kr.buddysecret.com Open in urlscan Pro
2606:4700:3030::6815:1001 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://kr.buddysecret.com/
Effective URL:
https://kr.buddysecret.com/
Submission: On April 17 via api (April 17th 2025, 3:26:57 pm UTC) from US — Scanned from US

Summary HTTP 181 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 49 IPs in 7 countries across 44 domains to perform 181 HTTP transactions. The main IP is 2606:4700:3030::6815:1001, located in United States and belongs to CLOUDFLARENET, US. The main domain is kr.buddysecret.com.
TLS certificate: Issued by WE1 on February 19th 2025. Valid for: 3 months.

This is the only time kr.buddysecret.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
26	2606:4700:303... 2606:4700:3030::6815:1001	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:310... 2606:4700:3108::ac42:28a3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
9	2607:f8b0:400... 2607:f8b0:4006:821::2008	15169 (GOOGLE) (GOOGLE)
22	2607:f8b0:400... 2607:f8b0:4006:81f::2002	15169 (GOOGLE) (GOOGLE)
3	2607:f8b0:400... 2607:f8b0:4006:80b::200a	15169 (GOOGLE) (GOOGLE)
5	2606:4700:20:... 2606:4700:20::ac43:4937	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2600:9000:26f... 2600:9000:26fa:0:1b:cadc:ef40:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6811:180e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:50c0:800... 2606:50c0:8002::153	54113 (FASTLY) (FASTLY)
5	2607:f8b0:400... 2607:f8b0:4006:808::2002	15169 (GOOGLE) (GOOGLE)
1	125.253.89.184 125.253.89.184	19437 (SS-ASH) (SS-ASH)
1	68.67.160.75 68.67.160.75	29990 (ASN-APPNEX) (ASN-APPNEX)
1	34.120.63.153 34.120.63.153	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	35.227.252.103 35.227.252.103	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	2607:f8b0:400... 2607:f8b0:4006:822::2003	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f01... 2a03:2880:f012:10c:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
4	2001:4860:480... 2001:4860:4802:38::178	15169 (GOOGLE) (GOOGLE)
1 3	2607:f8b0:400... 2607:f8b0:4006:817::2004	15169 (GOOGLE) (GOOGLE)
4	2001:4860:480... 2001:4860:4802:34::181	15169 (GOOGLE) (GOOGLE)
2	2607:f8b0:400... 2607:f8b0:4004:c1b::9c	15169 (GOOGLE) (GOOGLE)
9	2607:f8b0:400... 2607:f8b0:4006:81c::2002	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f11... 2a03:2880:f112:182:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
3	2607:f8b0:400... 2607:f8b0:4006:81f::2001	15169 (GOOGLE) (GOOGLE)
9	2607:f8b0:400... 2607:f8b0:4006:823::2001	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:80e::2003	15169 (GOOGLE) (GOOGLE)
1	2607:f8b0:400... 2607:f8b0:4006:808::2006	15169 (GOOGLE) (GOOGLE)
4 19	142.251.35.162 142.251.35.162	15169 (GOOGLE) (GOOGLE)
2 4	104.18.26.193 104.18.26.193	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	68.67.181.230 68.67.181.230	29990 (ASN-APPNEX) (ASN-APPNEX)
2 2	3.33.220.150 3.33.220.150	16509 (AMAZON-02) (AMAZON-02)
2 2	3.212.200.160 3.212.200.160	14618 (AMAZON-AES) (AMAZON-AES)
3 3	50.31.142.127 50.31.142.127	23352 (SERVERCEN...) (SERVERCENTRAL)
1 1	52.203.204.178 52.203.204.178	14618 (AMAZON-AES) (AMAZON-AES)
1 1	174.137.133.49 174.137.133.49	27257 (WEBAIR-IN...) (WEBAIR-INTERNET)
1 1	51.222.239.232 51.222.239.232	16276 (OVH OVH SAS) (OVH OVH SAS)
2 2	185.184.8.90 185.184.8.90	204995 (RTB-HOUSE...) (RTB-HOUSE-AMS RTB Marketing and Tech Services Ltd)
1	142.250.176.198 142.250.176.198	15169 (GOOGLE) (GOOGLE)
2	23.200.197.55 23.200.197.55	16625 (AKAMAI-AS) (AKAMAI-AS)
1 1	2606:4700:440... 2606:4700:4400::6812:25c1	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	2606:4700:440... 2606:4700:4400::ac40:963f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	35.190.0.66 35.190.0.66	15169 (GOOGLE) (GOOGLE)
1 1	172.105.221.29 172.105.221.29	63949 (AKAMAI-LI...) (AKAMAI-LINODE-AP Akamai Connected Cloud)
1 1	2600:1f10:4ce... 2600:1f10:4ce4:4a00:4bbd:8403:8768:c46	14618 (AMAZON-AES) (AMAZON-AES)
1 1	54.224.103.108 54.224.103.108	14618 (AMAZON-AES) (AMAZON-AES)
1 2	23.205.56.163 23.205.56.163	16625 (AKAMAI-AS) (AKAMAI-AS)
1	35.208.249.213 35.208.249.213	15169 (GOOGLE) (GOOGLE)
1	18.238.49.67 18.238.49.67	16509 (AMAZON-02) (AMAZON-02)
1	13.35.93.97 13.35.93.97	16509 (AMAZON-02) (AMAZON-02)
2	3.210.88.34 3.210.88.34	14618 (AMAZON-AES) (AMAZON-AES)
5	18.173.132.26 18.173.132.26	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:261... 2600:9000:261f:dc00:a:deb0:3380:93a1	16509 (AMAZON-02) (AMAZON-02)
2	54.172.88.56 54.172.88.56	14618 (AMAZON-AES) (AMAZON-AES)
5	130.211.115.4 130.211.115.4	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	23.200.196.50 23.200.196.50	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2607:f8b0:400... 2607:f8b0:4006:80c::2002	15169 (GOOGLE) (GOOGLE)
3	2607:f8b0:400... 2607:f8b0:4006:817::2001	15169 (GOOGLE) (GOOGLE)
1 2	2620:100:a00b... 2620:100:a00b::12	19750 (AS-CRITEO) (AS-CRITEO)
2	74.119.117.17 74.119.117.17	19750 (AS-CRITEO) (AS-CRITEO)
2	162.19.138.116 162.19.138.116	16276 (OVH OVH SAS) (OVH OVH SAS)
1	3.224.67.107 3.224.67.107	14618 (AMAZON-AES) (AMAZON-AES)
1	141.95.98.64 141.95.98.64	16276 (OVH OVH SAS) (OVH OVH SAS)
181	49

26 2606:4700:3030::6815:1001 (United States)

ASN13335 (CLOUDFLARENET, US)

kr.buddysecret.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:3108::ac42:28a3 (United States)

ASN13335 (CLOUDFLARENET, US)

datacygnal.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2607:f8b0:4006:821::2008 (United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

22 2607:f8b0:4006:81f::2002 (United States)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4006:80b::200a (United States)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700:20::ac43:4937 (United States)

ASN13335 (CLOUDFLARENET, US)

img.holaquiz.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:9000:26fa:0:1b:cadc:ef40:93a1 (United States)

ASN16509 (AMAZON-02, US)

cmp.inmobi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:180e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:50c0:8002::153 (United States)

ASN54113 (FASTLY, US)

superal.github.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2607:f8b0:4006:808::2002 (United States)

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 125.253.89.184 (United States)

ASN19437 (SS-ASH, US)

prebid.a-mo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 68.67.160.75 (Colonia, United States)

ASN29990 (ASN-APPNEX, US)
PTR: 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.120.63.153 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 153.63.120.34.bc.googleusercontent.com

prebid.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.227.252.103 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 103.252.227.35.bc.googleusercontent.com

rtb.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4006:822::2003 (United States)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f012:10c:face:b00c:0:3 (Secaucus, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2001:4860:4802:38::178 (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4006:817::2004 (United States) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2001:4860:4802:34::181 (United States)

ASN15169 (GOOGLE, US)

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2607:f8b0:4004:c1b::9c (Washington, United States)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2607:f8b0:4006:81c::2002 (United States)

ASN15169 (GOOGLE, US)

td.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f112:182:face:b00c:0:25de (Secaucus, United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4006:81f::2001 (United States)

ASN15169 (GOOGLE, US)

df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2607:f8b0:4006:823::2001 (United States)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:80e::2003 (United States)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:808::2006 (United States)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 142.251.35.162 (Queens, United States) 4 redirects

ASN15169 (GOOGLE, US)
PTR: lga25s78-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.18.26.193 (None, ) 2 redirects

ASN13335 (CLOUDFLARENET, US)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 68.67.181.230 (North Bergen, United States) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 1042.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.33.220.150 (Seattle, United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.212.200.160 (Ashburn, United States) 2 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-212-200-160.compute-1.amazonaws.com

match.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 50.31.142.127 (Chicago, United States) 3 redirects

ASN23352 (SERVERCENTRAL, US)
PTR: chi.outbrain.com

b1sync.zemanta.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b1sync.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.203.204.178 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-203-204-178.compute-1.amazonaws.com

sync.srv.stackadapt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 174.137.133.49 (United States) 1 redirects

ASN27257 (WEBAIR-INTERNET, US)

dsp.adkernel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 51.222.239.232 (Canada) 1 redirects

ASN16276 (OVH OVH SAS, FR)
PTR: ip232.ip-51-222-239.net

onetag-sys.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.184.8.90 (Amsterdam, Netherlands) 2 redirects

ASN204995 (RTB-HOUSE-AMS RTB Marketing and Tech Services Ltd, CY)
PTR: ip-185-184-8-90.rtbhouse.net

creativecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.176.198 (United States)

ASN15169 (GOOGLE, US)
PTR: lga34s37-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.200.197.55 (Piscataway, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-200-197-55.deploy.static.akamaitechnologies.com

servedby.flashtalking.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::6812:25c1 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

a.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:963f (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

s.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.0.66 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 66.0.190.35.bc.googleusercontent.com

ads.travelaudience.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.105.221.29 (Tokyo, Japan) 1 redirects

ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG)
PTR: li1875-29.members.linode.com

a.c.appier.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f10:4ce4:4a00:4bbd:8403:8768:c46 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)

google.partners.tremorhub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.224.103.108 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-224-103-108.compute-1.amazonaws.com

match.sharethrough.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.205.56.163 (Edison, United States) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-205-56-163.deploy.static.akamaitechnologies.com

sync.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.208.249.213 (Council Bluffs, United States)

ASN15169 (GOOGLE, US)
PTR: 213.249.208.35.bc.googleusercontent.com

gtrace.mediago.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.238.49.67 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-238-49-67.jfk52.r.cloudfront.net

ajs-assets.ftstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.35.93.97 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-93-97.jfk50.r.cloudfront.net

agen-assets.ftstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.210.88.34 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-210-88-34.compute-1.amazonaws.com

d9.flashtalking.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 18.173.132.26 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-173-132-26.jfk52.r.cloudfront.net

cdn.flashtalking.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:261f:dc00:a:deb0:3380:93a1 (United States)

ASN16509 (AMAZON-02, US)

js.ad-score.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.172.88.56 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-172-88-56.compute-1.amazonaws.com

ad-events.flashtalking.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 130.211.115.4 (Council Bluffs, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 4.115.211.130.bc.googleusercontent.com

data.ad-score.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.200.196.50 (Piscataway, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-200-196-50.deploy.static.akamaitechnologies.com

secure.flashtalking.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:80c::2002 (United States)

ASN15169 (GOOGLE, US)

ep1.adtrafficquality.google	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4006:817::2001 (United States)

ASN15169 (GOOGLE, US)

ep2.adtrafficquality.google	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:100:a00b::12 (United States) 1 redirects

ASN19750 (AS-CRITEO, US)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 74.119.117.17 (United States)

ASN19750 (AS-CRITEO, US)

mug.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 162.19.138.116 (Frankfurt am Main, Germany)

ASN16276 (OVH OVH SAS, FR)
PTR: ns31533567.ip-162-19-138.eu

id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.224.67.107 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-224-67-107.compute-1.amazonaws.com

id.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 141.95.98.64 (France)

ASN16276 (OVH OVH SAS, FR)
PTR: ns3216658.ip-141-95-98.eu

lb.eu-1-id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
36	doubleclick.net 4 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 230 stats.g.doubleclick.net — Cisco Umbrella Rank: 142 td.doubleclick.net — Cisco Umbrella Rank: 169 googleads.g.doubleclick.net — Cisco Umbrella Rank: 47 cm.g.doubleclick.net — Cisco Umbrella Rank: 294 ad.doubleclick.net — Cisco Umbrella Rank: 148	333 KB
34	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 111 df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 179	412 KB
26	buddysecret.com kr.buddysecret.com	1 MB
12	flashtalking.com servedby.flashtalking.com — Cisco Umbrella Rank: 828 d9.flashtalking.com — Cisco Umbrella Rank: 1617 cdn.flashtalking.com — Cisco Umbrella Rank: 1060 ad-events.flashtalking.com — Cisco Umbrella Rank: 1156 secure.flashtalking.com — Cisco Umbrella Rank: 2339	182 KB
9	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 41	926 KB
7	google.com 1 redirects www.google.com — Cisco Umbrella Rank: 3 analytics.google.com — Cisco Umbrella Rank: 145	584 B
6	ad-score.com js.ad-score.com — Cisco Umbrella Rank: 3056 data.ad-score.com — Cisco Umbrella Rank: 2567	189 KB
5	holaquiz.com img.holaquiz.com	797 KB
4	criteo.com 1 redirects gum.criteo.com — Cisco Umbrella Rank: 474 mug.criteo.com — Cisco Umbrella Rank: 3802	2 KB
4	adtrafficquality.google ep1.adtrafficquality.google — Cisco Umbrella Rank: 411 ep2.adtrafficquality.google — Cisco Umbrella Rank: 419	25 KB
4	casalemedia.com 2 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 656	3 KB
4	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 48	22 KB
4	inmobi.com cmp.inmobi.com — Cisco Umbrella Rank: 5596	213 KB
3	gstatic.com fonts.gstatic.com www.gstatic.com	88 KB
3	adnxs.com 1 redirects ib.adnxs.com — Cisco Umbrella Rank: 290	9 KB
3	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 36	5 KB
2	id5-sync.com id5-sync.com — Cisco Umbrella Rank: 529	2 KB
2	ftstatic.com ajs-assets.ftstatic.com — Cisco Umbrella Rank: 1585 agen-assets.ftstatic.com — Cisco Umbrella Rank: 1288	32 KB
2	teads.tv 1 redirects sync.teads.tv — Cisco Umbrella Rank: 1458	919 B
2	tribalfusion.com 2 redirects a.tribalfusion.com — Cisco Umbrella Rank: 1319 s.tribalfusion.com — Cisco Umbrella Rank: 3149	1 KB
2	creativecdn.com 2 redirects creativecdn.com — Cisco Umbrella Rank: 546	1 KB
2	zemanta.com 2 redirects b1sync.zemanta.com — Cisco Umbrella Rank: 739	1 KB
2	bidr.io 2 redirects match.prod.bidr.io — Cisco Umbrella Rank: 648	1 KB
2	adsrvr.org 2 redirects match.adsrvr.org — Cisco Umbrella Rank: 389	2 KB
2	facebook.com www.facebook.com — Cisco Umbrella Rank: 114	215 B
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 193	81 KB
1	eu-1-id5-sync.com lb.eu-1-id5-sync.com — Cisco Umbrella Rank: 981	290 B
1	crwdcntrl.net id.crwdcntrl.net — Cisco Umbrella Rank: 2464	784 B
1	mediago.io gtrace.mediago.io — Cisco Umbrella Rank: 4032	293 B
1	sharethrough.com 1 redirects match.sharethrough.com — Cisco Umbrella Rank: 634	467 B
1	tremorhub.com 1 redirects google.partners.tremorhub.com — Cisco Umbrella Rank: 8562	580 B
1	appier.net 1 redirects a.c.appier.net — Cisco Umbrella Rank: 5725	676 B
1	travelaudience.com 1 redirects ads.travelaudience.com — Cisco Umbrella Rank: 4917	548 B
1	onetag-sys.com 1 redirects onetag-sys.com — Cisco Umbrella Rank: 803	385 B
1	adkernel.com 1 redirects dsp.adkernel.com — Cisco Umbrella Rank: 5502	542 B
1	stackadapt.com 1 redirects sync.srv.stackadapt.com — Cisco Umbrella Rank: 635	1 KB
1	outbrain.com 1 redirects b1sync.outbrain.com — Cisco Umbrella Rank: 806	723 B
1	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 388	3 KB
1	openx.net rtb.openx.net — Cisco Umbrella Rank: 599	387 B
1	media.net prebid.media.net — Cisco Umbrella Rank: 987	164 B
1	a-mo.net prebid.a-mo.net — Cisco Umbrella Rank: 798	1 KB
1	github.io superal.github.io	3 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 236	11 KB
1	datacygnal.io datacygnal.io — Cisco Umbrella Rank: 17602	86 KB
181	44

	Domain	Requested by
26	kr.buddysecret.com	kr.buddysecret.com
22	pagead2.googlesyndication.com	kr.buddysecret.com pagead2.googlesyndication.com df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com ep2.adtrafficquality.google
19	cm.g.doubleclick.net	4 redirects googleads.g.doubleclick.net df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com kr.buddysecret.com
9	tpc.googlesyndication.com	df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com
9	www.googletagmanager.com	kr.buddysecret.com www.googletagmanager.com
7	googleads.g.doubleclick.net	pagead2.googlesyndication.com df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com kr.buddysecret.com
5	data.ad-score.com	js.ad-score.com
5	cdn.flashtalking.com	ajs-assets.ftstatic.com kr.buddysecret.com cdn.flashtalking.com
5	securepubads.g.doubleclick.net	datacygnal.io securepubads.g.doubleclick.net kr.buddysecret.com
5	img.holaquiz.com	kr.buddysecret.com
4	dsum-sec.casalemedia.com	2 redirects googleads.g.doubleclick.net
4	analytics.google.com	www.googletagmanager.com
4	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
4	cmp.inmobi.com	kr.buddysecret.com cmp.inmobi.com
3	ep2.adtrafficquality.google	pagead2.googlesyndication.com ep2.adtrafficquality.google
3	df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
3	www.google.com	1 redirects www.googletagmanager.com df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com ep2.adtrafficquality.google
3	ib.adnxs.com	1 redirects datacygnal.io googleads.g.doubleclick.net
3	fonts.googleapis.com	kr.buddysecret.com df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
2	id5-sync.com	datacygnal.io
2	mug.criteo.com
2	gum.criteo.com	1 redirects
2	ad-events.flashtalking.com	kr.buddysecret.com
2	d9.flashtalking.com	ajs-assets.ftstatic.com d9.flashtalking.com
2	sync.teads.tv	1 redirects kr.buddysecret.com
2	servedby.flashtalking.com	df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com kr.buddysecret.com
2	creativecdn.com	2 redirects
2	b1sync.zemanta.com	2 redirects
2	match.prod.bidr.io	2 redirects
2	match.adsrvr.org	2 redirects
2	www.facebook.com	kr.buddysecret.com
2	td.doubleclick.net	www.googletagmanager.com
2	stats.g.doubleclick.net	www.googletagmanager.com
2	connect.facebook.net	www.googletagmanager.com connect.facebook.net
2	fonts.gstatic.com	fonts.googleapis.com
1	lb.eu-1-id5-sync.com	datacygnal.io
1	id.crwdcntrl.net	datacygnal.io
1	ep1.adtrafficquality.google	pagead2.googlesyndication.com
1	secure.flashtalking.com	kr.buddysecret.com
1	js.ad-score.com	ajs-assets.ftstatic.com
1	agen-assets.ftstatic.com	ajs-assets.ftstatic.com
1	ajs-assets.ftstatic.com	servedby.flashtalking.com
1	gtrace.mediago.io	df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
1	match.sharethrough.com	1 redirects
1	google.partners.tremorhub.com	1 redirects
1	a.c.appier.net	1 redirects
1	ads.travelaudience.com	1 redirects
1	s.tribalfusion.com	1 redirects
1	a.tribalfusion.com	1 redirects
1	ad.doubleclick.net	df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
1	onetag-sys.com	1 redirects
1	dsp.adkernel.com	1 redirects
1	sync.srv.stackadapt.com	1 redirects
1	b1sync.outbrain.com	1 redirects
1	s0.2mdn.net	df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
1	www.gstatic.com	df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
1	rtb.openx.net	datacygnal.io
1	prebid.media.net	datacygnal.io
1	prebid.a-mo.net	datacygnal.io
1	superal.github.io	kr.buddysecret.com
1	cdnjs.cloudflare.com	kr.buddysecret.com
1	datacygnal.io	kr.buddysecret.com
181	62

This site contains links to these domains. Also see Links.

Domain
www.instagram.com
www.facebook.com
twitter.com
kr.realtest.me

Subject Issuer	Validity	Valid
buddysecret.com WE1	`2025-02-19` - `2025-05-20`	3 months	crt.sh
datacygnal.io WE1	`2025-02-28` - `2025-05-29`	3 months	crt.sh
*.google-analytics.com WR2	`2025-03-31` - `2025-06-23`	3 months	crt.sh
*.g.doubleclick.net WR2	`2025-03-31` - `2025-06-23`	3 months	crt.sh
upload.video.google.com WR2	`2025-03-31` - `2025-06-23`	3 months	crt.sh
holaquiz.com WE1	`2025-04-12` - `2025-07-11`	3 months	crt.sh
cmp.inmobi.com Sectigo ECC Organization Validation Secure Server CA	`2024-07-31` - `2025-07-31`	a year	crt.sh
cdnjs.cloudflare.com WE1	`2025-03-24` - `2025-06-22`	3 months	crt.sh
*.github.io Sectigo RSA Domain Validation Secure Server CA	`2025-03-07` - `2026-03-07`	a year	crt.sh
*.a-mo.net R10	`2025-03-28` - `2025-06-26`	3 months	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2025-02-21` - `2026-03-23`	a year	crt.sh
prebid.media.net WR3	`2025-03-26` - `2025-06-24`	3 months	crt.sh
*.openx.net RapidSSL TLS RSA CA G1	`2024-08-14` - `2025-08-18`	a year	crt.sh
*.gstatic.com WR2	`2025-03-31` - `2025-06-23`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2025-01-24` - `2025-04-24`	3 months	crt.sh
*.google.com WR2	`2025-03-31` - `2025-06-23`	3 months	crt.sh
*.doubleclick.net WR2	`2025-03-31` - `2025-06-23`	3 months	crt.sh
tpc.googlesyndication.com WR2	`2025-03-31` - `2025-06-23`	3 months	crt.sh
servedby.flashtalking.com DigiCert TLS RSA SHA256 2020 CA1	`2024-07-17` - `2025-07-17`	a year	crt.sh
*.mediago.io GeoTrust TLS RSA CA G1	`2024-12-17` - `2025-12-16`	a year	crt.sh
*.ftstatic.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-02-10` - `2026-03-11`	a year	crt.sh
*.flashtalking.com Amazon RSA 2048 M02	`2024-07-30` - `2025-08-28`	a year	crt.sh
*.ad-score.com Go Daddy Secure Certificate Authority - G2	`2024-09-05` - `2025-10-07`	a year	crt.sh
cdn.flashtalking.com DigiCert TLS RSA SHA256 2020 CA1	`2025-02-25` - `2026-02-25`	a year	crt.sh
adtrafficquality.google WR2	`2025-03-31` - `2025-06-23`	3 months	crt.sh
*.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2025-02-09` - `2025-05-10`	3 months	crt.sh
id5-sync.com E5	`2025-03-01` - `2025-05-30`	3 months	crt.sh
*.crwdcntrl.net Amazon RSA 2048 M02	`2024-09-07` - `2025-10-07`	a year	crt.sh
eu-1-id5-sync.com R10	`2025-03-01` - `2025-05-30`	3 months	crt.sh

This page contains 19 frames:

Primary Page: https://kr.buddysecret.com/
Frame ID: B244781F35D75F6DA32D687D9270481D
Requests: 82 HTTP requests in this frame

Frame: https://www.googletagmanager.com/static/service_worker/54a0/sw_iframe.html?origin=https%3A%2F%2Fkr.buddysecret.com
Frame ID: BD4F4DA955CEB551354AF28943584B96
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/ga/rul?tid=G-21EKGFLRB3&gacid=1243215478.1744903608&gtm=45je54f1v882275148za200&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=102509682~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103130498~103130500&z=2114652611
Frame ID: B1E2E6C377C16CBF41961A6D0783D9AC
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/static/topics/topics_frame.html
Frame ID: 8097BDC09712A70756B0088CFD543E34
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20250410/r20190131/zrt_lookup_fy2021.html
Frame ID: 4EE3ACF9BF3FB61FAED86C2FD28BA248
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&gpp_sid=-1&client=ca-pub-9369680060196134&output=html&adk=1812271804&adf=3025194257&abgtt=6&lmt=1744903608&plaf=7%3A2&plat=3%3A128%2C4%3A128%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fkr.buddysecret.com%2F&pra=5&wgl=1&aihb=0&asro=0&aifxl=29_18~30_19&aiapm=0.15&aiapmi=0.16&aiact=0.7&ailct=0.7&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1744903607633&bpp=4&bdt=1714&idt=139&shv=r20250410&mjsv=m202504140101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&nras=1&correlator=2569786218843&frm=20&pv=2&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=95355973%2C95355975%2C31091833%2C95331832%2C95353451%2C95354564%2C95357460%2C95357878%2C95357716%2C95358121&oid=2&pvsid=760403915646792&tmod=1928073957&uas=0&nvt=1&fsapi=1&fc=1920&brdim=100%2C100%2C100%2C100%2C1600%2C0%2C1600%2C1285%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=1&uci=a!1&fsb=1&dtd=846
Frame ID: 6B2A551B137440AE26910B4692CC439A
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/ga/rul?tid=G-9QKBNZJYL1&gacid=1243215478.1744903608&gtm=45je54f1h1v899789978z8843104604za200zb843104604&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=102509683~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103116025~103130498~103130500&z=433650386
Frame ID: CFEFE6FDC9CF04B0B247351F0808F8F0
Requests: 1 HTTP requests in this frame

Frame: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html
Frame ID: A8900B2E4C165A5F702DBA8A1BFC925B
Requests: 1 HTTP requests in this frame

Frame: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html
Frame ID: 1D357760152BFAAD4F78962A114F57C3
Requests: 41 HTTP requests in this frame

Frame: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html
Frame ID: 9DC36C5A4E9186517ACC4EA29DE902E2
Requests: 17 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQw7j0ARj-sMmKAjAB&v=APEucNXlW9q4hvhNJlsdvf1HJ3AY_WvujGQJLH2hetL11DBvdUmlyxlbhwRY0uu3SYAyZCArspX22bYUZ3WWohBS46xFqwhwwE_Bme64iHVIJT3hrrhHwpQ
Frame ID: 71A9B2F10B25C697FB5B5094AABDFEED
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 0955A21BBF428AC4E0E9F1804B31C356
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: F2E9D0301FF198BB70D9A43EC5FB9933
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 0A0962E64CAE24EBD30D8584D5B8E7E4
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: 75F1B4F73B0C123BC4BD4AED05BE54A6
Requests: 3 HTTP requests in this frame

Frame: https://cdn.flashtalking.com/194232/4753811/index.html
Frame ID: 97100EADCF5CBD990630DD3D8922570A
Requests: 4 HTTP requests in this frame

Frame: data://truncated
Frame ID: 57B9A63CB9CCE021525EEECEC472BAE1
Requests: 1 HTTP requests in this frame

Frame: https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html
Frame ID: 0F2BA377DCA4FB6B13D47F54EDE15392
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 03B3923698369EDD9B1BBB6F564A2C25
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

BuddySecret | 친구들을 당신의 비밀 일기에 참여시켜 보세요.

