content-type-options: nosniff
access-control-allow-origin: https://google.qbd.heng.ink
server-timing: gfet4t7; dur=20
content-length: 30
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 22 Sep 2024 18:28:16 GMT
x-xss-protection: 0
content-type: application/json+protobuf; charset=UTF-8
vary: Origin, X-Origin, Referer
server: ESF
x-frame-options: SAMEORIGIN

GET
H2 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SpvAvsXfWWo.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-MoqWi0fF1M09Ccs-6QfulXvxfdg/ 123 KB
42 KB 349ms
4ms Script
text/javascript 142.251.35.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SpvAvsXfWWo.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-MoqWi0fF1M09Ccs-6QfulXvxfdg/cb=gapi.loaded_0

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.35.174 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f14.1e100.net

Software

sffe /

Resource Hash

f847294692483e4b7666c0f98cbe2bd03b86ae27b721cae332feb26223dde9fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://google.qbd.heng.ink/

Response headers

content-encoding: gzip
age: 29318
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
x-content-type-options: nosniff
expires: Mon, 22 Sep 2025 10:19:38 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 22 Sep 2024 10:19:38 GMT
last-modified: Fri, 06 Sep 2024 22:07:50 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
accept-ranges: bytes
access-control-allow-origin: *
content-length: 42573
x-xss-protection: 0
server: sffe

POST
H2 204 gen_204
google.qbd.heng.ink/ 0
506 B 261ms
260ms Ping
text/plain 23.247.131.142
GCTL-AS-AP Gcc Cl...

General

Check archive.org

Show headers Download Go to

Full URL

https://google.qbd.heng.ink/gen_204?atyp=csi&ei=v2HwZoGsAbrj2roP4v2GyQ0&s=webhp&t=all&imn=10&ima=1&imad=0&imac=0&wh=1200&aftie=NF&aft=1&aftp=1200&adh=&cls=0.0000216484375&ime=1&imeae=0&imeap=0&imex=1&imeh=0&imeha=0&imehb=0&imea=0&imeb=0&imel=0&imed=0&imeeb=0&scp=0&cb=67539&ucb=196473&ts=67839&mem=ujhs.10,tjhs.14,jhsl.4295,dm.8&nv=ne.1,feid.679b07d9-74bf-4713-a44c-2cd0c53e42ec&net=dl.10000,ect.4g,rtt.0&hp=&sys=hc.16&p=bs.true&rt=hst.32,prt.282,cbs.34,cbt.295,afti.501,aft.501,aftqf.502,xjses.1222,xjsee.1278,xjs.1278,lcp.507,fcp.291,wsrt.1704,cst.505,dnst.504,rqst.927,rspt.233,sslt.295,rqstt.1010,unt.0,cstt.505,dit.1990&zx=1727029696865&opi=89978449

Requested by

Host: google.qbd.heng.ink
URL: https://google.qbd.heng.ink/xjs/_/js/k=xjs.hd.en.W2-Wvkt2M60.es5.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAACAIUAAAAAAKAAAAAAAAAAAAAAAAAAACBAEARAIAAAEA4AAAIBAAAAEABEQAAARIAB5lAgCAAGACAAAAAIAAAECgCAAAAgAAMAAAAAgAAAAAAFAAAAAAAAAAAAAAAAAAgAACAgAAAAAAAAAAAEAAAAAA6AEAAAAAAAAAAQAAAgQAMEAGIAAAAAAAAKAPAIIHwJDCAgAAAAAAAAAAAAAAAUgQzIUEFAQgAAAAAAAAAAAAAAAAAFLSxIUN/d=1/ed=1/dg=3/br=1/rs=ACT90oEY1tYvgXwgefQxzDIEBrRoO5U9KQ/ee=ALeJib:B8gLwd;AfeaP:TkrAjf;BMxAGc:E5bFse;BgS6mb:fidj5d;BjwMce:cXX2Wb;CxXAWb:YyRLvc;DULqB:RKfG5c;Dkk6ge:JZmW9e;DpcR3d:zL72xf;EABSZ:MXZt9d;ESrPQc:mNTJvc;EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;EnlcNd:WeHg4;F9mqte:UoRcbe;Fmv9Nc:O1Tzwc;G0KhTb:LIaoZ;G6wU6e:hezEbd;GleZL:J1A7Od;HMDDWe:G8QUdb;HoYVKb:PkDN7e;HqeXPd:cmbnH;IBADCc:RYquRb;IZrNqe:P8ha2c;IoGlCf:b5lhvb;IsdWVc:qzxzOb;JXS8fb:Qj0suc;JbMT3:M25sS;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;KOxcK:OZqGte;KQzWid:ZMKkN;KcokUb:KiuZBf;KpRAue:Tia57b;LBgRLc:SdcwHb,XVMNvd;LEikZe:byfTOb,lsjVmc;LXA8b:q7OdKd;LsNahb:ucGLNb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Np8Qkd:Dpx6qc;Nyt6ic:jn2sGd;OgagBe:cNTe0;OohIYe:mpEAQb;Pjplud:EEDORb,PoEs9b;Q1Ow7b:x5CSu;Q6C5kf:pfdZCe;QGR0gd:Mlhmy;R2kc8b:ALJqWb;R4IIIb:QWfeKf;R9Ulx:CR7Ufe;RDNBlf:zPRCJb;SLtqO:Kh1xYe;SMDL4c:fTfGO,fTfGO;SNUn3:ZwDk9d,x8cHvb;ScI3Yc:e7Hzgb,e7Hzgb;ShpF6e:N0pvGc;SzQQ3e:dNhofb;TxfV6d:YORN0b;U96pRd:FsR04;UBKJZ:LGDJGb;UDrY1c:eps46d;UVmjEd:EesRsb;UyG7Kb:wQd0G;V2HTTe:RolTY;VGRfx:VFqbr;VN6jIc:ddQyuf;VOcgDe:YquhTb;VsAqSb:PGf2Re;VxQ32b:k0XsBb;WCEKNd:I46Hvd;WDGyFe:jcVOxd;Wfmdue:g3MJlb;XUezZ:sa7lqb;YIZmRd:A1yn5d;YV5bee:IvPZ6d;YkQtAf:rx8ur;ZMvdv:PHFPjb;ZSH6tc:QAvyLe;ZWEUA:afR4Cf;a56pNe:JEfCwb;aAJE9c:WHW6Ef;aCJ9tf:qKftvc;aZ61od:arTwJ;af0EJf:ghinId;bDXwRe:UsyOtc;bcPXSc:gSZLJb;cEt90b:ws9Tlc;cFTWae:gT8qnd;coJ8e:KvoW8;dIoSBb:ZgGg9b;dLlj2:Qqt3Gf;daB6be:lMxGPd;dowIGb:ebZ3mb,ebZ3mb;dtl0hd:lLQWFe;eBAeSb:Ck63tb;eBZ5Nd:audvde;eHDfl:ofjVkb;eO3lse:nFClrf;euOXY:OZjbQ;g8nkx:U4MzKc;gaub4:TN6bMe;gtVSi:ekUOYd;h3MYod:cEt90b;hK67qb:QWEO5b;heHB1:sFczq;hjRo6e:F62sG;hsLsYc:Vl118;iFQyKf:QIhFr,vfuNJf;imqimf:jKGL2e;jY0zg:Q6tNgc;k2Qxcb:XY51pe;kCQyJ:ueyPK;kMFpHd:OTA3Ae;kbAm9d:MkHyGd;lOO0Vd:OTA3Ae;lkq0A:JyBE3e;nAFL3:NTMZac,s39S4;nJw4Gd:dPFZH;oGtAuc:sOXFj;oSUNyd:fTfGO,fTfGO;oUlnpc:RagDlc;okUaUd:wItadb;pKJiXd:VCenhc;pNsl2d:j9Yuyc;pXdRYb:JKoKVe;pj82le:mg5CW;qZx2Fc:j0xrE;qaS3gd:yiLg6e;qafBPd:sgY6Zb;qavrXe:zQzcXe;qddgKe:d7YSfd,x4FYXe;rQSrae:C6D5Fc;sTsDMc:kHVSUb;sZmdvc:rdGEfc;tH4IIe:Ymry6;tosKvd:ZCqP3;trZL0b:qY8PFe;uuQkY:u2V3ud;vGrMZ:lPJJ0c;vfVwPd:lcrkwe;w3bZCb:ZPGaIb;w4rSdf:XKiZ9;w9w86d:dt4g2b;wQlYve:aLUfP;wR5FRb:O1Gjze,TtcOte;wV5Pjc:L8KGxe;whEZac:F4AmNb;xBbsrc:NEW1Qc;ysNiMc:CpIBjd;yxTchf:KUM7Z;z97YGf:oug9te;zOsCQe:Ko78Df;zaIgPb:Qtpxbd/m=cdos,hsm,jsa,mb4ZUb,d,csi,cEt90b,SNUn3,qddgKe,sTsDMc,dtl0hd,eHDfl

