URL: https://www.hedan.rr.nu/
Submission: On July 05 via api from US — Scanned from DE

Summary

This website contacted 17 IPs in 6 countries across 12 domains to perform 68 HTTP transactions. The main IP is 172.66.47.11, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.hedan.rr.nu.
TLS certificate: Issued by E6 on July 5th 2024. Valid for: 3 months.
This is the only time www.hedan.rr.nu was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
14 172.66.47.11 13335 (CLOUDFLAR...)
2 2620:1ec:29:1... 8075 (MICROSOFT...)
9 2a04:4e42:600... 54113 (FASTLY)
1 154.85.69.9 139057 (LDPL-AS-A...)
5 7 116.207.181.224 136191 (CHINATELE...)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
8 20.231.53.73 8075 (MICROSOFT...)
14 151.101.129.229 54113 (FASTLY)
2 110.42.2.205 136188 (CHINATELE...)
3 101.42.40.156 45090 (TENCENT-N...)
2 113.13.246.102 4134 (CHINANET-...)
4 8 45.154.12.123 138195 (MOACKCOLT...)
1 2 13.74.129.1 8075 (MICROSOFT...)
1 1 2620:1ec:c11:... 8068 (MICROSOFT...)
1 240e:c3:2800:... 63838 (CT-HUNAN-...)
1 2404:2280:1cc... 24429 (TAOBAO Zh...)
68 17
Apex Domain
Subdomains
Transfer
23 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 381
fastly.jsdelivr.net — Cisco Umbrella Rank: 43046
877 KB
14 rr.nu
www.hedan.rr.nu
8 MB
12 myhkw.cn
myhkw.cn
api.myhkw.cn
cdn.myhkw.cn
158 KB
12 clarity.ms
www.clarity.ms — Cisco Umbrella Rank: 743
q.clarity.ms — Cisco Umbrella Rank: 7690
c.clarity.ms — Cisco Umbrella Rank: 1434
30 KB
8 paulzzh.com
img.paulzzh.com
2 MB
2 126.net
p3.music.126.net — Cisco Umbrella Rank: 130632
m801.music.126.net — Cisco Umbrella Rank: 86334
127 KB
2 tongjiniao.com
api.tongjiniao.com — Cisco Umbrella Rank: 383645
5 KB
2 gstatic.com
fonts.gstatic.com
46 KB
1 bing.com
c.bing.com — Cisco Umbrella Rank: 224
762 B
1 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 83
885 B
1 bootcss.com
cdn.bootcss.com — Cisco Umbrella Rank: 68048
1 KB
0 ctose.cn Failed
apii.ctose.cn Failed
68 12
Domain Requested by
17 fastly.jsdelivr.net cdn.jsdelivr.net
fastly.jsdelivr.net
www.hedan.rr.nu
14 www.hedan.rr.nu www.hedan.rr.nu
8 img.paulzzh.com 4 redirects
8 q.clarity.ms www.clarity.ms
7 myhkw.cn 5 redirects www.hedan.rr.nu
cdn.jsdelivr.net
6 cdn.jsdelivr.net www.hedan.rr.nu
3 cdn.myhkw.cn www.hedan.rr.nu
api.myhkw.cn
2 c.clarity.ms 1 redirects
2 api.tongjiniao.com www.hedan.rr.nu
api.tongjiniao.com
2 api.myhkw.cn www.hedan.rr.nu
api.myhkw.cn
2 fonts.gstatic.com fonts.googleapis.com
2 www.clarity.ms www.hedan.rr.nu
www.clarity.ms
1 m801.music.126.net
1 p3.music.126.net
1 c.bing.com 1 redirects
1 fonts.googleapis.com cdn.jsdelivr.net
1 cdn.bootcss.com www.hedan.rr.nu
0 apii.ctose.cn Failed www.hedan.rr.nu
68 18

This site contains links to these domains. Also see Links.

Domain
forum.hedan.link
qm.qq.com
map.hedan.link
jq.qq.com
Subject Issuer Validity Valid
www.hedan.rr.nu
E6
2024-07-05 -
2024-10-03
3 months crt.sh
www.clarity.ms
DigiCert TLS RSA SHA256 2020 CA1
2023-12-07 -
2024-12-07
a year crt.sh
jsdelivr.net
GlobalSign Atlas R3 DV TLS CA 2023 Q3
2023-09-27 -
2024-10-28
a year crt.sh
*.bootcss.com
Sectigo RSA Domain Validation Secure Server CA
2024-01-03 -
2025-02-02
a year crt.sh
myhkw.cn
TrustAsia RSA DV TLS CA G2
2024-04-28 -
2025-04-28
a year crt.sh
upload.video.google.com
WR2
2024-06-13 -
2024-09-05
3 months crt.sh
*.gstatic.com
WR2
2024-06-13 -
2024-09-05
3 months crt.sh
a.clarity.ms
Microsoft Azure RSA TLS Issuing CA 08
2024-06-23 -
2025-06-18
a year crt.sh
*.tongjiniao.com
Sectigo RSA Domain Validation Secure Server CA
2023-10-22 -
2024-10-21
a year crt.sh
api.myhkw.cn
TrustAsia RSA DV TLS CA G2
2024-03-28 -
2025-03-28
a year crt.sh
cdn.myhkw.cn
TrustAsia RSA DV TLS CA G2
2024-04-12 -
2025-04-12
a year crt.sh

This page contains 1 frames:

Primary Page: https://www.hedan.rr.nu/
Frame ID: 7CE0EDF57234047C0157450128F8BA99
Requests: 69 HTTP requests in this frame

Screenshot

Page Title

方块核弹世界-ChimeTown-铃铛小镇服务器

Detected technologies

Overall confidence: 100%
Detected patterns
  • /semantic(?:-([\d.]+))?(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Overall confidence: 100%
Detected patterns
  • //cdn\.jsdelivr\.net/

Page Statistics

68
Requests

84 %
HTTPS

41 %
IPv6

12
Domains

18
Subdomains

17
IPs

6
Countries

11144 kB
Transfer

15802 kB
Size

10
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 46
  • https://myhkw.cn/api/playercss?id=demo HTTP 302
  • https://api.myhkw.cn/cache/css/player-l.css?v=20240630
Request Chain 47
  • https://myhkw.cn/api/playlist?id=demo HTTP 302
  • https://cdn.myhkw.cn/cache/playlist/demo.js?v=20240430-1720109201
Request Chain 53
  • https://img.paulzzh.com/touhou/random?0.9458146323980605 HTTP 302
  • https://img.paulzzh.com/touhou/konachan/image/586e2fd214d9277af9e353cebdfa584b.jpg
Request Chain 54
  • https://c.clarity.ms/c.gif HTTP 302
  • https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=F11526CD2C964345981B4FFE46DE92BB&RedC=c.clarity.ms&MXFR=066B0C5D385E677A313C18EE3C5E69C2 HTTP 302
  • https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=F11526CD2C964345981B4FFE46DE92BB&MUID=0C9605CDD0B862423E67117ED16A631C
Request Chain 56
  • https://myhkw.cn/api/pic?song=2144209098&pic=109951169484028770&type=wy&id=demo&sign=749/n7RxhZX4Y HTTP 302
  • https://p3.music.126.net/y1h40wgnEzAJKGN0IksUsg==/109951169484028770.jpg?param=300y300
Request Chain 57
  • https://myhkw.cn/api/url?song=2144209098&type=wy&id=demo&sign=749/n7RxhZX4Y HTTP 302
  • https://m801.music.126.net/20240705201632/6b1d29d953a008cfbd4ab15950a2abb7/jdymusic/obj/wo3DlMOGwrbDjj7DisKw/35121150388/9599/98ef/5bfc/83bceee69e40dea5aa652fa9f7430735.mp3
Request Chain 58
  • https://myhkw.cn/api/lyrics?song=2144209098&type=wy&id=demo&sign=749/n7RxhZX4Y&ksc=54&_=1720180285011 HTTP 302
  • https://cdn.myhkw.cn/cache/lyrics/wy-2144209098-b1iFf46SqiyN6.js?v=20240430-1720109201
Request Chain 62
  • https://img.paulzzh.com/touhou/random?0.6461772809886324 HTTP 302
  • https://img.paulzzh.com/touhou/konachan/image/fa4b177419fce5c8de4ae4f0c125a11d.jpg
Request Chain 64
  • https://img.paulzzh.com/touhou/random?0.7010095440573152 HTTP 302
  • https://img.paulzzh.com/touhou/konachan/image/56682a25b9dc3fc46d6a20df2fccf69c.jpg
Request Chain 66
  • https://img.paulzzh.com/touhou/random?0.6524199555166075 HTTP 302
  • https://img.paulzzh.com/touhou/konachan/jpeg/5d3df11fd766a1751322be73ca4a44ab.jpg