Page URL History Show full URLs

http://kr.buddysecret.com/ HTTP 307
https://kr.buddysecret.com/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

AngularJS (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

\bangular.{0,32}\.js

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Prebid (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.com/[^"]*(?:prebid|/pb\.js)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

181
Requests

86 %
HTTPS

48 %
IPv6

44
Domains

62
Subdomains

49
IPs

7
Countries

4786 kB
Transfer

11624 kB
Size

71
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://www.instagram.com/buddysecret2

Search URL Search Domain Scan URL

URL: https://www.facebook.com/Buddysecret1

Search URL Search Domain Scan URL

URL: https://twitter.com/BuddySecret1

Search URL Search Domain Scan URL

URL: https://kr.realtest.me/%EB%8B%B9%EC%8B%A0%EC%9D%80%EC%B9%9C%EA%B5%AC%EB%93%A4%EC%9D%B4%EB%AA%87%EB%AA%85%EC%9D%B4%EB%82%98%EC%9E%88%EB%82%98%EC%9A%94/play/3353?utm_site_source=custom&utm_site_medium=ad&utm_site_campaign=user

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://kr.buddysecret.com/ HTTP 307
https://kr.buddysecret.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 98

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJMvtw8FKAs2pYL7SYevKkE&google_cver=1&gdpr=0

Request Chain 99

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=aAEdudHM6qoAAFqKAFRrgAAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJMvtw8FKAs2pYL7SYevKkE&google_cver=1

Request Chain 100

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0 HTTP 302
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEOcnrGDLHwh_hfOWsBHKf-s&google_cver=1

Request Chain 101

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Nzk3MzYxODQ2NDAyODk1MDky

Request Chain 108

https://match.adsrvr.org/track/cmf/google?google_push=AXcoOmREpRckBVY6xQ5NZpA9wOkTijxToGu_93Rpl4r1Twa4CXrxVOrCCTRg_phydKSH6Q5mGYx751_phmPPShfX2Ke6sbAO2B4_PA HTTP 302
https://match.adsrvr.org/track/cmb/google?google_push=AXcoOmREpRckBVY6xQ5NZpA9wOkTijxToGu_93Rpl4r1Twa4CXrxVOrCCTRg_phydKSH6Q5mGYx751_phmPPShfX2Ke6sbAO2B4_PA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=YmY0OWFiY2YtZWUwNS00Y2FlLWE3YjYtMzg3NmZjMGVhOWVm&google_push&gdpr=0&gdpr_consent=&ttd_tdid=bf49abcf-ee05-4cae-a7b6-3876fc0ea9ef

Request Chain 109

https://match.prod.bidr.io/cookie-sync/adx?google_push=AXcoOmTwXfwcpRVvgR2ZlOw3EewIlj12XytPpT10CybrsEUMs7PJaPj6dSfYxbWl2k9kiOv4VS7r1WMLIqICI1VVlEGS1Jlop623zQ HTTP 303
https://match.prod.bidr.io/cookie-sync/adx?google_push=AXcoOmTwXfwcpRVvgR2ZlOw3EewIlj12XytPpT10CybrsEUMs7PJaPj6dSfYxbWl2k9kiOv4VS7r1WMLIqICI1VVlEGS1Jlop623zQ&_bee_ppp=1 HTTP 303
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFFSlowN1FBanNBQUJ4cDdnTHFQZw&google_push=AXcoOmTwXfwcpRVvgR2ZlOw3EewIlj12XytPpT10CybrsEUMs7PJaPj6dSfYxbWl2k9kiOv4VS7r1WMLIqICI1VVlEGS1Jlop623zQ&bee_sync_partners=&bee_sync_current_partner=adx&bee_sync_hop_count=1

Request Chain 110

https://b1sync.zemanta.com/usersync/googleadx/?google_push=AXcoOmQcDFhHTAsljtly_l0wNhmdJSspAvevnFEGwTFGV7riFTPOjfGAne9jTtwWdkU8ghhf7apN7NAzrhMOkFQfEncOa4racUoxlw HTTP 302
https://b1sync.outbrain.com/usersync/googleadx/?google_push=AXcoOmQcDFhHTAsljtly_l0wNhmdJSspAvevnFEGwTFGV7riFTPOjfGAne9jTtwWdkU8ghhf7apN7NAzrhMOkFQfEncOa4racUoxlw&s=2 HTTP 302
https://b1sync.zemanta.com/usersync/googleadx/?google_push=AXcoOmQcDFhHTAsljtly_l0wNhmdJSspAvevnFEGwTFGV7riFTPOjfGAne9jTtwWdkU8ghhf7apN7NAzrhMOkFQfEncOa4racUoxlw&obuid=d90a8f44-6ad9-4b84-a205-808e48dc40b4&s=2 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmQcDFhHTAsljtly_l0wNhmdJSspAvevnFEGwTFGV7riFTPOjfGAne9jTtwWdkU8ghhf7apN7NAzrhMOkFQfEncOa4racUoxlw&google_hm=ZDkwYThmNDQtNmFkOS00Yjg0LWEyMDUtODA4ZTQ4ZGM0MGI0

Request Chain 111

https://sync.srv.stackadapt.com/sync?nid=154&google_push=AXcoOmRxKIApwCbu7EB8v-wGUGWCe5woL41gxrNM0Pcp_ZLYlG2eLsuOvK7sm8xeOJxeCRzaP0jInIZeyIDIdzPhwRUQ13vcRNGD HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=JadE-PchX0xYM7fAfAIENQW16oY&google_push=AXcoOmRxKIApwCbu7EB8v-wGUGWCe5woL41gxrNM0Pcp_ZLYlG2eLsuOvK7sm8xeOJxeCRzaP0jInIZeyIDIdzPhwRUQ13vcRNGD

Request Chain 112

https://dsp.adkernel.com/sync?exchange=11&google_push=AXcoOmS7_9yxggs4uAQIMKx7iDR9vf5kTeNXnwBnIuvVlC4r37LsboZXKSQmFXchWQdd0eBp3WPALm3yfWPYcyfFKYgIItgjS6ZDBQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=adkernel&google_hm=QTU2MDQzNDA4MDc0MTU2MzcwNzk&google_push=AXcoOmS7_9yxggs4uAQIMKx7iDR9vf5kTeNXnwBnIuvVlC4r37LsboZXKSQmFXchWQdd0eBp3WPALm3yfWPYcyfFKYgIItgjS6ZDBQ

Request Chain 113

https://onetag-sys.com/match/?int_id=19&redir=1&google_push=AXcoOmTx7gYfRo3Gayp4S1qRJVR42pOXvzFKjdqlFd20-12dXSHqMFmdWrfQwui8kFnUl_2iM4xCje9DxH12MDF4Y2HwYEODaaXV HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmTx7gYfRo3Gayp4S1qRJVR42pOXvzFKjdqlFd20-12dXSHqMFmdWrfQwui8kFnUl_2iM4xCje9DxH12MDF4Y2HwYEODaaXV

Request Chain 114

https://creativecdn.com/cm-notify?pi=adxab&google_nid=rtb_house_tr&google_push=AXcoOmQiInHAXClMeUEdmhKhv2olsz3HQ45NcOk58gnb4ROwVcer4Z2J-L3WR_0XXiR24wdHwXEmxb5I04DvGwsZal162KeYVZA8ww HTTP 302
https://creativecdn.com/cm-notify?pi=adxab&google_nid=rtb_house_tr&google_push=AXcoOmQiInHAXClMeUEdmhKhv2olsz3HQ45NcOk58gnb4ROwVcer4Z2J-L3WR_0XXiR24wdHwXEmxb5I04DvGwsZal162KeYVZA8ww&tc=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_ula=5153224&google_hm=xcbBFKseDHl2g-ww9frTDO37mFPT2DKPw5pJW4AkDRw&pi=adx&tdc=ams&pi=adxab&google_nid=rtb_house_tr&google_push=AXcoOmQiInHAXClMeUEdmhKhv2olsz3HQ45NcOk58gnb4ROwVcer4Z2J-L3WR_0XXiR24wdHwXEmxb5I04DvGwsZal162KeYVZA8ww&tc=1

Request Chain 116

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 129

https://a.tribalfusion.com/i.match?p=b6&u=&google_push=AXcoOmTjnI3kP00tmw7zi9hA2ibB0f5Yu3fRq36irCpGbvqidjhRz8J_OGiZEVoSQ1ufLfuLwxN2eIPatPTawodZEZ64kdTX9Xn5eQ&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmTjnI3kP00tmw7zi9hA2ibB0f5Yu3fRq36irCpGbvqidjhRz8J_OGiZEVoSQ1ufLfuLwxN2eIPatPTawodZEZ64kdTX9Xn5eQ%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24 HTTP 302
https://s.tribalfusion.com/z/i.match?p=b6&u=&google_push=AXcoOmTjnI3kP00tmw7zi9hA2ibB0f5Yu3fRq36irCpGbvqidjhRz8J_OGiZEVoSQ1ufLfuLwxN2eIPatPTawodZEZ64kdTX9Xn5eQ&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmTjnI3kP00tmw7zi9hA2ibB0f5Yu3fRq36irCpGbvqidjhRz8J_OGiZEVoSQ1ufLfuLwxN2eIPatPTawodZEZ64kdTX9Xn5eQ%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=exp&google_push=AXcoOmTjnI3kP00tmw7zi9hA2ibB0f5Yu3fRq36irCpGbvqidjhRz8J_OGiZEVoSQ1ufLfuLwxN2eIPatPTawodZEZ64kdTX9Xn5eQ&google_ula=2786954&google_hm=18072662158148687623

Request Chain 130

https://ads.travelaudience.com/google_pixel?google_push=AXcoOmTASAykh7IGTcj111uz6W3d6QvEQ7YetGTNvbdYVJtWyAOv311zXX5sstI1EFd6GWoim0RxbatdU1Jj2JSE3ie4B6z_CMWqLw HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=StvpU9wtRTAnEJgEUjspmQ&google_push=AXcoOmTASAykh7IGTcj111uz6W3d6QvEQ7YetGTNvbdYVJtWyAOv311zXX5sstI1EFd6GWoim0RxbatdU1Jj2JSE3ie4B6z_CMWqLw

Request Chain 131

https://a.c.appier.net/gcm?google_push=AXcoOmQQeKbMPpSNg_RNpb7098yQ6070YNZ0ZFw6sA8QtmhbekMedSwwPGqXAJN9o0Ngu2u3XzGXrkSFrzzxLWOPA1ZYsuyL46pp HTTP 302
https://cm.g.doubleclick.net/pixel?google_hm=Y3U2RXhqcFBCM09QM0U4WXVoMEJhQQ%3D%3D&google_nid=appier&google_push=AXcoOmQQeKbMPpSNg_RNpb7098yQ6070YNZ0ZFw6sA8QtmhbekMedSwwPGqXAJN9o0Ngu2u3XzGXrkSFrzzxLWOPA1ZYsuyL46pp

Request Chain 132

https://google.partners.tremorhub.com/sync?UIDF=&google_push=AXcoOmS5nnphihAbLuJ8bijIR_OaQav8vR4Q0L1xlZHblglLOE4JSI24LCJ4g8XZstmdZ0jojKWMrm9qsPb-SA_ApyYNNzPmbgd0pw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=tremor&google_hm=Njk2ZjFiYjYyYjQ5NGQ1ZWFhMmM4MzU0MGY2MjRmZmQ%3D&UIDF=&google_push=AXcoOmS5nnphihAbLuJ8bijIR_OaQav8vR4Q0L1xlZHblglLOE4JSI24LCJ4g8XZstmdZ0jojKWMrm9qsPb-SA_ApyYNNzPmbgd0pw

Request Chain 133

https://match.sharethrough.com/E4rooAtA/v1?google_push=AXcoOmRFubF8iScWipejzVwNeI4yc5MwIeGd21zjHWB73KLJA2vYLN-U_EoAiQco2FaVmGY50-1Nh7XfhYuF-OStBY5ZiTU1hv1fevc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=ZmIxZDlmY2EtZjA3YS00M2IxLTkwNTktZjFhMTRhMzkzNGE3&google_push=AXcoOmRFubF8iScWipejzVwNeI4yc5MwIeGd21zjHWB73KLJA2vYLN-U_EoAiQco2FaVmGY50-1Nh7XfhYuF-OStBY5ZiTU1hv1fevc

Request Chain 134

https://sync.teads.tv/um?ssb_provider_id=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_push=AXcoOmQGyVv_KCt0A54LktJTkymkjcFnGyGCMT3nPlI2XCNXybcGnzJ2DC5dqYwflGOH1CoYxY2Np1u_FqCw2AP_Jy3gnFGiS7hvYmg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=NTE5NjJkMzUtMjE3YS00ZDhlLWI5MzAtMTBiNTkxMzE2YzM3&google_push=AXcoOmQGyVv_KCt0A54LktJTkymkjcFnGyGCMT3nPlI2XCNXybcGnzJ2DC5dqYwflGOH1CoYxY2Np1u_FqCw2AP_Jy3gnFGiS7hvYmg HTTP 302
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

Request Chain 172

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fkr.buddysecret.com%2F&domain=kr.buddysecret.com&cw=1&lsw=1 HTTP 302
https://mug.criteo.com/sid?cpp=rdqsVnx2c3RKU080T3FCU3cra0lRc0VLUERqUnZnc21wR0JEaEY0cW5zU29wd3FQa2FsN2F0a2lnUGRWalhvR2lPRlBHR3dZQWJZYUZRY3JnRGlxZW4wb25WRytvMDNEN1B2RmZvZVpub2hIWjdYem1jMmFkTTFTN0VkZFU2QmtSVEtVVElIZFdNbmhVd3FHQ2F0Z2VFd21QMHhNZnZGaVVjNWkwTFdPU1VCcXRDRWJUMjdFQ3RQR1IxaUY4TlVkc0dOUGFiQUhVZUdhblVzTTYwUDZCQ1FsQWhXQkN5NTVLVWVscW1JRndQM2pKNGNvdndHMi84U0lRRHlSSjYwL1FLcHJWRGdkN1VFNVlsQXVnSVVFa3NpQnFZUT09fA&cppv=2

181 HTTP transactions
6 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

200

Primary Request / Show response
kr.buddysecret.com/
Redirect Chain

http://kr.buddysecret.com/
https://kr.buddysecret.com/

32 KB
10 KB

697ms
659ms

Document
text/html

2606:4700:3030::6815:1001
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:1001 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

61848dad75b06e2ccedf7d41c9a180cb8a7217a5e181c10a17e38acd7f487f0f

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 931cf14cecbe4239-EWR
content-encoding: zstd
content-type: text/html; charset=UTF-8
date: Thu, 17 Apr 2025 15:26:45 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eviiDuzQl8vXGPohc2YHJH0Xe%2BzCsWgd6xkRTyPlY6oKAuopRVi4uUqdWf%2FE0SucjoSac6257kkjH6E0SGPimz7deCJS4i4wNWxBbjXA8KY9xQ0tKwZ4KrG8W9g8G9M1cg23r%2BNVeytesxZTSrC1fh8%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
server-host: as-hi-149-web
server-timing: cfL4;desc="?proto=QUIC&rtt=8796&min_rtt=7875&rtt_var=2295&sent=11&recv=11&lost=0&retrans=0&sent_bytes=3695&recv_bytes=3293&delivery_rate=799&cwnd=12000&unsent_bytes=0&cid=38b3257c39a7dd08&ts=664&x=16"
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Redirect headers

Location: https://kr.buddysecret.com/
Non-Authoritative-Reason: HttpsUpgrades

GET
H3 200 font-awesome.css
kr.buddysecret.com/public/css/ 30 KB
8 KB 31ms
30ms Stylesheet
text/css 2606:4700:3030::6815:1001
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://kr.buddysecret.com/public/css/font-awesome.css?v=20250213

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:1001 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c936bca314b30e3c48bbad667c920cac28e3e43b72f5f372c706e885a0aa2743

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

content-encoding: zstd
cf-cache-status: HIT
etag: W/"b6da1-7823-6062c071e0700"
age: 750
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HDEJy5ggPx5F6v59qCMh93yoeFvVWwWYJB%2FHDd%2FbWu8rb82RdUq95QYJex9HPH0qxoh2eH%2B03CfsaZvNuhqyuiOH%2FZ9ndqWMNU960sQIoMN7Wsouk%2BlPef%2Bl56fnNlFe6HILYt8QVOMl0BbyXL1pCjo%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=8796&min_rtt=7875&rtt_var=2295&sent=11&recv=11&lost=0&retrans=0&sent_bytes=3695&recv_bytes=3293&delivery_rate=799&cwnd=12000&unsent_bytes=0&cid=38b3257c39a7dd08&ts=956&x=16"
date: Thu, 17 Apr 2025 15:26:46 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Mon, 25 Sep 2023 10:00:28 GMT
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 931cf152ad364239-EWR
server-host: as-hi-160-web
server: cloudflare

GET
H3 200 bootstrap.css
kr.buddysecret.com/public/css/ 119 KB
22 KB 1256ms
1253ms Stylesheet
text/css 2606:4700:3030::6815:1001
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://kr.buddysecret.com/public/css/bootstrap.css?v=20250213

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:1001 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a5270b4442df921b38b1241f7152a12f1cc932633bae9ec745515477369e4939

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: MISS
etag: W/"b6f45-1dad3-60ae2d5e97f00"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AhIJTzlO5%2BJvvwhRY2qoLUYzFrDbrQf5GyKNaha5OoZdA%2BjTJj8MBY2rqpYXO6kxPVkopwdNm3YL4UD%2Bd3gI8TSHMHfmB8tK4Lw%2FpNPjcJAKNFh29DkpPlNRbAYtm3K7dMH8ORMH7GdcQFHrRR3cfiI%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 931cf152ad374239-EWR
server-host: as-hi--web
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=8796&min_rtt=7875&rtt_var=2295&sent=11&recv=11&lost=0&retrans=0&sent_bytes=3695&recv_bytes=3293&delivery_rate=799&cwnd=12000&unsent_bytes=0&cid=38b3257c39a7dd08&ts=2187&x=16"
date: Thu, 17 Apr 2025 15:26:47 GMT
content-type: text/css
last-modified: Fri, 24 Nov 2023 09:47:08 GMT
server: cloudflare
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

GET
H3 200 common-spinner.css
kr.buddysecret.com/public/css/ 2 KB
1 KB 56ms
53ms Stylesheet
text/css 2606:4700:3030::6815:1001
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://kr.buddysecret.com/public/css/common-spinner.css?v=20250213

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:1001 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3b6dfeb59f7464899e64068a09afaa80fdae61e9767a041f9bc60aae5362c599

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

content-encoding: zstd
cf-cache-status: HIT
etag: W/"b6a85-6ff-5dd3c17586ac0"
age: 750
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ylgt6gx9p1facTaM3POX2RKWXAePd7ewDZXQYNNp78XYuASthya0nZ8gJy44YiqpeJlXH4%2F3FMpuuie%2FrZ9uv%2B3a%2Bc6fETEJZsVy3Ue4I3lWb945waTeDXBViZudZXYTbhbNN0A0KbdJucDI2K%2FOm3o%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=8796&min_rtt=7875&rtt_var=2295&sent=11&recv=11&lost=0&retrans=0&sent_bytes=3695&recv_bytes=3293&delivery_rate=799&cwnd=12000&unsent_bytes=0&cid=38b3257c39a7dd08&ts=982&x=16"
date: Thu, 17 Apr 2025 15:26:46 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Fri, 22 Apr 2022 10:57:23 GMT
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 931cf152ad394239-EWR
server-host: as-hi-160-web
server: cloudflare

GET
H3 200 style.css
kr.buddysecret.com/public/css/surpriseforu/ 82 KB
16 KB 33ms
30ms Stylesheet
text/css 2606:4700:3030::6815:1001
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://kr.buddysecret.com/public/css/surpriseforu/style.css?v=20250213

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:1001 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2ea6b0765c26c3890b84b72d244500f51bbcdf8ff5b9307fd1742baaf74a1e5a

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

content-encoding: zstd
cf-cache-status: HIT
etag: W/"b8b49-1478a-62f698abd5780"
age: 749
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RLA04VsNV4shkWcQ8G9PW34oZCkZ2d2O4gH1XtBUUSN1p6aNP2B%2BtEIpI9aZp7meE2Gq%2FZmJrJS0lDHqDQfGtfjzZP7PduxwOpZ6ASJozPSnkbGPbn%2BHVUa8JAsGxNeMW0nwtYbJUC7flMpRl2f2EdA%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=8796&min_rtt=7875&rtt_var=2295&sent=11&recv=11&lost=0&retrans=0&sent_bytes=3695&recv_bytes=3293&delivery_rate=799&cwnd=12000&unsent_bytes=0&cid=38b3257c39a7dd08&ts=959&x=16"
date: Thu, 17 Apr 2025 15:26:46 GMT
content-type: text/css
vary: Accept-Encoding
last-modified: Mon, 03 Mar 2025 05:36:46 GMT
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 931cf152ad384239-EWR
server-host: as-hi-176-web
server: cloudflare

GET
H2 200 ots-126-1758947244.js Show response
datacygnal.io/ 248 KB
86 KB 77ms
38ms Script
application/javascript 2606:4700:3108::ac42:28a3
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL: https://datacygnal.io/ots-126-1758947244.js
Requested by: Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3108::ac42:28a3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d60668453877eac3e55b0d4b4ba8db95fd237171aa5388d7b5f31ce3763377b8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
cf-cache-status: HIT
etag: W/"3dfa0-62bbf31d42ac0"
age: 5294
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B1Kxl8o0LpXz0Sjoc%2BwvJ0tBr6E%2F3NOKLJ%2FDge53Wxn8pqT6cIyiQdkO3J4Qq%2Br13J74E9iSUgVPz19lc0Q7qjYnUI%2F2SgLhyjXPwo72ZLnK47siIQu3yyubJEvg9dOJjUTAfxxdUxk8j0Q%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 931cf152ddebf791-EWR
server-timing: cfL4;desc="?proto=TCP&rtt=7487&min_rtt=7205&rtt_var=1401&sent=8&recv=11&lost=0&retrans=0&sent_bytes=4023&recv_bytes=2303&delivery_rate=551189&cwnd=253&unsent_bytes=0&cid=38173a33d8a8ad94&ts=46&x=0"
date: Thu, 17 Apr 2025 15:26:46 GMT
content-type: application/javascript
last-modified: Wed, 15 Jan 2025 14:07:15 GMT
vary: Accept-Encoding
server: cloudflare

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 267 KB
93 KB 136ms
91ms Script
application/javascript 2607:f8b0:4006:821::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-192512597-12

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

43324aeea4490ed1ade86f559e71f0708c76416c76d7231645eb4cd1c0915ea4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1055:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1055:0"}],}
expires: Thu, 17 Apr 2025 15:26:47 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 15:26:47 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 17 Apr 2025 15:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1055:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1055:0
content-length: 95457
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 268 KB
94 KB 128ms
83ms Script
application/javascript 2607:f8b0:4006:821::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-126527512-14

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2b3e41a2654e5211a6f6f7a4e46dc84227dd89f9e3b7d38bccd199171eab8087

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1055:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1055:0"}],}
expires: Thu, 17 Apr 2025 15:26:47 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 15:26:47 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 17 Apr 2025 15:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1055:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1055:0
content-length: 95632
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 152 KB
51 KB 77ms
51ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-9369680060196134

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

043a2cafe2792001a17ef392d26032da56e99275f7b99068d5870f98d01bef7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Origin: https://kr.buddysecret.com
Referer: https://kr.buddysecret.com/

Response headers

content-encoding: br
etag: 1536708290950332581
x-content-type-options: nosniff
expires: Thu, 17 Apr 2025 15:26:47 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 17 Apr 2025 15:26:47 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
link: <https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 52691
x-xss-protection: 0
server: cafe

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 323 KB
111 KB 125ms
81ms Script
application/javascript 2607:f8b0:4006:821::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-11336677260

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d9a80f43d1162b529a3691b3329a11072753b21ac8700f1fb05c6915531cd761

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1055:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1055:0"}],}
expires: Thu, 17 Apr 2025 15:26:47 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 15:26:47 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 17 Apr 2025 15:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1055:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1055:0
content-length: 113035
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 css2
fonts.googleapis.com/ 33 KB
2 KB 57ms
29ms Stylesheet
text/css 2607:f8b0:4006:80b::200a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

94f1349f03cfb69bd52b7b5fce44eb3d58c7cf3eb79d8a7e48ad6afc0ed3e183

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Thu, 17 Apr 2025 15:26:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 15:26:46 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Thu, 17 Apr 2025 14:39:57 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 css2
fonts.googleapis.com/ 13 KB
795 B 67ms
40ms Stylesheet
text/css 2607:f8b0:4006:80b::200a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Poppins:ital,wght@0,100;0,200;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,400;1,500;1,600;1,700;1,800;1,900&display=swap

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

44fa9eae5a99b742fc9ecd104ed5e9b9f9d858590c4732bf860ab2175f30a458

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Thu, 17 Apr 2025 15:26:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 15:26:46 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Thu, 17 Apr 2025 15:26:46 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 BuddySecret_LOGONEW.png
img.holaquiz.com/public/site_content/quiz/ck_editor/images/meta/Surprise4u_2/ 240 KB
241 KB 642ms
579ms Image
image/png 2606:4700:20::ac43:4937
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://img.holaquiz.com/public/site_content/quiz/ck_editor/images/meta/Surprise4u_2/BuddySecret_LOGONEW.png

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4937 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7baed263e09ef3cc2cf23b357f390990fbc493f6a2d93893d0f31a875927dbb8

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

cf-cache-status: REVALIDATED
etag: "16e0b7-3c0b3-5bda6d11b4780"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T4TaLFRZfseoCn9JSk9pJ3xTmbSNyNNr6xhWNADuAV7ZwM5E1cZmYhLvd3lqfNTMcuQMrmgBSKY5omYiRHtiD5HSvkCSQ1dCZLsFYUqc%2FcZKoDJTuzXOCrRHKcRejaDyoAzpjwF8Wr%2BtiMvHifU%3D"}],"group":"cf-nel","max_age":604800}
server-timing: cfL4;desc="?proto=TCP&rtt=19557&min_rtt=13514&rtt_var=13364&sent=7&recv=12&lost=0&retrans=0&sent_bytes=3999&recv_bytes=2338&delivery_rate=284429&cwnd=254&unsent_bytes=0&cid=c3adec0bb121ebaa&ts=596&x=0"
date: Thu, 17 Apr 2025 15:26:46 GMT
content-type: image/png
last-modified: Tue, 16 Mar 2021 12:50:54 GMT
vary: Accept-Encoding
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 931cf1530ebe381d-EWR
server-host: as-hi-205-web
accept-ranges: bytes
access-control-allow-origin: *
content-length: 245939
server: cloudflare

GET
H3 200 language-globe2.png
kr.buddysecret.com/public/images/surpriseforu/ 2 KB
2 KB 550ms
549ms Image
image/png 2606:4700:3030::6815:1001
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://kr.buddysecret.com/public/images/surpriseforu/language-globe2.png

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:1001 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

87293aa389c2ae3691ad691ca7848a875fb0c35bfe5ec8489f2e016f9dec4339

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

cf-cache-status: REVALIDATED
etag: "b8e18-6b4-5dfc0789fb280"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Bk6wmB%2FZxbqtbWYxxxVD48Q3OGi2GQikyztw09lqvUpq2y6WDEdOWNoqhYl13T%2FWohlDEDnNeTkLIiB7hqHFrsPLvfZdnHjj%2BIwebZQGEjKXepm1OjTK5cigGDRFs9B4APb8eZTHx6099GLLBLW%2FFAI%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=8796&min_rtt=7875&rtt_var=2295&sent=11&recv=11&lost=0&retrans=0&sent_bytes=3695&recv_bytes=3293&delivery_rate=799&cwnd=12000&unsent_bytes=0&cid=38b3257c39a7dd08&ts=1479&x=16"
date: Thu, 17 Apr 2025 15:26:46 GMT
content-type: image/png
vary: Accept-Encoding
last-modified: Tue, 24 May 2022 11:43:54 GMT
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 931cf152ad3a4239-EWR
server-host: as-hi-160-web
accept-ranges: bytes
content-length: 1716
server: cloudflare

GET
H3 200 Pink_insta.png
kr.buddysecret.com/public/images/surpriseforu/ 867 B
2 KB 29ms
28ms Image
image/png 2606:4700:3030::6815:1001
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://kr.buddysecret.com/public/images/surpriseforu/Pink_insta.png

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:1001 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ab0a4fd818ae651b0b4da61889b0543363fee8a750aeb9dd38e77ce6917d11bf

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

cf-cache-status: HIT
etag: "b8e12-363-5dfc0789fb280"
age: 748
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vA7dQ%2FmPU1W6YiymnWi%2F422oyzdqSqfItxPDHne6PxU5MasuOfPQqut44%2FDTrofkMmoDqNcB8F5j%2FEyZMww7wAUYCqhiVVFb7rjJnRN9cgbseQ6yBbDtSNHOO9Zcg4OxKKESzJ%2FOhwMJhWUpka3%2FVYY%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=8796&min_rtt=7875&rtt_var=2295&sent=11&recv=11&lost=0&retrans=0&sent_bytes=3695&recv_bytes=3293&delivery_rate=799&cwnd=12000&unsent_bytes=0&cid=38b3257c39a7dd08&ts=1510&x=16"
date: Thu, 17 Apr 2025 15:26:46 GMT
content-type: image/png
vary: Accept-Encoding
last-modified: Tue, 24 May 2022 11:43:54 GMT
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 931cf1561d914239-EWR
server-host: as-hi-68-web
accept-ranges: bytes
content-length: 867
server: cloudflare

GET
H3 200 Pink_fb.png
kr.buddysecret.com/public/images/surpriseforu/ 428 B
1 KB 530ms
530ms Image
image/png 2606:4700:3030::6815:1001
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://kr.buddysecret.com/public/images/surpriseforu/Pink_fb.png

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:1001 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d98cb0a1e156fddbf20389dc37e2ed4860fe71e9a691e34e41f3ba9516b805ac

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

cf-cache-status: REVALIDATED
etag: "b8e11-1ac-5dfc0789fb280"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6id5U6DMEjsqAOeAYWKxhBvkC6Ihb6jcI6%2BtXIUMoQnHxlMEAvBUDJ9lVb4c96mQjGcXBdl%2FWstkAwhs1bXNzwLD4lyNx5ojiG2SpPuldxqxsuIXX5yN5wRjP1uFut3YPzxle%2FdS68QGmQdKsgCsvro%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=8796&min_rtt=7875&rtt_var=2295&sent=11&recv=11&lost=0&retrans=0&sent_bytes=3695&recv_bytes=3293&delivery_rate=799&cwnd=12000&unsent_bytes=0&cid=38b3257c39a7dd08&ts=2046&x=16"
date: Thu, 17 Apr 2025 15:26:47 GMT
content-type: image/png
vary: Accept-Encoding
last-modified: Tue, 24 May 2022 11:43:54 GMT
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 931cf1564da54239-EWR
server-host: as-hi-160-web
accept-ranges: bytes
content-length: 428
server: cloudflare

GET
H3 200 Pink_twitter.png
kr.buddysecret.com/public/images/surpriseforu/ 829 B
2 KB 27ms
27ms Image
image/png 2606:4700:3030::6815:1001
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://kr.buddysecret.com/public/images/surpriseforu/Pink_twitter.png

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:1001 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f61c6c2848203266c231c5690c5871675a612d38df19946c9d3167dc5bf34e0c

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

cf-cache-status: HIT
etag: "b8e13-33d-5dfc0789fb280"
age: 748
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UjMJfTDqsoBOPVVPvfbwV2E%2BzGyk%2Fx1cw2tk5f4%2BZKklrEgJcclSuDQBEbd%2BK7ViKryMQ9pPgJHAKrfa2in9g6Gp3uW%2Fi1Yq4ijvHzqbO4SBDBpwfga2tUB59P59TQfXqQA6i1ZP17YdxIP%2BsR%2FFZRs%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=8796&min_rtt=7875&rtt_var=2295&sent=11&recv=11&lost=0&retrans=0&sent_bytes=3695&recv_bytes=3293&delivery_rate=799&cwnd=12000&unsent_bytes=0&cid=38b3257c39a7dd08&ts=1642&x=16"
date: Thu, 17 Apr 2025 15:26:46 GMT
content-type: image/png
vary: Accept-Encoding
last-modified: Tue, 24 May 2022 11:43:54 GMT
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 931cf156edb54239-EWR
server-host: as-hi-142-web
accept-ranges: bytes
content-length: 829
server: cloudflare

GET
H2 200 HolaQuiz-Category67b8191f6820e.jpg
img.holaquiz.com/public/site_content/quiz/category/ 221 KB
222 KB 1327ms
1315ms Image
image/jpeg 2606:4700:20::ac43:4937
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://img.holaquiz.com/public/site_content/quiz/category/HolaQuiz-Category67b8191f6820e.jpg

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4937 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

57c634fc97a7a5c89a37ec929687ebd2a8f531c6f1c0151bcf75b5949a80d34d

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

cf-cache-status: MISS
etag: "31c363-37404-62ea0dd5145c0"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=skdEjC7U8MBA4D%2BJRnsNr6iYwlYdS3xN69DYIz8a2zvVv9YRPh%2BMeGiPcRhAaLmBgd4ZwKrpaomdDfvoQHC7B4WypzGCld9pIRNWHAEo5p1X9dWVTgNPpuD%2Bbqw7hUV0AVKD2cD%2FKmjrnu%2BS0qg%3D"}],"group":"cf-nel","max_age":604800}
server-timing: cfL4;desc="?proto=TCP&rtt=18743&min_rtt=13514&rtt_var=94&sent=345&recv=331&lost=0&retrans=0&sent_bytes=420251&recv_bytes=2893&delivery_rate=8157725&cwnd=388&unsent_bytes=0&cid=c3adec0bb121ebaa&ts=2620&x=0"
date: Thu, 17 Apr 2025 15:26:48 GMT
content-type: image/jpeg
last-modified: Fri, 21 Feb 2025 06:11:43 GMT
vary: Accept-Encoding
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 931cf15b1a14381d-EWR
server-host: as-hi-205-web
accept-ranges: bytes
access-control-allow-origin: *
content-length: 226308
server: cloudflare

GET
H2 200 HolaQuiz-Category6045d5ec9a3e3.jpg
img.holaquiz.com/public/site_content/quiz/category/ 174 KB
175 KB 1303ms
1291ms Image
image/jpeg 2606:4700:20::ac43:4937
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://img.holaquiz.com/public/site_content/quiz/category/HolaQuiz-Category6045d5ec9a3e3.jpg

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4937 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

262235b53289354531ed1c656f88f05a2af65e78b3fc0e1018024e599f47f46b

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

cf-cache-status: MISS
etag: "cffe3-2b9e5-5bd019b705300"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ewyq1YLpZJcC8j3wNXPq9aRU6fwPCB1rtQh68%2BTlkC55HdljvhzU9wEu9AADH25ewiNY3tgITeN%2FHgBuA8f4%2BIzlTb%2Ff%2BKyKEsX2WOdeEYxaCRoK9A4D0cU0aD9uWkiEYR07VIndzBAyYNvDQsY%3D"}],"group":"cf-nel","max_age":604800}
server-timing: cfL4;desc="?proto=TCP&rtt=17616&min_rtt=13514&rtt_var=184&sent=294&recv=280&lost=0&retrans=0&sent_bytes=356175&recv_bytes=2893&delivery_rate=8157725&cwnd=388&unsent_bytes=0&cid=c3adec0bb121ebaa&ts=2597&x=0"
date: Thu, 17 Apr 2025 15:26:48 GMT
content-type: image/jpeg
last-modified: Mon, 08 Mar 2021 07:44:44 GMT
vary: Accept-Encoding
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 931cf15b1a19381d-EWR
server-host: as-hi-205-web
accept-ranges: bytes
access-control-allow-origin: *
content-length: 178661
server: cloudflare