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.247.131.142 , United States, ASN152705 (GCTL-AS-AP Gcc Cloud Technology Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	object-src 'none';base-uri 'self';script-src 'nonce-6TpwVKL7dgE-ES0cD3-0wQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-prefers-color-scheme: light
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://google.qbd.heng.ink/

Response headers

strict-transport-security: max-age=31536000
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-6TpwVKL7dgE-ES0cD3-0wQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
permissions-policy: unload=()
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 22 Sep 2024 18:21:53 GMT
x-xss-protection: 0
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 204 gen_204
google.qbd.heng.ink/ 0
506 B 259ms
259ms Image
text/plain 23.247.131.142
GCTL-AS-AP Gcc Cl...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://google.qbd.heng.ink/gen_204?atyp=i&ct=psnt&cad=&nt=navigate&ei=v2HwZoGsAbrj2roP4v2GyQ0&zx=1727029696869&opi=89978449

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.247.131.142 , United States, ASN152705 (GCTL-AS-AP Gcc Cloud Technology Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	object-src 'none';base-uri 'self';script-src 'nonce-ViplQGNs1NPNPPDacW6Q_Q' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-prefers-color-scheme: light
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://google.qbd.heng.ink/

Response headers

strict-transport-security: max-age=31536000
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-ViplQGNs1NPNPPDacW6Q_Q' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
permissions-policy: unload=()
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 22 Sep 2024 18:21:53 GMT
x-xss-protection: 0
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 search Show response
google.qbd.heng.ink/complete/ 51 B
1 KB 285ms
284ms XHR
application/json 23.247.131.142
GCTL-AS-AP Gcc Cl...

General

Check archive.org

Show headers Download Go to

Full URL

https://google.qbd.heng.ink/complete/search?q&cp=0&client=gws-wiz&xssi=t&gs_pcrt=2&hl=zh-CN&authuser=0&psi=v2HwZoGsAbrj2roP4v2GyQ0.1727029696914&dpr=1&nolsbt=1

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.247.131.142 , United States, ASN152705 (GCTL-AS-AP Gcc Cloud Technology Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

4c755031a7aaf76142549aa650be2eb1800408001e646c03ea749596204235b4

Security Headers

Name	Value
Content-Security-Policy	object-src 'none';base-uri 'self';script-src 'nonce-SIK1WHBR0wDaK0IoSBBUAw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1
Strict-Transport-Security	max-age=31536000, max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-prefers-color-scheme: light
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://google.qbd.heng.ink/

Response headers

content-encoding: gzip
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]}
x-content-type-options: nosniff
expires: Sun, 22 Sep 2024 18:28:17 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 22 Sep 2024 18:21:53 GMT
content-type: application/json; charset=UTF-8
vary: Accept-Encoding, Accept-Encoding
content-disposition: attachment; filename="f.txt"
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000, max-age=31536000
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-SIK1WHBR0wDaK0IoSBBUAw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1
cache-control: private, max-age=3600
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
accept-ch: Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64
permissions-policy: unload=()
x-xss-protection: 0
server: nginx

GET
H2 200 m=sb_wiz,aa,abd,syti,syth,sytc,syfw,sytg,syt2,syzr,syyx,syt7,syyw,syu7,sytd,sytf,sytb,sytw,syt0,sytx,syty,sytp,sytt,syt8,sytn,sytq,sytr,sytk,sytl,syt3,syt4,syrt,syri,syrg,syrf,syt6,syyv,syu6,syu5,s... Show response
google.qbd.heng.ink/xjs/_/js/k=xjs.hd.en.W2-Wvkt2M60.es5.O/ck=xjs.hd.h1gT9808VR4.L.B1.O/am=JCkAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAACAAACAAAAAAAACAK0IAEADAKANgAgAAAAAAACAAAAwACBAEARAIAAAEC4AAAIBAAAAUARE... 490 KB
177 KB 257ms
256ms Script
text/javascript 23.247.131.142
GCTL-AS-AP Gcc Cl...