68 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
www.hedan.rr.nu/
77 KB
49 KB
Document
General
Full URL
https://www.hedan.rr.nu/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.47.11 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fc544e095e9c62b22290d8eaf5812e29023d77e9d7cfb0155fd1ac9315bf75fc
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
cache-control
public, max-age=0, must-revalidate
cf-ray
89e724987dcc3603-FRA
content-encoding
br
content-type
text/html; charset=utf-8
date
Fri, 05 Jul 2024 11:51:24 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy
strict-origin-when-cross-origin
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VZ53PLAHBK0dtjeW7D2ZzyA5IvdlPF937t9Epa5A1CbyseYmKm%2FvyRV3F%2FesMHR0yM7VhBNdbWVFl59utNpnyHPIY91Q9B0nllsBGPVYcXFn6iyhJU7f1rKyt%2FmYQuwRWZ0%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
x-content-type-options
nosniff
css.css
www.hedan.rr.nu/css/
11 KB
3 KB
Stylesheet
General
Full URL
https://www.hedan.rr.nu/css/css.css
Requested by
Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.47.11 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fa501844318e06fadf4d4f127ad2be47b7ff55cd9409baf70a7368b14c0302ea
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Jul 2024 11:51:24 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"0b69cbe335f5a607d66ba28e97f9329d"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r3isX21Ihrrii4GX%2FVDqHDSwRKqum1OJ3wnxpikve8CXGZjwwDx9IemTIMlZp%2FG3dPkso0JUA7Fp%2BKnIT0WZ7BF%2FeJ7ffDFFUSWIm1zyuwpSvdhIuGCuxeRKOrDPfspNlNs%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
89e724992ed63603-FRA
alt-svc
h3=":443"; ma=86400
main.js
www.hedan.rr.nu/static/js/
77 KB
49 KB
Script
General
Full URL
https://www.hedan.rr.nu/static/js/main.js
Requested by
Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.47.11 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fc544e095e9c62b22290d8eaf5812e29023d77e9d7cfb0155fd1ac9315bf75fc
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Jul 2024 11:51:24 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6tpIEa4d6IaCUEBNHCn%2BdMWw3VVjP81LGbVpjq2AMiFWGSROZBnJmnjYuK%2FGYfsRoH3jc1UEBHRDSrjcXixFN9TFDAQhJvMeX9Yki5qoQ%2FuMCI9InSaHo8CqtsvhxmE7Dcs%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
89e724992ed83603-FRA
alt-svc
h3=":443"; ma=86400
logo.png
www.hedan.rr.nu/img/
1 MB
1 MB
Image
General
Full URL
https://www.hedan.rr.nu/img/logo.png
Requested by
Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.47.11 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b140ce5cbf9bf2a79282a7b988a91f412dd4e0683d5175fa542f8fe66081f9b5
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Jul 2024 11:51:24 GMT
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"7a63d84654b49a718ae853b8872d612c"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BZSunArtXgNRdx0O1LckoB0y82OkEmwBxyC%2Fs60drnG1QZOJxgZjuKRCXnBvXYEzKFRYbchW98QoM5LC1jn3jkLSLoCn8CDlTR6wNmPJBa8m6gCmgpNtNK1wItEEYbxwF7g%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
89e72499cf813603-FRA
alt-svc
h3=":443"; ma=86400
content-length
1096720
bird.png
www.hedan.rr.nu/img/
24 KB
25 KB
Image
General
Full URL
https://www.hedan.rr.nu/img/bird.png
Requested by
Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.47.11 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
775800ecf32595fac19e09efeefe175104c8f58086958278d5fe5456b629baa0
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Jul 2024 11:51:24 GMT
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"14a913eea8eed6a4fb4ed6789a2b4946"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9zkCh3xbZSu5jYMZcnoPLjqFclrbfnsgMuAx4kx4qJLrqMJff5%2FBkF9HzvXmAAZ6AiNa5gDjNq8zK5dK18Nau9QnxDTXxWqH43DJzslJgvzxl6UdP03QxCifTSnxyjeriGI%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
89e72499cf823603-FRA
alt-svc
h3=":443"; ma=86400
content-length
24865
st.png
www.hedan.rr.nu/img/
184 KB
184 KB
Image
General
Full URL
https://www.hedan.rr.nu/img/st.png
Requested by
Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.47.11 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
734cb8c4e906c83e72713a3aff5a2b8b1f2e1eed50f08bdfab890adef5f43557
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Jul 2024 11:51:24 GMT
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"787dfb1cc1aa1fb96c80db0f93784746"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SxFpgbGYYFyI4kJX0Ua1ig3YE9dKD2CjMDcBL7x0514pb1KTtuubPi4HxohFYJpng6FKGu9uJBYe59FX7sLQB60y8GeyDqsC%2FjCq1G3RZXYBFeuNBfwYf99yMOgf0eLXqGw%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
89e724992edb3603-FRA
alt-svc
h3=":443"; ma=86400
content-length
188036
forum.png
www.hedan.rr.nu/img/
4 MB
4 MB
Image
General
Full URL
https://www.hedan.rr.nu/img/forum.png
Requested by
Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.47.11 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cebaf3897d64760fa3fde87d5ff7e6806c895c87b3dcc4494137e14b817c3900
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Jul 2024 11:51:24 GMT
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"89ae6ed587ad2fa9ee500d50d45154fc"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2kgiipfVJmXE%2BYOvJP9V1HYX4iDYw8gsmTig8pBBCt2ZSXH%2FzFg5w0E96JtycN6kYEwFfE2HWAjVeIatIkI1iCU%2B6bgO%2FnFbUtLqi3dRZVywVPDD2gtdbzdG%2FxuWH%2Fu%2F29E%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
89e724992edc3603-FRA
alt-svc
h3=":443"; ma=86400
content-length
4142179
bugs.png
www.hedan.rr.nu/img/
2 MB
2 MB
Image
General
Full URL
https://www.hedan.rr.nu/img/bugs.png
Requested by
Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.47.11 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c75c6c164c77e9cb9293e5c767c83e8ad459fd69da30644add1daf3ae7e75996
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Jul 2024 11:51:24 GMT
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"c094c336e3c1befbb53c61a58bcab9b8"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fKR8cgva04O%2F3M7YUFWe7HmEAAWOeKXzgfUvQcIoCR%2Bm5rOoKqSpNMtJ%2FffsyFVsvjI0Ht2wheC6BrjJ%2Br97%2FFnX8e8eHkxa2j%2BerGkL%2B4ieA7Z0Xe0yh4FezU0GwvVS5FU%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
89e72499cf7b3603-FRA
alt-svc
h3=":443"; ma=86400
content-length
2521721
map.png
www.hedan.rr.nu/img/
186 KB
187 KB
Image
General
Full URL
https://www.hedan.rr.nu/img/map.png
Requested by
Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.47.11 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
455ecebc82403fdcfdc760886996690b4793c4d86834577fd99861fbb50b4bfe
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Jul 2024 11:51:24 GMT
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"1d6681c88e225244a873f5c380d3f4d2"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QSy1UU0AjqLjokF%2Bhm1OGDq48Lcs7Eb1NzPEQKWP%2BmRsL5eQzSw90T%2F76q%2Fy%2Bz3v9qaw9JYBuoBlhV2akeHlxXhXbCWc8bfWk4x2T5luLAoxiqc%2BMcybyhYc12zDiNPfvmI%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
89e72499cf7e3603-FRA
alt-svc
h3=":443"; ma=86400
content-length
190865
gjs1z5cvkr
www.clarity.ms/tag/
637 B
1000 B
Script
General
Full URL
https://www.clarity.ms/tag/gjs1z5cvkr
Requested by
Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:29:1::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
d1f56fc38e8d50795552832c4b20432fedee68a763682b9fc648fc95b7c0c334

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

expires
-1
date
Fri, 05 Jul 2024 11:51:24 GMT
x-azure-ref
20240705T115124Z-15b895685ccqjjt8vg64q1zygw000000043g0000000009wm
x-cache
CONFIG_NOCACHE
content-type
application/x-javascript
cache-control
no-cache, no-store
accept-ranges
bytes
content-length
637
request-context
appId=cid-v1:2f7711a9-b21e-4abe-a9d6-5b0ce5d18b64
font-awesome.min.css
cdn.jsdelivr.net/npm/font-awesome/css/
30 KB
7 KB
Stylesheet
General
Full URL
https://cdn.jsdelivr.net/npm/font-awesome/css/font-awesome.min.css
Requested by
Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Fri, 05 Jul 2024 11:51:24 GMT
x-content-type-options
nosniff
content-encoding
br
age
40054
x-jsd-version
4.7.0
x-cache
HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
7114
x-served-by
cache-fra-etou8220033-FRA
x-jsd-version-type
version
etag
W/"7918-USx9eQM+MCipvmG1QM8aaHDIlvg"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
semantic.min.css
cdn.jsdelivr.net/semantic-ui/2.2.4/
537 KB
81 KB
Stylesheet
General
Full URL
https://cdn.jsdelivr.net/semantic-ui/2.2.4/semantic.min.css
Requested by
Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
050c1211e2f1b838207de3de15da3757dd3aadcbdc269912018aff2ea736a12a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
x-content-type-options
nosniff
date
Fri, 05 Jul 2024 11:51:24 GMT
age
811625
x-cache
HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
83012
x-served-by
cache-fra-etou8220033-FRA
etag
W/"86243-07ZDO+Btgeq8oMe1q0O1wfgFsKk"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
jquery.min.js
cdn.jsdelivr.net/npm/jquery@3.2/dist/
85 KB
31 KB
Script
General
Full URL
https://cdn.jsdelivr.net/npm/jquery@3.2/dist/jquery.min.js
Requested by
Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Fri, 05 Jul 2024 11:51:24 GMT
x-content-type-options
nosniff
content-encoding
br
age
17354
x-jsd-version
3.2.1
x-cache
HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
31984
x-served-by
cache-fra-etou8220033-FRA
x-jsd-version-type
version
etag
W/"15283-EFUBjCirQQh++czv5BFgaJPavqI"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
semantic.min.js
cdn.jsdelivr.net/semantic-ui/2.2.4/
269 KB
67 KB
Script
General
Full URL
https://cdn.jsdelivr.net/semantic-ui/2.2.4/semantic.min.js
Requested by
Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
06561773aec97881597f18ec78be970815858bb330c4aa14105eab3c8cc79813
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
br
x-content-type-options
nosniff
date
Fri, 05 Jul 2024 11:51:24 GMT
age
1503061
x-cache
HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
67979
x-served-by
cache-fra-etou8220033-FRA
etag
W/"433a0-DtY0XSdutfvWhsaTOgbjYvnF1Ak"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
jquery.scrollTo.min.js
cdn.jsdelivr.net/npm/jquery.scrollto@2.1.2/
2 KB
2 KB
Script
General
Full URL
https://cdn.jsdelivr.net/npm/jquery.scrollto@2.1.2/jquery.scrollTo.min.js
Requested by
Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
ed04b5707b07ef987720582b14ab1d8662871e95aa17cdac6fff6f34ba9caacd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Fri, 05 Jul 2024 11:51:24 GMT
x-content-type-options
nosniff
content-encoding
br
age
1401894
x-jsd-version
2.1.2
x-cache
HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
1357
x-served-by
cache-fra-etou8220033-FRA
x-jsd-version-type
version
etag
W/"98f-WLY0jlgHHtauqlQXy4RmBiZdk9g"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges
bytes
timing-allow-origin
*
autoload.js
cdn.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/
2 KB
1 KB
Script
General
Full URL
https://cdn.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/autoload.js
Requested by
Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
acd8cc92baa460bfc303aca613f09f7912be7615999e30a453c6acb316b4d534
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Fri, 05 Jul 2024 11:51:24 GMT
x-content-type-options
nosniff
content-encoding
br
age
28227
x-jsd-version
0.9.0
x-cache
HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
1115
x-served-by
cache-fra-etou8220033-FRA
x-jsd-version-type
version
etag
W/"7df-LZ4N/mlwFqyDQhqPv7g36r1joFw"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
canvas-nest.min.js
cdn.bootcss.com/canvas-nest.js/1.0.1/
2 KB
1 KB
Script
General
Full URL
https://cdn.bootcss.com/canvas-nest.js/1.0.1/canvas-nest.min.js
Requested by
Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
154.85.69.9 Singapore, Singapore, ASN139057 (LDPL-AS-AP LEGEND DYNASTY PTE. LTD., SG),
Reverse DNS
Software
nginx /
Resource Hash
485463b08985a0daa7c07c82972e1e09c90d665726f8180fe7dc358f7fcb5a3e