GET
H2 200 HolaQuiz-Category652394206c6e7.png
img.holaquiz.com/public/site_content/quiz/category/ 104 KB
105 KB 1246ms
1235ms Image
image/png 2606:4700:20::ac43:4937
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://img.holaquiz.com/public/site_content/quiz/category/HolaQuiz-Category652394206c6e7.png

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4937 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b6fcf52da7b7725cba7568a798d4034232bd375a2a48ae9786da94c65a697795

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

cf-cache-status: MISS
etag: "334055-1a1eb-6074222f54800"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bA6MgqwWqpg27DHl1HnQQxnOyGyfClzVr9ya2Y8suTawsQ7VjoDu8xUWxF54YltykZryD2ZWE8knqKSV%2BcSz3fMCxnmUyW9XGp%2BR58DxRs2RVsSePYy%2BBXIawt%2Fde8Vkbb6poHtdKBSa8jffctY%3D"}],"group":"cf-nel","max_age":604800}
server-timing: cfL4;desc="?proto=TCP&rtt=14750&min_rtt=13514&rtt_var=40&sent=256&recv=242&lost=0&retrans=0&sent_bytes=308556&recv_bytes=2893&delivery_rate=8157725&cwnd=388&unsent_bytes=0&cid=c3adec0bb121ebaa&ts=2541&x=0"
date: Thu, 17 Apr 2025 15:26:48 GMT
content-type: image/png
last-modified: Mon, 09 Oct 2023 05:48:16 GMT
vary: Accept-Encoding
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 931cf15b1a1c381d-EWR
server-host: as-hi-205-web
accept-ranges: bytes
access-control-allow-origin: *
content-length: 106987
server: cloudflare

GET
H2 200 korea%20real%20test.png
img.holaquiz.com/public/site_content/quiz/ck_editor/images/ADS_CUSTOM/ 54 KB
54 KB 1078ms
1067ms Image
image/png 2606:4700:20::ac43:4937
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://img.holaquiz.com/public/site_content/quiz/ck_editor/images/ADS_CUSTOM/korea%20real%20test.png

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::ac43:4937 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5c7ee55fa8687f9c8a3ac3866aaeb29531641f15faca744db916ec442f9dd8d7

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

cf-cache-status: MISS
etag: "1185e4-d6d7-5f7a0765a2300"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TJR9vpZmTnV46p0uLyL57LiUT7xP4RNY1Ku4btXtGvDkDTY1rq3OCHn3K%2BpviLXBSV88SR52CyZTfTez%2F9CwGxEgYmWso63%2Bgb0prgyvJjySgqIY08d%2Bc4B%2F0jtWf8ttlhUhPBwI%2BZMUZrtUV48%3D"}],"group":"cf-nel","max_age":604800}
server-timing: cfL4;desc="?proto=TCP&rtt=16289&min_rtt=13514&rtt_var=98&sent=211&recv=198&lost=0&retrans=0&sent_bytes=252848&recv_bytes=2893&delivery_rate=8157725&cwnd=348&unsent_bytes=0&cid=c3adec0bb121ebaa&ts=2374&x=0"
date: Thu, 17 Apr 2025 15:26:48 GMT
content-type: image/png
last-modified: Fri, 24 Mar 2023 07:37:16 GMT
vary: Accept-Encoding
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 931cf15b1a20381d-EWR
server-host: as-hi-205-web
accept-ranges: bytes
access-control-allow-origin: *
content-length: 54999
server: cloudflare

GET
H3 200 BlueFB.png
kr.buddysecret.com/public/images/surpriseforu/ 867 B
2 KB 42ms
33ms Image
image/png 2606:4700:3030::6815:1001
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://kr.buddysecret.com/public/images/surpriseforu/BlueFB.png

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:1001 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

00dd44415498e7c266af756fdf35c8743e4f6e853d476d01ded93d50404c3711

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

cf-cache-status: HIT
etag: "b8e0c-363-5dfc0789fb280"
age: 743
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=86s4DoJSqJYsLQGl3m1Ox2gxLvPXfR%2BPOcMpGjOwSmb7Ju7LjWvIhlbWrCc7E8mAUbFMUZhwG6YgjzA0MYh0QrAKfZH1HHCy8y00VepDhe%2FlnF2e0i1Y0sfubenKBCc6IJALnEUw5whwWNP9zV%2Bf0Ao%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=8796&min_rtt=7875&rtt_var=2295&sent=11&recv=11&lost=0&retrans=0&sent_bytes=3695&recv_bytes=3293&delivery_rate=799&cwnd=12000&unsent_bytes=0&cid=38b3257c39a7dd08&ts=2310&x=16"
date: Thu, 17 Apr 2025 15:26:47 GMT
content-type: image/png
vary: Accept-Encoding
last-modified: Tue, 24 May 2022 11:43:54 GMT
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 931cf15b1dfb4239-EWR
server-host: as-hi-227-web
accept-ranges: bytes
content-length: 867
server: cloudflare

GET
H3 200 Blueinsta.png
kr.buddysecret.com/public/images/surpriseforu/ 2 KB
2 KB 38ms
30ms Image
image/png 2606:4700:3030::6815:1001
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://kr.buddysecret.com/public/images/surpriseforu/Blueinsta.png

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:1001 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9b37d726335bf66cf138264a88bd4faf1652194d417bf69c3115eb36d66d5590

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

cf-cache-status: HIT
etag: "b8e0d-660-5dfc0789fb280"
age: 743
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vB4ZGiKzrvKNbpxvl%2BM3tDq7vb%2FhZSmtJ6hj7lN%2FD6KaAz6wjcFvC5pdwRLkIdyc2wIGQyd5fmo0fhrzbo5dP6w%2BGIBYqigvC7NvepCi%2BBy1m9DWxGSLmdFHJ61A%2FStewhABwBlSYwj2JA11Yd1JpK4%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=8796&min_rtt=7875&rtt_var=2295&sent=11&recv=11&lost=0&retrans=0&sent_bytes=3695&recv_bytes=3293&delivery_rate=799&cwnd=12000&unsent_bytes=0&cid=38b3257c39a7dd08&ts=2305&x=16"
date: Thu, 17 Apr 2025 15:26:47 GMT
content-type: image/png
vary: Accept-Encoding
last-modified: Tue, 24 May 2022 11:43:54 GMT
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 931cf15b1dfc4239-EWR
server-host: as-hi-227-web
accept-ranges: bytes
content-length: 1632
server: cloudflare

GET
H3 200 Bluetwitter.png
kr.buddysecret.com/public/images/surpriseforu/ 1 KB
2 KB 37ms
30ms Image
image/png 2606:4700:3030::6815:1001
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://kr.buddysecret.com/public/images/surpriseforu/Bluetwitter.png

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:1001 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ecb2dbe5d73e1c489ea95d2cca25c8865e4b07c4b867da199341ba5ee20e87ef

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

cf-cache-status: HIT
etag: "b8e0e-4d3-5dfc0789fb280"
age: 743
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8z956lJmYhP%2FOq9iqKe9YoL%2B9z0LHiF8O22q6Cl5VCJCUCn2AUoaI978ECU0BYzFqzIT9nivvWNF8veerbGGbQfB4M04eAh5knnccfqy5Hy3D5kKgQwzJJOf92CAs48ECYRhPLphb%2BQsBuFSMivOTm4%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=8796&min_rtt=7875&rtt_var=2295&sent=11&recv=11&lost=0&retrans=0&sent_bytes=3695&recv_bytes=3293&delivery_rate=799&cwnd=12000&unsent_bytes=0&cid=38b3257c39a7dd08&ts=2305&x=16"
date: Thu, 17 Apr 2025 15:26:47 GMT
content-type: image/png
vary: Accept-Encoding
last-modified: Tue, 24 May 2022 11:43:54 GMT
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 931cf15b1dfd4239-EWR
server-host: as-hi-149-web
accept-ranges: bytes
content-length: 1235
server: cloudflare

GET
H3 200 jquery.min.js Show response
kr.buddysecret.com/public/js/ 94 KB
35 KB 26ms
26ms Script
text/javascript 2606:4700:3030::6815:1001
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://kr.buddysecret.com/public/js/jquery.min.js?v=20240213_1

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:1001 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

aec3d419d50f05781a96f223e18289aeb52598b5db39be82a7b71dc67d6a7947

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

content-encoding: zstd
cf-cache-status: HIT
etag: W/"b6e36-176f8-5bcb218b0e500"
age: 748
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j1LNU%2BoDUBOyJt5KXs%2Bspqq%2BwHVPsg2ojyRaJWEXce8RpZmab8Ynx66vy8aRv3uAftlyxvN4ukHcj9N5mj54KwIgU7qNRBneWMp%2B%2F1fqcpB4qLdo8uA3h0SS3SOG%2B9uhcKYoFrTT1iSjSYC1lAQz3BY%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=8796&min_rtt=7875&rtt_var=2295&sent=11&recv=11&lost=0&retrans=0&sent_bytes=3695&recv_bytes=3293&delivery_rate=799&cwnd=12000&unsent_bytes=0&cid=38b3257c39a7dd08&ts=1670&x=16"
date: Thu, 17 Apr 2025 15:26:46 GMT
content-type: text/javascript
vary: Accept-Encoding
last-modified: Thu, 04 Mar 2021 08:53:08 GMT
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 931cf1571db84239-EWR
server-host: as-hi-227-web
server: cloudflare

GET
H2 200 choice.js Show response
cmp.inmobi.com/choice/3uGEuyXwFskbz/buddysecret.com/ 4 KB
2 KB 181ms
13ms Script
application/javascript 2600:9000:26fa:0:1b:cadc:ef40:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cmp.inmobi.com/choice/3uGEuyXwFskbz/buddysecret.com/choice.js?tag_version=V3
Requested by: Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:26fa:0:1b:cadc:ef40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d14d5bbdf0172db131ffa07cafec87939e5aa81963be1c63e0de95a64494000e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin,Accept-Encoding
cache-control: max-age=900
content-encoding: br
etag: W/"8d81db5d58a4197041d9003cd34ac39d"
age: 23
cross-origin-resource-policy: cross-origin
via: 1.1 39cd5ffcd7df50a48d03f7c7f50d3d1a.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-amz-cf-id: 69XrvetnQGCG1k0qofQIPU-4AFmRpPj4cy95hbttGhaJZp8nyxrGdw==
date: Thu, 17 Apr 2025 15:26:47 GMT
content-type: application/javascript
last-modified: Thu, 20 Mar 2025 06:36:30 GMT
server: AmazonS3
x-amz-cf-pop: JFK52-P1
x-amz-server-side-encryption: AES256

GET
H3 200 bootstrap.js Show response
kr.buddysecret.com/public/js/ 34 KB
10 KB 528ms
527ms Script
text/javascript 2606:4700:3030::6815:1001
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://kr.buddysecret.com/public/js/bootstrap.js?v=20240213_1

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:1001 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

57f6d3807b91f5746bee342a67bb053029f637f59ed6afee9f224ab8ef394757

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: REVALIDATED
etag: W/"b6e17-888e-6062c071e0700"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1GKSwhe2KeNEZ4XwGSLu5WPF76EbFKsC%2B8g98Ihb3tm0JNgfG2%2BnUuhzYa6JNlkAbXY57%2FGZ3gRbDhuIM7%2FcN9Z4T7tRPnmIP1dV6uCvo9Wml9UiiP4NCrFHotvBWau06MHE6AmP1ttbSPxqcfpk80M%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 931cf1576dbd4239-EWR
server-host: as-hi-91-web
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=8796&min_rtt=7875&rtt_var=2295&sent=11&recv=11&lost=0&retrans=0&sent_bytes=3695&recv_bytes=3293&delivery_rate=799&cwnd=12000&unsent_bytes=0&cid=38b3257c39a7dd08&ts=2222&x=16"
date: Thu, 17 Apr 2025 15:26:47 GMT
content-type: text/javascript
last-modified: Mon, 25 Sep 2023 10:00:28 GMT
server: cloudflare
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

GET
H3 200 angular.js Show response
kr.buddysecret.com/public/js/ 114 KB
42 KB 20ms
19ms Script
text/javascript 2606:4700:3030::6815:1001
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://kr.buddysecret.com/public/js/angular.js?v=20240213_1

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:1001 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c72c5cdb8ee97ed1e23f49f9cc0884c795f9c70e85a566453d9701f12cebfe9f

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

content-encoding: zstd
cf-cache-status: HIT
etag: W/"b6e2d-1c61c-5bcb218b0e500"
age: 748
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fraNe1Ke1HHYfmf7irs2q4USlntINuTDRmC9qwkBFaHW9GuEsjs9DCxEgasLALxZUwNjTAty7aFVJyRhJ3wXAiyT9fFAQg4dQVBmBvx0z3F8DLmHd5eqI72d9XmibSN9%2BqI8mScesfZimY8LGuFMWpg%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=8796&min_rtt=7875&rtt_var=2295&sent=11&recv=11&lost=0&retrans=0&sent_bytes=3695&recv_bytes=3293&delivery_rate=799&cwnd=12000&unsent_bytes=0&cid=38b3257c39a7dd08&ts=2067&x=16"
date: Thu, 17 Apr 2025 15:26:47 GMT
content-type: text/javascript
vary: Accept-Encoding
last-modified: Thu, 04 Mar 2021 08:53:08 GMT
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 931cf1599ded4239-EWR
server-host: as-hi-227-web
server: cloudflare

GET
H3 200 angular-sanitize.js Show response
kr.buddysecret.com/public/js/ 21 KB
8 KB 16ms
15ms Script
text/javascript 2606:4700:3030::6815:1001
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://kr.buddysecret.com/public/js/angular-sanitize.js?v=20240213_1

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:1001 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

db668b70fd0021a224a50338fc80f62881fc5e678e84987ff62785d86ab3f320

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

content-encoding: zstd
cf-cache-status: HIT
etag: W/"b6e2c-5536-5bcb218b0e500"
age: 748
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Emx9pcE149gNbjEa42v1rselM6eukIae2IPMoUWSoQ6BmvS3q9EnMLkFmO590FpAPpiuUI1wlsWvq%2FjsobUNsxe1g%2Bilfv7%2B8Wvg9UG5rhRCQmSiqxvB3kUP6fUO6iwn%2BOGlBM3kqKvicBWjtqZi2d4%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=8796&min_rtt=7875&rtt_var=2295&sent=11&recv=11&lost=0&retrans=0&sent_bytes=3695&recv_bytes=3293&delivery_rate=799&cwnd=12000&unsent_bytes=0&cid=38b3257c39a7dd08&ts=2096&x=16"
date: Thu, 17 Apr 2025 15:26:47 GMT
content-type: text/javascript
vary: Accept-Encoding
last-modified: Thu, 04 Mar 2021 08:53:08 GMT
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 931cf159cdee4239-EWR
server-host: as-hi-227-web
server: cloudflare

GET
H3 200 site_api.js Show response
kr.buddysecret.com/public/js/ 269 B
879 B 27ms
26ms Script
text/javascript 2606:4700:3030::6815:1001
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://kr.buddysecret.com/public/js/site_api.js?v=20240213_1

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:1001 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2a7e4bf63bc70f8c050d0d52aea5b15dddaaf64fd51036cd996130cbb5f58b14

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

content-encoding: zstd
cf-cache-status: HIT
etag: W/"b6efa-10d-5fe8d9ac50400"
age: 747
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bO74ZwL6DdGUJtygJDpR0SBqd5A7MUOoRu6qrWroBLY%2B5%2BOAYsUDG%2FPSc%2BMtC7VunW8SJhVvdewexc2%2BIhbO%2B7j5bnEvDPA2M9EXUp624NolF0MyjxjqUQucWUcfPgx0754M5jHN%2FH%2FLD5Sd8hRfarI%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=8796&min_rtt=7875&rtt_var=2295&sent=11&recv=11&lost=0&retrans=0&sent_bytes=3695&recv_bytes=3293&delivery_rate=799&cwnd=12000&unsent_bytes=0&cid=38b3257c39a7dd08&ts=2116&x=16"
date: Thu, 17 Apr 2025 15:26:47 GMT
content-type: text/javascript
vary: Accept-Encoding
last-modified: Tue, 20 Jun 2023 11:03:44 GMT
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 931cf159edf04239-EWR
server-host: as-hi-227-web
server: cloudflare

GET
H3 200 s_a_cont.js Show response
kr.buddysecret.com/public/js/ 118 KB
24 KB 533ms
533ms Script
text/javascript 2606:4700:3030::6815:1001
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://kr.buddysecret.com/public/js/s_a_cont.js?v=20240213_1

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:1001 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

afdefcf0c1df347da2d28a48b4e662be32dab2715f9547d597a8e4e232f502f6

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: REVALIDATED
etag: W/"b6f5a-1d7bc-626395e384000"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o9K9y7JTNnAgq%2BJopNpZ45kCN%2BYFXR9WfwlrYhnepg2d4RK8BKgzuUvIbgi78WgCIbnFLWq%2FYRIr5dUiLm8AziHAqWNSgXecXVSjg%2BXvNtNhLqKEazJUtgeXQ60wYPb%2FABM%2BRv%2BQ6eP5WkAC7L9bCJQ%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 931cf15a1df14239-EWR
server-host: as-hi-91-web
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=8796&min_rtt=7875&rtt_var=2295&sent=11&recv=11&lost=0&retrans=0&sent_bytes=3695&recv_bytes=3293&delivery_rate=799&cwnd=12000&unsent_bytes=0&cid=38b3257c39a7dd08&ts=2662&x=16"
date: Thu, 17 Apr 2025 15:26:47 GMT
content-type: text/javascript
last-modified: Wed, 06 Nov 2024 07:21:36 GMT
server: cloudflare
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

GET
H3 200 s_a_ser.js Show response
kr.buddysecret.com/public/js/ 6 KB
2 KB 23ms
23ms Script
text/javascript 2606:4700:3030::6815:1001
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://kr.buddysecret.com/public/js/s_a_ser.js?v=20240213_1

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:1001 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5b21ad876eb91d28b2042311b9ff660e96a44673ee90da912f2d8bafc10b6054

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

content-encoding: zstd
cf-cache-status: HIT
etag: W/"b6f1a-191a-626395e384000"
age: 747
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7GqpumuwU5ub69mYuNUajfWUqATZDe1juAYjCHaXmrsrRkYJSlv9yGq4KOpvw7l8MtvX2sJGcV7eEBT9STULMIXlvbtktPaQUoZVRNezfK%2Bd2%2Bp2inO0zAAkqq%2Bs9PdxR5PzI3vzJOSYn69q6Qffi5s%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=8796&min_rtt=7875&rtt_var=2295&sent=11&recv=11&lost=0&retrans=0&sent_bytes=3695&recv_bytes=3293&delivery_rate=799&cwnd=12000&unsent_bytes=0&cid=38b3257c39a7dd08&ts=2289&x=16"
date: Thu, 17 Apr 2025 15:26:47 GMT
content-type: text/javascript
vary: Accept-Encoding
last-modified: Wed, 06 Nov 2024 07:21:36 GMT
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 931cf15afdf94239-EWR
server-host: as-hi-227-web
server: cloudflare

GET
H3 200 site.js Show response
kr.buddysecret.com/public/js/ 54 KB
14 KB 28ms
25ms Script
text/javascript 2606:4700:3030::6815:1001
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://kr.buddysecret.com/public/js/site.js?v=20240213_1

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:1001 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

eef8bb0f7222bdb9159735d34e28cda50fd2b5bd9d26a7af08c8ca7c8ff4c9ce

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

content-encoding: zstd
cf-cache-status: HIT
etag: W/"b6f50-d65e-62f698abd5780"
age: 747
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PmiqwAJu85s2D%2B2gdMMJv9t0fVKgmpHj2PZDzFobVw%2F9FNDEMDyBd1Rzxh7RrZTEa4wYmpUBP%2F5auV9rPrbwhYCa8g7ahUfpfVLCOBtxSw4d2HhkDgbPpI1gY7mdy4Ijp24wIPDk%2FGtQq3xjnBsBeEg%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=8796&min_rtt=7875&rtt_var=2295&sent=11&recv=11&lost=0&retrans=0&sent_bytes=3695&recv_bytes=3293&delivery_rate=799&cwnd=12000&unsent_bytes=0&cid=38b3257c39a7dd08&ts=2296&x=16"
date: Thu, 17 Apr 2025 15:26:47 GMT
content-type: text/javascript
vary: Accept-Encoding
last-modified: Mon, 03 Mar 2025 05:36:46 GMT
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 931cf15b0dfa4239-EWR
server-host: as-hi-149-web
server: cloudflare

GET
H3 200 html2canvas.min.js Show response
cdnjs.cloudflare.com/ajax/libs/html2canvas/0.4.1/ 36 KB
11 KB 56ms
23ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/html2canvas/0.4.1/html2canvas.min.js

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

737473b145a0fb2d97963ba71104b42ea59d434e17d43de3db67ddffc24200ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

cf-cdnjs-via: cfworker/kv
content-encoding: br
cf-cache-status: HIT
etag: "5eb03e9d-9079"
age: 17976
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q8bmp%2FRUCggx19EYULQ7lJSoh2fdQ3hGxa6iaw7awCbZbiL8cgCjKfsPI6DzYlk053DrBSzG%2Fei%2BS8gfVudWAfda42G%2B%2BU6sfs8%2FTWBIOqH%2FpjQLxP%2BovhoWQ3dz87ssbdjE%2BM%2Bghw8B0Lwwj0x70kO9"}],"group":"cf-nel","max_age":604800}
x-content-type-options: nosniff
expires: Tue, 07 Apr 2026 15:26:47 GMT
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
date: Thu, 17 Apr 2025 15:26:47 GMT
content-type: application/javascript; charset=utf-8
last-modified: Mon, 04 May 2020 16:11:09 GMT
vary: Accept-Encoding
priority: u=3,i=?0
strict-transport-security: max-age=15780000
cache-control: public, max-age=30672000
timing-allow-origin: *
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
cross-origin-resource-policy: cross-origin
cf-ray: 931cf15b4a74ed71-EWR
accept-ranges: bytes
access-control-allow-origin: *
content-length: 11066
server: cloudflare

GET
H2 200 canvas2image.js Show response
superal.github.io/canvas2image/ 8 KB
3 KB 56ms
7ms Script
application/javascript 2606:50c0:8002::153
FASTLY

General

Check archive.org

Download Go to

Full URL: https://superal.github.io/canvas2image/canvas2image.js
Requested by: Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:50c0:8002::153 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: GitHub.com /
Resource Hash: 9a03674bfe83fe09eee7aae6106943918be73a009be21468c2bdb1b4ce958fdc

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

x-fastly-request-id: 4b38fc52c277aff98613b48331cc03ae41a03fb1
content-encoding: gzip
etag: W/"581208a8-1fcf"
age: 499
x-github-request-id: 8AF2:3FE610:3BC61E5:3E28DAE:67FD1B0B
expires: Mon, 14 Apr 2025 14:36:19 GMT
x-proxy-cache: MISS
x-cache: HIT
date: Thu, 17 Apr 2025 15:26:47 GMT
content-type: application/javascript; charset=utf-8
last-modified: Thu, 27 Oct 2016 14:01:12 GMT
x-served-by: cache-lga21971-LGA
x-cache-hits: 1
vary: Accept-Encoding
cache-control: max-age=600
x-timer: S1744903608.574490,VS0,VE2
via: 1.1 varnish
permissions-policy: interest-cohort=()
accept-ranges: bytes
access-control-allow-origin: *
content-length: 2514
server: GitHub.com

GET
H3 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 107 KB
33 KB 58ms
35ms Script
text/javascript 2607:f8b0:4006:808::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: datacygnal.io
URL: https://datacygnal.io/ots-126-1758947244.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:808::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5fc08f524829bf1173c58d89452e7ab47bc10ec5f5397293a7b913340bbcd973

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

content-encoding: br
etag: 609 / 20195 / 31091815 / config-hash: 7394840903501563290
x-content-type-options: nosniff
expires: Thu, 17 Apr 2025 15:26:47 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 17 Apr 2025 15:26:47 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 33666
x-xss-protection: 0
server: cafe

POST
H2 200 c Show response
prebid.a-mo.net/a/ 1 KB
1 KB 89ms
21ms Fetch
application/json 125.253.89.184
SS-ASH

General

Check archive.org

Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: datacygnal.io
URL: https://datacygnal.io/ots-126-1758947244.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 125.253.89.184 , United States, ASN19437 (SS-ASH, US),
Reverse DNS
Software: envoy /
Resource Hash: 5a6db48a22395fda1d956371b9cd94e2c1b66031764fd2a539b1e4e9132c52f6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://kr.buddysecret.com/

Response headers

cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
x-envoy-upstream-service-time: 3
access-control-allow-credentials: true
access-control-allow-origin: https://kr.buddysecret.com
content-length: 507
date: Thu, 17 Apr 2025 15:26:46 GMT
content-type: application/json; charset=utf-8
vary: origin, accept-encoding
server: envoy

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 15 KB
7 KB 290ms
261ms Fetch
application/json 68.67.160.75
ASN-APPNEX

General

Check archive.org

Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: datacygnal.io
URL: https://datacygnal.io/ots-126-1758947244.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.75 Colonia, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

f5a6c43bdddf5a9ff1ac615e6038b9e2068271aef17a82addad82ba1c6143903

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://kr.buddysecret.com/

Response headers

cache-control: no-store, no-cache, private
content-encoding: gzip
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 5.181.234.134; 5.181.234.134; 673.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: https://kr.buddysecret.com
an-x-request-uuid: 3168cede-b713-4b04-b581-1273a878db94
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 17 Apr 2025 15:26:47 GMT
x-xss-protection: 0
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: nginx/1.23.4

POST
H2 204 prebid Show response
prebid.media.net/rtb/ 0
164 B 1083ms
1028ms Fetch 34.120.63.153
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CUQHC56J
Requested by: Host: datacygnal.io
URL: https://datacygnal.io/ots-126-1758947244.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.63.153 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 153.63.120.34.bc.googleusercontent.com
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://kr.buddysecret.com/

Response headers

content-encoding: gzip
access-control-allow-credentials: true
via: 1.1 google
access-control-allow-origin: https://kr.buddysecret.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 15:26:48 GMT
vary: Accept-Encoding
server: envoy

POST
H2 200 prebidjs Show response
rtb.openx.net/openrtbb/ 53 B
387 B 98ms
40ms Fetch
text/plain 35.227.252.103
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://rtb.openx.net/openrtbb/prebidjs
Requested by: Host: datacygnal.io
URL: https://datacygnal.io/ots-126-1758947244.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 00539d1b402fbbc6c6fb35b49a99f3573f58865cab316b25cf4be9ffb5cc4bf7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://kr.buddysecret.com/

Response headers

content-encoding: gzip
x-forwarded-for: 5.181.234.134
access-control-allow-credentials: true
observe-browsing-topics: ?1
via: 1.1 google
access-control-allow-origin: https://kr.buddysecret.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77
date: Thu, 17 Apr 2025 15:26:47 GMT
content-type: text/plain
vary: Origin

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 355 KB
118 KB 122ms
85ms Script
application/javascript 2607:f8b0:4006:821::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MBZ4PJR

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7b3ad4e08bc976d5f91a87059303ab382b09b09917a97d8e3c1f64f3f1f38710

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1297:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1297:0"}],}
expires: Thu, 17 Apr 2025 15:26:47 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 15:26:47 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 17 Apr 2025 15:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1297:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1297:0
content-length: 120508
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504150101/ 529 KB
167 KB 9ms
8ms Script
text/javascript 2607:f8b0:4006:808::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504150101/pubads_impl.js?cb=31091815

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:808::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

31e988de147264b3ff0990eac51ed08398a7346729cbd42b231876431fbb4020

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

content-encoding: br
etag: 3850784624983485084
age: 19536
x-content-type-options: nosniff
expires: Fri, 17 Apr 2026 10:01:11 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 17 Apr 2025 10:01:11 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 170612
x-xss-protection: 0
server: cafe

GET
H3 200 show_ads_impl_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202504140101/ 452 KB
151 KB 16ms
15ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202504140101/show_ads_impl_fy2021.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-9369680060196134

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a79d8eab8b4ab229954cf71bea78de20f4350e06b82f5a27a3e5c86f6f051e4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

content-encoding: br
etag: 17865680416683633794
age: 13109
x-content-type-options: nosniff
expires: Thu, 01 May 2025 11:48:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 17 Apr 2025 11:48:18 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 154885
x-xss-protection: 0
server: cafe

GET
H3 200 gpt
securepubads.g.doubleclick.net/pagead/managed/dict/m202504170101/ 64 KB
23 KB 18ms
15ms Other
text/plain 2607:f8b0:4006:808::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/dict/m202504170101/gpt

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:808::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e4a1f6bb4df43a4e3aded46465e55b8749b64817d13ed9557075c596d218c340

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

content-encoding: br
etag: 5790688912801242087
age: 5141
x-content-type-options: nosniff
expires: Thu, 24 Apr 2025 14:01:06 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 17 Apr 2025 14:01:06 GMT
content-type: text/plain; charset=UTF-8
vary: Accept-Encoding
cache-control: public, immutable, max-age=604800, stale-while-revalidate=7200
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 23384
x-xss-protection: 0
server: cafe
use-as-dictionary: match="/gampad/ads", id="m202504170101"

GET
H3 200 JTUSjIg1_i6t8kCHKm459Wlhyw.woff2
fonts.gstatic.com/s/montserrat/v29/ 37 KB
37 KB 30ms
10ms Font
font/woff2 2607:f8b0:4006:822::2003
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fonts.gstatic.com/s/montserrat/v29/JTUSjIg1_i6t8kCHKm459Wlhyw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fdc9964050bfa24c27a3c76c6791b3674292a5f352cbc83d7a4dc49595bc3fb1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Origin: https://kr.buddysecret.com
Referer: https://fonts.googleapis.com/

Response headers

age: 120926
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 16 Apr 2026 05:51:21 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 16 Apr 2025 05:51:21 GMT
last-modified: Wed, 06 Nov 2024 17:30:37 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 37828
x-xss-protection: 0
server: sffe

GET
H2 200 cmp2.js Show response
cmp.inmobi.com/tcfv2/ 562 KB
133 KB 9ms
8ms Script
text/javascript 2600:9000:26fa:0:1b:cadc:ef40:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cmp.inmobi.com/tcfv2/cmp2.js?referer=buddysecret.com
Requested by: Host: cmp.inmobi.com
URL: https://cmp.inmobi.com/choice/3uGEuyXwFskbz/buddysecret.com/choice.js?tag_version=V3
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:26fa:0:1b:cadc:ef40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5c9aa6c380bb79fbc0df353d36d66a912f8c0d21cb30ed1c43a3af430deb173d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

access-control-max-age: 86400
content-encoding: gzip
etag: W/"8ba77f70c07a107bec1948ca2eb6f64e"
age: 1066
access-control-allow-methods: GET
x-amz-storage-class: INTELLIGENT_TIERING
x-cache: Hit from cloudfront
x-amz-cf-id: zTXZJKRoDr2HccV2BlQJeSP5AIkE9CYg1a5_UNGqIu5glYd_Gt6Y1w==
date: Thu, 17 Apr 2025 15:09:02 GMT
content-type: text/javascript;charset=UTF-8
vary: Accept-Encoding
last-modified: Mon, 24 Mar 2025 11:31:04 GMT
cache-control: max-age=3600
via: 1.1 39cd5ffcd7df50a48d03f7c7f50d3d1a.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: JFK52-P1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 269 KB
94 KB 81ms
80ms Script
application/javascript 2607:f8b0:4006:821::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-192512597-12&l=dataLayer&cx=c&gtm=45be54f1v9168898132za200&tag_exp=101509156~102509682~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103130498~103130500