General

Check archive.org

Show headers Download Go to

Full URL

https://google.qbd.heng.ink/xjs/_/js/k=xjs.hd.en.W2-Wvkt2M60.es5.O/ck=xjs.hd.h1gT9808VR4.L.B1.O/am=JCkAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAACAAACAAAAAAAACAK0IAEADAKANgAgAAAAAAACAAAAwACBAEARAIAAAEC4AAAIBAAAAUAREQAAARNAB5lAgCEAGECCKAAQoAAJECgCEIhAgAAMAAAQAgAAwwDEFSAMAoQAAAAAABAgAgAgAAaAwgQAKCHQAAYAMIEAEAI6AEIAAAAAAAABYAAAgQAMEAGIAAAAAAAAKAPAIIHwJDCAgAAAAAAAAAAAAAAAUgQzIUEFAQgAAAAAAAAAAAAAAAAAFLSxIUN/d=0/dg=0/br=1/ujg=1/rs=ACT90oGvRBjk6QGphX-8OfeoHoMEh4ZDww/m=sb_wiz,aa,abd,syti,syth,sytc,syfw,sytg,syt2,syzr,syyx,syt7,syyw,syu7,sytd,sytf,sytb,sytw,syt0,sytx,syty,sytp,sytt,syt8,sytn,sytq,sytr,sytk,sytl,syt3,syt4,syrt,syri,syrg,syrf,syt6,syyv,syu6,syu5,syu4,async,pHXghd,sf,sy1bq,sy1bt,sy490,sonic,TxCJfd,sy494,qzxzOb,IsdWVc,sy496,sy1ge,sy1cs,sy1co,syre,syrc,syrd,syrb,syra,sy47p,sy47s,sy2bu,sy18d,sy13b,sy13c,syro,syr6,syfb,sybv,syby,sybt,sybx,sybw,sycp,spch,syrw,syrv,rtH1bd,sy1dx,sy19g,sy184,syg8,sy1dw,sy13j,sy1dv,sy185,syga,sy1dy,SMquOb,sy8g,sygg,syge,sygf,sygh,sygd,sygo,sygm,sygk,sygc,sycm,sych,syck,syak,syac,syb6,syaj,syai,syah,sya5,syb1,syaq,sy9s,sy9r,syci,syc0,syc1,syc7,syao,syb9,syc6,sybz,sybs,sybr,syaf,syam,syc2,sybn,sybk,sybj,sybl,syae,syb7,sybe,sybc,sybg,sybd,sybf,sya9,syb4,sycr,syd6,sycs,syd7,sya7,syb3,syaa,syb5,sya6,syb2,syap,syab,sycq,sycf,sycb,sycc,sy9v,sy9z,sy9w,sya0,sy9x,sy9p,sy9m,sy9o,sya4,syc3,syg2,sygb,syg7,syg5,sy7z,sy7w,sy7y,syg4,syg9,syg3,syg1,syfy,syfx,sy82,uxMpU,syft,syd1,sycz,syct,syd8,sycv,sycu,sybh,sycx,syco,sy8y,sy8x,sy8w,Mlhmy,QGR0gd,aurFic,sy97,fKUV3e,OTA3Ae,sy8h,OmgaI,EEDORb,PoEs9b,Pjplud,sy8s,sy8l,A1yn5d,YIZmRd,uY49fb,sy7t,sy7r,sy7s,sy7q,sy7p,sy7o,byfTOb,lsjVmc,LEikZe,kWgXee,Ug7Xab,U0aPgd,ovKuLd,sgY6Zb,qafBPd,ebZ3mb,dowIGb,sy1e2,sy1dz,syyc,sysn,d5EhJe,sy1ei,fCxEDd,syvg,sy1eh,sy1eg,sy1ef,sy1eb,sy1e6,sy1e8,sy1e7,sy1ea,sy1bc,sy1b5,sy18m,sy18v,syvf,syxw,syxv,T1HOxc,sy1e9,sy1e5,zx30Y,sy1ej,sy1ed,sy19s,Wo3n8,syui,loL8vb,syum,syul,syuk,ms4mZb,syq6,B2qlPe,syut,NzU6V,sy103,syv9,zGLm3b,sywo,sywp,sywg,DhPYme,MpJwZc,UUJqVe,sy7l,sOXFj,sy7k,s39S4,oGtAuc,NTMZac,nAFL3,sy8e,sy8d,q0xTif,y05UD,sy13x,sy1de,sy1d8,syxu,sy1d0,sy16q,syxt,syxs,syxr,syxx,sy1d7,sy16i,sy1cw,sy16n,sy1d6,sy13r,sy1d1,sy1cx,sy16o,sy16p,sy1d9,sy13e,sy1d5,sy1d4,sy1d2,syjz,sy1d3,sy1db,sy1cq,sy1cy,sy1cp,sy1cv,sy1cr,sy17l,sy1cz,sy1cl,sy16s,sy16t,syxz,syy0,epYOx?xjs=s3

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.247.131.142 , United States, ASN152705 (GCTL-AS-AP Gcc Cloud Technology Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

3c110a2d4be0aac87e46297666dc8c94fbe9542f907b6aee18d162f96893614a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-prefers-color-scheme: light
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://google.qbd.heng.ink/