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

expires
Fri, 05 Jul 2024 11:51:25 GMT
pragma
no-cache
date
Fri, 05 Jul 2024 11:51:25 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
access-control-allow-methods
GET, POST, PATCH, PUT, DELETE, OPTIONS
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
access-control-allow-headers
Authorization, Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, X-CSRF-TOKEN, X-Requested-With,token
x-ser
BC77_lt-qinghai-xining-7-cache-9, BC31_US-Georgia-atlanta-1-cache-4, BC8_DE-Frankfurt-Frankfurt-11-cache-1
autoload.js
apii.ctose.cn/live2d/Source-One/default/
0
0

player.js
myhkw.cn/player/js/
82 KB
29 KB
Script
General
Full URL
https://myhkw.cn/player/js/player.js
Requested by
Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
116.207.181.224 , China, ASN136191 (CHINATELECOM-HUBEI-YICHANG-IDC YICHANG, Hubei Province, P.R.China., CN),
Reverse DNS
Software
Byte-nginx /
Resource Hash
190948952131adf151e50aa94c281280992382a048030b7daae0e42e0939356c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Strict-Transport-Security
max-age=31536000
Content-Encoding
gzip
via
bdengine-75f66ccb55-zknx4
Date
Fri, 05 Jul 2024 11:51:26 GMT
x-tt-trace-tag
id=5
Age
0
Transfer-Encoding
chunked
X-Bdcdn-Cache-Status
TCP_MISS
Connection
keep-alive
x-request-id
144dfec65dd3a1640eba76654f0ded81
Last-Modified
Mon, 27 May 2024 02:08:34 GMT
Server
Byte-nginx
Etag
W/"6653eb22-1478d"
Vary
Accept-Encoding
Content-Type
application/javascript
Access-Control-Allow-Origin
*
x-request-ip
217.114.218.20
Cache-Control
max-age=43200
x-response-cinfo
217.114.218.20
x-response-cache
miss
Expires
Fri, 05 Jul 2024 23:51:26 GMT
truncated
/
43 KB
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
427f7a363b07e17ab7900d38d315c2bb2e4e66f8239f837c72de4321931117d9

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type
image/png
5dd408c68e0e2e3ee933d777.gif
www.hedan.rr.nu/static/images/
31 KB
31 KB
Image
General
Full URL
https://www.hedan.rr.nu/static/images/5dd408c68e0e2e3ee933d777.gif
Requested by
Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.47.11 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Jul 2024 11:51:24 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QmzVO7QCTzJdR%2FprwDJ5M%2BBab%2BFS9wYs7X9EcsrcjoOK8irLPSvO6K8XrTPd7asL70ioCOjNwTPvJd%2Fqy4mzjp%2FOt12shhRmxGxKloKA2sOpQgMCKf%2BSU40UhkNZtnAlTlo%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
89e72499cf853603-FRA
alt-svc
h3=":443"; ma=86400
bg_c.png
www.hedan.rr.nu/style/images/
14 KB
14 KB
Image
General
Full URL
https://www.hedan.rr.nu/style/images/bg_c.png
Requested by
Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/css/css.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.47.11 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/css/css.css
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Jul 2024 11:51:24 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AD46we9riH2N01qgBrwLwKsloK4wnxwTYvWRkAhplGDHh6aa6s8WdhcrN6Ma2z9pUhvqbWwZeKFB9Q%2FO9hw1v6IA54QsYBAL%2FcriMX9FZfLpTngAFzBujQh8pKPWiFfo42s%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
89e72499cf883603-FRA
alt-svc
h3=":443"; ma=86400
t01bded47820389b871.png
www.hedan.rr.nu/style/images/
47 KB
47 KB
Image
General
Full URL
https://www.hedan.rr.nu/style/images/t01bded47820389b871.png
Requested by
Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/css/css.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.47.11 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/css/css.css
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Jul 2024 11:51:24 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=75szyPvcKyMnh7jtlgHkeZD%2B5tNklHeBaVyDlNlyYfJNx%2B19e1H7XLM9yPQKmknLeI4o85eLHKmKcLy4g9OAcehjlNcgX7qVlxsibAIJ5CB2V%2FeAo6c6yl%2F0qmtucCld2ao%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
89e72499cf8a3603-FRA
alt-svc
h3=":443"; ma=86400
bg_cover.png
www.hedan.rr.nu/style/images/
31 KB
31 KB
Image
General
Full URL
https://www.hedan.rr.nu/style/images/bg_cover.png
Requested by
Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/css/css.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.47.11 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/css/css.css
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Jul 2024 11:51:24 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jW5EE1KyfEoiykSPVJpX7CNM9XSqeQ0EcPcRwFZfDVXZaEQRJbSzifAC8C8KuMkbNXzoms%2FwkZhGmqbmGRnyc%2FQ37HdBf8WTgUnB3xiMmQKDl4kgI4UXXd7eZGfo838XAcQ%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/html; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
89e72499cf8c3603-FRA
alt-svc
h3=":443"; ma=86400
css
fonts.googleapis.com/
3 KB
885 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Lato:400,700,400italic,700italic&subset=latin
Requested by
Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/semantic-ui/2.2.4/semantic.min.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
5e245f87c91e4cc60c4f66311f2691f187b9f710259f5f75cd6beff7598d6ddd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://cdn.jsdelivr.net/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000
date
Fri, 05 Jul 2024 11:51:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Fri, 05 Jul 2024 11:28:49 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 05 Jul 2024 11:51:24 GMT
clarity.js
www.clarity.ms/s/0.7.34/
61 KB
26 KB
Script
General
Full URL
https://www.clarity.ms/s/0.7.34/clarity.js
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/tag/gjs1z5cvkr
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:29:1::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
fffc6ed23cfeabaaace717503bfabd907816869c8c5ff38a2127b8284e8c5988