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-11336677260

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d5ea70f50143025b50fca4d71ddb3ef7a543b341e0cc97ed44159e0edfac1c2e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1055:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1055:0"}],}
expires: Thu, 17 Apr 2025 15:26:47 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 15:26:47 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 17 Apr 2025 15:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1055:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1055:0
content-length: 96166
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 463 KB
147 KB 88ms
88ms Script
application/javascript 2607:f8b0:4006:821::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-21EKGFLRB3&l=dataLayer&cx=c&gtm=457e54f1za200&tag_exp=102509682~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-126527512-14

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a72b844efddd899f13868bfdca594d670d8ee2ace65229668cec99261cff0512

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1055:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1055:0"}],}
expires: Thu, 17 Apr 2025 15:26:47 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 15:26:47 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1055:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1055:0
content-length: 150929
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 geoip Show response
cmp.inmobi.com/ 49 B
333 B 13ms
5ms XHR
application/json 2600:9000:26fa:0:1b:cadc:ef40:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cmp.inmobi.com/geoip
Requested by: Host: cmp.inmobi.com
URL: https://cmp.inmobi.com/tcfv2/cmp2.js?referer=buddysecret.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:26fa:0:1b:cadc:ef40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 1ea50329b826918b0b803777e2f5ac48a3570aa1f9c06bc92b6a1731ae37654a

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
Referer: https://kr.buddysecret.com/

Response headers

access-control-expose-headers: *
via: 1.1 daebf63abf2bfb477063c6c713df85f0.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: FunctionGeneratedResponse from cloudfront
content-length: 49
x-amz-cf-id: 7G8xhdlklLyx0RtORVL1-WUIQRgf1bSehZhWXHgdHzWu6faxqCa8ZA==
date: Thu, 17 Apr 2025 15:26:47 GMT
content-type: application/json
x-amz-cf-pop: JFK52-P1
server: CloudFront

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 330 KB
114 KB 93ms
93ms Script
application/javascript 2607:f8b0:4006:821::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-DBTY2304E3&l=dataLayer&cx=c&gtm=457e54f1za200zb9168898132&tag_exp=102509682~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103101750~103101752~103106314~103106316~103130498~103130500

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-192512597-12

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

74e226a6bc13e9512d2154b7c93d319b339e930cd09cc77bc210dca36a95e5ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1055:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1055:0"}],}
expires: Thu, 17 Apr 2025 15:26:48 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 15:26:48 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1055:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1055:0
content-length: 116309
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 485 KB
153 KB 89ms
89ms Script
application/javascript 2607:f8b0:4006:821::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-9QKBNZJYL1&l=dataLayer&cx=c&gtm=45He54f1h1v843104604za200&tag_exp=102509683~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103116026

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MBZ4PJR

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:821::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a55e134ae31e9448a2ac35da6c36eaf59c9781b18494db9084962adc09f084fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

content-encoding: br
report-to: {"group":"ascgcycc:1055:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1055:0"}],}
expires: Thu, 17 Apr 2025 15:26:48 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 15:26:48 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1055:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1055:0
content-length: 156260
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 271 KB
68 KB 38ms
5ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MBZ4PJR

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

4db2de8828c5ab292d741519e8ef19dcec43a348ef5b3dd4868f483db84af114

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: ;script-src 'nonce-OjKufJvH' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com https://.google-analytics.com;font-src 'self' data: blob: ;img-src 'self' data: blob: https://.google-analytics.com;media-src 'self' data: blob: ;child-src 'self' data: blob: ;frame-src 'self' data: blob: ;manifest-src 'self' data: blob: ;object-src 'self' data: blob: ;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Thu, 17 Apr 2025 15:26:48 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: *;script-src 'nonce-OjKufJvH' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com https://*.google-analytics.com;font-src 'self' data: blob: *;img-src 'self' data: blob: * https://*.google-analytics.com;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=3, rtx=0, c=23, mss=1232, tbw=4823, tp=10, tpl=0, uplat=0, ullat=-1
pragma: public
x-fb-debug: Othn1GIJ5BrUhbNRmPBW92e83HN2CXXKr/HWMKLy76r3OECKLe4rmNzkBs/WZ3mefYbk8UZiENPi/mKtel/Nlw==
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: default-src 'self' blob: *;script-src 'nonce-OjKufJvH' 'report-sample' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com https://*.google-analytics.com;font-src 'self' data: blob: *;img-src 'self' data: blob: * https://*.google-analytics.com;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;report-uri https://www.facebook.com/csp/reporting/?minimize=0;require-trusted-types-for 'script';
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
content-length: 69838
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H3 200 paper_background.png
kr.buddysecret.com/public/images/surpriseforu/ 1 MB
1 MB 1143ms
1143ms Image
image/png 2606:4700:3030::6815:1001
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://kr.buddysecret.com/public/images/surpriseforu/paper_background.png

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/public/css/surpriseforu/style.css?v=20250213

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:1001 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bf5694b365ccfafd151d2195c9aa52e16a58f65fb5121f5aeabcb1863002a740

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/public/css/surpriseforu/style.css?v=20250213

Response headers

cf-cache-status: MISS
etag: "b8d3c-10c370-5bcb218b0e500"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m97cVhkIvNfqLPwo5zRCMk8b5R9yKeBFXvBpCe7D046%2FXZlCGVTTRRVCeC%2FeWwa%2Bs%2FBAKO7w7EojK%2F7F5%2BYaXQf5spTqU7B044NdpO7jPX3TxaEjSAvq6UTrQu15adRvng2qjznxL7Cdbiqe6lMnK10%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=8796&min_rtt=7875&rtt_var=2295&sent=11&recv=11&lost=0&retrans=0&sent_bytes=3695&recv_bytes=3293&delivery_rate=799&cwnd=12000&unsent_bytes=0&cid=38b3257c39a7dd08&ts=3960&x=16"
date: Thu, 17 Apr 2025 15:26:49 GMT
content-type: image/png
vary: Accept-Encoding
last-modified: Thu, 04 Mar 2021 08:53:08 GMT
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 931cf15e6e224239-EWR
server-host: as-hi--web
accept-ranges: bytes
content-length: 1098608
server: cloudflare

GET
H3 200 hearts.png
kr.buddysecret.com/public/images/surpriseforu/ 4 KB
5 KB 20ms
19ms Image
image/png 2606:4700:3030::6815:1001
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://kr.buddysecret.com/public/images/surpriseforu/hearts.png

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/public/css/surpriseforu/style.css?v=20250213

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:1001 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

78ca0005131ba25ff6cd2b6c2f9c877550411b65ce8d3ea2dfd5853f97ed70ad

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/public/css/surpriseforu/style.css?v=20250213

Response headers

cf-cache-status: HIT
etag: "b8d2e-11ff-5bcb218b0e500"
age: 745
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yRlPVIlV5jxdoNRnoRAbkAxGhXm9fpOa%2BlYHR0liBeDKMBEGt1X%2BrReHR%2FM3d7nHhqvvxJGJryBM22OpQnmsO3XzObeUIYU5Z8aN%2Bc06OZQUQMqslf1cuX%2F5kcJX5dLeJOKXg17b85bBV5NcbwoHz1U%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=8796&min_rtt=7875&rtt_var=2295&sent=11&recv=11&lost=0&retrans=0&sent_bytes=3695&recv_bytes=3293&delivery_rate=799&cwnd=12000&unsent_bytes=0&cid=38b3257c39a7dd08&ts=2846&x=16"
date: Thu, 17 Apr 2025 15:26:48 GMT
content-type: image/png
vary: Accept-Encoding
last-modified: Thu, 04 Mar 2021 08:53:08 GMT
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 931cf15e7e234239-EWR
server-host: as-hi-68-web
accept-ranges: bytes
content-length: 4607
server: cloudflare

GET
H3 200 spiral.png
kr.buddysecret.com/public/images/surpriseforu/ 17 KB
18 KB 896ms
895ms Image
image/png 2606:4700:3030::6815:1001
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://kr.buddysecret.com/public/images/surpriseforu/spiral.png

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/public/css/surpriseforu/style.css?v=20250213

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:1001 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

00af79d58e8976a1ddd7a3476b34d7d88d8da5e0221316d0af6430319760cf91

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/public/css/surpriseforu/style.css?v=20250213

Response headers

cf-cache-status: MISS
etag: "b8d45-441b-5bcb218b0e500"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AvImLQzIxBCL1tRIn221QCYt0Tf79NpNfxYhgPMoqlPmQysoxx5I%2FpsOWGk%2Fxw0DvfiftBs1N3fYrNztbUljEmUQb5AetQWI%2FoK88cZU%2FKKkZIpIjJeKKWmQ%2BT%2FUOeTx22eDNJsW0aNrmHm58CW0bIY%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=8796&min_rtt=7875&rtt_var=2295&sent=11&recv=11&lost=0&retrans=0&sent_bytes=3695&recv_bytes=3293&delivery_rate=799&cwnd=12000&unsent_bytes=0&cid=38b3257c39a7dd08&ts=3715&x=16"
date: Thu, 17 Apr 2025 15:26:48 GMT
content-type: image/png
vary: Accept-Encoding
last-modified: Thu, 04 Mar 2021 08:53:08 GMT
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 931cf15e7e244239-EWR
server-host: as-hi--web
accept-ranges: bytes
content-length: 17435
server: cloudflare

GET
H3 200 tape.png
kr.buddysecret.com/public/images/surpriseforu/ 14 KB
14 KB 25ms
24ms Image
image/png 2606:4700:3030::6815:1001
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL

https://kr.buddysecret.com/public/images/surpriseforu/tape.png

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/public/css/surpriseforu/style.css?v=20250213

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:1001 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d76195d14edb2e4ff1482ec8fc09b9a0c7478cb78a6eefe681679a81e2a13489

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/public/css/surpriseforu/style.css?v=20250213

Response headers

cf-cache-status: HIT
etag: "b8b47-3644-5c857574e1c00"
age: 746
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BeZ7RTi8U1EfnAwk5amaep2C7pprHH2pgPeAkxkc0vXq%2Bu67g8%2FJWc0ZIfEE3TqONxjOaiCmPg8lwGlcabf75c%2FVCywxZxPU7fRXw5QYlBqhp3KOfZxpKDMNc5nATWpnoT3kf97Ci5TukPlm6LKxYOw%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=8796&min_rtt=7875&rtt_var=2295&sent=11&recv=11&lost=0&retrans=0&sent_bytes=3695&recv_bytes=3293&delivery_rate=799&cwnd=12000&unsent_bytes=0&cid=38b3257c39a7dd08&ts=2848&x=16"
date: Thu, 17 Apr 2025 15:26:48 GMT
content-type: image/png
vary: Accept-Encoding
last-modified: Fri, 30 Jul 2021 13:38:56 GMT
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 931cf15e7e254239-EWR
server-host: as-hi-227-web
accept-ranges: bytes
content-length: 13892
server: cloudflare

GET
H3 200 fontawesome.woff
kr.buddysecret.com/public/fonts/ 43 KB
44 KB 1163ms
1163ms Font
application/octet-stream 2606:4700:3030::6815:1001
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://kr.buddysecret.com/public/fonts/fontawesome.woff?v=4.7.0

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/public/css/font-awesome.css?v=20250213

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:1001 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0fd28fece9ebd606b8b071460ebd3fc2ed7bc7a66ef91c8834f11dfacab4a849

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Origin: https://kr.buddysecret.com
Referer: https://kr.buddysecret.com/public/css/font-awesome.css?v=20250213

Response headers

vary: Accept-Encoding
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: zstd
cf-cache-status: MISS
etag: W/"b6dcb-ad90-5bcb218b0e500"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IKOa7m6rFsx15piFPlQMoHmXtFlxq7ESptmSsFGzryDx1zP%2BePyfZil9LU3SZ520zVITJXdX%2B32ejrcTsLTPttsMW4le1N6fTgxWK51dXze8mDc5tVcZQO%2BXlYtzPQ6tRrIqNeorSh%2FBt9uMEunLhkA%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 931cf15ebe274239-EWR
server-host: as-hi--web
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=8796&min_rtt=7875&rtt_var=2295&sent=11&recv=11&lost=0&retrans=0&sent_bytes=3695&recv_bytes=3293&delivery_rate=799&cwnd=12000&unsent_bytes=0&cid=38b3257c39a7dd08&ts=4026&x=16"
date: Thu, 17 Apr 2025 15:26:49 GMT
content-type: text/plain; charset=UTF-8
last-modified: Thu, 04 Mar 2021 08:53:08 GMT
server: cloudflare
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

GET
H2 200 vendor-list-trimmed-v1.json Show response
cmp.inmobi.com/GVL-v3/ 628 KB
78 KB 5ms
4ms XHR
application/json 2600:9000:26fa:0:1b:cadc:ef40:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cmp.inmobi.com/GVL-v3/vendor-list-trimmed-v1.json
Requested by: Host: cmp.inmobi.com
URL: https://cmp.inmobi.com/tcfv2/cmp2.js?referer=buddysecret.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:26fa:0:1b:cadc:ef40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b2c23c0748ec27b48c08bcde5dc7e6c1e19eac3cfe703140f7e2080f1d008be7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

access-control-max-age: 3000
content-encoding: gzip
etag: W/"a700e7a6ccbc3e5b6715e1e42f08fe16"
age: 55639
access-control-allow-methods: GET
x-cache: Hit from cloudfront
x-amz-cf-id: uz1014rnjHNT22jKKLyqHF00JLde7dTb-EF1LIGD_YvPunLIPcohHg==
date: Wed, 16 Apr 2025 23:59:30 GMT
content-type: application/json
vary: Accept-Encoding,Access-Control-Request-Headers,Access-Control-Request-Method
last-modified: Thu, 10 Apr 2025 23:59:17 GMT
cache-control: max-age=86400
access-control-allow-credentials: true
via: 1.1 daebf63abf2bfb477063c6c713df85f0.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-amz-cf-pop: JFK52-P1
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H3 200 1248373189146307 Show response
connect.facebook.net/signals/config/ 64 KB
13 KB 86ms
85ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Download Go to

Full URL

https://connect.facebook.net/signals/config/1248373189146307?v=2.9.198&r=stable&domain=kr.buddysecret.com&hme=53363064397d256bdf8f213dd9a9e18c291fc2ed691e4233e4a9e488f248f817&ex_m=73%2C128%2C113%2C117%2C64%2C5%2C106%2C72%2C18%2C100%2C92%2C53%2C57%2C182%2C203%2C210%2C206%2C207%2C209%2C31%2C107%2C55%2C80%2C208%2C177%2C180%2C204%2C205%2C190%2C139%2C43%2C195%2C192%2C193%2C36%2C152%2C17%2C52%2C199%2C198%2C141%2C20%2C42%2C1%2C45%2C68%2C69%2C70%2C74%2C96%2C19%2C16%2C99%2C95%2C94%2C114%2C54%2C116%2C41%2C115%2C32%2C97%2C28%2C178%2C181%2C149%2C13%2C14%2C15%2C7%2C8%2C27%2C24%2C25%2C60%2C65%2C67%2C78%2C56%2C105%2C108%2C29%2C79%2C11%2C9%2C83%2C50%2C23%2C110%2C109%2C111%2C102%2C12%2C22%2C3%2C40%2C77%2C21%2C161%2C89%2C135%2C49%2C48%2C101%2C76%2C0%2C98%2C59%2C87%2C35%2C30%2C85%2C86%2C91%2C39%2C6%2C93%2C84%2C46%2C34%2C37%2C90%2C4%2C88%2C248%2C175%2C126%2C164%2C157%2C2%2C38%2C66%2C44%2C112%2C47%2C82%2C71%2C118%2C63%2C62%2C33%2C103%2C61%2C58%2C51%2C81%2C75%2C26%2C104%2C10%2C119

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

fe32c45eca9ebd2b11a388fff10271ec51f59493a926cd45c60c8cbbfe9f2ee6

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' blob: ;script-src 'nonce-Wij44tI7' .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* blob: data: 'self' https://.google-analytics.com .google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: .cdninstagram.com https://.google-analytics.com;font-src 'self' data: blob: ;img-src 'self' data: blob: https://.google-analytics.com;media-src 'self' data: blob: ;child-src 'self' data: blob: ;frame-src 'self' data: blob: ;manifest-src 'self' data: blob: ;object-src 'self' data: blob: ;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

content-encoding: gzip
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
date: Thu, 17 Apr 2025 15:26:48 GMT
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src 'self' blob: *;script-src 'nonce-Wij44tI7' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com https://*.google-analytics.com;font-src 'self' data: blob: *;img-src 'self' data: blob: * https://*.google-analytics.com;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control: public, max-age=1200
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=2, rtx=0, c=78, mss=1232, tbw=79447, tp=74, tpl=0, uplat=80, ullat=0
pragma: public
x-fb-debug: jq8E+BqcpTM0ESxnTJzcs/UxIL98Eb8bTvPydKMa9/ODR4gon8OYoGW/jUTx+UVT9J9KOc8q0byW1GNpI5D+rg==
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: default-src 'self' blob: *;script-src 'nonce-Wij44tI7' 'report-sample' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com https://*.google-analytics.com;font-src 'self' data: blob: *;img-src 'self' data: blob: * https://*.google-analytics.com;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;report-uri https://www.facebook.com/csp/reporting/?minimize=0;require-trusted-types-for 'script';
permissions-policy: accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?1

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 45ms
16ms Script
text/javascript 2001:4860:4802:38::178
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-126527512-14

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:38::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

content-encoding: gzip
age: 2032
report-to: {"group":"ascnsrsgac:225:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options: nosniff
expires: Thu, 17 Apr 2025 16:52:56 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 14:52:56 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
content-type: text/javascript
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:225:0
content-length: 20994
server: Golfe2

POST
H3 200 collect
www.google.com/ccm/ 0
0 56ms
25ms Ping
text/plain 2607:f8b0:4006:817::2004
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2Fkr.buddysecret.com%2F&scrsrc=www.googletagmanager.com&frm=0&rnd=53632215.1744903608&dt=BuddySecret%20%7C%20%EC%B9%9C%EA%B5%AC%EB%93%A4%EC%9D%84%20%EB%8B%B9%EC%8B%A0%EC%9D%98%20%EB%B9%84%EB%B0%80%20%EC%9D%BC%EA%B8%B0%EC%97%90%20%EC%B0%B8%EC%97%AC%EC%8B%9C%EC%BC%9C%20%EB%B3%B4%EC%84%B8%EC%9A%94.&auid=905920845.1744903608&navt=n&npa=0&us_privacy=1---&gtm=45He54f1h1v843104604za200&gcd=13l3l3l3l1l1&dma=0&tcfd=10000&tag_exp=102509683~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103116026&tft=1744903608196&tfd=2991&apve=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MBZ4PJR
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2607:f8b0:4006:817::2004 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

GET
H2 200 sw_iframe.html Show response
www.googletagmanager.com/static/service_worker/54a0/ Frame BD4F 3 KB
2 KB 43ms
19ms Document
text/html 2607:f8b0:4006:821::2008
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.googletagmanager.com/static/service_worker/54a0/sw_iframe.html?origin=https%3A%2F%2Fkr.buddysecret.com

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MBZ4PJR

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d36b373b44b77f016e4b7df913ba2da2a8025456f016bc794861f210c0e3ada3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 1482
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="analytics-container-tag-serving"
cross-origin-resource-policy: cross-origin
date: Thu, 17 Apr 2025 15:26:48 GMT
expires: Fri, 17 Apr 2026 15:26:48 GMT
last-modified: Thu, 10 Apr 2025 08:58:00 GMT
report-to: {"group":"analytics-container-tag-serving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving"}]}
server: sffe
service-worker-allowed: /static/service_worker
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 collect
analytics.google.com/g/ 0
0 115ms
25ms Fetch
text/plain 2001:4860:4802:34::181
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-21EKGFLRB3&gtm=45je54f1v882275148za200&_p=1744903607511&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tcfd=10000&tag_exp=102509682~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103130498~103130500&cid=1243215478.1744903608&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_eu=EAAI&_s=1&sid=1744903608&sct=1&seg=0&dl=https%3A%2F%2Fkr.buddysecret.com%2F&dt=BuddySecret%20%7C%20%EC%B9%9C%EA%B5%AC%EB%93%A4%EC%9D%84%20%EB%8B%B9%EC%8B%A0%EC%9D%98%20%EB%B9%84%EB%B0%80%20%EC%9D%BC%EA%B8%B0%EC%97%90%20%EC%B0%B8%EC%97%AC%EC%8B%9C%EC%BC%9C%20%EB%B3%B4%EC%84%B8%EC%9A%94.&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=3079
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-21EKGFLRB3&l=dataLayer&cx=c&gtm=457e54f1za200&tag_exp=102509682~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:153:0
report-to: {"group":"ascnsrsggc:153:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:153:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://kr.buddysecret.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:153:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 15:26:48 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
550 B 115ms
26ms Ping
text/plain 2607:f8b0:4004:c1b::9c
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-21EKGFLRB3&cid=1243215478.1744903608&gtm=45je54f1v882275148za200&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=102509682~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103130498~103130500
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-21EKGFLRB3&l=dataLayer&cx=c&gtm=457e54f1za200&tag_exp=102509682~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c1b::9c Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:122:0
report-to: {"group":"ascnsrsggc:122:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:122:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://kr.buddysecret.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:122:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 15:26:48 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 rul Show response
td.doubleclick.net/td/ga/ Frame B1E2 13 B
496 B 94ms
23ms Document
text/html 2607:f8b0:4006:81c::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://td.doubleclick.net/td/ga/rul?tid=G-21EKGFLRB3&gacid=1243215478.1744903608&gtm=45je54f1v882275148za200&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=102509682~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103130498~103130500&z=2114652611

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-21EKGFLRB3&l=dataLayer&cx=c&gtm=457e54f1za200&tag_exp=102509682~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b633a587c652d02386c4f16f8c6f6aab7352d97f16367c3c40576214372dd628

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://kr.buddysecret.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 17 Apr 2025 15:26:48 GMT
expires: Thu, 17 Apr 2025 15:26:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 topics_frame.html Show response
securepubads.g.doubleclick.net/static/topics/ Frame 8097 101 KB
28 KB 39ms
7ms Document
text/html 2607:f8b0:4006:808::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/static/topics/topics_frame.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504150101/pubads_impl.js?cb=31091815

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:808::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

af8c669f941e754271c71ba5714ac0e5247ce6c3d1b1638257e1b2862d33beaa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://kr.buddysecret.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 2040
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000, stale-while-revalidate=3600
content-encoding: br
content-length: 28941
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 17 Apr 2025 14:52:48 GMT
expires: Thu, 17 Apr 2025 15:42:48 GMT
last-modified: Mon, 14 Apr 2025 19:44:10 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20250410/r20190131/ Frame 4EE3 8 KB
4 KB 36ms
6ms Document
text/html 2607:f8b0:4006:81c::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20250410/r20190131/zrt_lookup_fy2021.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202504140101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ba04c128644298545babb4bb2b698dc34c3fc1a69e8e7d1a13bb3698b0666b1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://kr.buddysecret.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

age: 32
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 3852
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 17 Apr 2025 15:26:16 GMT
etag: 11186363664254562180
expires: Thu, 01 May 2025 15:26:16 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 6B2A 10 KB
4 KB 595ms
575ms Document
text/html 2607:f8b0:4006:81c::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?gdpr=0&us_privacy=1---&gpp_sid=-1&client=ca-pub-9369680060196134&output=html&adk=1812271804&adf=3025194257&abgtt=6&lmt=1744903608&plaf=7%3A2&plat=3%3A128%2C4%3A128%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fkr.buddysecret.com%2F&pra=5&wgl=1&aihb=0&asro=0&aifxl=29_18~30_19&aiapm=0.15&aiapmi=0.16&aiact=0.7&ailct=0.7&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1744903607633&bpp=4&bdt=1714&idt=139&shv=r20250410&mjsv=m202504140101&ptt=9&saldr=aa&abxe=1&cookie_enabled=1&eoidce=1&nras=1&correlator=2569786218843&frm=20&pv=2&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=95355973%2C95355975%2C31091833%2C95331832%2C95353451%2C95354564%2C95357460%2C95357878%2C95357716%2C95358121&oid=2&pvsid=760403915646792&tmod=1928073957&uas=0&nvt=1&fsapi=1&fc=1920&brdim=100%2C100%2C100%2C100%2C1600%2C0%2C1600%2C1285%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&bz=1&td=1&tdf=2&psd=W251bGwsbnVsbCxudWxsLDNd&nt=1&ifi=1&uci=a!1&fsb=1&dtd=846

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202504140101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

40e0511952974c0f1299e247cfae41824b0c9de8d90cb2e87dee2bf4fc0e4d9d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://kr.buddysecret.com/
Sec-Browsing-Topics: ();p=P0000000000000000000000000000000
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 4361
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 17 Apr 2025 15:26:49 GMT
expires: Thu, 17 Apr 2025 15:26:49 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
452 B 24ms
20ms XHR
text/plain 2001:4860:4802:38::178
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=655443728&t=pageview&_s=1&dl=https%3A%2F%2Fkr.buddysecret.com%2F&ul=en-us&de=UTF-8&dt=BuddySecret%20%7C%20%EC%B9%9C%EA%B5%AC%EB%93%A4%EC%9D%84%20%EB%8B%B9%EC%8B%A0%EC%9D%98%20%EB%B9%84%EB%B0%80%20%EC%9D%BC%EA%B8%B0%EC%97%90%20%EC%B0%B8%EC%97%AC%EC%8B%9C%EC%BC%9C%20%EB%B3%B4%EC%84%B8%EC%9A%94.&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAACAAI~&jid=1430640717&gjid=987923857&cid=1243215478.1744903608&tid=UA-126527512-14&_gid=1489070139.1744903608&_r=1&gtm=457e54f1za200&gcd=13l3l3l3l1l1&dma=0&tcfd=10000&tag_exp=102509682~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316&jsscut=1&z=1371911889

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:38::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://kr.buddysecret.com/

Response headers

report-to: {"group":"ascnsrsgac:175:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 15:26:48 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://kr.buddysecret.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:175:0
content-length: 1
server: Golfe2

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
69 B 22ms
21ms XHR
text/plain 2001:4860:4802:38::178
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=655443728&t=pageview&_s=1&dl=https%3A%2F%2Fkr.buddysecret.com%2F&ul=en-us&de=UTF-8&dt=BuddySecret%20%7C%20%EC%B9%9C%EA%B5%AC%EB%93%A4%EC%9D%84%20%EB%8B%B9%EC%8B%A0%EC%9D%98%20%EB%B9%84%EB%B0%80%20%EC%9D%BC%EA%B8%B0%EC%97%90%20%EC%B0%B8%EC%97%AC%EC%8B%9C%EC%BC%9C%20%EB%B3%B4%EC%84%B8%EC%9A%94.&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAACAAI~&jid=1695031654&gjid=1130738053&cid=1243215478.1744903608&tid=UA-192512597-12&_gid=1489070139.1744903608&_r=1&gtm=457e54f1za200zb9168898132&gcd=13l3l3l3l1l1&dma=0&tcfd=10000&tag_exp=102509682~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103101750~103101752~103106314~103106316~103130498~103130500&jsscut=1&z=135196601

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:38::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://kr.buddysecret.com/

Response headers

report-to: {"group":"ascnsrsgac:175:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:175:0"}],}
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 15:26:48 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
content-type: text/plain
cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:175:0
access-control-allow-origin: https://kr.buddysecret.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsgac:175:0
content-length: 1
server: Golfe2

GET
H3 200 /
www.facebook.com/tr/ 0
16 B 28ms
10ms Image
text/plain 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1248373189146307&ev=PageView&dl=https%3A%2F%2Fkr.buddysecret.com%2F&rl=&if=false&ts=1744903608543&sw=1600&sh=1200&v=2.9.198&r=stable&a=tmSimo-GTM-WebTemplate&ec=0&o=12318&fbp=fb.1.1744903608540.250262110880106616&ler=empty&cdl=API_unavailable&it=1744903608157&coo=false&tm=1&rqm=GET

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=7, rtx=0, c=23, mss=1232, tbw=4828, tp=10, tpl=0, uplat=0, ullat=0
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Thu, 17 Apr 2025 15:26:48 GMT
content-type: text/plain
server: proxygen-bolt
priority: u=3,i

GET
H3 200 /
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 67 B
199 B 121ms
103ms Image
image/png 2a03:2880:f112:182:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Download Go to Show image

Full URL

https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=1248373189146307&ev=PageView&dl=https%3A%2F%2Fkr.buddysecret.com%2F&rl=&if=false&ts=1744903608543&sw=1600&sh=1200&v=2.9.198&r=stable&a=tmSimo-GTM-WebTemplate&ec=0&o=12318&fbp=fb.1.1744903608540.250262110880106616&ler=empty&cdl=API_unavailable&it=1744903608157&coo=false&tm=1&rqm=FGET

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f112:182:face:b00c:0:25de Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a

Security Headers

Name	Value
Content-Security-Policy	default-src blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net 127.0.0.1:* 'nonce-BFuy0pLF' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://.google-analytics.com .google.com;style-src .fbcdn.net data: .facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com https://.google-analytics.com;font-src data: .facebook.com .fbcdn.net .fbsbx.com https://fonts.gstatic.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net .carriersignal.info blob: android-webview-video-poster: .whatsapp.net .fb.com .oculuscdn.com .tenor.co .tenor.com .giphy.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://.google-analytics.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com data: .tenor.co .tenor.com https://.giphy.com;child-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;frame-src .facebook.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net accounts.meta.com https://paywithmybank.com/ https://.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net .google.com .doubleclick.net;manifest-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;object-src data: blob: 'self' https://.fbsbx.com .facebook.com .fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

content-encoding: zstd
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7494303931780881762&cpp=C3&cv=1021982746&st=1744903608578"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options: nosniff
expires: Sat, 01 Jan 2000 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
attribution-reporting-register-trigger: {"event_trigger_data":[{"trigger_data":"0"}],"aggregatable_trigger_data":[],"aggregatable_values":{},"aggregatable_source_registration_time":"exclude","filters":{"3":["6400686900007569"]},"debug_reporting":true,"debug_key":"4311787951915174461"}
date: Thu, 17 Apr 2025 15:26:48 GMT
content-type: image/png
vary: Accept-Encoding
x-fb-debug: 0bGlQyyN6K/BB8Wmgcd2MinhmUT/bouACzOc6KdummfT7Pu5RvMGE4zt/2DxM7mUcOZsakH9EV3gn5FPlwv3Gg==
priority: u=3,i
x-frame-options: DENY
strict-transport-security: max-age=15552000; preload
reporting-endpoints: coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7494303931780881762&cpp=C3&cv=1021982746&st=1744903608578", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-BFuy0pLF' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control: private, no-store, no-cache, must-revalidate
x-fb-connection-quality: EXCELLENT; q=0.9, rtt=8, rtx=0, c=24, mss=1232, tbw=5196, tp=13, tpl=0, uplat=93, ullat=0
cross-origin-opener-policy: same-origin-allow-popups;report-to="coop_report"
pragma: no-cache
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-BFuy0pLF' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' 'report-sample' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
permissions-policy: accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy: force-load-at-top
x-xss-protection: 0
origin-agent-cluster: ?1