Response headers

content-encoding: gzip
age: 26823
report-to: {"group":"gws-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws-team"}]}
x-content-type-options: nosniff
expires: Mon, 22 Sep 2025 11:01:14 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 22 Sep 2024 18:21:53 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding, Accept-Encoding, Origin
last-modified: Fri, 20 Sep 2024 18:37:12 GMT
strict-transport-security: max-age=31536000
cache-control: public, immutable, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="gws-team"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gws-team
x-xss-protection: 0
server: nginx

GET
H2 200 rs=ACT90oEY1tYvgXwgefQxzDIEBrRoO5U9KQ Show response
google.qbd.heng.ink/xjs/_/js/md=2/k=xjs.hd.en.W2-Wvkt2M60.es5.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAACAIUAAAAAAKAAAAAAAAAAAAAAAAAAACBAEARAIAAAEA4AAAIBAAAAEABEQAAARIAB5lAgCAAGACAAAAAI... 12 KB
2 KB 254ms
254ms Fetch
text/javascript 23.247.131.142
GCTL-AS-AP Gcc Cl...

General

Check archive.org

Show headers Download Go to

Full URL

https://google.qbd.heng.ink/xjs/_/js/md=2/k=xjs.hd.en.W2-Wvkt2M60.es5.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAACAIUAAAAAAKAAAAAAAAAAAAAAAAAAACBAEARAIAAAEA4AAAIBAAAAEABEQAAARIAB5lAgCAAGACAAAAAIAAAECgCAAAAgAAMAAAAAgAAAAAAFAAAAAAAAAAAAAAAAAAgAACAgAAAAAAAAAAAEAAAAAA6AEAAAAAAAAAAQAAAgQAMEAGIAAAAAAAAKAPAIIHwJDCAgAAAAAAAAAAAAAAAUgQzIUEFAQgAAAAAAAAAAAAAAAAAFLSxIUN/rs=ACT90oEY1tYvgXwgefQxzDIEBrRoO5U9KQ

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.247.131.142 , United States, ASN152705 (GCTL-AS-AP Gcc Cloud Technology Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

8abde86dbcd73a9a21fd550ad33798407aae770d9159f0844d8be99fdd94f4e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-prefers-color-scheme: light
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://google.qbd.heng.ink/

Response headers

content-encoding: gzip
age: 34761
report-to: {"group":"gws-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws-team"}]}
x-content-type-options: nosniff
expires: Mon, 22 Sep 2025 08:48:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 22 Sep 2024 18:21:53 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding, Accept-Encoding, Origin
last-modified: Sun, 22 Sep 2024 05:10:29 GMT
strict-transport-security: max-age=31536000
cache-control: public, immutable, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="gws-team"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gws-team
x-xss-protection: 0
server: nginx

GET
H2 204 client_204
google.qbd.heng.ink/ 0
537 B 269ms
269ms Image
text/plain 23.247.131.142
GCTL-AS-AP Gcc Cl...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://google.qbd.heng.ink/client_204?atyp=i&biw=1600&bih=1200&ei=v2HwZoGsAbrj2roP4v2GyQ0&opi=89978449

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.247.131.142 , United States, ASN152705 (GCTL-AS-AP Gcc Cloud Technology Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	object-src 'none';base-uri 'self';script-src 'nonce--WAs2lPB7ueXY4iRWRy0XQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1
Strict-Transport-Security	max-age=31536000, max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-prefers-color-scheme: light
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://google.qbd.heng.ink/

Response headers

strict-transport-security: max-age=31536000, max-age=31536000
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce--WAs2lPB7ueXY4iRWRy0XQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]}
permissions-policy: unload=()
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 22 Sep 2024 18:21:53 GMT
x-xss-protection: 0
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 favicon.ico
google.qbd.heng.ink/ 5 KB
2 KB 214ms
214ms Other
image/x-icon 23.247.131.142
GCTL-AS-AP Gcc Cl...

General

Check archive.org

Show headers Download Go to

Full URL

https://google.qbd.heng.ink/favicon.ico

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.247.131.142 , United States, ASN152705 (GCTL-AS-AP Gcc Cloud Technology Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-prefers-color-scheme: light
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://google.qbd.heng.ink/

Response headers

content-encoding: gzip
age: 5014
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
x-content-type-options: nosniff
expires: Mon, 30 Sep 2024 03:05:47 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 22 Sep 2024 18:21:53 GMT
content-type: image/x-icon
last-modified: Tue, 22 Oct 2019 18:30:00 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000
cache-control: public, max-age=691200
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
content-length: 1494
x-xss-protection: 0
server: nginx

POST log
play.google.com/ 0
0

GET
H2 200 m=syjt,syky Show response
google.qbd.heng.ink/xjs/_/ss/k=xjs.hd.h1gT9808VR4.L.B1.O/am=JCkAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAACAAACAAAAAAAAAAKgIAEADACANgAgAAAAAAACAAAAwAAAAAAQAIAAAACwAAAAAAAAAQAQEQAAABFAAAAAACEAAEACKAAQoAAJECgC... 2 KB
1 KB 215ms
214ms Fetch
text/css 23.247.131.142
GCTL-AS-AP Gcc Cl...

General

Check archive.org

Show headers Download Go to

Full URL

https://google.qbd.heng.ink/xjs/_/ss/k=xjs.hd.h1gT9808VR4.L.B1.O/am=JCkAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAACAAACAAAAAAAAAAKgIAEADACANgAgAAAAAAACAAAAwAAAAAAQAIAAAACwAAAAAAAAAQAQEQAAABFAAAAAACEAAEACKAAQoAAJECgCEIhAAAAMAAAQAgAAwwDEFSAMAoQAAAAAABAgAgAAAAaAQgQAKCHQAAYAMIEAEAI6AEIAAAAAAAABIAAAAAAMEAGIAAAAAAAAIAMAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAQAFAAAAAAAAAAAAAAAAAAAAEA/d=0/br=1/rs=ACT90oGOT_37bZ866DwnEshMfZBPqO07jw/m=syjt,syky?xjs=s4

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.247.131.142 , United States, ASN152705 (GCTL-AS-AP Gcc Cloud Technology Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