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Jul 2024 11:51:24 GMT
content-encoding
br
last-modified
Thu, 23 May 2024 23:20:12 GMT
etag
W/"0x8DC7B7EE5574D78"
vary
Accept-Encoding
x-azure-ref
20240705T115124Z-15b895685ccqjjt8vg64q1zygw000000043g0000000009wu
content-type
application/javascript;charset=utf-8
access-control-allow-origin
*
x-ms-request-id
10d6d463-701e-0001-3003-cd7107000000
cache-control
public, max-age=86400
x-cache
TCP_HIT
x-ms-version
2018-03-28
x-fd-int-roxy-purgeid
51562430
S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v24/
23 KB
24 KB
Font
General
Full URL
https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:400,700,400italic,700italic&subset=latin
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fonts.googleapis.com/
Origin
https://www.hedan.rr.nu
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 02 Jul 2024 14:56:54 GMT
x-content-type-options
nosniff
age
248071
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
23580
x-xss-protection
0
last-modified
Tue, 02 May 2023 15:17:22 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 02 Jul 2025 14:56:54 GMT
S6u9w4BMUTPHh6UVSwiPGQ.woff2
fonts.gstatic.com/s/lato/v24/
23 KB
23 KB
Font
General
Full URL
https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:400,700,400italic,700italic&subset=latin
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://fonts.googleapis.com/
Origin
https://www.hedan.rr.nu
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 04 Jul 2024 18:06:58 GMT
x-content-type-options
nosniff
age
63867
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
23040
x-xss-protection
0
last-modified
Tue, 02 May 2023 15:07:25 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 04 Jul 2025 18:06:58 GMT
waifu.css
fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/
5 KB
1 KB
Stylesheet
General
Full URL
https://fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/waifu.css
Requested by
Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/autoload.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
9610bbc4db6f94e7c35f7f8112635a6f66996b69f59bcdca9eafcf1289f3e192
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Fri, 05 Jul 2024 11:51:25 GMT
x-content-type-options
nosniff
content-encoding
br
age
26206
x-jsd-version
0.9.0
x-cache
HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
1061
x-served-by
cache-fra-etou8220033-FRA
x-jsd-version-type
version
etag
W/"1349-IFANr7FuywwY52CqrawHsCO6oVo"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
live2d.min.js
fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/
148 KB
41 KB
Script
General
Full URL
https://fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/live2d.min.js
Requested by
Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/autoload.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
2135c76b0a63d0f6c9c48df746d0eec6ead131999ba6f9678488472e95e1edd6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Fri, 05 Jul 2024 11:51:25 GMT
x-content-type-options
nosniff
content-encoding
br
age
19415
x-jsd-version
0.9.0
x-cache
HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
42242
x-served-by
cache-fra-etou8220033-FRA
x-jsd-version-type
version
etag
W/"24f9d-lDg/th3oFcP4Bq4/EQJrvP44QII"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
waifu-tips.js
fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/
12 KB
5 KB
Script
General
Full URL
https://fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/waifu-tips.js
Requested by
Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/autoload.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
f5977b6a02d773e4d59939dac292a13ea324db2b75ac69bd947124fe97e5a537
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Fri, 05 Jul 2024 11:51:25 GMT
x-content-type-options
nosniff
content-encoding
br
age
24447
x-jsd-version
0.9.0
x-cache
HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
4621
x-served-by
cache-fra-etou8220033-FRA
x-jsd-version-type
version
etag
W/"2e24-nJ8kEU5OLie/Bli6AfVwLRWNxlg"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
collect
q.clarity.ms/
0
279 B
XHR
General
Full URL
https://q.clarity.ms/collect
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.34/clarity.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.231.53.73 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept
application/x-clarity-gzip
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Access-Control-Allow-Origin
https://www.hedan.rr.nu
Date
Fri, 05 Jul 2024 11:51:25 GMT
Access-Control-Allow-Credentials
true
Server
nginx
Connection
keep-alive
Vary
Origin
Request-Context
appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8
model_list.json
fastly.jsdelivr.net/gh/fghrsh/live2d_api/
2 KB
849 B
Fetch
General
Full URL
https://fastly.jsdelivr.net/gh/fghrsh/live2d_api/model_list.json
Requested by
Host: fastly.jsdelivr.net
URL: https://fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/waifu-tips.js
Protocol
H3
Security
QUIC, , AES_256_GCM
Server
151.101.129.229 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
7ed2434b5c1a9b5ae6498c3ab49742b4ba63de914cba8d37035f0072d3c2404c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Fri, 05 Jul 2024 11:51:25 GMT
x-content-type-options
nosniff
content-encoding
br
age
36238
x-jsd-version
1.0.1
x-cache
HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
494
x-served-by
cache-fra-etou8220027-FRA
x-jsd-version-type
version
etag
W/"674-5X9m1mMOU+NK/DwSIDkdJivsUK0"
vary
Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
waifu-tips.json
fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/
11 KB
5 KB
Fetch
General
Full URL
https://fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/waifu-tips.json
Requested by
Host: fastly.jsdelivr.net
URL: https://fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/waifu-tips.js
Protocol
H3
Security
QUIC, , AES_256_GCM
Server
151.101.129.229 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
8785a3daf3723b7a8f708249b4cdd10faefcbfb1c70546a00d4fa92ea6197fbb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Fri, 05 Jul 2024 11:51:25 GMT
x-content-type-options
nosniff
content-encoding
br
age
29574
x-jsd-version
0.9.0
x-cache
HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
5028
x-served-by
cache-fra-etou8220027-FRA
x-jsd-version-type
version
etag
W/"2d1c-rJaQFqZ8liM2qrulZBaBuzUPV4U"
vary
Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
index.json
fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/
1 KB
717 B
XHR
General
Full URL
https://fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/index.json
Requested by
Host: fastly.jsdelivr.net
URL: https://fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/live2d.min.js
Protocol
H3
Security
QUIC, , AES_256_GCM
Server
151.101.129.229 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
b718cca2727a8043608202e3adccb528433f15e14a30e9d752d047ac5fd123bc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Fri, 05 Jul 2024 11:51:25 GMT
x-content-type-options
nosniff
content-encoding
br
age
9510
x-jsd-version
1.0.1
x-cache
HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
364
x-served-by
cache-fra-etou8220027-FRA
x-jsd-version-type
version
etag
W/"537-PuSMBXf54kkeGutzZrRkznlTed8"
vary
Accept-Encoding
content-type
application/json; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
model.moc
fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/
99 KB
99 KB
XHR
General
Full URL
https://fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/model.moc
Requested by
Host: fastly.jsdelivr.net
URL: https://fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/live2d.min.js
Protocol
H3
Security
QUIC, , AES_256_GCM
Server
151.101.129.229 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
f19c7a20bf7eafcc1ef303b9c9c52d0face97aa0990129aeddec8d5e089d1ef5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Fri, 05 Jul 2024 11:51:25 GMT
x-content-type-options
nosniff
age
41007
x-jsd-version
1.0.1
x-cache
HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
101353
x-served-by
cache-fra-etou8220027-FRA
x-jsd-version-type
version
etag
W/"18be9-7Evs37ZKciqHiqae2EKQQ0Avclk"
vary
Accept-Encoding
content-type
application/octet-stream
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
default-costume.png
fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/textures/
445 KB
446 KB
Image
General
Full URL
https://fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/textures/default-costume.png
Requested by
Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/
Protocol
H3
Security
QUIC, , AES_256_GCM
Server
151.101.129.229 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
42804a9e7164fbefa4144704c963a7e3a06d389ec83d0a731e5c902cea594043
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Origin
https://www.hedan.rr.nu
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Fri, 05 Jul 2024 11:51:25 GMT
x-content-type-options
nosniff
age
17420
x-jsd-version
1.0.1
x-cache
HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
455918
x-served-by
cache-fra-etou8220027-FRA
x-jsd-version-type
version
etag
W/"6f4ee-zdl5Jl0LhU3YZ5EZ1zwu6jDg430"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
Breath1.mtn
fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/motions/
3 KB
4 KB
XHR
General
Full URL
https://fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/motions/Breath1.mtn
Requested by
Host: fastly.jsdelivr.net
URL: https://fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/live2d.min.js
Protocol
H3
Security
QUIC, , AES_256_GCM
Server
151.101.129.229 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
21c4df569b781c179cf31af94f160d786c7b8242bedeea5bc4e9be321c5be906
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Fri, 05 Jul 2024 11:51:25 GMT
x-content-type-options
nosniff
age
25077
x-jsd-version
1.0.1
x-cache
HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
3283
x-served-by
cache-fra-etou8220027-FRA
x-jsd-version-type
version
etag
W/"cd3-6f4q1oumauLL+NL0ZiuumzFEscw"
vary
Accept-Encoding
content-type
application/octet-stream
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
Breath2.mtn
fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/motions/
6 KB
7 KB
XHR
General
Full URL
https://fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/motions/Breath2.mtn
Requested by
Host: fastly.jsdelivr.net
URL: https://fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/live2d.min.js
Protocol
H3
Security
QUIC, , AES_256_GCM
Server
151.101.129.229 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
e073ab0c5ad4ffe4bad2ddac87433a6937e10e0c40a84e6a6c285dc2c8890d6e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Fri, 05 Jul 2024 11:51:25 GMT
x-content-type-options
nosniff
age
2387
x-jsd-version
1.0.1
x-cache
HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
6489
x-served-by
cache-fra-etou8220027-FRA
x-jsd-version-type
version
etag
W/"1959-HBs1QZ4jcyfl1vcYe3c40rhT+pI"
vary
Accept-Encoding
content-type
application/octet-stream
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
Breath3.mtn
fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/motions/
9 KB
9 KB
XHR
General
Full URL
https://fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/motions/Breath3.mtn
Requested by
Host: fastly.jsdelivr.net
URL: https://fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/live2d.min.js
Protocol
H3
Security
QUIC, , AES_256_GCM
Server
151.101.129.229 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
1eb42542e7f5b645f4b83ceac7bae8194d1b86fa2602385da22286fe8a330a98
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Fri, 05 Jul 2024 11:51:25 GMT
x-content-type-options
nosniff
age
2883
x-jsd-version
1.0.1
x-cache
HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
9363
x-served-by
cache-fra-etou8220027-FRA
x-jsd-version-type
version
etag
W/"2493-hIwnQKC4JKU8WSyAUs4GRTsco0Y"
vary
Accept-Encoding
content-type
application/octet-stream
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
Breath5.mtn
fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/motions/
12 KB
13 KB
XHR
General
Full URL
https://fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/motions/Breath5.mtn
Requested by
Host: fastly.jsdelivr.net
URL: https://fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/live2d.min.js
Protocol
H3
Security
QUIC, , AES_256_GCM
Server
151.101.129.229 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
c5f8f19c7cbec6a8107e742297fb4e79fd781121ad468ec30e37b058f5494556
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Fri, 05 Jul 2024 11:51:25 GMT
x-content-type-options
nosniff
age
37937
x-jsd-version
1.0.1
x-cache
HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
12530
x-served-by
cache-fra-etou8220027-FRA
x-jsd-version-type
version
etag
W/"30f2-30VVHrCFvWDsDaKqBTv1DTYvj5g"
vary
Accept-Encoding
content-type
application/octet-stream
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
Breath7.mtn
fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/motions/
9 KB
9 KB
XHR
General
Full URL
https://fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/motions/Breath7.mtn
Requested by
Host: fastly.jsdelivr.net
URL: https://fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/live2d.min.js
Protocol
H3
Security
QUIC, , AES_256_GCM
Server
151.101.129.229 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
d34775b817bf40359e2d9dd90749d5e32355e3ed2325700e80b90347fb65558c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Fri, 05 Jul 2024 11:51:25 GMT
x-content-type-options
nosniff
age
22894
x-jsd-version
1.0.1
x-cache
HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
9310
x-served-by
cache-fra-etou8220027-FRA
x-jsd-version-type
version
etag
W/"245e-HPzLJPkqBz6fZEyqpm1PZCaV2HM"
vary
Accept-Encoding
content-type
application/octet-stream
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
Breath8.mtn
fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/motions/
12 KB
13 KB
XHR
General
Full URL
https://fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/motions/Breath8.mtn
Requested by
Host: fastly.jsdelivr.net
URL: https://fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/live2d.min.js
Protocol
H3
Security
QUIC, , AES_256_GCM
Server
151.101.129.229 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
71958456c6d32df0e3120ab972e0caa220108f11628e65617c26b83a313b86e8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Fri, 05 Jul 2024 11:51:25 GMT
x-content-type-options
nosniff
age
7835
x-jsd-version
1.0.1
x-cache
HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
12528
x-served-by
cache-fra-etou8220027-FRA
x-jsd-version-type
version
etag
W/"30f0-0rit+8rxB/YXzZQBz3y6wma5Icc"
vary
Accept-Encoding
content-type
application/octet-stream
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
Breath9.mtn
fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/motions/
10 KB
10 KB
XHR
General
Full URL
https://fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/motions/Breath9.mtn
Requested by
Host: fastly.jsdelivr.net
URL: https://fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/live2d.min.js
Protocol
H3
Security
QUIC, , AES_256_GCM
Server
151.101.129.229 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
1a694fe6913171fcd6a000ce17bf774f84a9e9c0fb14df9ff1961baeeec3f23b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Fri, 05 Jul 2024 11:51:25 GMT
x-content-type-options
nosniff
age
30553
x-jsd-version
1.0.1
x-cache
HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
9882
x-served-by
cache-fra-etou8220027-FRA
x-jsd-version-type
version
etag
W/"269a-4Yuji2K0F9yz4t974VzLnEh3iNY"
vary
Accept-Encoding
content-type
application/octet-stream
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
Sleeping.mtn
fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/motions/
24 KB
25 KB
XHR
General
Full URL
https://fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/motions/Sleeping.mtn
Requested by
Host: fastly.jsdelivr.net
URL: https://fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/live2d.min.js
Protocol
H3
Security
QUIC, , AES_256_GCM
Server
151.101.129.229 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
fe42aebb3acdf53d4edaef71733067238d10b6a78aad19299c3a24b06db1b4fe
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Fri, 05 Jul 2024 11:51:25 GMT
x-content-type-options
nosniff
age
633
x-jsd-version
1.0.1
x-cache
HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
25043
x-served-by
cache-fra-etou8220027-FRA
x-jsd-version-type
version
etag
W/"61d3-fNTCqWHqtE+crIz0neloUMXb0g0"
vary
Accept-Encoding
content-type
application/octet-stream
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
Breath1.mtn
fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/motions/
3 KB
0
XHR
General
Full URL
https://fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/motions/Breath1.mtn
Requested by
Host: fastly.jsdelivr.net
URL: https://fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/live2d.min.js
Protocol
H3
Security
QUIC, , AES_256_GCM
Server
151.101.129.229 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
21c4df569b781c179cf31af94f160d786c7b8242bedeea5bc4e9be321c5be906
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Jul 2024 11:51:25 GMT
x-content-type-options
nosniff
age
25077
x-jsd-version
1.0.1
x-cache
HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length
3283
x-served-by
cache-fra-etou8220027-FRA
x-jsd-version-type
version
etag
W/"cd3-6f4q1oumauLL+NL0ZiuumzFEscw"
vary
Accept-Encoding
content-type
application/octet-stream
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=604800, s-maxage=43200
accept-ranges
bytes
timing-allow-origin
*
collect
q.clarity.ms/
0
279 B
XHR
General
Full URL
https://q.clarity.ms/collect
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.34/clarity.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.231.53.73 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept
application/x-clarity-gzip
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Access-Control-Allow-Origin
https://www.hedan.rr.nu
Date
Fri, 05 Jul 2024 11:51:26 GMT
Access-Control-Allow-Credentials
true
Server
nginx
Connection
keep-alive
Vary
Origin
Request-Context
appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8
player-l.css
api.myhkw.cn/cache/css/
Redirect Chain
  • https://myhkw.cn/api/playercss?id=demo
  • https://api.myhkw.cn/cache/css/player-l.css?v=20240630
27 KB
6 KB
Stylesheet
General
Full URL
https://api.myhkw.cn/cache/css/player-l.css?v=20240630
Requested by
Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/
Protocol
HTTP/1.1
Server
110.42.2.205 , China, ASN136188 (CHINATELECOM-ZHEJIANG-NINGBO-IDC NINGBO, ZHEJIANG Province, P.R.China., CN),
Reverse DNS
Software
nginx /
Resource Hash
9dd2b5c4ab64c7d98baee85a3e4bed2ad319dd8548b191aed554a8ffdb44b0ae