POST
H3 204 collect
www.google-analytics.com/g/ 0
0 24ms
23ms Fetch
text/plain 2001:4860:4802:38::178
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-DBTY2304E3&gtm=45je54f1v9124146141za200&_p=1744903607511&gcd=13l3l3l3l1l1&npa=0&dma=0&tcfd=10000&tag_exp=102509683~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103116025&cid=1243215478.1744903608&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=EAAI&_s=1&sid=1744903608&sct=1&seg=0&dl=https%3A%2F%2Fkr.buddysecret.com%2F&dt=BuddySecret%20%7C%20%EC%B9%9C%EA%B5%AC%EB%93%A4%EC%9D%84%20%EB%8B%B9%EC%8B%A0%EC%9D%98%20%EB%B9%84%EB%B0%80%20%EC%9D%BC%EA%B8%B0%EC%97%90%20%EC%B0%B8%EC%97%AC%EC%8B%9C%EC%BC%9C%20%EB%B3%B4%EC%84%B8%EC%9A%94.&en=page_view&_fv=1&_ss=1&tfd=3382
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-DBTY2304E3&l=dataLayer&cx=c&gtm=457e54f1za200zb9168898132&tag_exp=102509682~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103101750~103101752~103106314~103106316~103130498~103130500
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:38::178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:97:0
report-to: {"group":"ascnsrsggc:97:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:97:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://kr.buddysecret.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:97:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 15:26:48 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
analytics.google.com/g/ 0
0 28ms
24ms Fetch
text/plain 2001:4860:4802:34::181
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-9QKBNZJYL1&gtm=45je54f1h1v899789978z8843104604za200zb843104604&_p=1744903607511&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tcfd=10000&tag_exp=102509683~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103116025~103130498~103130500&cid=1243215478.1744903608&ecid=1138323896&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_z=1-00~2-00~3-00~4-00~7-00~8-00~9-00~6-00~5-00&ec_mode=a&_eu=Ag&_s=1&sid=1744903608&sct=1&seg=0&dl=https%3A%2F%2Fkr.buddysecret.com%2F&dt=BuddySecret%20%7C%20%EC%B9%9C%EA%B5%AC%EB%93%A4%EC%9D%84%20%EB%8B%B9%EC%8B%A0%EC%9D%98%20%EB%B9%84%EB%B0%80%20%EC%9D%BC%EA%B8%B0%EC%97%90%20%EC%B0%B8%EC%97%AC%EC%8B%9C%EC%BC%9C%20%EB%B3%B4%EC%84%B8%EC%9A%94.&en=page_view&_fv=1&_ss=1&tfd=3453
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-9QKBNZJYL1&l=dataLayer&cx=c&gtm=45He54f1h1v843104604za200&tag_exp=102509683~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103116026
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:153:0
report-to: {"group":"ascnsrsggc:153:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:153:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://kr.buddysecret.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:153:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 15:26:48 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
57 B 24ms
22ms Ping
text/plain 2607:f8b0:4004:c1b::9c
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-9QKBNZJYL1&cid=1243215478.1744903608&gtm=45je54f1h1v899789978z8843104604za200zb843104604&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=102509683~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103116025~103130498~103130500
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-9QKBNZJYL1&l=dataLayer&cx=c&gtm=45He54f1h1v843104604za200&tag_exp=102509683~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103116026
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c1b::9c Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:122:0
report-to: {"group":"ascnsrsggc:122:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:122:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://kr.buddysecret.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:122:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 15:26:48 GMT
content-type: text/plain
server: Golfe2

GET
H2 200 rul Show response
td.doubleclick.net/td/ga/ Frame CFEF 13 B
299 B 29ms
25ms Document
text/html 2607:f8b0:4006:81c::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://td.doubleclick.net/td/ga/rul?tid=G-9QKBNZJYL1&gacid=1243215478.1744903608&gtm=45je54f1h1v899789978z8843104604za200zb843104604&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=102509683~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103116025~103130498~103130500&z=433650386

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-9QKBNZJYL1&l=dataLayer&cx=c&gtm=45He54f1h1v843104604za200&tag_exp=102509683~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103116026

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b633a587c652d02386c4f16f8c6f6aab7352d97f16367c3c40576214372dd628

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://kr.buddysecret.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 16
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 17 Apr 2025 15:26:48 GMT
expires: Thu, 17 Apr 2025 15:26:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 207 KB
45 KB 653ms
652ms Fetch
text/plain 2607:f8b0:4006:808::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=760403915646792&correlator=770146419920162&eid=31091815%2C83321073&output=ldjh&gdfp_req=1&vrg=202504150101&ptt=17&impl=fifs&gdpr=0&us_privacy=1---&gpp=DBABLA~BAAAAAAAAACA.QA&gpp_sid=7&iu_parts=38924784%2CBuddysecret_ATF_728x90%2CBuddysecret_BTF_728x90%2CBuddysecret_Mid1_Desktop_300x250%2CBuddysecret_Mid2_Desktop_300x250&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4&prev_iu_szs=728x90%2C728x90%2C300x250%2C300x250&ifi=2&didk=2902313880~965644627~3737853003~2871717075&dids=Buddysecret_ATF_728x90~Buddysecret_BTF_728x90~Buddysecret_Mid1_Desktop_300x2~Buddysecret_Mid2_Desktop_300x2&adfs=4167863610~276020177~~&sfv=1-0-41&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1744903608827&lmt=1744903608&adxs=426%2C426%2C-9%2C-9&adys=106%2C1225%2C-9%2C-9&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C1%7C-1%7C-1&ucis=1%7C2%7C3%7C4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-600&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fkr.buddysecret.com%2F&vis=1&psz=768x0%7C748x0%7C0x-1%7C0x-1&msz=768x0%7C748x0%7C0x-1%7C0x-1&fws=0%2C0%2C2%2C2&ohw=0%2C0%2C0%2C0&topics=9&tps=9&htps=10&nt=1&psd=WzMxLFtdLG51bGwsM10.&dlt=1744903605919&idt=1792&prev_scp=%7Chb_pb_appnexus%3D0.00%26hb_adid_appnexus%3D2241553cffa678f8%26hb_bidder_appnexus%3Dappnexus%26hb_cn%3Dpbjs%26hb_pb%3D0.00%26hb_adid%3D2241553cffa678f8%26hb_bidder%3Dappnexus%7C%7C&adks=422879149%2C2664481632%2C3647984818%2C1883757687&frm=20&eoidce=1&td=1&egid=6636&tan=0c3c62e3-9746-4e24-b630-60ba689bebb5%2C0c3c62e3-9746-4e24-b630-60ba689bebb6%2C0c3c62e3-9746-4e24-b630-60ba689bebb7%2C0c3c62e3-9746-4e24-b630-60ba689bebb8&tdf=2

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504150101/pubads_impl.js?cb=31091815

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:808::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3225d669e6d0d6fd0aafd6280328d1dad395444532eed8cf5190f0d6c6e8edda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

content-encoding: dcb
google-lineitem-id: -1,-1,-1,-1
observe-browsing-topics: ?1
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date: Thu, 17 Apr 2025 15:26:49 GMT
content-type: text/plain; charset=UTF-8
google-creative-id: -1,-1,-1,-1
cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
access-control-allow-origin: https://kr.buddysecret.com
content-length: 45884
x-xss-protection: 0
server: cafe

GET
H3 200 container.html Show response
df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/ Frame A890 7 KB
3 KB 70ms
24ms Document
text/html 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504150101/pubads_impl.js?cb=31091815

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c173503f8ae4fdbb42c06c514edf25e62e81503e418ee3a0cdbd884e1a741444

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://kr.buddysecret.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3024
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 17 Apr 2025 15:26:48 GMT
expires: Thu, 17 Apr 2025 15:26:48 GMT
last-modified: Thu, 30 Jan 2025 19:28:58 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/ Frame 1D35 7 KB
0 0ms
0ms Document
text/html 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504150101/pubads_impl.js?cb=31091815

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c173503f8ae4fdbb42c06c514edf25e62e81503e418ee3a0cdbd884e1a741444

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://kr.buddysecret.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3024
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 17 Apr 2025 15:26:48 GMT
expires: Thu, 17 Apr 2025 15:26:48 GMT
last-modified: Thu, 30 Jan 2025 19:28:58 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/ Frame 9DC3 7 KB
0 0ms
0ms Document
text/html 2607:f8b0:4006:81f::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202504150101/pubads_impl.js?cb=31091815

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c173503f8ae4fdbb42c06c514edf25e62e81503e418ee3a0cdbd884e1a741444

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://kr.buddysecret.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: br
content-length: 3024
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 17 Apr 2025 15:26:48 GMT
expires: Thu, 17 Apr 2025 15:26:48 GMT
last-modified: Thu, 30 Jan 2025 19:28:58 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 71A9 645 B
257 B 42ms
38ms Document
text/html 2607:f8b0:4006:81c::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQw7j0ARj-sMmKAjAB&v=APEucNXlW9q4hvhNJlsdvf1HJ3AY_WvujGQJLH2hetL11DBvdUmlyxlbhwRY0uu3SYAyZCArspX22bYUZ3WWohBS46xFqwhwwE_Bme64iHVIJT3hrrhHwpQ

Requested by

Host: df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
URL: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a08acd55bb001aa85ced7f4f93a4a1446ca18a17689e872b59a9da81ebe0cd45

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 234
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 17 Apr 2025 15:26:49 GMT
expires: Thu, 17 Apr 2025 15:26:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 1D35 110 KB
37 KB 84ms
39ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
URL: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

60cf08e6b7a432b3f2a36fcfc12e63683a47a57fa9bb4df0a9d000c16261c80c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 18146946010209014275
x-content-type-options: nosniff
expires: Thu, 17 Apr 2025 15:26:49 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 17 Apr 2025 15:26:49 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
content-disposition: attachment; filename="f.txt"
cache-control: private, max-age=600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 38116
x-xss-protection: 0
server: cafe

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1D35 42 B
63 B 113ms
70ms Image
image/gif 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-By1D14NS82f2HcOXBLFsKeX0A0_L4U-jtIdhegHZ2bp-b6MUzH6UKLNeHMg_tpD2A3hhJA7hytELo2N5nvbEiCrPjyqJJTPI8PrLI7RZA_NT4mxdY

Requested by

Host: df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
URL: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Thu, 17 Apr 2025 15:26:49 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250410/r20110914/client/ Frame 1D35 3 KB
2 KB 59ms
10ms Script
text/javascript 2607:f8b0:4006:823::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250410/r20110914/client/window_focus_fy2021.js

Requested by

Host: df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
URL: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0ba1a463f7811ae10ea114a0bcc044c05c391ec1fcb3dd5a7bd9d9bb3fe2b070

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 14574132110251334613
age: 278
x-content-type-options: nosniff
expires: Thu, 01 May 2025 15:22:11 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 17 Apr 2025 15:22:11 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1242
x-xss-protection: 0
server: cafe

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250410/r20110914/client/ Frame 1D35 18 KB
8 KB 63ms
14ms Script
text/javascript 2607:f8b0:4006:823::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250410/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
URL: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2a14e84adb8fb9735a8e414b7e168f3e5ff9bad71acb1cef9d597355c6d744fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 11643015732383494192
age: 11596
x-content-type-options: nosniff
expires: Thu, 01 May 2025 12:13:33 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 17 Apr 2025 12:13:33 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 7916
x-xss-protection: 0
server: cafe

GET l
www.google.com/ads/measurement/ Frame 1D35 0
0

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 1D35 221 KB
68 KB 54ms
13ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
URL: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3049db58f204e8279193524985a52bbad008bfaac0b82caad5f064b54d7494d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 18003062906086184080
age: 257
x-content-type-options: nosniff
expires: Thu, 17 Apr 2025 16:22:32 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 17 Apr 2025 15:22:32 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69570
x-xss-protection: 0
server: cafe

GET
H2 200 css
fonts.googleapis.com/ Frame 9DC3 20 KB
2 KB 69ms
30ms Stylesheet
text/css 2607:f8b0:4006:80b::200a
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
URL: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80b::200a , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

7d219cea3316552d5927b5b7528f1192223374dd1b9dd58c48e5de057af6e3f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Thu, 17 Apr 2025 15:26:49 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 15:26:49 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Thu, 17 Apr 2025 14:40:45 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H2 200 omrhp_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250410/r20110914/elements/html/ Frame 9DC3 8 KB
3 KB 46ms
15ms Script
text/javascript 2607:f8b0:4006:823::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250410/r20110914/elements/html/omrhp_fy2021.js

Requested by

Host: df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
URL: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1657584221779c9f6943c52bb7fba23376c18be3e021da4168fab39d8bb7863a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 567199331036499589
age: 271
x-content-type-options: nosniff
expires: Thu, 01 May 2025 15:22:18 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 17 Apr 2025 15:22:18 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 3211
x-xss-protection: 0
server: cafe

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250410/r20110914/client/ Frame 9DC3 2 KB
884 B 47ms
19ms Script
text/javascript 2607:f8b0:4006:823::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250410/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
URL: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47fe168cff78df21234662a31024f35f3880bc92736637b0ccf1acd94a33a3e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 17658825730907809421
age: 277
x-content-type-options: nosniff
expires: Thu, 01 May 2025 15:22:12 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 17 Apr 2025 15:22:12 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 803
x-xss-protection: 0
server: cafe

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250410/r20110914/ Frame 9DC3 21 KB
8 KB 35ms
11ms Script
text/javascript 2607:f8b0:4006:823::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250410/r20110914/abg_lite_fy2021.js

Requested by

Host: df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
URL: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

746df02e811af2d3ca508afa3890da5abc3c02216ec678ea534ec758c19344b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 15008947672397862551
age: 277
x-content-type-options: nosniff
expires: Thu, 01 May 2025 15:22:12 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 17 Apr 2025 15:22:12 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 8505
x-xss-protection: 0
server: cafe

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 0955 143 B
166 B 16ms
7ms Document
text/html 2607:f8b0:4006:81c::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
URL: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

age: 750
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 17 Apr 2025 15:14:19 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250410/r20110914/client/ Frame 9DC3 3 KB
0 27ms
27ms Script
text/javascript 2607:f8b0:4006:823::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250410/r20110914/client/window_focus_fy2021.js

Requested by

Host: df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
URL: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0ba1a463f7811ae10ea114a0bcc044c05c391ec1fcb3dd5a7bd9d9bb3fe2b070

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 14574132110251334613
age: 278
x-content-type-options: nosniff
expires: Thu, 01 May 2025 15:22:11 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 17 Apr 2025 15:22:11 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 1242
x-xss-protection: 0
server: cafe

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame F2E9 1 KB
643 B 21ms
13ms Document
text/html 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
URL: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

age: 77194
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 16 Apr 2025 18:00:15 GMT
etag: 48472445140208031
expires: Thu, 17 Apr 2025 18:00:15 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20250410/r20110914/client/ Frame 9DC3 18 KB
0 36ms
36ms Script
text/javascript 2607:f8b0:4006:823::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20250410/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
URL: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2a14e84adb8fb9735a8e414b7e168f3e5ff9bad71acb1cef9d597355c6d744fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 11643015732383494192
age: 11596
x-content-type-options: nosniff
expires: Thu, 01 May 2025 12:13:33 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 17 Apr 2025 12:13:33 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 7916
x-xss-protection: 0
server: cafe

GET l
www.google.com/ads/measurement/ Frame 9DC3 0
0

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 9DC3 221 KB
0 22ms
22ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
URL: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3049db58f204e8279193524985a52bbad008bfaac0b82caad5f064b54d7494d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 18003062906086184080
age: 257
x-content-type-options: nosniff
expires: Thu, 17 Apr 2025 16:22:32 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 17 Apr 2025 15:22:32 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=ISO-8859-1
vary: Accept-Encoding
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 69570
x-xss-protection: 0
server: cafe

GET
H2 200 9ddb8e913f9d337966429fcaf4b59f8e.js Show response
www.gstatic.com/mysidia/ Frame 9DC3 36 KB
15 KB 48ms
8ms Script
text/javascript 2607:f8b0:4006:80e::2003
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.gstatic.com/mysidia/9ddb8e913f9d337966429fcaf4b59f8e.js?tag=addon/mysidia_one_click_handler_one_afma

Requested by

Host: df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
URL: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:80e::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c3ee7e7ce011e3e48b7abf57f0aac831f15ff20125aed0176475fede7f5deeaa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

content-encoding: gzip
age: 11754
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
x-content-type-options: nosniff
expires: Wed, 16 Jul 2025 12:10:55 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 12:10:55 GMT
last-modified: Tue, 15 Apr 2025 15:25:10 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=7776000
cross-origin-opener-policy: same-origin; report-to="mysidia"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
accept-ranges: bytes
content-length: 15300
x-xss-protection: 0
server: sffe

GET
H2 200 14763004658117789537
s0.2mdn.net/simgad/11978389953481028780/ Frame 9DC3 3 KB
3 KB 52ms
6ms Image
image/jpeg 2607:f8b0:4006:808::2006
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/11978389953481028780/14763004658117789537?w=100&h=100&tw=1&q=75

Requested by

Host: df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
URL: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:808::2006 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5f7dbb21095f2f825e3545ff2708fba122c0c5a3d0852356339f234821acdd68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

age: 42643
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options: nosniff
expires: Fri, 17 Apr 2026 03:36:06 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons: true
date: Thu, 17 Apr 2025 03:36:06 GMT
last-modified: Fri, 03 Jan 2025 00:45:05 GMT
content-type: image/jpeg
cache-control: public, max-age=31536000
timing-allow-origin: *
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
content-length: 2669
x-xss-protection: 0
server: sffe

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 71A9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm&gdpr=0
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJMvtw8FKAs2pYL7SYevKkE&google_cver=1&gdpr=0

43 B
767 B

30ms
28ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJMvtw8FKAs2pYL7SYevKkE&google_cver=1&gdpr=0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQw7j0ARj-sMmKAjAB&v=APEucNXlW9q4hvhNJlsdvf1HJ3AY_WvujGQJLH2hetL11DBvdUmlyxlbhwRY0uu3SYAyZCArspX22bYUZ3WWohBS46xFqwhwwE_Bme64iHVIJT3hrrhHwpQ
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V3ezVnKqFeOQZUbrLilOfZJuI79l5QKq01e9hVj6bPKLL972TUcs64u8SxVN6%2Bq249yAm9P3SvMGDjRV13x8FmFvD6zkvhmbgtAy9NZ%2BNckMAOZxDgdY0WT%2BHI2S1e6CEup%2B%2FrjV2qbBwg%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 17 Apr 2025 15:26:49 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=2,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 931cf1696ac6f834-EWR
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJMvtw8FKAs2pYL7SYevKkE&google_cver=1&gdpr=0
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 324
date: Thu, 17 Apr 2025 15:26:49 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 71A9
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&gdpr=0&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&gdpr=0&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=aAEdudHM6qoAAFqKAFRrgAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJMvtw8FKAs2pYL7SYevKkE&google_cver=1

43 B
764 B

26ms
25ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJMvtw8FKAs2pYL7SYevKkE&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQw7j0ARj-sMmKAjAB&v=APEucNXlW9q4hvhNJlsdvf1HJ3AY_WvujGQJLH2hetL11DBvdUmlyxlbhwRY0uu3SYAyZCArspX22bYUZ3WWohBS46xFqwhwwE_Bme64iHVIJT3hrrhHwpQ
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0k2Tpc2sy3u%2FBnnxX0omSPi3v4UWsfV1JpmlUCJIfHmQCE31m6rj09aVJ5YL2nPAnPL48x9GlyrOm%2F%2FTwfhVNXRqGeae75I3Eq9GNRCeK0urIQgKtoLaZPVaxvxhqp8KJdYp%2FtqpGwKrZg%3D%3D"}],"group":"cf-nel","max_age":604800}
expires: 0
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date: Thu, 17 Apr 2025 15:26:49 GMT
content-type: image/gif
vary: Accept-Encoding
priority: u=2,i
cache-control: no-cache
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
cf-ray: 931cf169cbfcf834-EWR
content-length: 43
server: cloudflare

Redirect headers

cache-control: no-cache, must-revalidate
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJMvtw8FKAs2pYL7SYevKkE&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 313
date: Thu, 17 Apr 2025 15:26:49 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

setuid
ib.adnxs.com/ Frame 71A9
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm&gdpr=0
https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEOcnrGDLHwh_hfOWsBHKf-s&google_cver=1

43 B
1 KB

6ms
5ms

Image
image/gif

68.67.181.230
ASN-APPNEX

General

Check archive.org

Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEOcnrGDLHwh_hfOWsBHKf-s&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJfnugEQw7j0ARj-sMmKAjAB&v=APEucNXlW9q4hvhNJlsdvf1HJ3AY_WvujGQJLH2hetL11DBvdUmlyxlbhwRY0uu3SYAyZCArspX22bYUZ3WWohBS46xFqwhwwE_Bme64iHVIJT3hrrhHwpQ

Protocol

Server

68.67.181.230 North Bergen, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

1042.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-store, no-cache, private
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin: 5.181.234.134; 5.181.234.134; 1042.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid: 0eab3513-8096-4e07-8bb2-9efe9eb6d1bc
content-length: 43
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 17 Apr 2025 15:26:49 GMT
x-xss-protection: 0
content-type: image/gif
server: nginx/1.23.4

Redirect headers

cache-control: no-cache, must-revalidate
location: https://ib.adnxs.com/setuid?entity=101&gdpr=0&code=CAESEOcnrGDLHwh_hfOWsBHKf-s&google_cver=1
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 301
date: Thu, 17 Apr 2025 15:26:49 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 71A9
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Nzk3MzYxODQ2NDAyODk1MDky

170 B
409 B

32ms
23ms

Image
image/png

142.251.35.162
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Nzk3MzYxODQ2NDAyODk1MDky

Requested by

Protocol

Server

142.251.35.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://googleads.g.doubleclick.net/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 15:26:49 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-store, no-cache, private
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Nzk3MzYxODQ2NDAyODk1MDky
pragma: no-cache
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
x-proxy-origin: 5.181.234.134; 5.181.234.134; 1042.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; *.adnxs.com
expires: Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin: *
an-x-request-uuid: 45b512e0-6dea-4403-9fa4-304ac57071cf
content-length: 0
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date: Thu, 17 Apr 2025 15:26:49 GMT
x-xss-protection: 0
content-type: text/html; charset=utf-8
server: nginx/1.23.4

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1D35 0
20 B 70ms
69ms Ping
image/gif 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=9886181384975&version=m202504010101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 17 Apr 2025 15:26:49 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1D35 0
20 B 68ms
67ms Ping
image/gif 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=9886181384975&version=m202504010101&ct=77&x=1&cor=1114102379014399500

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 17 Apr 2025 15:26:49 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 1D35 36 KB
21 KB 54ms
54ms Script
text/javascript 2607:f8b0:4006:81c::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AOH0Fq0r-wu0D09Wmm2O9sHzhbR3ubfWdZSxJaNpaBpJZIbxogACZBFylvsPMC96XGLu--SV3GMZJTvQuW7CkWzAf_qoGzTzi5Ufx8e6WbXgjqZtzSnQOKNDlfib-K5ZsqOh8V2hVyy2ZZ5vsq43Ln8hYTrthjKcaGP0cwGomTmn47NYo6WBKR0zgNt5bqaeTHOW9RthCgI9u2-bQJ0QDFpDEr4pYN4phsclnW65RetcbdLfFQhY0eMONkb-yX8KZUJudUu_0YwR1bdi5kDlMUh7v4gQ&cry=1&dbm_d=AKAmf-DsjhSSq0vIYNboi3obhDCe5Kk-Gteh894a4tvF8pXzaZ5-TJSsVAzkpcRZelnyMGjPg43OanAD5kfUXxF_RDIWS2AFjOJjWV1Ag6lV-Jp3auxqYHuSLWiQQv34gDZI714utfpJhjQh6PYNdGDuAVrufV2gx8KOsfcaE8Zaal84fcVrLaYzv1vKFhzit5p6WOVYH5beqowa6fYLEwC8L9CCHKpb104jgdV_Onh9L8bp63DFbV_vBS_uM3QQuIVIILB9IeEqSOigK3uYZTbED9gn7Zr3Jbtjss9WL1vuHXNjWrbiEKQvb4-s1jikDpAWTXnqeOnFj9tUXYTGWH-eYV9qOGnoa9U4TkKdxHuk_BJ0Yyj1rLSh9L6Jiv4ujjP4XDs_5vyp00xR70oujsgiHhkZySgVVX8CVVmsY83QbJD37t8lgzDKa10Ue0fPdOEDsftmYbyi17ox6Ag_gJrwK1hSlFVFRqzwcBU7CbYKHDhiWCbWLmc6lC3cLxzgBSq1PPVXnU3tmA_vqkh1By_wqWayFZNCc7hhQch2DKYvvdAqD596Up2MH-9pmvOXZ3JYnezjwhYAv-FH_zgW6n4K3FRuGSr3TAgS6EOjTe6MglmyEkOE8pAf8Xv_M6M2T-nyZrHEnV1vP5nrT2TV55VbguLlj07v6WJntXyPWSXE61QyoY50iii42kMPisHXIdrpmoxceoVuWMC0w5BNWmbfbsSeN-QOBC01Qj4rQTqQ0fIKzD26hRE-BYoqrTg_r2Fpgj7sJaZx-1Labyv5nX4Gc7WH3iDOLmI1PiGf4XyCoESn7KCCyTKxf0PffnfXipqZ-ic5rNKFBfap0DnnGceQOjIyESEfC-PFZ2q9rHIBUZbvzlKSYZHi_X5NqKdR3skuAQeno5XE3ZtSZL6hGNmdVTcXCHvNveWesCIrkRW0IeFSmwcSrmwsToR0Iux4IUst5sbwkhgxDgXeCTyRI77EONGY-T3SCTWkga23ZzFrU0DlPdT7SXWwdSYpxmQXAFhn72451lxXfGoKJbxGpOwQFuQFGJs87GPW7C0zgLIw5AmQvyOIUhPEqK7ys_gwnbQvQFfwU3Q6Ys3HOtVm3X9FDhTX5kY10KowqzO9bTNiRsY-_g9w7xmGywsrN8eT4Ej_h8frCbYngD4iQ6O6MW951AkcMybDEqvcJjw-7TS0zDpEMSQ14P0iOUbRFqFvClAQ9LU70qvx4B3VxAdZSqmdWBbKwWbYuTQGQ153vI8hfMt283QIFMwrZZnMW1uIWlt6_GcIyRYn-ilcFGyI5F6tA8tqKHOIUMrQWu5azHeF039F3LvSTVz2gcqSawJIiuhbaQnqCS0PVaV5MbAe9MwypYY0EOJI9OhybVInV7swH6SxXnUXDrv3vvGyku0sIylxIUi4LLSexztC8wUfXAlE_pSNAM4_uoXYzQ_T3IpW5feKsYn0XFNwh1maEY__8f7KbuzLeCahUbPpR9npD9Svaw8eAIVZdZqxQEQNvcE4jLJnjBMJj-FFsiaffuiHmVXRmFg8f50luZnHJ0H9mR9IPA_2Fgo9R5YPQlQ69k63uL04O2jKP4kHPejJdiZnRrFD1M3OmD_kF3FEIBjCuV3HEQ3lZMYsLZpIxo36CynIPSuYr9JModcqNKkjfiXOjO116qXwDovO-__yriS1vKtBoA5GKWrIzReG4ojiTbhbsUSAiewLphO9SvPWl1sXMC48KXU19ey0soq_TLAj6mX8FoF-Vrtil8sL5bNiI_p_rQ5tRVrnium2ASUfYItza2Ku-sH2lsSX_t82Is1gbStP1GZ27d0IXuKzhJlfNbaeLRrZoy5ArnQ22IM8rlrRc7Tb3BmMigo9JZU1zXIsyIAO9w2-sTjJBqFu2Q-n9oU809sX5OXhPVdzYO0VP85Roqr3y22w52Ecp5usoWWV1m_HeLY4PEX_gIZWYfn0eUZidEx141g-UPmjw8TsKJGVdnh1xVGzn12B67NFT5fvJKFsuF6QF6dOkztpRPObCsE2bsftkfaONCSZIG2yLGOzaDiKeg3LWKuBSM5PrlQ5QlVVpLAtNwBbZ8yj3A_VHmBUo4jZ_wQg0BoM6pSHDLbX4i-l8O1rxs293rjelGw5JDhR1lNr8EgyGTiFmaz0hDksXybDrKQ_xIeacMSWo_Dv7xtn6tkdHW6-7YNyxObhfwhK7l3zXob2PdoRkygjXVMdVDjLooyJzWQVcqx25Fr_S_4ds0YYlGRjamrPHnjz5uEK4vyMK2xv592uv4JW4O9R5IdOkf17JeA9L-uchahF5AMFtg5GqlgMKSvW2RQ5QAn5NrFICRmSKiZNJu5rg8Z1kvbvh8bqV-3bu-H_FulWTGniAbQc0Frr4g6g7Yovb4Q2jO-9phtr8DkoktbvAuACyFfjt9X4_XRlgbCfo3eqV1cIqWodrwIXkn5siaFkZ32jptmSViVgiOSBsrkw6KVfhLEaAhSuvXAIrBz5CiNOX4IKR0Bvlsmn-Qb7KoGw77X8JFpHpMRY8i33GxzBsDCCdg1EWF1PTIbe4NJDP20hwVJliODQ9bXNdTL8scOLOGVklSZUwLO50pH4Hd9h8W7onquqhaA-nuB2Bffz2jjxZxvk8LB04tl42fAiIAwbEphH53ZoCpSounaNnyJdyKHLxzXElgTPlQyQGQUgMfnGwzURNUDZR0Uwc8PKw0BDTsXgQ3e5ll5JOQnfzFbWt4WIr9BdGgAW394HOh-kAxjFLdVspJsAsRNvWHTSROHLYYt4EHkDhJ9IFP8dyfCEJpMxWcW7f5CydjXkKlDJWH0138VpV_y5X0AdqJgefYju93WSUAyvsEyAlXiA0mWJqdND8yQQ7m89lYnpsvi_9Rs3OpRP2hwnP4NrlvpLwa1lQE9-Dn9jMjwcGYa6NQrNrNZAFrNtmBWbq8plTbNV_wyAgMS6AEsnmBsSBb6Hgk8ckggofsNLmoFBTMOluuuc5CVqnmGseVH2gI0exUj7IzwbRCHfgNeh2yQMrVgST-KIcdTx7-8SqzCjOGfGpvclJlLFFc9gKv2FxYy3fyL-11cRWT_G8j_WiYqzpvGNtY1rKr2AwwKzjAwFTWBupzKJ3dNCPObpUgj1Kf2uq5m-Tg5mc8Ed9Q3rEPPedkOdtn-ANCUxBsVmMnuBBZB4vIpZa9YNOSxqO7t6TaQmMvaEfeWKj9E5JQwLD7jYUCWnUGOm9JKpg2EJ2JJZpQPujcN4hAeXnroznbQLGigW7FOPCCsvZtTX3m_6_VqTgRgTJZ_A5j3tKdDCl4jl7OKiMXxmPQ5ORW_RNvmWfOs3tIwSUEE-rja8UE0IxeVKVYYD-ZplmFIOd5VBrWa_RA61Yl8PUaO8nYOOj1Hr3rgpGuQBu9O-i2Oa6U8M8UuysRkkPjwkxIR9NCoYe7T6w2rJkOOVva2z--o6oSie7OqgdBNVFh4h7-6kf2LKPpYe-9s7AaH6uNtb9y5ckJMGQG_JPIoG5TTPIYkDxFIWbPW8ZFeXSL-gTsxGuTkabzCVkClThdL73kY_4UQmNyJkJvqp5rfKwC0ABH300i7aQpS34iwGduSLkDPJTCZD91P50ujHIwqVykDer4AJGBYXEIFv2dlF6prSHmYw26iV1V4Gi6lu2P60wBQLE05ZHBa8WBdmoa8PSR0x7x-IQRAaQo2n9Y__c6tdeNLyJENHZMpwFWTV2SKRgo7k8svqVxZZEe5mEuj-j-qRXnzEekNwhjnvhM3K1IKOHb4QvbGDj4GeEM01YqHnil_m9dXTDtmMli-vPwxjkWi9NUualEHMIrU9y49dT7qAsn45yLKrQhkpIWqAk-E94e0bxEJiz3F_w3yEFsUUGnAwDQQ0LIL5IeJYGVqv3eSuKSw5Vh0SDbJNN0ug397eW1fsFgoiulpeheJQ6xsTF28IyAq1Qa-hw0_IAfTk2_GMGLKAyywUoeGF44DgzhT7PELWvn45J9-h4a3oNm96lJD_V2twBKYYYHaACvizcPhynJ0QI5iAcfB-IdKXqNUxWzagmtFkuI5dsezkoHooSbo-W1dP3oay4f4etJiTNKppRGJq4ZWqHJ0Aan14oUmxLMs-eNhfui64hNm6cR_4iifgN62Q5J-0QXVnGjbSR5pRD5OSQB8EQSm5N4oTJ3Gf4NqbH-D1DzMULAa2WeJXOeIJex7Ig4yrYyEExdAe7KVI3DUdrTpL_qG_EXJA7Qnf8eTQKV1m21Fkh0VcQ_LyR5enhAtSheh6mvsUZpYwsRWmuxs_WpspS7kPu7Z6y9EDbSthrHhVdwK_79TBk2lOTX2IzG4IaAlqiw&cid=CAQSOwDZpuyzAqenojOHhAk7R6e-qOxAER5h6-s9ghrmpo5pcSyxNFWRYhUZOgPKNN4xvaAEdx5CjBLTU2NSGAE&dv3_ver=m202504010101&nel=1&rfl=https%3A%2F%2Fkr.buddysecret.com%2F&ds=l&xdt=1&ct=77&iif=1&cor=1114102379014399500&adk=3944675603&idt=100&cac=0&dtd=56

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

61ee34d49fdc21d7180385256087b54e7fe5351b20a6a82b10dcfec591dc7123

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 21015
date: Thu, 17 Apr 2025 15:26:49 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9DC3 0
0 86ms
85ms Fetch
image/gif 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 17 Apr 2025 15:26:49 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9DC3 0
0 72ms
71ms Fetch
image/gif 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 17 Apr 2025 15:26:49 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame 9DC3 216 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 197b9d70e037e56f81adad4e52bf3c3d6583daff6992553e8cfb7640a09fffb6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F2E9
Redirect Chain

https://match.adsrvr.org/track/cmf/google?google_push=AXcoOmREpRckBVY6xQ5NZpA9wOkTijxToGu_93Rpl4r1Twa4CXrxVOrCCTRg_phydKSH6Q5mGYx751_phmPPShfX2Ke6sbAO2B4_PA
https://match.adsrvr.org/track/cmb/google?google_push=AXcoOmREpRckBVY6xQ5NZpA9wOkTijxToGu_93Rpl4r1Twa4CXrxVOrCCTRg_phydKSH6Q5mGYx751_phmPPShfX2Ke6sbAO2B4_PA
https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=YmY0OWFiY2YtZWUwNS00Y2FlLWE3YjYtMzg3NmZjMGVhOWVm&google_push&gdpr=0&gdpr_consent=&ttd_tdid=bf49abcf-ee05-4cae-a7b6-3876fc0ea9ef

170 B
188 B

23ms
21ms

Image
image/png

142.251.35.162
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=YmY0OWFiY2YtZWUwNS00Y2FlLWE3YjYtMzg3NmZjMGVhOWVm&google_push&gdpr=0&gdpr_consent=&ttd_tdid=bf49abcf-ee05-4cae-a7b6-3876fc0ea9ef

Requested by

Host: df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
URL: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Server

142.251.35.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 15:26:49 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_hm=YmY0OWFiY2YtZWUwNS00Y2FlLWE3YjYtMzg3NmZjMGVhOWVm&google_push&gdpr=0&gdpr_consent=&ttd_tdid=bf49abcf-ee05-4cae-a7b6-3876fc0ea9ef
content-length: 423
date: Thu, 17 Apr 2025 15:26:49 GMT
server: Kestrel

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F2E9
Redirect Chain

https://match.prod.bidr.io/cookie-sync/adx?google_push=AXcoOmTwXfwcpRVvgR2ZlOw3EewIlj12XytPpT10CybrsEUMs7PJaPj6dSfYxbWl2k9kiOv4VS7r1WMLIqICI1VVlEGS1Jlop623zQ
https://match.prod.bidr.io/cookie-sync/adx?google_push=AXcoOmTwXfwcpRVvgR2ZlOw3EewIlj12XytPpT10CybrsEUMs7PJaPj6dSfYxbWl2k9kiOv4VS7r1WMLIqICI1VVlEGS1Jlop623zQ&_bee_ppp=1
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFFSlowN1FBanNBQUJ4cDdnTHFQZw&google_push=AXcoOmTwXfwcpRVvgR2ZlOw3EewIlj12XytPpT10CybrsEUMs7PJaPj6dSfYxbWl2k9kiOv4VS7r1...