0d5c53fcc37c7a2ce26367bbe6197fcd9272dd7ebc81823d088a4dfff5ae599b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-prefers-color-scheme: light
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://google.qbd.heng.ink/

Response headers

content-encoding: gzip
age: 87033
report-to: {"group":"gws-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws-team"}]}
x-content-type-options: nosniff
expires: Sun, 21 Sep 2025 09:44:58 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 22 Sep 2024 18:21:54 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding, Accept-Encoding, Origin
last-modified: Fri, 20 Sep 2024 18:37:12 GMT
strict-transport-security: max-age=31536000
cache-control: public, immutable, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="gws-team"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gws-team
x-xss-protection: 0
server: nginx

GET
H2 200 m=sy1fm,P10Owf,sy1ee,sy1ec,syqy,gSZvdb,syzm,syzl,WlNQGd,syr3,syr0,syqz,syqx,DPreE,syzy,syzw,nabPbb,syzg,syze,syjt,syky,CnSW2d,kQvlef,syzx,fXO0xe Show response
google.qbd.heng.ink/xjs/_/js/k=xjs.hd.en.W2-Wvkt2M60.es5.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAACAIUAAAAAAKAAAAAAAAAAAAAAAAAAACBAEARAIAAAEA4AAAIBAAAAEABEQAAARIAB5lAgCAAGACAAAAAIAAAEC... 24 KB
9 KB 270ms
269ms Script
text/javascript 23.247.131.142
GCTL-AS-AP Gcc Cl...

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.247.131.142 , United States, ASN152705 (GCTL-AS-AP Gcc Cloud Technology Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

95e2057a66078e441d5f945bb2c83500cbd005837246d37fd35edb4df17737ec

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-prefers-color-scheme: light
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://google.qbd.heng.ink/

Response headers

content-encoding: gzip
age: 34758
report-to: {"group":"gws-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws-team"}]}
x-content-type-options: nosniff
expires: Mon, 22 Sep 2025 08:48:59 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 22 Sep 2024 18:21:54 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding, Accept-Encoding, Origin
last-modified: Sun, 22 Sep 2024 05:10:29 GMT
strict-transport-security: max-age=31536000
cache-control: public, immutable, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="gws-team"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gws-team
x-xss-protection: 0
server: nginx

POST
H2 204 gen_204
google.qbd.heng.ink/ 0
507 B 266ms
265ms Ping
text/plain 23.247.131.142
GCTL-AS-AP Gcc Cl...

General

Check archive.org

Show headers Download Go to

Full URL

https://google.qbd.heng.ink/gen_204?atyp=csi&ei=v2HwZoGsAbrj2roP4v2GyQ0&s=promo&rt=hpbas.2097&zx=1727029697679&opi=89978449

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.247.131.142 , United States, ASN152705 (GCTL-AS-AP Gcc Cloud Technology Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	object-src 'none';base-uri 'self';script-src 'nonce-JOSUvqoLzJnYNpNzq5DclQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-prefers-color-scheme: light
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://google.qbd.heng.ink/

Response headers

strict-transport-security: max-age=31536000
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-JOSUvqoLzJnYNpNzq5DclQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
permissions-policy: unload=()
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 22 Sep 2024 18:21:54 GMT
x-xss-protection: 0
server: nginx
x-frame-options: SAMEORIGIN

POST
H2 204 gen_204
google.qbd.heng.ink/ 0
506 B 262ms
262ms Ping
text/plain 23.247.131.142
GCTL-AS-AP Gcc Cl...

General

Check archive.org

Show headers Download Go to

Full URL

https://google.qbd.heng.ink/gen_204?atyp=i&ei=v2HwZoGsAbrj2roP4v2GyQ0&dt19=2&prm23=0&zx=1727029697683&opi=89978449

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.247.131.142 , United States, ASN152705 (GCTL-AS-AP Gcc Cloud Technology Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	object-src 'none';base-uri 'self';script-src 'nonce-aJATcIWGEqN59CRRDjOTrA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-prefers-color-scheme: light
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://google.qbd.heng.ink/

Response headers

strict-transport-security: max-age=31536000
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-aJATcIWGEqN59CRRDjOTrA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
permissions-policy: unload=()
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 22 Sep 2024 18:21:54 GMT
x-xss-protection: 0
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 204 client_204 Show response
google.qbd.heng.ink/ 0
854 B 263ms
262ms XHR
text/plain 23.247.131.142
GCTL-AS-AP Gcc Cl...

General

Check archive.org

Show headers Download Go to

Full URL

https://google.qbd.heng.ink/client_204?cs=1&opi=89978449

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.247.131.142 , United States, ASN152705 (GCTL-AS-AP Gcc Cloud Technology Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	object-src 'none';base-uri 'self';script-src 'nonce-luaHMeIdl9YeVbxIXfoY3g' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1
Strict-Transport-Security	max-age=31536000, max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-prefers-color-scheme: light
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://google.qbd.heng.ink/

Response headers

strict-transport-security: max-age=31536000, max-age=31536000
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-luaHMeIdl9YeVbxIXfoY3g' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]}
permissions-policy: unload=()
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
date: Sun, 22 Sep 2024 18:21:54 GMT
x-xss-protection: 0
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 hpba Show response
google.qbd.heng.ink/async/ 102 B
892 B 281ms
280ms XHR
text/plain 23.247.131.142
GCTL-AS-AP Gcc Cl...