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://www.hedan.rr.nu/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date
Fri, 05 Jul 2024 11:59:19 GMT
Content-Encoding
gzip
Server
nginx
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
text/css
Access-Control-Allow-Origin
*
wb_list
not_in_list
Access-Control-Allow-Credentials
true
cache_hit
hit
Access-Control-Allow-Headers
x-csrf-token,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
Content-Length
5585

Redirect headers

Date
Fri, 05 Jul 2024 11:51:26 GMT
Strict-Transport-Security
max-age=31536000
via
bdengine-75f66ccb55-zknx4
x-tt-trace-tag
id=5
Transfer-Encoding
chunked
X-Bdcdn-Cache-Status
TCP_MISS
Connection
keep-alive
x-request-id
9e101ac60dc2f2955329e7496069ce85
Server
Byte-nginx
Access-Control-Max-Age
1800
Access-Control-Allow-Methods
GET, POST, PATCH, PUT, DELETE, OPTIONS
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Location
https://api.myhkw.cn/cache/css/player-l.css?v=20240630
x-request-ip
217.114.218.20
Cache-Control
no-cache,must-revalidate
Access-Control-Allow-Credentials
true
x-response-cinfo
217.114.218.20
x-response-cache
miss
Access-Control-Allow-Headers
Authorization, Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, X-CSRF-TOKEN, X-Requested-With
demo.js
cdn.myhkw.cn/cache/playlist/
Redirect Chain
  • https://myhkw.cn/api/playlist?id=demo
  • https://cdn.myhkw.cn/cache/playlist/demo.js?v=20240430-1720109201
286 KB
108 KB
XHR
General
Full URL
https://cdn.myhkw.cn/cache/playlist/demo.js?v=20240430-1720109201
Requested by
Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/
Protocol
H2
Server
101.42.40.156 Beijing, China, ASN45090 (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),
Reverse DNS
Software
nginx /
Resource Hash
1091869ea9381acffa3fc0e788eecf199747ff18241a79f94fc444f5da3e80de
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://www.hedan.rr.nu/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Fri, 05 Jul 2024 11:51:29 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Thu, 04 Jul 2024 16:05:10 GMT
server
nginx
etag
W/"6686c836-477b3"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=43200
access-control-allow-credentials
true
access-control-allow-headers
x-csrf-token,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
expires
Fri, 05 Jul 2024 23:51:29 GMT

Redirect headers

Date
Fri, 05 Jul 2024 11:51:27 GMT
Strict-Transport-Security
max-age=31536000
via
bdengine-75f66ccb55-lpsqd
x-tt-trace-tag
id=5
Transfer-Encoding
chunked
X-Bdcdn-Cache-Status
TCP_MISS
Connection
keep-alive
x-request-id
9e914ffbb827a3b235643f1c4019ed98
Server
Byte-nginx
Access-Control-Max-Age
1800
Access-Control-Allow-Methods
GET, POST, PATCH, PUT, DELETE, OPTIONS
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Location
https://cdn.myhkw.cn/cache/playlist/demo.js?v=20240430-1720109201
x-request-ip
217.114.218.20
Cache-Control
no-cache,must-revalidate
Access-Control-Allow-Credentials
true
x-response-cinfo
217.114.218.20
x-response-cache
miss
Access-Control-Allow-Headers
Authorization, Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, X-CSRF-TOKEN, X-Requested-With
c
api.tongjiniao.com/
11 KB
4 KB
Script
General
Full URL
https://api.tongjiniao.com/c?_=610877997219291136
Requested by
Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
113.13.246.102 , China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),
Reverse DNS
Software
nginx /
Resource Hash
45cd9f34002a0f28737e26b85712c88fcca730d8d1f65ec4aa33c7925184c240

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Jul 2024 11:51:27 GMT
content-encoding
br
server
nginx
content-type
text/plain; charset=utf-8
access-control-allow-origin
*
cache-control
no-cache,no-store, no-cache
access-control-allow-credentials
true
access-control-allow-headers
DNT,Keep-Alive,User-Agent,Cache-Control,Content-Type,Authorization
content-length
4186
r
api.tongjiniao.com/
42 B
305 B
XHR
General
Full URL
https://api.tongjiniao.com/r?t=1720180287&p=667818288559321088
Requested by
Host: api.tongjiniao.com
URL: https://api.tongjiniao.com/c?_=610877997219291136
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
113.13.246.102 , China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),
Reverse DNS
Software
nginx /
Resource Hash
7ee2a3a5e4b1e50bb31b22d8399f9917073e0421d56c5da3699371ec79af2082

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform
"Win32"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

date
Fri, 05 Jul 2024 11:51:28 GMT
content-encoding
br
server
nginx
content-type
application/json; charset=utf-8
access-control-allow-origin
*
cache-control
no-cache,no-store, no-cache
access-control-allow-credentials
true
access-control-allow-headers
DNT,Keep-Alive,User-Agent,Cache-Control,Content-Type,Authorization
content-length
46
link.cur
api.myhkw.cn/player/css/
4 KB
5 KB
Image
General
Full URL
https://api.myhkw.cn/player/css/link.cur
Requested by
Host: api.myhkw.cn
URL: https://api.myhkw.cn/cache/css/player-l.css?v=20240630
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
110.42.2.205 , China, ASN136188 (CHINATELECOM-ZHEJIANG-NINGBO-IDC NINGBO, ZHEJIANG Province, P.R.China., CN),
Reverse DNS
Software
nginx /
Resource Hash
4cb477acd16dffe9da6c574ca89f9e912ae001ea9a6300ca5673aa7b3784ca97

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://api.myhkw.cn/cache/css/player-l.css?v=20240630
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 05 Jul 2024 11:59:20 GMT
Server
nginx
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
application/octet-stream
Access-Control-Allow-Origin
*
wb_list
not_in_list
Access-Control-Allow-Credentials
true
cache_hit
hit
Access-Control-Allow-Headers
x-csrf-token,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
Content-Length
4286
myhkfont.woff2
cdn.myhkw.cn/player/icon/
3 KB
3 KB
Font
General
Full URL
https://cdn.myhkw.cn/player/icon/myhkfont.woff2
Requested by
Host: api.myhkw.cn
URL: https://api.myhkw.cn/cache/css/player-l.css?v=20240630
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
101.42.40.156 Beijing, China, ASN45090 (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),
Reverse DNS
Software
nginx /
Resource Hash
b2ff75abc0e0ccbd083a87b45e64c9a62f1f6ca32c46445240026a246d30254c

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://api.myhkw.cn/
Origin
https://www.hedan.rr.nu
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Jul 2024 11:51:29 GMT
last-modified
Sun, 14 Nov 2021 10:29:27 GMT
server
nginx
etag
"6190e507-c68"
content-type
font/woff2
access-control-allow-origin
*
accept-ranges
bytes
content-length
3176
collect
q.clarity.ms/
0
279 B
XHR
General
Full URL
https://q.clarity.ms/collect
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.34/clarity.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.231.53.73 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept
application/x-clarity-gzip
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Access-Control-Allow-Origin
https://www.hedan.rr.nu
Date
Fri, 05 Jul 2024 11:51:28 GMT
Access-Control-Allow-Credentials
true
Server
nginx
Connection
keep-alive
Vary
Origin
Request-Context
appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8
586e2fd214d9277af9e353cebdfa584b.jpg
img.paulzzh.com/touhou/konachan/image/
Redirect Chain
  • https://img.paulzzh.com/touhou/random?0.9458146323980605
  • https://img.paulzzh.com/touhou/konachan/image/586e2fd214d9277af9e353cebdfa584b.jpg
221 KB
221 KB
Image
General
Full URL
https://img.paulzzh.com/touhou/konachan/image/586e2fd214d9277af9e353cebdfa584b.jpg
Protocol
H2
Server
45.154.12.123 , United Kingdom, ASN138195 (MOACKCOLTD-AS-AP MOACK.Co.LTD, KR),
Reverse DNS
Software
nginx /
Resource Hash
fdc01648678f8f3cc842bc584dacbceb76d4913d2e9e820d12838478e29c4db7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://www.hedan.rr.nu/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Fri, 05 Jul 2024 11:51:31 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
last-modified
Fri, 06 Aug 2021 19:46:07 GMT
server
nginx
etag
"610d917f-372f3"
content-type
image/jpeg
cache-control
max-age=2592000
accept-ranges
bytes
content-length
226035
expires
Sun, 04 Aug 2024 11:51:31 GMT