170 B
188 B

27ms
22ms

Image
image/png

142.251.35.162
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFFSlowN1FBanNBQUJ4cDdnTHFQZw&google_push=AXcoOmTwXfwcpRVvgR2ZlOw3EewIlj12XytPpT10CybrsEUMs7PJaPj6dSfYxbWl2k9kiOv4VS7r1WMLIqICI1VVlEGS1Jlop623zQ&bee_sync_partners=&bee_sync_current_partner=adx&bee_sync_hop_count=1

Requested by

Host: df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
URL: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Server

142.251.35.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 15:26:49 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

strict-transport-security: max-age=2592000; includeSubDomains
location: https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFFSlowN1FBanNBQUJ4cDdnTHFQZw&google_push=AXcoOmTwXfwcpRVvgR2ZlOw3EewIlj12XytPpT10CybrsEUMs7PJaPj6dSfYxbWl2k9kiOv4VS7r1WMLIqICI1VVlEGS1Jlop623zQ&bee_sync_partners=&bee_sync_current_partner=adx&bee_sync_hop_count=1
Content-Length: 0
Date: Thu, 17 Apr 2025 15:26:49 GMT
Server: gunicorn
Connection: keep-alive

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F2E9
Redirect Chain

https://b1sync.zemanta.com/usersync/googleadx/?google_push=AXcoOmQcDFhHTAsljtly_l0wNhmdJSspAvevnFEGwTFGV7riFTPOjfGAne9jTtwWdkU8ghhf7apN7NAzrhMOkFQfEncOa4racUoxlw
https://b1sync.outbrain.com/usersync/googleadx/?google_push=AXcoOmQcDFhHTAsljtly_l0wNhmdJSspAvevnFEGwTFGV7riFTPOjfGAne9jTtwWdkU8ghhf7apN7NAzrhMOkFQfEncOa4racUoxlw&s=2
https://b1sync.zemanta.com/usersync/googleadx/?google_push=AXcoOmQcDFhHTAsljtly_l0wNhmdJSspAvevnFEGwTFGV7riFTPOjfGAne9jTtwWdkU8ghhf7apN7NAzrhMOkFQfEncOa4racUoxlw&obuid=d90a8f44-6ad9-4b84-a205-808e4...
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmQcDFhHTAsljtly_l0wNhmdJSspAvevnFEGwTFGV7riFTPOjfGAne9jTtwWdkU8ghhf7apN7NAzrhMOkFQfEncOa4racUoxlw&google_hm=ZDkwYThmNDQtNmFkOS...

170 B
188 B

29ms
28ms

Image
image/png

142.251.35.162
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmQcDFhHTAsljtly_l0wNhmdJSspAvevnFEGwTFGV7riFTPOjfGAne9jTtwWdkU8ghhf7apN7NAzrhMOkFQfEncOa4racUoxlw&google_hm=ZDkwYThmNDQtNmFkOS00Yjg0LWEyMDUtODA4ZTQ4ZGM0MGI0

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Server

142.251.35.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 15:26:50 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-cache, no-store, must-revalidate
location: https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmQcDFhHTAsljtly_l0wNhmdJSspAvevnFEGwTFGV7riFTPOjfGAne9jTtwWdkU8ghhf7apN7NAzrhMOkFQfEncOa4racUoxlw&google_hm=ZDkwYThmNDQtNmFkOS00Yjg0LWEyMDUtODA4ZTQ4ZGM0MGI0
pragma: no-cache
expires: Thu, 01 Dec 1994 16:00:00 GMT
p3p: CP="We do not support P3P header."
content-length: 258
date: Thu, 17 Apr 2025 15:26:50 GMT
content-type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F2E9
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_push=AXcoOmRxKIApwCbu7EB8v-wGUGWCe5woL41gxrNM0Pcp_ZLYlG2eLsuOvK7sm8xeOJxeCRzaP0jInIZeyIDIdzPhwRUQ13vcRNGD
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=JadE-PchX0xYM7fAfAIENQW16oY&google_push=AXcoOmRxKIApwCbu7EB8v-wGUGWCe5woL41gxrNM0Pcp_ZLYlG2eLsuOvK7sm8xeOJxeCRzaP0jInIZeyIDIdz...

170 B
188 B

22ms
21ms

Image
image/png

142.251.35.162
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=JadE-PchX0xYM7fAfAIENQW16oY&google_push=AXcoOmRxKIApwCbu7EB8v-wGUGWCe5woL41gxrNM0Pcp_ZLYlG2eLsuOvK7sm8xeOJxeCRzaP0jInIZeyIDIdzPhwRUQ13vcRNGD

Requested by

Host: df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
URL: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Server

142.251.35.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 15:26:49 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=JadE-PchX0xYM7fAfAIENQW16oY&google_push=AXcoOmRxKIApwCbu7EB8v-wGUGWCe5woL41gxrNM0Pcp_ZLYlG2eLsuOvK7sm8xeOJxeCRzaP0jInIZeyIDIdzPhwRUQ13vcRNGD
Content-Length: 242
Date: Thu, 17 Apr 2025 15:26:49 GMT
Content-Type: text/html; charset=utf-8
Connection: keep-alive

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F2E9
Redirect Chain

https://dsp.adkernel.com/sync?exchange=11&google_push=AXcoOmS7_9yxggs4uAQIMKx7iDR9vf5kTeNXnwBnIuvVlC4r37LsboZXKSQmFXchWQdd0eBp3WPALm3yfWPYcyfFKYgIItgjS6ZDBQ
https://cm.g.doubleclick.net/pixel?google_nid=adkernel&google_hm=QTU2MDQzNDA4MDc0MTU2MzcwNzk&google_push=AXcoOmS7_9yxggs4uAQIMKx7iDR9vf5kTeNXnwBnIuvVlC4r37LsboZXKSQmFXchWQdd0eBp3WPALm3yfWPYcyfFKYgI...

170 B
188 B

29ms
28ms

Image
image/png

142.251.35.162
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=adkernel&google_hm=QTU2MDQzNDA4MDc0MTU2MzcwNzk&google_push=AXcoOmS7_9yxggs4uAQIMKx7iDR9vf5kTeNXnwBnIuvVlC4r37LsboZXKSQmFXchWQdd0eBp3WPALm3yfWPYcyfFKYgIItgjS6ZDBQ

Requested by

Host: df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
URL: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Server

142.251.35.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 15:26:49 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=adkernel&google_hm=QTU2MDQzNDA4MDc0MTU2MzcwNzk&google_push=AXcoOmS7_9yxggs4uAQIMKx7iDR9vf5kTeNXnwBnIuvVlC4r37LsboZXKSQmFXchWQdd0eBp3WPALm3yfWPYcyfFKYgIItgjS6ZDBQ
Content-Length: 0
Date: Thu, 17 Apr 2025 15:26:49 GMT
Server: nginx
Connection: keep-alive

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F2E9
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_push=AXcoOmTx7gYfRo3Gayp4S1qRJVR42pOXvzFKjdqlFd20-12dXSHqMFmdWrfQwui8kFnUl_2iM4xCje9DxH12MDF4Y2HwYEODaaXV
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmTx7gYfRo3Gayp4S1qRJVR42pOXvzFKjdqlFd20-12dXSHqMFmdWrfQwui8kFnUl_2iM4xCje9DxH12MDF4Y2HwYEODaaXV

170 B
188 B

27ms
25ms

Image
image/png

142.251.35.162
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmTx7gYfRo3Gayp4S1qRJVR42pOXvzFKjdqlFd20-12dXSHqMFmdWrfQwui8kFnUl_2iM4xCje9DxH12MDF4Y2HwYEODaaXV

Requested by

Host: df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
URL: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Server

142.251.35.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 15:26:49 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmTx7gYfRo3Gayp4S1qRJVR42pOXvzFKjdqlFd20-12dXSHqMFmdWrfQwui8kFnUl_2iM4xCje9DxH12MDF4Y2HwYEODaaXV
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F2E9
Redirect Chain

https://creativecdn.com/cm-notify?pi=adxab&google_nid=rtb_house_tr&google_push=AXcoOmQiInHAXClMeUEdmhKhv2olsz3HQ45NcOk58gnb4ROwVcer4Z2J-L3WR_0XXiR24wdHwXEmxb5I04DvGwsZal162KeYVZA8ww
https://creativecdn.com/cm-notify?pi=adxab&google_nid=rtb_house_tr&google_push=AXcoOmQiInHAXClMeUEdmhKhv2olsz3HQ45NcOk58gnb4ROwVcer4Z2J-L3WR_0XXiR24wdHwXEmxb5I04DvGwsZal162KeYVZA8ww&tc=1
https://cm.g.doubleclick.net/pixel?google_ula=5153224&google_hm=xcbBFKseDHl2g-ww9frTDO37mFPT2DKPw5pJW4AkDRw&pi=adx&tdc=ams&pi=adxab&google_nid=rtb_house_tr&google_push=AXcoOmQiInHAXClMeUEdmhKhv2ols...

170 B
188 B

34ms
33ms

Image
image/png

142.251.35.162
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_ula=5153224&google_hm=xcbBFKseDHl2g-ww9frTDO37mFPT2DKPw5pJW4AkDRw&pi=adx&tdc=ams&pi=adxab&google_nid=rtb_house_tr&google_push=AXcoOmQiInHAXClMeUEdmhKhv2olsz3HQ45NcOk58gnb4ROwVcer4Z2J-L3WR_0XXiR24wdHwXEmxb5I04DvGwsZal162KeYVZA8ww&tc=1

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Server

142.251.35.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 15:26:50 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

expires: Thu, 01 Jan 1970 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
location: https://cm.g.doubleclick.net/pixel?google_ula=5153224&google_hm=xcbBFKseDHl2g-ww9frTDO37mFPT2DKPw5pJW4AkDRw&pi=adx&tdc=ams&pi=adxab&google_nid=rtb_house_tr&google_push=AXcoOmQiInHAXClMeUEdmhKhv2olsz3HQ45NcOk58gnb4ROwVcer4Z2J-L3WR_0XXiR24wdHwXEmxb5I04DvGwsZal162KeYVZA8ww&tc=1
content-length: 0
date: Thu, 17 Apr 2025 15:26:50 GMT, Thu, 17 Apr 2025 15:26:50 GMT
pragma: no-cache
vary: Accept-Encoding

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame F2E9 0
12 B 36ms
34ms Image
text/html 142.251.35.162
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13K9y8wO61ShK1uXJeX_SPb2-rXvk0g4UmC6c2WPUqo6bTK_U4V2zOzTBdc158attcHOWSan

Requested by

Host: df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
URL: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.35.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Thu, 17 Apr 2025 15:26:49 GMT
x-xss-protection: 0
content-type: text/html
server: HTTP server (unknown)

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 0955
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

31ms
27ms

Document
text/html

2607:f8b0:4006:81c::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
URL: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 17 Apr 2025 15:26:49 GMT
expires: Thu, 17 Apr 2025 15:26:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 17 Apr 2025 15:26:49 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9DC3 0
0 68ms
67ms Fetch
image/gif 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 17 Apr 2025 15:26:49 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20250410/r20110914/ Frame 1D35 28 KB
10 KB 16ms
14ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20250410/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AOH0Fq0r-wu0D09Wmm2O9sHzhbR3ubfWdZSxJaNpaBpJZIbxogACZBFylvsPMC96XGLu--SV3GMZJTvQuW7CkWzAf_qoGzTzi5Ufx8e6WbXgjqZtzSnQOKNDlfib-K5ZsqOh8V2hVyy2ZZ5vsq43Ln8hYTrthjKcaGP0cwGomTmn47NYo6WBKR0zgNt5bqaeTHOW9RthCgI9u2-bQJ0QDFpDEr4pYN4phsclnW65RetcbdLfFQhY0eMONkb-yX8KZUJudUu_0YwR1bdi5kDlMUh7v4gQ&cry=1&dbm_d=AKAmf-DsjhSSq0vIYNboi3obhDCe5Kk-Gteh894a4tvF8pXzaZ5-TJSsVAzkpcRZelnyMGjPg43OanAD5kfUXxF_RDIWS2AFjOJjWV1Ag6lV-Jp3auxqYHuSLWiQQv34gDZI714utfpJhjQh6PYNdGDuAVrufV2gx8KOsfcaE8Zaal84fcVrLaYzv1vKFhzit5p6WOVYH5beqowa6fYLEwC8L9CCHKpb104jgdV_Onh9L8bp63DFbV_vBS_uM3QQuIVIILB9IeEqSOigK3uYZTbED9gn7Zr3Jbtjss9WL1vuHXNjWrbiEKQvb4-s1jikDpAWTXnqeOnFj9tUXYTGWH-eYV9qOGnoa9U4TkKdxHuk_BJ0Yyj1rLSh9L6Jiv4ujjP4XDs_5vyp00xR70oujsgiHhkZySgVVX8CVVmsY83QbJD37t8lgzDKa10Ue0fPdOEDsftmYbyi17ox6Ag_gJrwK1hSlFVFRqzwcBU7CbYKHDhiWCbWLmc6lC3cLxzgBSq1PPVXnU3tmA_vqkh1By_wqWayFZNCc7hhQch2DKYvvdAqD596Up2MH-9pmvOXZ3JYnezjwhYAv-FH_zgW6n4K3FRuGSr3TAgS6EOjTe6MglmyEkOE8pAf8Xv_M6M2T-nyZrHEnV1vP5nrT2TV55VbguLlj07v6WJntXyPWSXE61QyoY50iii42kMPisHXIdrpmoxceoVuWMC0w5BNWmbfbsSeN-QOBC01Qj4rQTqQ0fIKzD26hRE-BYoqrTg_r2Fpgj7sJaZx-1Labyv5nX4Gc7WH3iDOLmI1PiGf4XyCoESn7KCCyTKxf0PffnfXipqZ-ic5rNKFBfap0DnnGceQOjIyESEfC-PFZ2q9rHIBUZbvzlKSYZHi_X5NqKdR3skuAQeno5XE3ZtSZL6hGNmdVTcXCHvNveWesCIrkRW0IeFSmwcSrmwsToR0Iux4IUst5sbwkhgxDgXeCTyRI77EONGY-T3SCTWkga23ZzFrU0DlPdT7SXWwdSYpxmQXAFhn72451lxXfGoKJbxGpOwQFuQFGJs87GPW7C0zgLIw5AmQvyOIUhPEqK7ys_gwnbQvQFfwU3Q6Ys3HOtVm3X9FDhTX5kY10KowqzO9bTNiRsY-_g9w7xmGywsrN8eT4Ej_h8frCbYngD4iQ6O6MW951AkcMybDEqvcJjw-7TS0zDpEMSQ14P0iOUbRFqFvClAQ9LU70qvx4B3VxAdZSqmdWBbKwWbYuTQGQ153vI8hfMt283QIFMwrZZnMW1uIWlt6_GcIyRYn-ilcFGyI5F6tA8tqKHOIUMrQWu5azHeF039F3LvSTVz2gcqSawJIiuhbaQnqCS0PVaV5MbAe9MwypYY0EOJI9OhybVInV7swH6SxXnUXDrv3vvGyku0sIylxIUi4LLSexztC8wUfXAlE_pSNAM4_uoXYzQ_T3IpW5feKsYn0XFNwh1maEY__8f7KbuzLeCahUbPpR9npD9Svaw8eAIVZdZqxQEQNvcE4jLJnjBMJj-FFsiaffuiHmVXRmFg8f50luZnHJ0H9mR9IPA_2Fgo9R5YPQlQ69k63uL04O2jKP4kHPejJdiZnRrFD1M3OmD_kF3FEIBjCuV3HEQ3lZMYsLZpIxo36CynIPSuYr9JModcqNKkjfiXOjO116qXwDovO-__yriS1vKtBoA5GKWrIzReG4ojiTbhbsUSAiewLphO9SvPWl1sXMC48KXU19ey0soq_TLAj6mX8FoF-Vrtil8sL5bNiI_p_rQ5tRVrnium2ASUfYItza2Ku-sH2lsSX_t82Is1gbStP1GZ27d0IXuKzhJlfNbaeLRrZoy5ArnQ22IM8rlrRc7Tb3BmMigo9JZU1zXIsyIAO9w2-sTjJBqFu2Q-n9oU809sX5OXhPVdzYO0VP85Roqr3y22w52Ecp5usoWWV1m_HeLY4PEX_gIZWYfn0eUZidEx141g-UPmjw8TsKJGVdnh1xVGzn12B67NFT5fvJKFsuF6QF6dOkztpRPObCsE2bsftkfaONCSZIG2yLGOzaDiKeg3LWKuBSM5PrlQ5QlVVpLAtNwBbZ8yj3A_VHmBUo4jZ_wQg0BoM6pSHDLbX4i-l8O1rxs293rjelGw5JDhR1lNr8EgyGTiFmaz0hDksXybDrKQ_xIeacMSWo_Dv7xtn6tkdHW6-7YNyxObhfwhK7l3zXob2PdoRkygjXVMdVDjLooyJzWQVcqx25Fr_S_4ds0YYlGRjamrPHnjz5uEK4vyMK2xv592uv4JW4O9R5IdOkf17JeA9L-uchahF5AMFtg5GqlgMKSvW2RQ5QAn5NrFICRmSKiZNJu5rg8Z1kvbvh8bqV-3bu-H_FulWTGniAbQc0Frr4g6g7Yovb4Q2jO-9phtr8DkoktbvAuACyFfjt9X4_XRlgbCfo3eqV1cIqWodrwIXkn5siaFkZ32jptmSViVgiOSBsrkw6KVfhLEaAhSuvXAIrBz5CiNOX4IKR0Bvlsmn-Qb7KoGw77X8JFpHpMRY8i33GxzBsDCCdg1EWF1PTIbe4NJDP20hwVJliODQ9bXNdTL8scOLOGVklSZUwLO50pH4Hd9h8W7onquqhaA-nuB2Bffz2jjxZxvk8LB04tl42fAiIAwbEphH53ZoCpSounaNnyJdyKHLxzXElgTPlQyQGQUgMfnGwzURNUDZR0Uwc8PKw0BDTsXgQ3e5ll5JOQnfzFbWt4WIr9BdGgAW394HOh-kAxjFLdVspJsAsRNvWHTSROHLYYt4EHkDhJ9IFP8dyfCEJpMxWcW7f5CydjXkKlDJWH0138VpV_y5X0AdqJgefYju93WSUAyvsEyAlXiA0mWJqdND8yQQ7m89lYnpsvi_9Rs3OpRP2hwnP4NrlvpLwa1lQE9-Dn9jMjwcGYa6NQrNrNZAFrNtmBWbq8plTbNV_wyAgMS6AEsnmBsSBb6Hgk8ckggofsNLmoFBTMOluuuc5CVqnmGseVH2gI0exUj7IzwbRCHfgNeh2yQMrVgST-KIcdTx7-8SqzCjOGfGpvclJlLFFc9gKv2FxYy3fyL-11cRWT_G8j_WiYqzpvGNtY1rKr2AwwKzjAwFTWBupzKJ3dNCPObpUgj1Kf2uq5m-Tg5mc8Ed9Q3rEPPedkOdtn-ANCUxBsVmMnuBBZB4vIpZa9YNOSxqO7t6TaQmMvaEfeWKj9E5JQwLD7jYUCWnUGOm9JKpg2EJ2JJZpQPujcN4hAeXnroznbQLGigW7FOPCCsvZtTX3m_6_VqTgRgTJZ_A5j3tKdDCl4jl7OKiMXxmPQ5ORW_RNvmWfOs3tIwSUEE-rja8UE0IxeVKVYYD-ZplmFIOd5VBrWa_RA61Yl8PUaO8nYOOj1Hr3rgpGuQBu9O-i2Oa6U8M8UuysRkkPjwkxIR9NCoYe7T6w2rJkOOVva2z--o6oSie7OqgdBNVFh4h7-6kf2LKPpYe-9s7AaH6uNtb9y5ckJMGQG_JPIoG5TTPIYkDxFIWbPW8ZFeXSL-gTsxGuTkabzCVkClThdL73kY_4UQmNyJkJvqp5rfKwC0ABH300i7aQpS34iwGduSLkDPJTCZD91P50ujHIwqVykDer4AJGBYXEIFv2dlF6prSHmYw26iV1V4Gi6lu2P60wBQLE05ZHBa8WBdmoa8PSR0x7x-IQRAaQo2n9Y__c6tdeNLyJENHZMpwFWTV2SKRgo7k8svqVxZZEe5mEuj-j-qRXnzEekNwhjnvhM3K1IKOHb4QvbGDj4GeEM01YqHnil_m9dXTDtmMli-vPwxjkWi9NUualEHMIrU9y49dT7qAsn45yLKrQhkpIWqAk-E94e0bxEJiz3F_w3yEFsUUGnAwDQQ0LIL5IeJYGVqv3eSuKSw5Vh0SDbJNN0ug397eW1fsFgoiulpeheJQ6xsTF28IyAq1Qa-hw0_IAfTk2_GMGLKAyywUoeGF44DgzhT7PELWvn45J9-h4a3oNm96lJD_V2twBKYYYHaACvizcPhynJ0QI5iAcfB-IdKXqNUxWzagmtFkuI5dsezkoHooSbo-W1dP3oay4f4etJiTNKppRGJq4ZWqHJ0Aan14oUmxLMs-eNhfui64hNm6cR_4iifgN62Q5J-0QXVnGjbSR5pRD5OSQB8EQSm5N4oTJ3Gf4NqbH-D1DzMULAa2WeJXOeIJex7Ig4yrYyEExdAe7KVI3DUdrTpL_qG_EXJA7Qnf8eTQKV1m21Fkh0VcQ_LyR5enhAtSheh6mvsUZpYwsRWmuxs_WpspS7kPu7Z6y9EDbSthrHhVdwK_79TBk2lOTX2IzG4IaAlqiw&cid=CAQSOwDZpuyzAqenojOHhAk7R6e-qOxAER5h6-s9ghrmpo5pcSyxNFWRYhUZOgPKNN4xvaAEdx5CjBLTU2NSGAE&dv3_ver=m202504010101&nel=1&rfl=https%3A%2F%2Fkr.buddysecret.com%2F&ds=l&xdt=1&ct=77&iif=1&cor=1114102379014399500&adk=3944675603&idt=100&cac=0&dtd=56

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

261a186cd1fc151c1e2b9384debb7d79fbe6c09f9291e9856f6901d16409208e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

content-encoding: br
etag: 6888123906427899671
age: 11760
x-content-type-options: nosniff
expires: Thu, 01 May 2025 12:10:49 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date: Thu, 17 Apr 2025 12:10:49 GMT
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=1209600
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
content-length: 10668
x-xss-protection: 0
server: cafe

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 1D35 41 KB
14 KB 16ms
8ms Script
text/javascript 2607:f8b0:4006:823::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

content-encoding: br
age: 2355
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Thu, 17 Apr 2025 15:37:34 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 14:47:34 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=3000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 13937
x-xss-protection: 0
server: sffe

GET
H3 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTc0NDkwMzYwOTgzNjQxMgogIHNlcnZlcl9pcDogODk1MjM1MDcKICBwcm9jZXNzX2lkOiAxODE0NzkxOTEzCn0KZmxvb2RsaWdodF9jb25maWdfaWQ6IDkyMTIyNTIK...
ad.doubleclick.net/ddm/activity/ Frame 1D35 0
22 B 59ms
26ms Image
image/png 142.250.176.198
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTc0NDkwMzYwOTgzNjQxMgogIHNlcnZlcl9pcDogODk1MjM1MDcKICBwcm9jZXNzX2lkOiAxODE0NzkxOTEzCn0KZmxvb2RsaWdodF9jb25maWdfaWQ6IDkyMTIyNTIKYWR2ZXJ0aXNlcl9kb21haW46ICJodHRwczovL2Fkb2JlLmNvbSIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IFZJRVcKaW1wcmVzc2lvbl9wcmlvcml0eTogMAppbXByZXNzaW9uX2V4cGlyeV9pbl9kYXlzOiAzMApldmVudF9pbXByZXNzaW9uX2lkOiAxNDg2MTE5NjYwNzkxMDMyNzg3NgpkZWJ1Z19rZXk6IDc1NjI0NTU0MTA3MzgxMTI3NTkKaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUFJPRFVDVF9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAyCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fREFURQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICIyMDI1LTA0LTE3IgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9GTE9PRExJR0hUX0NPTkZJR19JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogOTIxMjI1MgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9DT1JFX1BMQVRGT1JNX1NFUlZJQ0UKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fTU9CSUxFX0JST1dTRVJfQ0xBU1MKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUVVFUllfQ09VTlRSWQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICJVUyIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBQ0VNRU5UX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzOTA1NDAxMzAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fQ09PS0lFX0NPTlNFTlQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0FEVkVSVElTRVJfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDQwMDQ5MzEKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0xJTkVfSVRFTV9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMjEwOTAwNzgxNjgKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0NSRUFUSVZFX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiA1NTkwNDQ3MzQKICB9Cn0KYXJjaGV0eXBlX2lkOiAxMgphcmNoZXR5cGVfaWQ6IDEzCmFyY2hldHlwZV9pZDogMTQKYXJjaGV0eXBlX2lkOiAxNQpmbG9vZGxpZ2h0X2FjdGl2aXRpZXNfZm9yX2JpZGRpbmc6IDExODU2NTc5CmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9hZG9iZS5jb20iCmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9mbGFzaHRhbGtpbmcuY29tIgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vZGVidWdjb252ZXJzaW9uZG9tYWluMS5jb20iCmltcHJlc3Npb25fZXZlbnRfcmVwb3J0aW5nX3dpbmRvd19kYXlzOiA0CmJyb3dzZXJfYXR0cmlidXRpb25fYXBpX3JlcXVlc3RfcHJvY2Vzc2luZ19iaXRzOiA3ODA0NzYwODgzMgpkbWFfcHJvZHVjdF9pZDogMTIyNzE1ODM3CnhmYV9hdHRyaWJ1dGlvbl9hcGlfdHlwZTogWEZBX0FUVFJJQlVUSU9OX0FQSV9UWVBFX1dFQgplY2hvX3NlcnZlcl9hY3Rpb246IEVDSE9fU0VSVkVSX0FDVElPTl9VU0VfQkVTVF9BVkFJTEFCTEVfQVJBCmV2ZW50X3JlcG9ydGluZ193aW5kb3dzIHsKICBlbmRfdGltZXNfc2Vjb25kczogODY0MDAKICBlbmRfdGltZXNfc2Vjb25kczogMzQ1NjAwCn0KbWF4X2V2ZW50X2xldmVsX3JlcG9ydHM6IDIK

Requested by

Host: df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
URL: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.176.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f6.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 0
date: Thu, 17 Apr 2025 15:26:49 GMT
x-xss-protection: 0
attribution-reporting-register-source: {"aggregation_keys":{"12":"0xc348aa78b35801e00000000000000000","13":"0x704af6271b07f2e60000000000000000","14":"0xbd86e4f3444f618b0000000000000000","15":"0xb64e8582a8b4e27d0000000000000000"},"debug_key":"7562455410738112759","debug_reporting":true,"destination":["https://adobe.com","https://flashtalking.com","https://debugconversiondomain1.com"],"event_report_windows":{"end_times":[86400,345600]},"expiry":"2592000","filter_data":{"14":["11856579"],"21":[],"23":[],"24":[],"25":[],"26":[],"27":[],"28":[],"29":[],"8":["9212252"]},"max_event_level_reports":2,"priority":"0","source_event_id":"14861196607910327876"}
content-type: image/png
server: cafe

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 0A09 1 KB
0 3ms
3ms Document
text/html 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
URL: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

age: 77194
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 16 Apr 2025 18:00:15 GMT
etag: 48472445140208031
expires: Thu, 17 Apr 2025 18:00:15 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1D35 0
0 72ms
68ms Fetch
image/gif 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 17 Apr 2025 15:26:49 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1D35 0
0 69ms
67ms Fetch
image/gif 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 17 Apr 2025 15:26:49 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
DATA 200
OK truncated
/ Frame 1D35 213 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e61c66e4ec81d658d0b94beed9ea89b286d0a6dc8e733fa96884c4d2e58e8987

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1D35 0
0 80ms
67ms Fetch
image/gif 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACaAM%3D

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 17 Apr 2025 15:26:50 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H3 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v62/ Frame 9DC3 35 KB
35 KB 20ms
6ms Font
font/woff2 2607:f8b0:4006:822::2003
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v62/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:822::2003 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

77d21084014dcb10980c296e583371786b3886f5814d8357127f36f8c6045583

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Origin: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
Referer: https://fonts.googleapis.com/

Response headers

age: 120928
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 16 Apr 2026 05:51:21 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 16 Apr 2025 05:51:21 GMT
last-modified: Tue, 29 Oct 2024 18:37:57 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 36216
x-xss-protection: 0
server: sffe

GET
H/1.1 200
OK / Show response
servedby.flashtalking.com/imp/8/233518;8243818;201;jsappend;DV360;DV360FY24AcrobatTeamPSPTeamsInMarketUSDSKBAN728x90/ Frame 1D35 2 KB
1 KB 91ms
49ms Script
text/javascript 23.200.197.55
AKAMAI-AS

General

Check archive.org

Download Go to

Full URL

https://servedby.flashtalking.com/imp/8/233518;8243818;201;jsappend;DV360;DV360FY24AcrobatTeamPSPTeamsInMarketUSDSKBAN728x90/?ftOBA=1&ft_domain=kr.buddysecret.com&ft_ifb=1&ft_agentEnv=0&ft_referrer=https%3A%2F%2Fkr.buddysecret.com%2F&gdpr=0&us_privacy=${US_PRIVACY}&cachebuster=433806.08894031035

Requested by

Host: df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
URL: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.200.197.55 Piscataway, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-200-197-55.deploy.static.akamaitechnologies.com

Software

prod-xre-app39.ash11 /

Resource Hash

24e087a247bfe43281ae326b08e953b08bc3985f8f08c5a41acbb6bf95b7d8e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

Strict-Transport-Security: max-age=86400
Cache-Control: max-age=0, no-cache, no-store
Content-Encoding: gzip
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 17 Apr 2025 15:26:50 GMT
Content-Length: 918
Allow-Fenced-Frame-Automatic-Beacons: true
Date: Thu, 17 Apr 2025 15:26:50 GMT
Content-Type: text/javascript;charset=ISO-8859-1
Vary: Accept-Encoding
Server: prod-xre-app39.ash11

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 75F1 38 KB
13 KB 17ms
15ms Document
text/html 2607:f8b0:4006:823::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:823::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1565
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 17 Apr 2025 15:00:45 GMT
expires: Thu, 17 Apr 2025 15:50:45 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0A09
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=&google_push=AXcoOmTjnI3kP00tmw7zi9hA2ibB0f5Yu3fRq36irCpGbvqidjhRz8J_OGiZEVoSQ1ufLfuLwxN2eIPatPTawodZEZ64kdTX9Xn5eQ&redirect=https%3A//cm.g.doubleclick.net...
https://s.tribalfusion.com/z/i.match?p=b6&u=&google_push=AXcoOmTjnI3kP00tmw7zi9hA2ibB0f5Yu3fRq36irCpGbvqidjhRz8J_OGiZEVoSQ1ufLfuLwxN2eIPatPTawodZEZ64kdTX9Xn5eQ&redirect=https%3A//cm.g.doubleclick.n...
https://cm.g.doubleclick.net/pixel?google_nid=exp&google_push=AXcoOmTjnI3kP00tmw7zi9hA2ibB0f5Yu3fRq36irCpGbvqidjhRz8J_OGiZEVoSQ1ufLfuLwxN2eIPatPTawodZEZ64kdTX9Xn5eQ&google_ula=2786954&google_hm=180...