General

Check archive.org

Show headers Download Go to

Full URL

https://google.qbd.heng.ink/async/hpba?vet=10ahUKEwjBh_T7lteIAxW6sVYBHeK-IdkQj-0KCBM..i&ei=v2HwZoGsAbrj2roP4v2GyQ0&opi=89978449&yv=3&sp_imghp=false&sp_hpte=1&sp_hpep=1&stick=&cs=0&async=_basejs:%2Fxjs%2F_%2Fjs%2Fk%3Dxjs.hd.en.W2-Wvkt2M60.es5.O%2Fam%3DAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAACAIUAAAAAAKAAAAAAAAAAAAAAAAAAACBAEARAIAAAEA4AAAIBAAAAEABEQAAARIAB5lAgCAAGACAAAAAIAAAECgCAAAAgAAMAAAAAgAAAAAAFAAAAAAAAAAAAAAAAAAgAACAgAAAAAAAAAAAEAAAAAA6AEAAAAAAAAAAQAAAgQAMEAGIAAAAAAAAKAPAIIHwJDCAgAAAAAAAAAAAAAAAUgQzIUEFAQgAAAAAAAAAAAAAAAAAFLSxIUN%2Fdg%3D0%2Fbr%3D1%2Frs%3DACT90oEY1tYvgXwgefQxzDIEBrRoO5U9KQ,_basecss:%2Fxjs%2F_%2Fss%2Fk%3Dxjs.hd.h1gT9808VR4.L.B1.O%2Fam%3DJCkAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAACAAACAAAAAAAAAAKgIAEADACANgAgAAAAAAACAAAAwAAAAAAQAIAAAACwAAAAAAAAAQAQEQAAABFAAAAAACEAAEACKAAQoAAJECgCEIhAAAAMAAAQAgAAwwDEFSAMAoQAAAAAABAgAgAAAAaAQgQAKCHQAAYAMIEAEAI6AEIAAAAAAAABIAAAAAAMEAGIAAAAAAAAIAMAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAQAFAAAAAAAAAAAAAAAAAAAAEA%2Fbr%3D1%2Frs%3DACT90oGOT_37bZ866DwnEshMfZBPqO07jw,_basecomb:%2Fxjs%2F_%2Fjs%2Fk%3Dxjs.hd.en.W2-Wvkt2M60.es5.O%2Fck%3Dxjs.hd.h1gT9808VR4.L.B1.O%2Fam%3DJCkAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAACAAACAAAAAAAACAK0IAEADAKANgAgAAAAAAACAAAAwACBAEARAIAAAEC4AAAIBAAAAUAREQAAARNAB5lAgCEAGECCKAAQoAAJECgCEIhAgAAMAAAQAgAAwwDEFSAMAoQAAAAAABAgAgAgAAaAwgQAKCHQAAYAMIEAEAI6AEIAAAAAAAABYAAAgQAMEAGIAAAAAAAAKAPAIIHwJDCAgAAAAAAAAAAAAAAAUgQzIUEFAQgAAAAAAAAAAAAAAAAAFLSxIUN%2Fd%3D1%2Fed%3D1%2Fdg%3D0%2Fbr%3D1%2Fujg%3D1%2Frs%3DACT90oGvRBjk6QGphX-8OfeoHoMEh4ZDww,_fmt:prog,_id:_v2HwZoGsAbrj2roP4v2GyQ0_8

Requested by

Host: google.qbd.heng.ink
URL: https://google.qbd.heng.ink/xjs/_/js/k=xjs.hd.en.W2-Wvkt2M60.es5.O/ck=xjs.hd.h1gT9808VR4.L.B1.O/am=JCkAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAACAAACAAAAAAAACAK0IAEADAKANgAgAAAAAAACAAAAwACBAEARAIAAAEC4AAAIBAAAAUAREQAAARNAB5lAgCEAGECCKAAQoAAJECgCEIhAgAAMAAAQAgAAwwDEFSAMAoQAAAAAABAgAgAgAAaAwgQAKCHQAAYAMIEAEAI6AEIAAAAAAAABYAAAgQAMEAGIAAAAAAAAKAPAIIHwJDCAgAAAAAAAAAAAAAAAUgQzIUEFAQgAAAAAAAAAAAAAAAAAFLSxIUN/d=0/dg=0/br=1/ujg=1/rs=ACT90oGvRBjk6QGphX-8OfeoHoMEh4ZDww/m=sb_wiz,aa,abd,syti,syth,sytc,syfw,sytg,syt2,syzr,syyx,syt7,syyw,syu7,sytd,sytf,sytb,sytw,syt0,sytx,syty,sytp,sytt,syt8,sytn,sytq,sytr,sytk,sytl,syt3,syt4,syrt,syri,syrg,syrf,syt6,syyv,syu6,syu5,syu4,async,pHXghd,sf,sy1bq,sy1bt,sy490,sonic,TxCJfd,sy494,qzxzOb,IsdWVc,sy496,sy1ge,sy1cs,sy1co,syre,syrc,syrd,syrb,syra,sy47p,sy47s,sy2bu,sy18d,sy13b,sy13c,syro,syr6,syfb,sybv,syby,sybt,sybx,sybw,sycp,spch,syrw,syrv,rtH1bd,sy1dx,sy19g,sy184,syg8,sy1dw,sy13j,sy1dv,sy185,syga,sy1dy,SMquOb,sy8g,sygg,syge,sygf,sygh,sygd,sygo,sygm,sygk,sygc,sycm,sych,syck,syak,syac,syb6,syaj,syai,syah,sya5,syb1,syaq,sy9s,sy9r,syci,syc0,syc1,syc7,syao,syb9,syc6,sybz,sybs,sybr,syaf,syam,syc2,sybn,sybk,sybj,sybl,syae,syb7,sybe,sybc,sybg,sybd,sybf,sya9,syb4,sycr,syd6,sycs,syd7,sya7,syb3,syaa,syb5,sya6,syb2,syap,syab,sycq,sycf,sycb,sycc,sy9v,sy9z,sy9w,sya0,sy9x,sy9p,sy9m,sy9o,sya4,syc3,syg2,sygb,syg7,syg5,sy7z,sy7w,sy7y,syg4,syg9,syg3,syg1,syfy,syfx,sy82,uxMpU,syft,syd1,sycz,syct,syd8,sycv,sycu,sybh,sycx,syco,sy8y,sy8x,sy8w,Mlhmy,QGR0gd,aurFic,sy97,fKUV3e,OTA3Ae,sy8h,OmgaI,EEDORb,PoEs9b,Pjplud,sy8s,sy8l,A1yn5d,YIZmRd,uY49fb,sy7t,sy7r,sy7s,sy7q,sy7p,sy7o,byfTOb,lsjVmc,LEikZe,kWgXee,Ug7Xab,U0aPgd,ovKuLd,sgY6Zb,qafBPd,ebZ3mb,dowIGb,sy1e2,sy1dz,syyc,sysn,d5EhJe,sy1ei,fCxEDd,syvg,sy1eh,sy1eg,sy1ef,sy1eb,sy1e6,sy1e8,sy1e7,sy1ea,sy1bc,sy1b5,sy18m,sy18v,syvf,syxw,syxv,T1HOxc,sy1e9,sy1e5,zx30Y,sy1ej,sy1ed,sy19s,Wo3n8,syui,loL8vb,syum,syul,syuk,ms4mZb,syq6,B2qlPe,syut,NzU6V,sy103,syv9,zGLm3b,sywo,sywp,sywg,DhPYme,MpJwZc,UUJqVe,sy7l,sOXFj,sy7k,s39S4,oGtAuc,NTMZac,nAFL3,sy8e,sy8d,q0xTif,y05UD,sy13x,sy1de,sy1d8,syxu,sy1d0,sy16q,syxt,syxs,syxr,syxx,sy1d7,sy16i,sy1cw,sy16n,sy1d6,sy13r,sy1d1,sy1cx,sy16o,sy16p,sy1d9,sy13e,sy1d5,sy1d4,sy1d2,syjz,sy1d3,sy1db,sy1cq,sy1cy,sy1cp,sy1cv,sy1cr,sy17l,sy1cz,sy1cl,sy16s,sy16t,syxz,syy0,epYOx?xjs=s3