Redirect headers

location
https://img.paulzzh.com/touhou/konachan/image/586e2fd214d9277af9e353cebdfa584b.jpg
access-control-allow-origin
*
date
Fri, 05 Jul 2024 11:51:30 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
server
nginx
content-length
370
content-type
text/html; charset=utf-8
c.gif
c.clarity.ms/
Redirect Chain
  • https://c.clarity.ms/c.gif
  • https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=F11526CD2C964345981B4FFE46DE92BB&RedC=c.clarity.ms&MXFR=066B0C5D385E677A313C18EE3C5E69C2
  • https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=F11526CD2C964345981B4FFE46DE92BB&MUID=0C9605CDD0B862423E67117ED16A631C
42 B
441 B
Image
General
Full URL
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=F11526CD2C964345981B4FFE46DE92BB&MUID=0C9605CDD0B862423E67117ED16A631C
Protocol
H2
Server
13.74.129.1 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://www.hedan.rr.nu/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 05 Jul 2024 11:51:29 GMT
last-modified
Tue, 25 Jun 2024 19:30:12 GMT
server
Microsoft-IIS/10.0
etag
"7473f1936c7da1:0"
x-powered-by
ASP.NET
content-type
image/gif
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
private, no-cache, proxy-revalidate, no-store
accept-ranges
bytes
content-length
42

Redirect headers

pragma
no-cache
date
Fri, 05 Jul 2024 11:51:29 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 4A4FB19A4FF54FBD89F4D5DA8EE8F896 Ref B: FRAEDGE1210 Ref C: 2024-07-05T11:51:30Z
x-powered-by
ASP.NET
x-cache
CONFIG_NOCACHE
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=F11526CD2C964345981B4FFE46DE92BB&MUID=0C9605CDD0B862423E67117ED16A631C
cache-control
private, no-cache, proxy-revalidate, no-store
content-length
0
loading.gif
www.hedan.rr.nu/img/
121 KB
121 KB
Other
General
Full URL
https://www.hedan.rr.nu/img/loading.gif
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.66.47.11 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
541e8b7bb29cff24faf737079d4267649f5d2a05a30483a0fe6c86863ab0bb4e
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 05 Jul 2024 11:51:29 GMT
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"5afbc8171943bcdea6f50a657b798452"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wiNx8%2BM2hK%2FxDKCwSeZ0SgXawoyYETnfJaaMT3TAxO3iPxmt8dmiSyAMI10HqJVmnWrARuPt6JMKkeIVusbnrG%2BKnrjPmTGXvdzy2iIyVxgsckRWOto7SVfbwxwIccdRilc%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
access-control-allow-origin
*
cache-control
public, max-age=0, must-revalidate
cf-ray
89e724ba285d3603-FRA
alt-svc
h3=":443"; ma=86400
content-length
123516
109951169484028770.jpg
p3.music.126.net/y1h40wgnEzAJKGN0IksUsg==/
Redirect Chain
  • https://myhkw.cn/api/pic?song=2144209098&pic=109951169484028770&type=wy&id=demo&sign=749/n7RxhZX4Y
  • https://p3.music.126.net/y1h40wgnEzAJKGN0IksUsg==/109951169484028770.jpg?param=300y300
126 KB
127 KB
Image
General
Full URL
https://p3.music.126.net/y1h40wgnEzAJKGN0IksUsg==/109951169484028770.jpg?param=300y300
Protocol
H2
Server
240e:c3:2800:200:8000::99 , China, ASN63838 (CT-HUNAN-HENGYANG-IDC Hengyang, CN),
Reverse DNS
Software
Byte-nginx /
Resource Hash
d751057f008ca217326b558c4beca2c8ebd948b50c1f8cd06c3687355899a241

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://www.hedan.rr.nu/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Fri, 05 Jul 2024 11:51:34 GMT
via
cache01.hyct
cdn-ip
240e:c3:2800:200:8000::99
x-nos-request-id
238fec300a82000000006680037a6334
x-tt-trace-tag
id=5
content-md5
11af9ebc630fae049ffe89e690bf7f11
age
514764
cdn-user-ip
2001:1b60:2:240:3247::6
x-bdcdn-cache-status
TCP_HIT
x-nos-storage-class
STANDARD
content-length
129443
x-request-id
02f651a773c0507b897006949744660c
last-modified
Wed, 10 Apr 2024 10:11:33 Asia/Shanghai
server
Byte-nginx
cdn-source
volc
etag
77fee26a88a0c51398fd2713906390ed-1
x-nos-requesttype
imageView
access-control-allow-methods
GET,POST,OPTIONS
content-type
image/jpg
access-control-allow-origin
*
cdn-cache
HIT
x-request-ip
2001:1b60:2:240:3247::6
cache-control
max-age=31536000
access-control-allow-credentials
true
x-response-cinfo
2001:1b60:2:240:3247::6
x-response-cache
edge_hit
timing-allow-origin
*
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

Redirect headers

Date
Fri, 05 Jul 2024 11:51:32 GMT
Strict-Transport-Security
max-age=31536000
via
bdengine-75f66ccb55-zknx4
x-tt-trace-tag
id=5
Transfer-Encoding
chunked
X-Bdcdn-Cache-Status
TCP_MISS
Connection
keep-alive
x-request-id
b9aeeb1069cf7b66e574395c7cb4535d
Server
Byte-nginx
Access-Control-Max-Age
1800
Access-Control-Allow-Methods
GET, POST, PATCH, PUT, DELETE, OPTIONS
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Location
https://p3.music.126.net/y1h40wgnEzAJKGN0IksUsg==/109951169484028770.jpg?param=300y300
x-request-ip
217.114.218.20
Cache-Control
no-cache,must-revalidate
Access-Control-Allow-Credentials
true
x-response-cinfo
217.114.218.20
x-response-cache
miss
Access-Control-Allow-Headers
Authorization, Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, X-CSRF-TOKEN, X-Requested-With
83bceee69e40dea5aa652fa9f7430735.mp3
m801.music.126.net/20240705201632/6b1d29d953a008cfbd4ab15950a2abb7/jdymusic/obj/wo3DlMOGwrbDjj7DisKw/35121150388/9599/98ef/5bfc/
Redirect Chain
  • https://myhkw.cn/api/url?song=2144209098&type=wy&id=demo&sign=749/n7RxhZX4Y
  • https://m801.music.126.net/20240705201632/6b1d29d953a008cfbd4ab15950a2abb7/jdymusic/obj/wo3DlMOGwrbDjj7DisKw/35121150388/9599/98ef/5bfc/83bceee69e40dea5aa652fa9f7430735.mp3
3 MB
0
Media
General
Full URL
https://m801.music.126.net/20240705201632/6b1d29d953a008cfbd4ab15950a2abb7/jdymusic/obj/wo3DlMOGwrbDjj7DisKw/35121150388/9599/98ef/5bfc/83bceee69e40dea5aa652fa9f7430735.mp3
Protocol
H2
Server
2404:2280:1cc:0:3::a , Singapore, ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN),
Reverse DNS
Software
Tengine /
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://www.hedan.rr.nu/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Wed, 10 Apr 2024 12:00:44 GMT
via
cache23.l2cm10-2[0,0,206-0,H], cache4.l2cm10-2[1,0], cache9.l2st3-1[0,0,206-0,H], cache9.l2st3-1[1,0], cache9.l2st3-1[1,0], cache15.l2hk2[0,0,206-0,H], cache13.l2hk2[1,0], cache39.l2fr1[0,0,206-0,H], cache25.l2fr1[1,0], ens-cache7.de5[0,0,206-0,H], ens-cache10.de5[2,0]
x-nos-object-name
obj%2Fwo3DlMOGwrbDjj7DisKw%2F35121150388%2F9599%2F98ef%2F5bfc%2F83bceee69e40dea5aa652fa9f7430735.mp3
x-nos-request-id
387f699a-00d0-4fc1-91ba-3ecbd117d5b3
cdn-ip
2404:2280:1cc:0:3::a
age
7429850
x-swift-cachetime
25644260
x-cache
HIT TCP_HIT dirn:12:756481540 mlen:0
cdn-user-ip
2001:1b60:2:240:3247::6
Content-Range
bytes 0-3790892/3790893
content-disposition
inline; filename="obj%2Fwo3DlMOGwrbDjj7DisKw%2F35121150388%2F9599%2F98ef%2F5bfc%2F83bceee69e40dea5aa652fa9f7430735.mp3"
x-swift-savetime
Mon, 17 Jun 2024 16:36:24 GMT
x-nos-storage-class
STANDARD
Content-Length
3790893
last-modified
Wed, 10 Apr 2024 09:43:36 GMT
server
Tengine
x-nos-meta-origin-md5
83bceee69e40dea5aa652fa9f7430735
cdn-source
ali
etag
"83bceee69e40dea5aa652fa9f7430735"
x-nos-requesttype
GetObject
ali-swift-global-savetime
1712750444
content-type
audio/mpeg; charset=UTF-8
access-control-allow-origin
*
access-control-allow-methods
GET,POST,OPTIONS
access-control-expose-headers
Content-Range, Last-Modified
access-control-allow-credentials
true
cache
state
timing-allow-origin
*
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
eagleid
a3b55c9e17201802941844009e