170 B
188 B

23ms
23ms

Image
image/png

142.251.35.162
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=exp&google_push=AXcoOmTjnI3kP00tmw7zi9hA2ibB0f5Yu3fRq36irCpGbvqidjhRz8J_OGiZEVoSQ1ufLfuLwxN2eIPatPTawodZEZ64kdTX9Xn5eQ&google_ula=2786954&google_hm=18072662158148687623

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Server

142.251.35.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 15:26:50 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

cache-control: no-cache, private
location: https://cm.g.doubleclick.net/pixel?google_nid=exp&google_push=AXcoOmTjnI3kP00tmw7zi9hA2ibB0f5Yu3fRq36irCpGbvqidjhRz8J_OGiZEVoSQ1ufLfuLwxN2eIPatPTawodZEZ64kdTX9Xn5eQ&google_ula=2786954&google_hm=18072662158148687623
cf-cache-status: DYNAMIC
pragma: no-cache
x-function: 209
cf-ray: 931cf16c0a8f8ca7-EWR
expires: Thu, 01 Jan 1970 00:00:00 GMT
alt-svc: h3=":443"; ma=86400
x-reuse-index: 652
p3p: CP="NOI DEVo TAIa OUR BUS"
date: Thu, 17 Apr 2025 15:26:50 GMT
content-type: text/html
server: cloudflare

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0A09
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_push=AXcoOmTASAykh7IGTcj111uz6W3d6QvEQ7YetGTNvbdYVJtWyAOv311zXX5sstI1EFd6GWoim0RxbatdU1Jj2JSE3ie4B6z_CMWqLw
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=StvpU9wtRTAnEJgEUjspmQ&google_push=AXcoOmTASAykh7IGTcj111uz6W3d6QvEQ7YetGTNvbdYVJtWyAOv311zXX5sstI1EFd6GWoim0RxbatdU1Jj2JSE3ie4B6z_CMWqLw

170 B
188 B

27ms
26ms

Image
image/png

142.251.35.162
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=StvpU9wtRTAnEJgEUjspmQ&google_push=AXcoOmTASAykh7IGTcj111uz6W3d6QvEQ7YetGTNvbdYVJtWyAOv311zXX5sstI1EFd6GWoim0RxbatdU1Jj2JSE3ie4B6z_CMWqLw

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Server

142.251.35.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 15:26:50 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=StvpU9wtRTAnEJgEUjspmQ&google_push=AXcoOmTASAykh7IGTcj111uz6W3d6QvEQ7YetGTNvbdYVJtWyAOv311zXX5sstI1EFd6GWoim0RxbatdU1Jj2JSE3ie4B6z_CMWqLw
x-host: tde-deliveryengine-production-5889cf7dfb-nkstp
via: 1.1 google
x-engine-version: 0.0.0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
date: Thu, 17 Apr 2025 15:26:50 GMT
server: nginx

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0A09
Redirect Chain

https://a.c.appier.net/gcm?google_push=AXcoOmQQeKbMPpSNg_RNpb7098yQ6070YNZ0ZFw6sA8QtmhbekMedSwwPGqXAJN9o0Ngu2u3XzGXrkSFrzzxLWOPA1ZYsuyL46pp
https://cm.g.doubleclick.net/pixel?google_hm=Y3U2RXhqcFBCM09QM0U4WXVoMEJhQQ%3D%3D&google_nid=appier&google_push=AXcoOmQQeKbMPpSNg_RNpb7098yQ6070YNZ0ZFw6sA8QtmhbekMedSwwPGqXAJN9o0Ngu2u3XzGXrkSFrzzxL...

170 B
188 B

21ms
20ms

Image
image/png

142.251.35.162
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_hm=Y3U2RXhqcFBCM09QM0U4WXVoMEJhQQ%3D%3D&google_nid=appier&google_push=AXcoOmQQeKbMPpSNg_RNpb7098yQ6070YNZ0ZFw6sA8QtmhbekMedSwwPGqXAJN9o0Ngu2u3XzGXrkSFrzzxLWOPA1ZYsuyL46pp

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Server

142.251.35.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 15:26:51 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

Cache-Control: no-store
Location: https://cm.g.doubleclick.net/pixel?google_hm=Y3U2RXhqcFBCM09QM0U4WXVoMEJhQQ%3D%3D&google_nid=appier&google_push=AXcoOmQQeKbMPpSNg_RNpb7098yQ6070YNZ0ZFw6sA8QtmhbekMedSwwPGqXAJN9o0Ngu2u3XzGXrkSFrzzxLWOPA1ZYsuyL46pp
Accept-Ch: Sec-CH-UA-Model,Sec-CH-UA-Platform-Version
Connection: keep-alive
Content-Length: 0
P3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Thu, 17 Apr 2025 15:26:50 GMT
Server: nginx

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0A09
Redirect Chain

https://google.partners.tremorhub.com/sync?UIDF=&google_push=AXcoOmS5nnphihAbLuJ8bijIR_OaQav8vR4Q0L1xlZHblglLOE4JSI24LCJ4g8XZstmdZ0jojKWMrm9qsPb-SA_ApyYNNzPmbgd0pw
https://cm.g.doubleclick.net/pixel?google_nid=tremor&google_hm=Njk2ZjFiYjYyYjQ5NGQ1ZWFhMmM4MzU0MGY2MjRmZmQ%3D&UIDF=&google_push=AXcoOmS5nnphihAbLuJ8bijIR_OaQav8vR4Q0L1xlZHblglLOE4JSI24LCJ4g8XZstmdZ...

170 B
188 B

25ms
25ms

Image
image/png

142.251.35.162
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tremor&google_hm=Njk2ZjFiYjYyYjQ5NGQ1ZWFhMmM4MzU0MGY2MjRmZmQ%3D&UIDF=&google_push=AXcoOmS5nnphihAbLuJ8bijIR_OaQav8vR4Q0L1xlZHblglLOE4JSI24LCJ4g8XZstmdZ0jojKWMrm9qsPb-SA_ApyYNNzPmbgd0pw

Requested by

Host: df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
URL: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Server

142.251.35.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 15:26:50 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tremor&google_hm=Njk2ZjFiYjYyYjQ5NGQ1ZWFhMmM4MzU0MGY2MjRmZmQ%3D&UIDF=&google_push=AXcoOmS5nnphihAbLuJ8bijIR_OaQav8vR4Q0L1xlZHblglLOE4JSI24LCJ4g8XZstmdZ0jojKWMrm9qsPb-SA_ApyYNNzPmbgd0pw
content-length: 0
p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date: Thu, 17 Apr 2025 15:26:50 GMT
server: nginx

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0A09
Redirect Chain

https://match.sharethrough.com/E4rooAtA/v1?google_push=AXcoOmRFubF8iScWipejzVwNeI4yc5MwIeGd21zjHWB73KLJA2vYLN-U_EoAiQco2FaVmGY50-1Nh7XfhYuF-OStBY5ZiTU1hv1fevc
https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=ZmIxZDlmY2EtZjA3YS00M2IxLTkwNTktZjFhMTRhMzkzNGE3&google_push=AXcoOmRFubF8iScWipejzVwNeI4yc5MwIeGd21zjHWB73KLJA2vYLN-U_EoAiQco...

170 B
188 B

28ms
27ms

Image
image/png

142.251.35.162
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=ZmIxZDlmY2EtZjA3YS00M2IxLTkwNTktZjFhMTRhMzkzNGE3&google_push=AXcoOmRFubF8iScWipejzVwNeI4yc5MwIeGd21zjHWB73KLJA2vYLN-U_EoAiQco2FaVmGY50-1Nh7XfhYuF-OStBY5ZiTU1hv1fevc

Requested by

Host: df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
URL: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Server

142.251.35.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
date: Thu, 17 Apr 2025 15:26:50 GMT
x-xss-protection: 0
content-type: image/png
server: HTTP server (unknown)

Redirect headers

strict-transport-security: max-age=16000000; includeSubDomains; preload;
location: https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=ZmIxZDlmY2EtZjA3YS00M2IxLTkwNTktZjFhMTRhMzkzNGE3&google_push=AXcoOmRFubF8iScWipejzVwNeI4yc5MwIeGd21zjHWB73KLJA2vYLN-U_EoAiQco2FaVmGY50-1Nh7XfhYuF-OStBY5ZiTU1hv1fevc
content-length: 0

GET
H2

200

report
sync.teads.tv/um/ Frame 0A09
Redirect Chain

https://sync.teads.tv/um?ssb_provider_id=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_push=AXcoOmQGyVv_KCt...
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=NTE5NjJkMzUtMjE3YS00ZDhlLWI5MzAtMTBiNTkxMzE2YzM3&google_push=AXcoOmQGyVv_KCt0A54LktJTkymkjcFnGyGCMT3nPlI2XCNXybcGnzJ2DC5dqYwflGOH1...
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

23 B
163 B

20ms
18ms

Image
image/gif

23.205.56.163
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
Requested by: Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/
Protocol: H2
Server: 23.205.56.163 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-205-56-163.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.1 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

expires: Thu, 17 Apr 2025 15:26:50 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 23
pragma: no-cache
date: Thu, 17 Apr 2025 15:26:50 GMT
content-type: image/gif
server: pekko-http/1.0.1

Redirect headers

cache-control: no-cache, must-revalidate
location: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
pragma: no-cache
cross-origin-resource-policy: cross-origin
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 260
date: Thu, 17 Apr 2025 15:26:50 GMT
x-xss-protection: 0
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)

GET
H2 204 google
gtrace.mediago.io/ju/cs/ Frame 0A09 0
293 B 127ms
36ms Image
text/html 35.208.249.213
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL: https://gtrace.mediago.io/ju/cs/google?google_push=AXcoOmT2DcqPXkc6aK-ieY2AUwwSt0xNnTYSIwWruYPl4av1_Rd_4xcPVGqgdxY_sbz3w0X9NYXUaCbufViqeJDI1J-YcB7rCuOXCA
Requested by: Host: df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
URL: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.208.249.213 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 213.249.208.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

access-control-allow-headers: Content-Type
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 15:26:50 GMT
content-type: text/html; charset=utf-8
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 0A09 0
12 B 25ms
24ms Image
text/html 142.251.35.162
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LyPVvxWzlgXRNQ8QQr6GMN22s9nmV5Ab6ojwnHRChYwvcBm9sjDO3JKz3pUk7aMZRoyS2fOnbW

Requested by

Host: df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
URL: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/safeframe/1-0-41/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.35.162 Queens, United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://pagead2.googlesyndication.com/

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Thu, 17 Apr 2025 15:26:50 GMT
x-xss-protection: 0
content-type: text/html
server: HTTP server (unknown)

GET
H3 200 ad
googleads.g.doubleclick.net/dbm/ Frame 9DC3 3 KB
3 KB 50ms
48ms Image
text/javascript 2607:f8b0:4006:81c::2002
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A5Y9vaTSuvOVElhzB3eHqKAriWGv1nrpmGT1lXpsVCoTorNsWBxDn8L85kq2MubSBBQ-WdiKtprB0ZzYsK0HhjamvpG3OAA1zs_gpYys8CY-dYhC-2dHYG6yJtkHXviS3Z60ugphrnx7dJtKfp6y1nJWaUjcE__iFJvstV58hKerRHuM106QzwTW1f9KKpOd-vgomV1IQnR6qO1SKRl6cPOVPAsMI9lgatFNyWASnSuIQ7w63hlX9hBECtoqV3dOfIL1tI4u58WjbIf5fdNw761x4fiw&cry=1&dbm_d=AKAmf-BquClYk5F_-qLEoI2Dq5D1-KMl5BUtdHry_oK37CC48GPkGDOVGa72aJiLzaxUKeL740CbQg-ED7iS_x6vSlkFRSd-qmsMae_jRRkg53vuFuc81LefwjpLYZZnb6uoCSfoMxdEvtuiWUhJiG6pUz6W0EmEvan0yHviTriwZclgiI6-70eKQRNHZaqLPfEzpMWIS5wHO-uYPsjR0IydKseuinvOu6fpVLviiOeSfSPGQVrbrzIouDRYd52tc_sT8aQw35XBuO38SOItQJDvgK3_GDqWzLflX7PithX_tx-HtWODsXmtl0ProY-ggGe4UJMCb6I98e0sAg-76vRBk0jyLYyLV_ILJn0gQl0dXgxj3PiwfUr6DMEBWSSBhWKQ-LyYeyWlwWS8hifSsyG9yy2BJq7FyRfKVpiKOgv2zUnFY2fni5PQ24XCJ270x3cRmHP1rnySEjfddOQSEZ8ebZnFaDSOhLJ9juE14DnA9Ez_eTxBLWMiwNNw9bTwycgheNKmnlMtMuHwwddr5tH3Wwdh9ncfsklrm06rwpAY4kMeCuBJyGYSQMq1LMZyob7Z5Ae_QZ87xt7WlnMSEAPnO4IpCq_5rwTjMTp4GGREfb0Bo6bjJZypAjxLYVLgfsXj6PnU7haeZvLQDau0Vibsc-sMSpLI7Y0rAM8nJ46719hdknRlKMUSxDz7xdUay6Rudk3U18Qj2Z_P3q1OGrocjV7fujJlm0wO8YwaBG-XW8LBepQXpJQOWEGEovVg7kcBFmOsQHqnItauYP4bG9gVZohXLgjlW0cvbm8uhban44nDVeZz90InHsq3UVsUJ7hz8rqXGMBYdW6do69ugb1S_ZHwl9aqbqITHwfkogzW_dUMlhK1N1TpB1dj2nofmZ3NCm0yw8zM7WmVtPbfgPDXAY_vmF3osyaShZBdjjooTquTH_XXbS_ELoea8PlvEfUR5DNsKNSGrbtjPcgfcdHQKleYls38oRbF-s7Mwxf7MGVbHagMWDhZ1UVYvzUJp1UFForT6BmRtBM78LSWkNbzpKbiwSojNKjhw7zO33PTYY1OZkX4VlNdVu1lJps5gJxgTHJ8PWVJxvYDa9lD4r2MRkPQ2lZCfnZbu0wav_h2HUJgqhoj2PGhPjCyaRhHo-JRIwaG9XWeaY18fqxt7WKCwChq1rgKFFIjp3di0dQh1_fhFglOzb_iSAJhk4f5jeGZxUSZIUUZNg17I8U_ROVZw7Uh1AO8RZJaZvrHnWOxdQMUoO-S5uRypeDVrb1CeQpjKuUGtUJhsKLRCvm-SiEprU_gyVyLRdIFqnI9i5VlydZxmNb7GN5pyKJfWmhnkzpnLQMnSZo3GAY33LZhGZ_2Bem8Zdo2QGbpe-6dWTn9jXG1ZKTdb_2uWbx8r9bS0QKhmrdYvEJmwq7BHVI2NBv1c7d9dsr-lwQmrJ0OGIonTXe72VVSLVf3KNfSXKFEFzlTXF4CgXbGAYLHB5fc4S29Qz0b3RjIUxYh7jFN3eO4zidgZkuyxmQvrjiLjJFjfpXFzVwjf2MhGxD0qLurGLshK6015ctBMdf982v3x_A3flg7oWhi_mZDe8awJI9eiR0zaorCdJnmIz-KdQ_2l_qGcK4yz1biwUTS5weU6RAU991Fcirq_DFSf4-7wWmgWxA5EDiMfaSEsmEJ49BSvfRPISKyYOSshYMy-8ld-GXOadDeA_DgW_6TKqmvQLnYOgXP6zGjD9REDKfVK4sF91Qx4hzD_PMdXwi_3HC_3ZzCpT7Mv_jmVSNE6V0fe0cEPAejWlqPCuJb5-kZB_uVSSiQJhZfXeMJ8eiPiXjRCnijX7_MisaAkhvzrxhQJai5XISEF1G9oKqfivS_XYhi1pfLRP0WN7lDMzvdin9RjhaiMjk4FCLcQQqOoYFoMd6S9kncqy2Z4A4GfCqiaaxGTfXAiA3cpBzbThFylD80xF08ujUpOS2HZfjfGXSYFqjLxu1Vrk6YKqLU8VdlYgsZYJm2ZuZk5ZYZVM8QiPRPnoJMaW0QVAltjLVnHL6Yllq9h-ClnA46FwzTD_HYGpFjuIzUURiHGWqKafCQfnxaiBH3HIPbXYuT1nFbcCpQlYPlZaKRNcaAPWCOUZC-DqLRl4vIsq3H_AKGtBFslgMbErujfm5ERZPXS87xK_7WrJObtTVYpIQA-isK31seqf0cpToBz0z7b3x3U70QSmcO_fZKK25Wy-JtfEDUgHgHGELGYmx9UiLhW2PC9aTAjsYoljxqzCa9wLv6dG_rj_V-wAUPYzsE8uFN9gq_GuHJVl2OsHKEx9CUQyfvA00JvX8ik5ZvMBIEHGGHippjwJWGoAiey-QT5DdJYjUJO9bUIC1MNxZp5OWstZjcCotB2jDrkHPZwv0rs4lVi7EB5PmuZQpVcTIMGFjFGUGtgHQe1xnSvDyHIJuw-eA6IVpoOcxFMPk8Bp-HKmKp1BRr6ZlFY3diTFWel5lOacZopuIX3LCM92OBZLB4I2r2OiH-li4WA-PCsxRvsf_ueKT_czGpTDNfAsYpr_tYgAR3WY5XUFlB7bBLHSAVCdf0LqTOMXjLI4-Coh7bAi84wxL739NoWeZ5R6_iDzF_0Um61h2olEmfsE1PTlulPKWTWJxN5zYpRbcNeSBcX8dCPNyeueU_UWj9JejdeLcz9blR_JfQJizap4dq0a9WzTtanlkr9RbPMWoUuGzlpuxFVcZ3R32I0WkcQVVTk7i6E0rlvu121aYQyZ1ZO_LGzZdqRI-mpurmu5tSl-Te2a3EGLmbWLndRGmzFZRznlX5hFQjgTJt6eMpTDuRxKQ3cu4R9oY76WU9NehwxK0jAalmTruDKjlpjMMnVxTD-Es06ViD6Up1Uv8Nb3r07kNazvyI-nJAoT39aty8qz86KOG36MeCId16qRw1KEt4LF87ZjbpBQUaby1vNuPmQ1WPmeGtXVumEpfaxmdUfugF4eGXgThXyB8l8OBys0xGpvBOEivieMPskUMa-EuvnUswTimiw5RD81vpiFloY336yW9-6_24xbNNIoz3JuCkrXktx89FO4dn_a_G0-ycXyEyBXJ_ZDMlhCzlzVv2ljUhiP8HC6Gb8Qs4sBdZVhx14QAEO2WAQea5b0XS7qJBmSRwKL2JAtMct8PTexXkOb4-awwbSojr-3xZrXkFBQFHIN5vmMjxbWmmB_fr0Z83xN3JZ7fydVu9wPaFpd-j4PrqBsqAgcq397vOMjnGqRHME4xbv4SS9VE3M2KgmvyZoTUanLV1IfsokWRcFw6MCSFk4NoLqYgkWSuSBCyo6ZheHmqtp2JsCc5Gir_Mu1DwasjHqv65a52CbTIRRBuFED8auqqIhPbOVEDZe2gHU9sCHFUI80jHepjLOvUudVEorT_4HylBfbYTgS81iGOxarOjlHXg6E0JpA2ZAaZMnHkh0-JLsKb48BfSuMc7s4rWvZZTvJsRiJ2xFjoFEykk54BoTpuWAm1ns60JrOMTIL9Vr6QecxZcnWZ57ws837rmTs4nXt00VYQ3sihNWm0ajdgCV-vkIp4r_uy20U3jPP5blmn8sAIEFqEG1fsG-cX-e3ioMEzhW9-ePF1b3-CKuDJnjLJbluUHCc-2Qx26DE_c8iEOTLZkRBcEnXvrTTDDn8fQk3SieG_eSnQfxKhIN3PuBYB5PvJyQkJr1m52mtJyD6uoSlhCJARnihieGlGnHTX78SA3&cid=CAQSOwDZpuyzAqenojOHhAk7R6e-qOxAER5h6-s9ghrmpo5pcSyxNFWRYhUZOgPKNN4xvaAEdx5CjBLTU2NSGAE&cbvp=2&rm=1

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
content-encoding: br
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length: 6398
date: Thu, 17 Apr 2025 15:26:50 GMT
x-xss-protection: 0
content-type: text/javascript; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H2 200 ftUtils.js Show response
ajs-assets.ftstatic.com/ Frame 1D35 96 KB
29 KB 58ms
8ms Script
application/javascript 18.238.49.67
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://ajs-assets.ftstatic.com/ftUtils.js
Requested by: Host: servedby.flashtalking.com
URL: https://servedby.flashtalking.com/imp/8/233518;8243818;201;jsappend;DV360;DV360FY24AcrobatTeamPSPTeamsInMarketUSDSKBAN728x90/?ftOBA=1&ft_domain=kr.buddysecret.com&ft_ifb=1&ft_agentEnv=0&ft_referrer=https%3A%2F%2Fkr.buddysecret.com%2F&gdpr=0&us_privacy=${US_PRIVACY}&cachebuster=433806.08894031035
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.238.49.67 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-238-49-67.jfk52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5856901d3159c27ccab3bdf9786682be92c1b55df22757a402288869445a1d51

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

access-control-max-age: 3000
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
content-encoding: gzip
etag: W/"d3c48e1d221f173643b61e784a31718a"
age: 10199
access-control-allow-methods: GET
x-varnish: 807202940 794690950
x-cache: Hit from cloudfront
x-amz-cf-id: 9Q7IAUPfZQ5P3bJJtlHB8sSp0KGQSoW0m4mVlpr5sR5NDB2IqPn5_Q==
date: Thu, 17 Apr 2025 12:36:51 GMT
content-type: application/javascript
last-modified: Mon, 03 Mar 2025 14:51:26 GMT
vary: Accept-Encoding,Accept-Encoding
cache-control: max-age=86400
via: 1.1 prod-web-edge4.dub11.ftdns.net (Varnish/trunk), 1.1 ff278a71a35448622a3b931c58f6a0ae.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 29455
x-amz-cf-pop: JFK52-P3
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H3 200 kLp1wZtyR2cl6iKecfHpV0vkPc8de5KeCPhMdHbgSC0.js Show response
pagead2.googlesyndication.com/bg/ Frame 75F1 54 KB
21 KB 10ms
10ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/kLp1wZtyR2cl6iKecfHpV0vkPc8de5KeCPhMdHbgSC0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

90ba75c19b72476725ea229e71f1e9574be43dcf1d7b929e08f84c7476e0482d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://tpc.googlesyndication.com/

Response headers

content-encoding: br
age: 177271
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
x-content-type-options: nosniff
expires: Wed, 15 Apr 2026 14:12:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 15 Apr 2025 14:12:19 GMT
last-modified: Mon, 07 Apr 2025 13:58:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
accept-ranges: bytes
content-length: 21048
x-xss-protection: 0
server: sffe

GET
H2 200 4753811.json Show response
agen-assets.ftstatic.com/display/8243818/ Frame 1D35 4 KB
2 KB 45ms
12ms XHR
application/json 13.35.93.97
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://agen-assets.ftstatic.com/display/8243818/4753811.json
Requested by: Host: ajs-assets.ftstatic.com
URL: https://ajs-assets.ftstatic.com/ftUtils.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.93.97 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-93-97.jfk50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0b311a51d9647aa7e6642eb1ba3af1372b5aae8af8ee76074b47a9bc2e42576b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

access-control-max-age: 3000
access-control-expose-headers: Accept-Ranges, Content-Encoding, Content-Length, Content-Range
content-encoding: gzip
etag: W/"3515bdbfaa1231c18de301aee3f1d2be"
age: 550
access-control-allow-methods: GET
x-varnish: 803925600
x-cache: Hit from cloudfront
x-amz-cf-id: _tEiStDCyRtJEsC5eAkBT1clwQAqGnQPac82g66yhvT5kPkQGBnEmA==
date: Thu, 17 Apr 2025 15:17:40 GMT
content-type: application/json
vary: Accept-Encoding,Accept-Encoding
last-modified: Wed, 27 Nov 2024 19:19:46 GMT
cache-control: max-age=30
via: 1.1 prod-web-edge5.ash11.ftdns.net (Varnish/trunk), 1.1 4bb97c894b41a52a86ef7d6744e0e642.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
x-amz-cf-pop: JFK50-P8
server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 d9core Show response
d9.flashtalking.com/ Frame 1D35 11 KB
11 KB 78ms
25ms Script
application/javascript 3.210.88.34
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://d9.flashtalking.com/d9core
Requested by: Host: ajs-assets.ftstatic.com
URL: https://ajs-assets.ftstatic.com/ftUtils.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.210.88.34 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-210-88-34.compute-1.amazonaws.com
Software: Apache/2.4.59 (Amazon Linux) OpenSSL/3.0.8 /
Resource Hash: b3d93d7265fa0db918412c2f256a9830232b11cc60790bf84f01a48ad799c2ac

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

cache-control: private, must-revalidate, proxy-revalidate, max-age=172800
etag: 5bc31bf7d4a298e1bef9d35fce222bfc
access-control-allow-credentials: true
access-control-allow-methods: GET,POST,SERVER
access-control-allow-origin: d9.flashtalking.com
p3p: policyref="localhost/w3c/D9_p3p_.xml", CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
date: Thu, 17 Apr 2025 15:26:50 GMT
content-type: application/javascript;charset=utf-8
server: Apache/2.4.59 (Amazon Linux) OpenSSL/3.0.8

GET
H2 200 index.html Show response
cdn.flashtalking.com/194232/4753811/ Frame 9710 155 KB
28 KB 66ms
6ms Document
text/html 18.173.132.26
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.flashtalking.com/194232/4753811/index.html
Requested by: Host: ajs-assets.ftstatic.com
URL: https://ajs-assets.ftstatic.com/ftUtils.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.26 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-26.jfk52.r.cloudfront.net
Software: Flashtalking (AKA) /
Resource Hash: b6f996cad5800270527eb13bf9b1bf2b0f386c8e0b8bb4a64c77af4f77077314

Request headers

Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
cache-control: max-age=1200
content-encoding: gzip
content-length: 28490
content-type: text/html
date: Thu, 17 Apr 2025 15:14:13 GMT
etag: W/"cdd1514b34bfbf24519f1fb6319168de"
last-modified: Tue, 18 Jun 2024 17:57:38 GMT
server: Flashtalking (AKA)
vary: Origin
via: 1.1 prod-web-edge6.dub11.ftdns.net (Varnish/trunk), 1.1 65302a67852221313e65b936cd8d6b68.cloudfront.net (CloudFront)
x-amz-cf-id: 7rT8d9FWRm2us8oNhI5chVO92w4B1GLGd_gnDYp_vlY2TLk8CaeCiA==
x-amz-cf-pop: JFK52-P2
x-cache: Hit from cloudfront
x-varnish: 803310237 803307881

GET
DATA 200
OK truncated
/ Frame 1D35 43 B
0 Image
image/gif

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/gif

GET
H/1.1 200
OK score.min.js Show response
js.ad-score.com/ Frame 1D35 926 KB
187 KB 58ms
5ms Script
application/javascript 2600:9000:261f:dc00:a:deb0:3380:93a1
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://js.ad-score.com/score.min.js?pid=1000925&tt=g
Requested by: Host: ajs-assets.ftstatic.com
URL: https://ajs-assets.ftstatic.com/ftUtils.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:261f:dc00:a:deb0:3380:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 75e96fccb646b1eef77b4ca7fd38719d2f52841b2307f0b1a8cb1f66df6e90eb