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.247.131.142 , United States, ASN152705 (GCTL-AS-AP Gcc Cloud Technology Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

3b70fa7bb82d55c24dff555bc5a4766babe06e576a119ff7dbac6433b5fd0323

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000, max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-prefers-color-scheme: light
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://google.qbd.heng.ink/

Response headers

content-encoding: gzip
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]}
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 22 Sep 2024 18:21:54 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding, Accept-Encoding
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000, max-age=31536000
cache-control: private
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
accept-ch: Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64
permissions-policy: unload=()
x-xss-protection: 0
version: 675447907
server: nginx

GET
H2 200 m=aLUfP Show response
google.qbd.heng.ink/xjs/_/js/k=xjs.hd.en.W2-Wvkt2M60.es5.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAACAIUAAAAAAKAAAAAAAAAAAAAAAAAAACBAEARAIAAAEA4AAAIBAAAAEABEQAAARIAB5lAgCAAGACAAAAAIAAAEC... 1 KB
1 KB 244ms
244ms Script
text/javascript 23.247.131.142
GCTL-AS-AP Gcc Cl...

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.247.131.142 , United States, ASN152705 (GCTL-AS-AP Gcc Cloud Technology Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

d4db04e2aec844f6e15283168a309401c09df84fb834c1cb74355a16397119e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-prefers-color-scheme: light
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://google.qbd.heng.ink/

Response headers

content-encoding: gzip
age: 34759
report-to: {"group":"gws-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws-team"}]}
x-content-type-options: nosniff
expires: Mon, 22 Sep 2025 08:48:59 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 22 Sep 2024 18:21:54 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding, Accept-Encoding, Origin
last-modified: Sun, 22 Sep 2024 05:10:29 GMT
strict-transport-security: max-age=31536000
cache-control: public, immutable, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="gws-team"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gws-team
x-xss-protection: 0
server: nginx

POST
H2 204 gen_204
google.qbd.heng.ink/ 0
506 B 256ms
255ms Ping
text/plain 23.247.131.142
GCTL-AS-AP Gcc Cl...

General

Check archive.org

Show headers Download Go to

Full URL

https://google.qbd.heng.ink/gen_204?atyp=csi&ei=wWHwZsbYMs_l2roPzfKdyA8&s=async&astyp=hpba&ima=0&imn=0&mem=ujhs.10,tjhs.14,jhsl.4295,dm.8&nv=ne.1,feid.679b07d9-74bf-4713-a44c-2cd0c53e42ec&hp=&rt=ttfb.297,st.298,bs.27,aaft.299,acrt.300,art.300&zx=1727029697980&opi=89978449

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.247.131.142 , United States, ASN152705 (GCTL-AS-AP Gcc Cloud Technology Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	object-src 'none';base-uri 'self';script-src 'nonce-Lb5ZtaUKhZANLpYCKaJm7Q' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-prefers-color-scheme: light
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://google.qbd.heng.ink/

Response headers

strict-transport-security: max-age=31536000
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-Lb5ZtaUKhZANLpYCKaJm7Q' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
permissions-policy: unload=()
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 22 Sep 2024 18:21:54 GMT
x-xss-protection: 0
server: nginx
x-frame-options: SAMEORIGIN

POST
H2 204 gen_204
google.qbd.heng.ink/ 0
506 B 257ms
257ms Ping
text/plain 23.247.131.142
GCTL-AS-AP Gcc Cl...

General

Check archive.org

Show headers Download Go to

Full URL

https://google.qbd.heng.ink/gen_204?atyp=csi&ei=v2HwZoGsAbrj2roP4v2GyQ0&s=promo&rt=hpbas.2097,hpbarr.302&zx=1727029697981&opi=89978449

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.247.131.142 , United States, ASN152705 (GCTL-AS-AP Gcc Cloud Technology Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	object-src 'none';base-uri 'self';script-src 'nonce-eq-Wf_3PtktOxRXlV-qC8Q' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-prefers-color-scheme: light
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://google.qbd.heng.ink/

Response headers

strict-transport-security: max-age=31536000
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-eq-Wf_3PtktOxRXlV-qC8Q' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
cross-origin-opener-policy: same-origin-allow-popups; report-to="gws"
report-to: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
permissions-policy: unload=()
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 22 Sep 2024 18:21:54 GMT
x-xss-protection: 0
server: nginx
x-frame-options: SAMEORIGIN

GET
H2 200 m=lOO0Vd,sy8t,P6sQOc Show response
google.qbd.heng.ink/xjs/_/js/k=xjs.hd.en.W2-Wvkt2M60.es5.O/am=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAACAIUAAAAAAKAAAAAAAAAAAAAAAAAAACBAEARAIAAAEA4AAAIBAAAAEABEQAAARIAB5lAgCAAGACAAAAAIAAAEC... 2 KB
1 KB 240ms
240ms Script
text/javascript 23.247.131.142
GCTL-AS-AP Gcc Cl...