Redirect headers

Date
Fri, 05 Jul 2024 11:51:32 GMT
Strict-Transport-Security
max-age=31536000
via
bdengine-75f66ccb55-lpsqd
x-tt-trace-tag
id=5
Transfer-Encoding
chunked
X-Bdcdn-Cache-Status
TCP_MISS
Connection
keep-alive
x-request-id
3f289051480f62c052168674dae84a86
Server
Byte-nginx
Access-Control-Max-Age
1800
Access-Control-Allow-Methods
GET, POST, PATCH, PUT, DELETE, OPTIONS
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Location
https://m801.music.126.net/20240705201632/6b1d29d953a008cfbd4ab15950a2abb7/jdymusic/obj/wo3DlMOGwrbDjj7DisKw/35121150388/9599/98ef/5bfc/83bceee69e40dea5aa652fa9f7430735.mp3
x-request-ip
217.114.218.20
Cache-Control
no-cache,must-revalidate
Access-Control-Allow-Credentials
true
x-response-cinfo
217.114.218.20
x-response-cache
miss
Access-Control-Allow-Headers
Authorization, Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, X-CSRF-TOKEN, X-Requested-With
wy-2144209098-b1iFf46SqiyN6.js
cdn.myhkw.cn/cache/lyrics/
Redirect Chain
  • https://myhkw.cn/api/lyrics?song=2144209098&type=wy&id=demo&sign=749/n7RxhZX4Y&ksc=54&_=1720180285011
  • https://cdn.myhkw.cn/cache/lyrics/wy-2144209098-b1iFf46SqiyN6.js?v=20240430-1720109201
3 KB
1 KB
XHR
General
Full URL
https://cdn.myhkw.cn/cache/lyrics/wy-2144209098-b1iFf46SqiyN6.js?v=20240430-1720109201
Protocol
H2
Server
101.42.40.156 Beijing, China, ASN45090 (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),
Reverse DNS
Software
nginx /
Resource Hash
4ca71aff6268498e0eda841d243a4296710019c2b03e581630e4e2b40940ed41
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://www.hedan.rr.nu/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Fri, 05 Jul 2024 11:51:32 GMT
strict-transport-security
max-age=31536000
content-encoding
gzip
last-modified
Thu, 04 Jul 2024 16:05:14 GMT
server
nginx
etag
W/"6686c83a-ca7"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=43200
access-control-allow-credentials
true
access-control-allow-headers
x-csrf-token,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
expires
Fri, 05 Jul 2024 23:51:32 GMT

Redirect headers

Date
Fri, 05 Jul 2024 11:51:32 GMT
Strict-Transport-Security
max-age=31536000
via
bdengine-75f66ccb55-lpsqd
x-tt-trace-tag
id=5
Transfer-Encoding
chunked
X-Bdcdn-Cache-Status
TCP_MISS
Connection
keep-alive
x-request-id
15693de4eeed97417d4e6f2c2696bf4d
Server
Byte-nginx
Access-Control-Max-Age
1800
Access-Control-Allow-Methods
GET, POST, PATCH, PUT, DELETE, OPTIONS
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Location
https://cdn.myhkw.cn/cache/lyrics/wy-2144209098-b1iFf46SqiyN6.js?v=20240430-1720109201
x-request-ip
217.114.218.20
Cache-Control
no-cache,must-revalidate
Access-Control-Allow-Credentials
true
x-response-cinfo
217.114.218.20
x-response-cache
miss
Access-Control-Allow-Headers
Authorization, Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, X-CSRF-TOKEN, X-Requested-With
collect
q.clarity.ms/
0
279 B
XHR
General
Full URL
https://q.clarity.ms/collect
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.34/clarity.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.231.53.73 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept
application/x-clarity-gzip
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Access-Control-Allow-Origin
https://www.hedan.rr.nu
Date
Fri, 05 Jul 2024 11:51:32 GMT
Access-Control-Allow-Credentials
true
Server
nginx
Connection
keep-alive
Vary
Origin
Request-Context
appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8
color
myhkw.cn/api/
47 B
1 KB
Script
General
Full URL
https://myhkw.cn/api/color?song=2144209098&type=wy&pic=109951169484028770&id=demo&sign=749%2Fn7RxhZX4Y&_=1720180285012
Requested by
Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/jquery@3.2/dist/jquery.min.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
116.207.181.224 , China, ASN136191 (CHINATELECOM-HUBEI-YICHANG-IDC YICHANG, Hubei Province, P.R.China., CN),
Reverse DNS
Software
Byte-nginx /
Resource Hash
2b072113d20de17990be4c43b88e695e5fb2b76d4bd232a2b9a2b20ccbfc4221
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 05 Jul 2024 11:51:35 GMT
Content-Encoding
gzip
via
bdengine-75f66ccb55-lpsqd
Strict-Transport-Security
max-age=31536000
x-tt-trace-tag
id=5
Transfer-Encoding
chunked
X-Bdcdn-Cache-Status
TCP_MISS
Connection
keep-alive
x-request-id
1fceb44e7d30a8528476b42835a842d5
Server
Byte-nginx
Access-Control-Max-Age
1800
Access-Control-Allow-Methods
GET, POST, PATCH, PUT, DELETE, OPTIONS
Content-Type
application/x-javascript; charset=utf-8
Access-Control-Allow-Origin
*
x-request-ip
217.114.218.20
Vary
Accept-Encoding
Access-Control-Allow-Credentials
true
x-response-cinfo
217.114.218.20
x-response-cache
miss
Access-Control-Allow-Headers
Authorization, Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, X-CSRF-TOKEN, X-Requested-With
collect
q.clarity.ms/
0
279 B
XHR
General
Full URL
https://q.clarity.ms/collect
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.34/clarity.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.231.53.73 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept
application/x-clarity-gzip
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Access-Control-Allow-Origin
https://www.hedan.rr.nu
Date
Fri, 05 Jul 2024 11:51:37 GMT
Access-Control-Allow-Credentials
true
Server
nginx
Connection
keep-alive
Vary
Origin
Request-Context
appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8
fa4b177419fce5c8de4ae4f0c125a11d.jpg
img.paulzzh.com/touhou/konachan/image/
Redirect Chain
  • https://img.paulzzh.com/touhou/random?0.6461772809886324
  • https://img.paulzzh.com/touhou/konachan/image/fa4b177419fce5c8de4ae4f0c125a11d.jpg
87 KB
87 KB
Image
General
Full URL
https://img.paulzzh.com/touhou/konachan/image/fa4b177419fce5c8de4ae4f0c125a11d.jpg
Protocol
H2
Server
45.154.12.123 , United Kingdom, ASN138195 (MOACKCOLTD-AS-AP MOACK.Co.LTD, KR),
Reverse DNS
Software
nginx /
Resource Hash
5502c2a10b71db8276582a2ec6cd9854d553c110953c307d69af0ea69753bfa9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://www.hedan.rr.nu/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Fri, 05 Jul 2024 11:51:38 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
last-modified
Fri, 06 Aug 2021 19:28:57 GMT
server
nginx
etag
"610d8d79-15afa"
content-type
image/jpeg
cache-control
max-age=2592000
accept-ranges
bytes
content-length
88826
expires
Sun, 04 Aug 2024 11:51:38 GMT

Redirect headers

location
https://img.paulzzh.com/touhou/konachan/image/fa4b177419fce5c8de4ae4f0c125a11d.jpg
access-control-allow-origin
*
date
Fri, 05 Jul 2024 11:51:38 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
server
nginx
content-length
370
content-type
text/html; charset=utf-8
collect
q.clarity.ms/
0
279 B
XHR
General
Full URL
https://q.clarity.ms/collect
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.34/clarity.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.231.53.73 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept
application/x-clarity-gzip
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Access-Control-Allow-Origin
https://www.hedan.rr.nu
Date
Fri, 05 Jul 2024 11:51:42 GMT
Access-Control-Allow-Credentials
true
Server
nginx
Connection
keep-alive
Vary
Origin
Request-Context
appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8
56682a25b9dc3fc46d6a20df2fccf69c.jpg
img.paulzzh.com/touhou/konachan/image/
Redirect Chain
  • https://img.paulzzh.com/touhou/random?0.7010095440573152
  • https://img.paulzzh.com/touhou/konachan/image/56682a25b9dc3fc46d6a20df2fccf69c.jpg
1 MB
1 MB
Image
General
Full URL
https://img.paulzzh.com/touhou/konachan/image/56682a25b9dc3fc46d6a20df2fccf69c.jpg
Protocol
H2
Server
45.154.12.123 , United Kingdom, ASN138195 (MOACKCOLTD-AS-AP MOACK.Co.LTD, KR),
Reverse DNS
Software
nginx /
Resource Hash
6679d2d00ec4fa18186a59c720a2e60f14600825815218b622bc735f440215f4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://www.hedan.rr.nu/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Fri, 05 Jul 2024 11:51:45 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
last-modified
Fri, 06 Aug 2021 19:41:16 GMT
server
nginx
etag
"610d905c-102b03"
content-type
image/jpeg
cache-control
max-age=2592000
accept-ranges
bytes
content-length
1059587
expires
Sun, 04 Aug 2024 11:51:45 GMT

Redirect headers

location
https://img.paulzzh.com/touhou/konachan/image/56682a25b9dc3fc46d6a20df2fccf69c.jpg
access-control-allow-origin
*
date
Fri, 05 Jul 2024 11:51:45 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
server
nginx
content-length
370
content-type
text/html; charset=utf-8
collect
q.clarity.ms/
0
279 B
XHR
General
Full URL
https://q.clarity.ms/collect
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.34/clarity.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.231.53.73 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept
application/x-clarity-gzip
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Access-Control-Allow-Origin
https://www.hedan.rr.nu
Date
Fri, 05 Jul 2024 11:51:51 GMT
Access-Control-Allow-Credentials
true
Server
nginx
Connection
keep-alive
Vary
Origin
Request-Context
appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8
5d3df11fd766a1751322be73ca4a44ab.jpg
img.paulzzh.com/touhou/konachan/jpeg/
Redirect Chain
  • https://img.paulzzh.com/touhou/random?0.6524199555166075
  • https://img.paulzzh.com/touhou/konachan/jpeg/5d3df11fd766a1751322be73ca4a44ab.jpg
236 KB
236 KB
Image
General
Full URL
https://img.paulzzh.com/touhou/konachan/jpeg/5d3df11fd766a1751322be73ca4a44ab.jpg
Protocol
H2
Server
45.154.12.123 , United Kingdom, ASN138195 (MOACKCOLTD-AS-AP MOACK.Co.LTD, KR),
Reverse DNS
Software
nginx /
Resource Hash
571826541b25322984ee2f549b7fa92df9b4bc5b6725cdb3ea9cedf42c9b7be6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Referer
https://www.hedan.rr.nu/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date
Fri, 05 Jul 2024 11:51:55 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
last-modified
Fri, 06 Aug 2021 19:31:22 GMT
server
nginx
etag
"610d8e0a-3ae43"
content-type
image/jpeg
cache-control
max-age=2592000
accept-ranges
bytes
content-length
241219
expires
Sun, 04 Aug 2024 11:51:55 GMT