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.247.131.142 , United States, ASN152705 (GCTL-AS-AP Gcc Cloud Technology Limited, HK),

Reverse DNS

Software

nginx /

Resource Hash

f3e2579e3d6855a63127b0c552a105ed3773b1a559f60bb7bccdd28a199a2ee2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-prefers-color-scheme: light
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://google.qbd.heng.ink/

Response headers

content-encoding: gzip
age: 34759
report-to: {"group":"gws-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws-team"}]}
x-content-type-options: nosniff
expires: Mon, 22 Sep 2025 08:48:59 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 22 Sep 2024 18:21:54 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding, Accept-Encoding, Origin
last-modified: Sun, 22 Sep 2024 05:10:29 GMT
strict-transport-security: max-age=31536000
cache-control: public, immutable, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="gws-team"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gws-team
x-xss-protection: 0
server: nginx

POST log
play.google.com/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: play.google.com
URL: https://play.google.com/log?format=json&hasfast=true

Domain: play.google.com
URL: https://play.google.com/log?format=json&hasfast=true

Verdicts & Comments Add Verdict or Comment

35 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.google.qbd.heng.ink/	1970-01-21 04:03:02	Name: AEC Value: AVYB7crnNWhMXHg0_fhJh3rxVeBV07bKMmxmMZv9spRQTcnUuFTPeRfjdg
.google.qbd.heng.ink/	1970-01-21 04:07:21	Name: NID Value: 517=G7slWT88K0NhcBBOgY_F1_2kfR0v7dmRB7QEohM6zFoCFO8JhpvMBhOqtQmS7iFKu8Fm7Pp4rpjBsTu88yTM6eWnMieI2Y4fFzAYyjI2Ohz8p9AuajchxFqUlff6EdZWA57Ho7IRFy6yUIx5NV4MuY2yeoWymrlCEx_PHcwjNb3rqk1pBhcRvDoVH6CnmNxFGi4BJSQ08ILAHOc
.google.com/	1970-01-21 04:07:20	Name: NID Value: 517=crJmzd0QnK1AEQeih_DSxAgV4RoiBW_qidrDD3EpPv5hB-w3u9KblO38T5_QTkeklphefisATCoCqb4i-kYPx2MWy2VzNY2y5ptL7UMNJ0U3N4fMYEgkfT5pcgoyNuWqDNOl7W1KzCg5ZB0ml_QV2LyKxLEInKWrn5t7lXMEMlKAOVOvlUtZmYs_4w

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://google.qbd.heng.ink/ Message: Access to XMLHttpRequest at 'https://play.google.com/log?format=json&hasfast=true' from origin 'https://google.qbd.heng.ink' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header has a value 'http://play.google.com' that is not equal to the supplied origin.
network	error	URL: https://play.google.com/log?format=json&hasfast=true Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://google.qbd.heng.ink/ Message: Access to XMLHttpRequest at 'https://play.google.com/log?format=json&hasfast=true' from origin 'https://google.qbd.heng.ink' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header has a value 'http://play.google.com' that is not equal to the supplied origin.
network	error	URL: https://play.google.com/log?format=json&hasfast=true Message: Failed to load resource: net::ERR_FAILED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000 max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

apis.google.com
google.qbd.heng.ink
ogads-pa.googleapis.com
play.google.com
www.gstatic.com
play.google.com
142.250.64.67
142.251.35.174
172.217.165.138
23.247.131.142
0d5c53fcc37c7a2ce26367bbe6197fcd9272dd7ebc81823d088a4dfff5ae599b
2b4b20e1fa834bf64509e94dd18eca0865abc217fcb62e769d6b6002084236a7
3b70fa7bb82d55c24dff555bc5a4766babe06e576a119ff7dbac6433b5fd0323
3c110a2d4be0aac87e46297666dc8c94fbe9542f907b6aee18d162f96893614a
4c755031a7aaf76142549aa650be2eb1800408001e646c03ea749596204235b4
5182c16fe1fa5855f8383b28f7a211f86c8222bd5f339854096004d4aee73871
5776cd87617eacec3bc00ebcf530d1924026033eda852f706c1a675a98915826
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
73d788f86be22112bb53762545989c0f1bbdb7343161130952c9ba3834ff81e3
8abde86dbcd73a9a21fd550ad33798407aae770d9159f0844d8be99fdd94f4e4
95e2057a66078e441d5f945bb2c83500cbd005837246d37fd35edb4df17737ec
acb0d39f01a6b8f84a164ede3c32998280b8d0c5c59b9c494025e85e683e58fc
d4db04e2aec844f6e15283168a309401c09df84fb834c1cb74355a16397119e4
d75a77100acd77b29dc7e62142d66c65dccc1b54a67abddb5d8d44bb86133ea1
ddb01ebdfade568bf5b7ccbf21d92f98da5371bdf59d3c577e8a7984b3981cac
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f3e2579e3d6855a63127b0c552a105ed3773b1a559f60bb7bccdd28a199a2ee2
f45f18083d92a9f4113b31d85274cf1b3db5b302872779f8a607ffbdaa173bfc
f847294692483e4b7666c0f98cbe2bd03b86ae27b721cae332feb26223dde9fc

google.qbd.heng.ink Open in urlscan Pro 23.247.131.142 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

31 Requests

94 %HTTPS

0 %IPv6

4 Domains

5 Subdomains

5 IPs

1 Countries

812 kBTransfer

2101 kBSize

3 Cookies

7 Outgoing links

Redirected requests

31 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

google.qbd.heng.ink Open in urlscan Pro
23.247.131.142 Public Scan

Screenshot
Live screenshot

Full Image

31
Requests

94 %
HTTPS

0 %
IPv6

4
Domains

5
Subdomains

5
IPs

1
Countries

812 kB
Transfer

2101 kB
Size

3
Cookies

31 HTTP transactions
0 data transactions