Redirect headers

location
https://img.paulzzh.com/touhou/konachan/jpeg/5d3df11fd766a1751322be73ca4a44ab.jpg
access-control-allow-origin
*
date
Fri, 05 Jul 2024 11:51:55 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
server
nginx
content-length
368
content-type
text/html; charset=utf-8
collect
q.clarity.ms/
0
279 B
XHR
General
Full URL
https://q.clarity.ms/collect
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.34/clarity.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.231.53.73 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept
application/x-clarity-gzip
Referer
https://www.hedan.rr.nu/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Access-Control-Allow-Origin
https://www.hedan.rr.nu
Date
Fri, 05 Jul 2024 11:51:59 GMT
Access-Control-Allow-Credentials
true
Server
nginx
Connection
keep-alive
Vary
Origin
Request-Context
appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
apii.ctose.cn
URL
https://apii.ctose.cn/live2d/Source-One/default/autoload.js

Verdicts & Comments Add Verdict or Comment

116 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

undefined| event object| fence object| sharedStorage function| clarity function| IsPC boolean| flag object| urodz object| now number| ile number| dni boolean| staticx object| img function| Sakura function| getRandom function| startSakura function| stopp function| SakuraList function| randomFnR function| $ function| jQuery function| loadExternalResource function| initWidget function| UtSystem function| UtDebug function| LDTransform function| LDGL function| Live2D function| Live2DModelWebGL function| Live2DModelJS function| Live2DMotion function| MotionQueueManager function| PhysicsHair function| AMotion function| PartsDataID function| DrawDataID function| BaseDataID function| ParamID function| loadlive2d object| timer string| mobiles string| skins number| errCount number| randcolor number| letterfx string| myhkcolor string| myhkfcolor number| songTotal boolean| myhkrandom boolean| myhkloop boolean| myhkpass boolean| errjc boolean| hasLrc boolean| hasKsc number| currentFrameId boolean| playisTsMoving boolean| autoswitch boolean| zdyc boolean| gcdw boolean| hasgeci boolean| playing boolean| myhkplaytime boolean| myhkplaying boolean| playingalbumId boolean| playingsongId boolean| myhk_player_songid boolean| myhkplayerlist number| myhkplayerversion string| playerName number| randomPlayer number| defaultVolume number| showLrc number| showGreeting number| defaultAlbum string| siteName string| greeting number| switchopen number| switchtime number| mswitchopen number| mswitchtime number| errNext number| errNum number| autoPlayer number| mautoPlayer number| background number| showNotes number| showMsg number| myhkversion undefined| myhkid number| playercss string| vol string| volume number| albumTotals number| albumIds number| albumId number| draggerSpeed function| _request number| songId string| musictype boolean| songlocations number| LimitHeight string| newimg number| coverHeight object| mcs string| lrcurl number| offsetcont object| lrcArray number| a object| lrcStr number| k number| lrcHeight object| $words number| r number| g number| b string| color string| lrccolor

10 Cookies

Domain/Path Name / Value
www.clarity.ms/ Name: CLID
Value: aabaac1212a2469985b1e967ba70ac56.20240705.20250705
.rr.nu/ Name: _clck
Value: 11sjjqh%7C2%7Cfn7%7C0%7C1647
.rr.nu/ Name: _clsk
Value: iq209g%7C1720180285496%7C1%7C1%7Cq.clarity.ms%2Fcollect
.bing.com/ Name: MUID
Value: 0C9605CDD0B862423E67117ED16A631C
.c.bing.com/ Name: MR
Value: 0
.c.bing.com/ Name: SRM_B
Value: 0C9605CDD0B862423E67117ED16A631C
.c.clarity.ms/ Name: SM
Value: C
.clarity.ms/ Name: MUID
Value: 0C9605CDD0B862423E67117ED16A631C
.c.clarity.ms/ Name: MR
Value: 0
.c.clarity.ms/ Name: ANONCHK
Value: 0

2 Console Messages

Source Level URL
Text
security error URL: https://www.hedan.rr.nu/
Message:
Refused to execute script from 'https://www.hedan.rr.nu/static/js/main.js' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
network error URL: https://apii.ctose.cn/live2d/Source-One/default/autoload.js
Message:
Failed to load resource: net::ERR_BLOCKED_BY_RESPONSE.NotSameOrigin

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.myhkw.cn
api.tongjiniao.com
apii.ctose.cn
c.bing.com
c.clarity.ms
cdn.bootcss.com
cdn.jsdelivr.net
cdn.myhkw.cn
fastly.jsdelivr.net
fonts.googleapis.com
fonts.gstatic.com
img.paulzzh.com
m801.music.126.net
myhkw.cn
p3.music.126.net
q.clarity.ms
www.clarity.ms
www.hedan.rr.nu
apii.ctose.cn
101.42.40.156
110.42.2.205
113.13.246.102
116.207.181.224
13.74.129.1
151.101.129.229
154.85.69.9
172.66.47.11
20.231.53.73
2404:2280:1cc:0:3::a
240e:c3:2800:200:8000::99
2620:1ec:29:1::45
2620:1ec:c11::237
2a00:1450:4001:80b::200a
2a00:1450:4001:829::2003
2a04:4e42:600::485
45.154.12.123
050c1211e2f1b838207de3de15da3757dd3aadcbdc269912018aff2ea736a12a
06561773aec97881597f18ec78be970815858bb330c4aa14105eab3c8cc79813
1091869ea9381acffa3fc0e788eecf199747ff18241a79f94fc444f5da3e80de
190948952131adf151e50aa94c281280992382a048030b7daae0e42e0939356c
1a694fe6913171fcd6a000ce17bf774f84a9e9c0fb14df9ff1961baeeec3f23b
1eb42542e7f5b645f4b83ceac7bae8194d1b86fa2602385da22286fe8a330a98
2135c76b0a63d0f6c9c48df746d0eec6ead131999ba6f9678488472e95e1edd6
21c4df569b781c179cf31af94f160d786c7b8242bedeea5bc4e9be321c5be906
2b072113d20de17990be4c43b88e695e5fb2b76d4bd232a2b9a2b20ccbfc4221
427f7a363b07e17ab7900d38d315c2bb2e4e66f8239f837c72de4321931117d9
42804a9e7164fbefa4144704c963a7e3a06d389ec83d0a731e5c902cea594043
455ecebc82403fdcfdc760886996690b4793c4d86834577fd99861fbb50b4bfe
45cd9f34002a0f28737e26b85712c88fcca730d8d1f65ec4aa33c7925184c240
485463b08985a0daa7c07c82972e1e09c90d665726f8180fe7dc358f7fcb5a3e
4ca71aff6268498e0eda841d243a4296710019c2b03e581630e4e2b40940ed41
4cb477acd16dffe9da6c574ca89f9e912ae001ea9a6300ca5673aa7b3784ca97
541e8b7bb29cff24faf737079d4267649f5d2a05a30483a0fe6c86863ab0bb4e
5502c2a10b71db8276582a2ec6cd9854d553c110953c307d69af0ea69753bfa9
571826541b25322984ee2f549b7fa92df9b4bc5b6725cdb3ea9cedf42c9b7be6
5e245f87c91e4cc60c4f66311f2691f187b9f710259f5f75cd6beff7598d6ddd
6679d2d00ec4fa18186a59c720a2e60f14600825815218b622bc735f440215f4
71958456c6d32df0e3120ab972e0caa220108f11628e65617c26b83a313b86e8
734cb8c4e906c83e72713a3aff5a2b8b1f2e1eed50f08bdfab890adef5f43557
775800ecf32595fac19e09efeefe175104c8f58086958278d5fe5456b629baa0
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7ed2434b5c1a9b5ae6498c3ab49742b4ba63de914cba8d37035f0072d3c2404c
7ee2a3a5e4b1e50bb31b22d8399f9917073e0421d56c5da3699371ec79af2082
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
8785a3daf3723b7a8f708249b4cdd10faefcbfb1c70546a00d4fa92ea6197fbb
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
9610bbc4db6f94e7c35f7f8112635a6f66996b69f59bcdca9eafcf1289f3e192
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9dd2b5c4ab64c7d98baee85a3e4bed2ad319dd8548b191aed554a8ffdb44b0ae
acd8cc92baa460bfc303aca613f09f7912be7615999e30a453c6acb316b4d534
b140ce5cbf9bf2a79282a7b988a91f412dd4e0683d5175fa542f8fe66081f9b5
b2ff75abc0e0ccbd083a87b45e64c9a62f1f6ca32c46445240026a246d30254c
b718cca2727a8043608202e3adccb528433f15e14a30e9d752d047ac5fd123bc
c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49
c5f8f19c7cbec6a8107e742297fb4e79fd781121ad468ec30e37b058f5494556
c75c6c164c77e9cb9293e5c767c83e8ad459fd69da30644add1daf3ae7e75996
cebaf3897d64760fa3fde87d5ff7e6806c895c87b3dcc4494137e14b817c3900
d1f56fc38e8d50795552832c4b20432fedee68a763682b9fc648fc95b7c0c334
d34775b817bf40359e2d9dd90749d5e32355e3ed2325700e80b90347fb65558c
d751057f008ca217326b558c4beca2c8ebd948b50c1f8cd06c3687355899a241
e073ab0c5ad4ffe4bad2ddac87433a6937e10e0c40a84e6a6c285dc2c8890d6e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ed04b5707b07ef987720582b14ab1d8662871e95aa17cdac6fff6f34ba9caacd
f19c7a20bf7eafcc1ef303b9c9c52d0face97aa0990129aeddec8d5e089d1ef5
f5977b6a02d773e4d59939dac292a13ea324db2b75ac69bd947124fe97e5a537
fa501844318e06fadf4d4f127ad2be47b7ff55cd9409baf70a7368b14c0302ea
fc544e095e9c62b22290d8eaf5812e29023d77e9d7cfb0155fd1ac9315bf75fc
fdc01648678f8f3cc842bc584dacbceb76d4913d2e9e820d12838478e29c4db7
fe42aebb3acdf53d4edaef71733067238d10b6a78aad19299c3a24b06db1b4fe
fffc6ed23cfeabaaace717503bfabd907816869c8c5ff38a2127b8284e8c5988