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

Content-Encoding: br
Age: 62863
Access-Control-Allow-Methods: GET
Expires: Thu, 17 Apr 2025 21:59:07 GMT
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 5tAkNsp795ZpkHSYa3lrFJrd8Kv-tVMBYTGyIehhQjEzxZQt2bnWhQ==
Date: Wed, 16 Apr 2025 21:59:07 GMT
Content-Type: application/javascript
Last-Modified: Wed, 16 Apr 2025 21:59:07 GMT
Vary: Accept-Encoding
Access-Control-Allow-Headers: Cache-Control
Transfer-Encoding: chunked
Cache-Control: public, max-age=86400
Connection: keep-alive
Access-Control-Allow-Credentials: true
Via: 1.1 d2b8f634cf8ac5ec77dee366297223bc.cloudfront.net (CloudFront)
Access-Control-Allow-Origin: *
X-Amz-Cf-Pop: JFK52-P3

GET
H2 200 /
ad-events.flashtalking.com/state/8243818;4753811;0;271;31FFADB5-05B1-27FE-DAE4-6C628FA3D2F4/ Frame 1D35 0
67 B 58ms
11ms Image
text/plain 54.172.88.56
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ad-events.flashtalking.com/state/8243818;4753811;0;271;31FFADB5-05B1-27FE-DAE4-6C628FA3D2F4/?cachebuster=658585816
Requested by: Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.172.88.56 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-172-88-56.compute-1.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

content-length: 0
date: Thu, 17 Apr 2025 15:26:50 GMT
content-type: text/plain; charset=utf-8
server: awselb/2.0

GET
H2 200 iconc.png
cdn.flashtalking.com/oba/icon/ Frame 1D35 1 KB
2 KB 65ms
8ms Image
image/png 18.173.132.26
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cdn.flashtalking.com/oba/icon/iconc.png?EDAA_icon=y
Requested by: Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.26 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-26.jfk52.r.cloudfront.net
Software: Flashtalking (AKA) /
Resource Hash: f75ada33b07cb31e16a0a0d3325961a22dc9526edb49bff04c31d7b7611f7025

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

cache-control: max-age=2592000
etag: W/"db320ef6f3c45ab5c90887ef618de2bb"
via: 1.1 prod-web-edge2.dub11.ftdns.net (Varnish/trunk), 1.1 65302a67852221313e65b936cd8d6b68.cloudfront.net (CloudFront)
x-varnish: 535993381
accept-ranges: bytes
x-cache: Hit from cloudfront
x-amz-cf-id: L2ISziXjmVLUENozf1GkvY1jzuA8lIxgmKtBErdid_Migw6zkUBRUQ==
date: Wed, 19 Mar 2025 10:36:23 GMT
content-type: image/png
last-modified: Sat, 12 Apr 2014 19:14:31 GMT
server: Flashtalking (AKA)
x-amz-cf-pop: JFK52-P2
vary: Origin

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 75F1 0
20 B 69ms
68ms Image
image/gif 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BW_pwuR0BaLyGM7OK2NoP6Y2u4QYAAAAAOAHgBAI&bg=!hoWlhcrNAAZDHFaHYxw7ADQBe5WfOOkBPQYvwStsRTWMs5IdUL4yZ0Cv2_cwKUcv5cCm5-PGwYxWrwLmFOZB3ElnOl1mAgAAALNSAAAABWgBB34ANbNW3hb4rj8Av2N1JknGgjWuW6CTMvt_j9XwtW20ueaLSQ4eIZr02WCBbYfPYlbcTw7nbPUgCgCZQLp5MBGqi8bKfu8Ti4ajS-KbAOWXXkkxhiL17yS0RWq8tYxhnNU6QbebCwdkixrO-JasS2zPEKX7rvpV44blJ9okwXdvzO5Oqd3Qm-5f8Th0kl4StAliUDoWE-ESdnH3wE2DFPNfE-onEPa1ELA5LzprF4pWKflK-KmlkkWtQaGnF_N4rQgnT2sBX-bWHo4G3QeEl2fc7OBumQKjEFLwOp57J30ZzMn2my9Sv8Nn30j259IJZ-Uk1LClWzWPPrZ1_L6G0zT8lsRKBvphyQKE00vWYxudCDUdmmxbD2yr_dSM3RQs9jMgaET0VxpzwM3Fz5FJSvHxcfPNjxtfo5Vtti-gcXcw7eJoQgw1sljBc8DyYYill_xNWJYVBP9bUjNVo-BzDAxaGq9eSzT4euOO6G078mz7-buAcq6b6j_orvnof0Sp-LRavjOGjpRH9_i_2CG2w2o4heygWV9B45RLt0txAiZijhjiP2HIk9RF8M8O45T311k__FC3tTLM2ZzgToKBre9hJ9EHmD3Ajo4TJh2vbAmIoN3PL_m-j_a2TlLXYnQxt0MXxj_Gm6mMmsvVycc5VuY40JyRnQD_xBnIlOVjR79nwmdtd8-imUXUdmFnEfTNyemJkTVUKH6ab_Yen3nPTzkiIt4FKHfi5FWsKO419lDpvgc4By8Zi7MWKfTU3WoM0dacItYZ-dzP86fDtHaQU785x_o18UUI4p0faGIjCEsiyRB-RwTEQyM-dJtYyj5EzSH0Iu-7a2Y_SSwZkHcGiO1mEUgFvPhMk7W36bPTbD6Ez0tc9GAz_o0Iuc1tmMMlF0ERH-Ahg6uXschO4qZszknArLFFbn0WybMSqN2-iJUkKSRxsa9cQFeFiVVXtIeLEn1DbwkOVGf6kTu3XVi2Z0Up0orjselavKvMsGCp_Fug21o7p7-dGw7kd0kUVG0yQHyHQ7wuWjRxS8MunHG2tJvt0wApJ1D7emTKsJVkaDmNwaAyP200lf4jFkzOciq4BO7prAtc8tQReeEtVbKmy7HuP0g3-87z3hyr4Jf1KURjNeRNQVWHe0C9geX6kRQbPMact1SBurakdDx5ebLSSWQoY-cZJ-WmL1cw

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://tpc.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 17 Apr 2025 15:26:50 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET
H2 200 createjs.min.js Show response
cdn.flashtalking.com/frameworks/js/createjs/1.0.0/ Frame 9710 236 KB
63 KB 5ms
4ms Script
text/javascript 18.173.132.26
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.flashtalking.com/frameworks/js/createjs/1.0.0/createjs.min.js
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/194232/4753811/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.26 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-26.jfk52.r.cloudfront.net
Software: Flashtalking (AKA) /
Resource Hash: e439bebf8de2df0582273906d2c1dceff2387c661efb2152ef1c28420ce4e7e5

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://cdn.flashtalking.com/194232/4753811/index.html

Response headers

cache-control: max-age=86400
content-encoding: gzip
etag: W/"c71464532c0fc2020d8e8667ecfd9a3f"
via: 1.1 prod-web-edge4.dub11.ftdns.net (Varnish/trunk), 1.1 65302a67852221313e65b936cd8d6b68.cloudfront.net (CloudFront)
x-varnish: 808326410 801289519
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 63757
x-amz-cf-id: Q2rVs9jZDyWHiJViAvJb0NgMzSmTaM1MmM4huioEH6zwOaEsMXUIBw==
date: Wed, 16 Apr 2025 21:01:37 GMT
content-type: text/javascript
last-modified: Wed, 11 Apr 2018 19:26:47 GMT
server: Flashtalking (AKA)
x-amz-cf-pop: JFK52-P2
vary: Origin

GET
H2 200 gsap.min.js Show response
cdn.flashtalking.com/frameworks/js/gsap/3.11.5/ Frame 9710 70 KB
28 KB 9ms
8ms Script
application/x-javascript 18.173.132.26
AMAZON-02

General

Check archive.org

Download Go to

Full URL: https://cdn.flashtalking.com/frameworks/js/gsap/3.11.5/gsap.min.js
Requested by: Host: cdn.flashtalking.com
URL: https://cdn.flashtalking.com/194232/4753811/index.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.26 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-26.jfk52.r.cloudfront.net
Software: Flashtalking (AKA) /
Resource Hash: e5118140a15e5dbb471f19c06816bcfa44170878bd8fe0ade80c24b7a988d8ba

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://cdn.flashtalking.com/194232/4753811/index.html

Response headers

content-encoding: gzip
etag: W/"e6d272f90fcdce13431fb1eb1b5cffc4"
x-varnish: 803906389 790613465
x-cache: Hit from cloudfront
x-amz-cf-id: DKAlt8UEAuDhdSDQfse2n-so6ZzIwL38jJGnrtTjbEyzAvAVOxB4Ng==
date: Thu, 17 Apr 2025 08:38:56 GMT
content-type: application/x-javascript
last-modified: Wed, 17 May 2023 13:43:22 GMT
vary: Origin
cache-control: max-age=86400
via: 1.1 prod-web-edge6.ash11.ftdns.net (Varnish/trunk), 1.1 65302a67852221313e65b936cd8d6b68.cloudfront.net (CloudFront)
accept-ranges: bytes
x-amz-meta-origin-date-iso8601: 2023-05-17T13:30:36.633Z
content-length: 27787
x-amz-cf-pop: JFK52-P2
server: Flashtalking (AKA)

POST
H2 200 lgc Show response
d9.flashtalking.com/ Frame 1D35 103 B
571 B 31ms
26ms XHR
application/json 3.210.88.34
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://d9.flashtalking.com/lgc
Requested by: Host: d9.flashtalking.com
URL: https://d9.flashtalking.com/d9core
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.210.88.34 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-210-88-34.compute-1.amazonaws.com
Software: Apache/2.4.59 (Amazon Linux) OpenSSL/3.0.8 /
Resource Hash: db1117f0fdd5373304082a82f479dfeddfd5f87d0c3598f3fa7f589612da8cc3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET,POST,SERVER
access-control-allow-origin: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
content-length: 103
p3p: policyref="localhost/w3c/D9_p3p_.xml", CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
date: Thu, 17 Apr 2025 15:26:50 GMT
content-type: application/json;charset=UTF-8
server: Apache/2.4.59 (Amazon Linux) OpenSSL/3.0.8

POST
H/1.1 200
OK cors Show response
data.ad-score.com/data/ Frame 1D35 154 B
750 B 147ms
42ms Fetch
text/plain 130.211.115.4
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://data.ad-score.com/data/cors?pm_st=jDUaiDEkmvXLiDNAPVGbzKsjxeqgxQLR-FE7fPshldVTrKD8d3XLPEk3APg==-E03FOMVja1XmMQ==&pm_ct=f4af5d1e334d119410578d30&pm_pl=1744903610451&pm_td=96&pid=1000925&en=1.1&callback=__pm_glbl_flJfdJn0KbjeaUMf2ewGFOsy._gc1&tt=g&v=3406626
Requested by: Host: js.ad-score.com
URL: https://js.ad-score.com/score.min.js?pid=1000925&tt=g
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 130.211.115.4 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 4.115.211.130.bc.googleusercontent.com
Software: /
Resource Hash: 7c680c5a1acf6974b490e893f5c752a1183859a2661bf12c41e332e1c3b42109

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

Cache-Control: post-check=0, pre-check=0, false, proxy-revalidate, no-cache, no-cache=Set-Cookie, no-store, must-revalidate, max-age=0, s-maxage=0
Pragma: no-cache
Age: 0
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: POST
Access-Control-Allow-Origin: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
P3p: CP="CURa ADMa DEVa TAIi PSAi PSDi IVAi IVDi CONi HISa TELi OUR IND DSP CAO COR"
Content-Length: 154
Date: Thu, 17 Apr 2025 15:26:50 GMT
Content-Type: text/plain; charset=utf-8

GET 3e6a72db-fb6c-4d17-b585-91cc45364890
https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/ Frame 1D35 0
0

GET
DATA 200
OK truncated
/ Frame 57B9 266 B
0 Image
image/svg+xml

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 662294921ca6240beb0f2aecb7f7ac23dd085b782bbe52a369b20226d26afe33

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 1D35 68 B
0 Image
image/png

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5e89733d8a8e055100cda68bf7a712ab0e1b24fefee7e39792b47cb5ff7c3cb1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/png

GET
H/1.1 200
OK /
servedby.flashtalking.com/state/8243818;4753811;0;401;31FFADB5-05B1-27FE-DAE4-6C628FA3D2F4/ Frame 1D35 42 B
387 B 33ms
32ms Image
image/gif 23.200.197.55
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL

https://servedby.flashtalking.com/state/8243818;4753811;0;401;31FFADB5-05B1-27FE-DAE4-6C628FA3D2F4/?ft_data=d9:fd368f3529b147618dc48195dc67c56d;d9s:fd368f3529b147618dc48195dc67c56d&cachebuster=88079908

Requested by

Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.200.197.55 Piscataway, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-200-197-55.deploy.static.akamaitechnologies.com

Software

prod-xre-app53.ash11 /

Resource Hash

47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

Strict-Transport-Security: max-age=86400
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Connection: keep-alive
Expires: Thu, 17 Apr 2025 15:26:51 GMT
Content-Length: 42
Allow-Fenced-Frame-Automatic-Beacons: true
Date: Thu, 17 Apr 2025 15:26:51 GMT
Content-Type: image/gif
Server: prod-xre-app53.ash11

GET 5dd4c944-9926-4142-bee7-39878307420c
https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/ Frame 1D35 0
0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 1D35 42 B
65 B 74ms
73ms Fetch
image/gif 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstebIZ9gMe3pReZXcxsXxJJN7WVKjDMe76RU6Kp-y-ST-w1WMqBPzv6cwrxjsBXMKGAxbSq6JiuN9l-w0pZ4h-QgF4Bjjz-6I8OmPgIorkmdgkYgSVRqPjRJCD8ffpqYHAzOV5Hke9QUj92FbUmk9LKbtC0Ex6UeiknQr1BBnhFsOyjxdjPz3ibO80hf49qin3yLLECHg&sai=AMfl-YT9C8v_eImucK616dMvrCSuWnlL7TCQIpuES6VmjclAAWz0fWmiYmMUuMjG56PuF9lFnduUzarNEh2tlnxNH5b4p77eaJ7pwvuz_T1nDkx2B0561vEcXB5yOgk&sig=Cg0ArKJSzOPvoESZUdL_EAE&cid=CAQSOwDZpuyzAqenojOHhAk7R6e-qOxAER5h6-s9ghrmpo5pcSyxNFWRYhUZOgPKNN4xvaAEdx5CjBLTU2NSGAE&id=lidar2&mcvt=1288&p=105,426,195,1154&tm=1319.2000007629395&tu=31.200000762939453&mtos=1288,1288,1288,1288,1288&tos=1288,0,0,0,0&v=20250416&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=422879149&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=4083640900&rst=1744903609531&rpt=411&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 42
date: Thu, 17 Apr 2025 15:26:51 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1D35 0
20 B 69ms
68ms Ping
image/gif 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=9886181384975&version=m202504010101&ct=77&x=1&cor=1114102379014399500

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
timing-allow-origin: *
pragma: no-cache
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
expires: Fri, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 0
date: Thu, 17 Apr 2025 15:26:51 GMT
x-xss-protection: 0
content-type: image/gif
server: cafe

GET c2e87b32-0c60-4799-813b-a83b3de025a7
https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/ Frame 1D35 0
0

GET
H/1.1 200
OK consumer-privacy-logo.png
secure.flashtalking.com/oba/icon/ Frame 1D35 6 KB
6 KB 125ms
21ms Image
image/png 23.200.196.50
AKAMAI-AS

General

Check archive.org

Download Go to Show image

Full URL: https://secure.flashtalking.com/oba/icon/consumer-privacy-logo.png
Requested by: Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.200.196.50 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-200-196-50.deploy.static.akamaitechnologies.com
Software: Flashtalking (AKA) /
Resource Hash: 49b19f7f2d3d0fc9d2270cd1ebd79d468ca86cf308f33b063595863e3f392e98

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

Cache-Control: max-age=1200
ETag: W/"d675694ab4d4d2eb56cca854c25d9c36"
Connection: keep-alive
Expires: Thu, 17 Apr 2025 15:46:51 GMT
X-Varnish: 503659720 503746315
Accept-Ranges: bytes
Content-Length: 5953
Date: Thu, 17 Apr 2025 15:26:51 GMT
Content-Type: image/png
Last-Modified: Thu, 11 Feb 2021 15:39:51 GMT
Server: Flashtalking (AKA)

POST
H/1.1 200
OK cors Show response
data.ad-score.com/data/ Frame 1D35 1 B
320 B 74ms
69ms Fetch
text/plain 130.211.115.4
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://data.ad-score.com/data/cors?pm_st=jDUaiDEkmvXLiDNAPVGbzKsjxeqgxQLR-FE7fPshldVTrKD8d3XLPEk3APg==-E03FOMVja1XmMQ==&pm_ct=f4af5d1e334d119410578d30&pm_pl=1744903610451&pm_td=955&pid=1000925&en=1.1&callback=__pm_glbl_flJfdJn0KbjeaUMf2ewGFOsy._gc2&tt=g&v=3406626
Requested by: Host: js.ad-score.com
URL: https://js.ad-score.com/score.min.js?pid=1000925&tt=g
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 130.211.115.4 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 4.115.211.130.bc.googleusercontent.com
Software: /
Resource Hash: 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

Access-Control-Allow-Origin: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
Content-Length: 1
Date: Thu, 17 Apr 2025 15:26:51 GMT
Content-Type: text/plain; charset=utf-8
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: POST

GET
H2 200 index_atlas_1.png
cdn.flashtalking.com/194232/4753811/images/ Frame 9710 41 KB
42 KB 11ms
11ms Image
image/png 18.173.132.26
AMAZON-02

General

Check archive.org

Download Go to Show image

Full URL: https://cdn.flashtalking.com/194232/4753811/images/index_atlas_1.png?1717537437186
Requested by: Host: kr.buddysecret.com
URL: https://kr.buddysecret.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.132.26 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-132-26.jfk52.r.cloudfront.net
Software: Flashtalking (AKA) /
Resource Hash: 3b090cf75f29091c1f0271d726f48f05386e46666021625d12acdf63a5aa9d43

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://cdn.flashtalking.com/194232/4753811/index.html

Response headers

cache-control: max-age=1200
content-encoding: gzip
etag: W/"898d8bebc865554098d2bf7f057a2eae"
via: 1.1 prod-web-edge6.ash11.ftdns.net (Varnish/trunk), 1.1 65302a67852221313e65b936cd8d6b68.cloudfront.net (CloudFront)
x-varnish: 803848257 804101071
accept-ranges: bytes
x-cache: Hit from cloudfront
content-length: 42276
x-amz-cf-id: MIv7XhhCksgjjzUci1e0_4IGZTQBJThsjHJR76jZnEpqbjSV7npEEg==
date: Thu, 17 Apr 2025 15:22:42 GMT
content-type: image/png
last-modified: Tue, 18 Jun 2024 17:57:38 GMT
server: Flashtalking (AKA)
x-amz-cf-pop: JFK52-P2
vary: Origin

GET
H3 200 sodar Show response
ep1.adtrafficquality.google/getconfig/ 17 KB
13 KB 62ms
37ms XHR
application/json 2607:f8b0:4006:80c::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep1.adtrafficquality.google/getconfig/sodar?sv=200&tid=gda&tv=r20250410&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202504140101/show_ads_impl_fy2021.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:80c::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

edab41abdcaa963e405b4acfd986c0485c1ba0089e78043838deb4b7d42aa117

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

timing-allow-origin: *
content-encoding: br
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length: 13194
date: Thu, 17 Apr 2025 15:26:51 GMT
x-xss-protection: 0
content-type: application/json; charset=UTF-8
content-disposition: attachment; filename="f.txt"
server: cafe

GET
H3 200 BuddySecret_Favicon_new.png
kr.buddysecret.com/public/images/ 2 KB
3 KB 531ms
530ms Other
image/png 2606:4700:3030::6815:1001
CLOUDFLARENET

General

Check archive.org

Download Go to

Full URL

https://kr.buddysecret.com/public/images/BuddySecret_Favicon_new.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::6815:1001 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

164ca7a24ab94bfe887fb66299da549e20864b507b76d0f175a756e4f525db00

Security Headers

Name	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

cf-cache-status: REVALIDATED
etag: "b6a90-760-5c857574e1c00"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nEIKbaTF2iIUYw8BkJI0hWqAw7gmgVjwTm9xL5FEefPkNaqNbcelTC%2FfiYGnEcQpqZhAk%2BpAYai0JNXjlx%2BUApouRZOWslo7eHlGxLBdly8Iwrl4SMZnjSORYrgiQego%2F8YylTXcPGHfDL%2FCQoKNcCM%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=QUIC&rtt=8796&min_rtt=7875&rtt_var=2295&sent=11&recv=11&lost=0&retrans=0&sent_bytes=3695&recv_bytes=3293&delivery_rate=799&cwnd=12000&unsent_bytes=0&cid=38b3257c39a7dd08&ts=6837&x=16"
date: Thu, 17 Apr 2025 15:26:52 GMT
content-type: image/png
vary: Accept-Encoding
last-modified: Fri, 30 Jul 2021 13:38:56 GMT
x-frame-options: ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 931cf1744ee84239-EWR
server-host: as-hi-152-web
accept-ranges: bytes
content-length: 1888
server: cloudflare

POST
H/1.1 200
OK cors Show response
data.ad-score.com/data/ Frame 1D35 1 B
320 B 41ms
38ms Fetch
text/plain 130.211.115.4
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://data.ad-score.com/data/cors?pm_st=jDUaiDEkmvXLiDNAPVGbzKsjxeqgxQLR-FE7fPshldVTrKD8d3XLPEk3APg==-E03FOMVja1XmMQ==&pm_ct=f4af5d1e334d119410578d30&pm_pl=1744903610451&pm_td=1169&pid=1000925&en=1.1&callback=__pm_glbl_flJfdJn0KbjeaUMf2ewGFOsy._gc3&tt=g&v=3406626
Requested by: Host: js.ad-score.com
URL: https://js.ad-score.com/score.min.js?pid=1000925&tt=g
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 130.211.115.4 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 4.115.211.130.bc.googleusercontent.com
Software: /
Resource Hash: 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

Access-Control-Allow-Origin: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
Content-Length: 1
Date: Thu, 17 Apr 2025 15:26:51 GMT
Content-Type: text/plain; charset=utf-8
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: POST

GET
DATA 200
OK truncated
/ Frame 1D35 35 B
0 Image
image/gif

General

Check archive.org

Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/gif

GET
H2 200 sodar2.js Show response
ep2.adtrafficquality.google/sodar/ 18 KB
7 KB 102ms
58ms Script
text/javascript 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202504140101/show_ads_impl_fy2021.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff3de130872fe0fb5b770dfa2bc9f0daf8ab320403a34a60d089436f08d24f99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

content-encoding: gzip
etag: "1727224258380615"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options: nosniff
expires: Thu, 17 Apr 2025 15:26:51 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 15:26:51 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: private, max-age=3000
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 6445
x-xss-protection: 0
server: sffe

POST
H/1.1 200
OK cors Show response
data.ad-score.com/data/ Frame 1D35 1 B
320 B 41ms
39ms Fetch
text/plain 130.211.115.4
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://data.ad-score.com/data/cors?pm_st=jDUaiDEkmvXLiDNAPVGbzKsjxeqgxQLR-FE7fPshldVTrKD8d3XLPEk3APg==-E03FOMVja1XmMQ==&pm_ct=f4af5d1e334d119410578d30&pm_pl=1744903610451&pm_td=1259&pid=1000925&en=1.1&callback=__pm_glbl_flJfdJn0KbjeaUMf2ewGFOsy._gc4&tt=g&v=3406626
Requested by: Host: js.ad-score.com
URL: https://js.ad-score.com/score.min.js?pid=1000925&tt=g
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 130.211.115.4 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 4.115.211.130.bc.googleusercontent.com
Software: /
Resource Hash: 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

Access-Control-Allow-Origin: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
Content-Length: 1
Date: Thu, 17 Apr 2025 15:26:51 GMT
Content-Type: text/plain; charset=utf-8
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: POST

GET
H2 200 runner.html Show response
ep2.adtrafficquality.google/sodar/sodar2/232/ Frame 0F2B 13 KB
5 KB 56ms
17ms Document
text/html 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:817::2001 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9dec95894af322b087ab6e87f9c8ce66d849646cf33b375d33c957f4569ed081

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://kr.buddysecret.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

accept-ranges: bytes
age: 1929
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3000
content-encoding: gzip
content-length: 5005
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 17 Apr 2025 14:54:42 GMT
expires: Thu, 17 Apr 2025 15:44:42 GMT
last-modified: Mon, 23 Sep 2024 18:12:21 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 03B3 829 B
566 B 46ms
46ms Document
text/html 2607:f8b0:4006:817::2004
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:817::2004 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

43c531a63af95a93af61eb653053e8eec420c24a49f5c6ba3b6cc2a2e0cf84c7

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-olAiT1jMBtzV-lp-ephMpg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://kr.buddysecret.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-olAiT1jMBtzV-lp-ephMpg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy-report-only: same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy: cross-origin
date: Thu, 17 Apr 2025 15:26:51 GMT
expires: Thu, 17 Apr 2025 15:26:51 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server: ESF
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 48ms
11ms Preflight
application/json 2620:100:a00b::12
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fkr.buddysecret.com%2F&domain=kr.buddysecret.com&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a00b::12 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://kr.buddysecret.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://kr.buddysecret.com
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 17 Apr 2025 15:26:50 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 205756
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fkr.buddysecret.com%2F&domain=kr.buddysecret.com&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=rdqsVnx2c3RKU080T3FCU3cra0lRc0VLUERqUnZnc21wR0JEaEY0cW5zU29wd3FQa2FsN2F0a2lnUGRWalhvR2lPRlBHR3dZQWJZYUZRY3JnRGlxZW4wb25WRytvMDNEN1B2RmZvZVpub2hIWjdYem1jMmFkTTFTN0VkZF...

348 B
942 B

51ms
20ms

Fetch
application/json

74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

https://mug.criteo.com/sid?cpp=rdqsVnx2c3RKU080T3FCU3cra0lRc0VLUERqUnZnc21wR0JEaEY0cW5zU29wd3FQa2FsN2F0a2lnUGRWalhvR2lPRlBHR3dZQWJZYUZRY3JnRGlxZW4wb25WRytvMDNEN1B2RmZvZVpub2hIWjdYem1jMmFkTTFTN0VkZFU2QmtSVEtVVElIZFdNbmhVd3FHQ2F0Z2VFd21QMHhNZnZGaVVjNWkwTFdPU1VCcXRDRWJUMjdFQ3RQR1IxaUY4TlVkc0dOUGFiQUhVZUdhblVzTTYwUDZCQ1FsQWhXQkN5NTVLVWVscW1JRndQM2pKNGNvdndHMi84U0lRRHlSSjYwL1FLcHJWRGdkN1VFNVlsQXVnSVVFa3NpQnFZUT09fA&cppv=2

Protocol

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

ca514553ce409ebb53bc624042b223f58dfa9abb71ebc1f1d7b356d64ed4cb14

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 826505
expires: 0
access-control-allow-origin: null
date: Thu, 17 Apr 2025 15:26:51 GMT
content-type: application/json; charset=utf-8
vary: Accept-Encoding
server: Kestrel

Redirect headers

strict-transport-security: max-age=31536000; preload;
cache-control: no-cache, no-store, must-revalidate
location: https://mug.criteo.com/sid?cpp=rdqsVnx2c3RKU080T3FCU3cra0lRc0VLUERqUnZnc21wR0JEaEY0cW5zU29wd3FQa2FsN2F0a2lnUGRWalhvR2lPRlBHR3dZQWJZYUZRY3JnRGlxZW4wb25WRytvMDNEN1B2RmZvZVpub2hIWjdYem1jMmFkTTFTN0VkZFU2QmtSVEtVVElIZFdNbmhVd3FHQ2F0Z2VFd21QMHhNZnZGaVVjNWkwTFdPU1VCcXRDRWJUMjdFQ3RQR1IxaUY4TlVkc0dOUGFiQUhVZUdhblVzTTYwUDZCQ1FsQWhXQkN5NTVLVWVscW1JRndQM2pKNGNvdndHMi84U0lRRHlSSjYwL1FLcHJWRGdkN1VFNVlsQXVnSVVFa3NpQnFZUT09fA&cppv=2
pragma: no-cache
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 242867
expires: 0
access-control-allow-origin: https://kr.buddysecret.com
content-length: 0
date: Thu, 17 Apr 2025 15:26:51 GMT
server: Kestrel

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 194 B
667 B 323ms
103ms Fetch
application/json 162.19.138.116
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: datacygnal.io
URL: https://datacygnal.io/ots-126-1758947244.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.116 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31533567.ip-162-19-138.eu

Software

Resource Hash

638f6c32140bec47fbade480a5417f878feff8366e1c4a5305d03c55fb90611d

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://kr.buddysecret.com/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://kr.buddysecret.com
p3p: CP="CAO PSA OUR"
date: Thu, 17 Apr 2025 15:26:51 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
access-control-allow-credentials: true

GET
H2 200 id Show response
id.crwdcntrl.net/ 75 B
784 B 86ms
20ms Fetch
application/json 3.224.67.107
AMAZON-AES

General

Check archive.org

Download Go to

Full URL: https://id.crwdcntrl.net/id
Requested by: Host: datacygnal.io
URL: https://datacygnal.io/ots-126-1758947244.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.224.67.107 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-224-67-107.compute-1.amazonaws.com
Software: /
Resource Hash: c7c8816e0d9c509b8debec95cf0404371888ae6de2ae3ac2ba6a293a473de67e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
content-type: text/plain
Referer: https://kr.buddysecret.com/

Response headers

cache-control: no-cache
pragma: no-cache
access-control-allow-credentials: true
expires: 0
access-control-allow-origin: https://kr.buddysecret.com
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length: 75
date: Thu, 17 Apr 2025 15:26:51 GMT
content-type: application/json;charset=utf-8

GET sodar
pagead2.googlesyndication.com/pagead/ Frame 03B3 0
0

GET
H3 200 kLp1wZtyR2cl6iKecfHpV0vkPc8de5KeCPhMdHbgSC0.js Show response
pagead2.googlesyndication.com/bg/ Frame 0F2B 54 KB
21 KB 8ms
8ms Script
text/javascript 2607:f8b0:4006:81f::2002
GOOGLE

General

Check archive.org

Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/kLp1wZtyR2cl6iKecfHpV0vkPc8de5KeCPhMdHbgSC0.js

Requested by

Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81f::2002 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

90ba75c19b72476725ea229e71f1e9574be43dcf1d7b929e08f84c7476e0482d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ep2.adtrafficquality.google/

Response headers

content-encoding: br
age: 177272
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
x-content-type-options: nosniff
expires: Wed, 15 Apr 2026 14:12:19 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 15 Apr 2025 14:12:19 GMT
last-modified: Mon, 07 Apr 2025 13:58:00 GMT
content-type: text/javascript
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
accept-ranges: bytes
content-length: 21048
x-xss-protection: 0
server: sffe

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 70ms
12ms Preflight
application/json 74.119.117.17
AS-CRITEO

General

Check archive.org

Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.117.17 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Thu, 17 Apr 2025 15:26:51 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 176179
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 204 generate_204
ep2.adtrafficquality.google/ Frame 0F2B 0
40 B 8ms
7ms Image
text/plain 2607:f8b0:4006:817::2001
GOOGLE

General

Check archive.org

Download Go to Show image

Full URL: https://ep2.adtrafficquality.google/generate_204?_-67eA
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:817::2001 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Thu, 17 Apr 2025 15:26:51 GMT
cross-origin-resource-policy: cross-origin

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 45 B
290 B 308ms
100ms Fetch
application/json 141.95.98.64
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: datacygnal.io
URL: https://datacygnal.io/ots-126-1758947244.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

141.95.98.64 , France, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns3216658.ip-141-95-98.eu

Software

Resource Hash

4ac2e0ba21cfb2f0ca586f6e1033acf71a07c063b99fec4eae0d138d9cd54f2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-origin: https://kr.buddysecret.com
date: Thu, 17 Apr 2025 15:26:52 GMT
content-type: application/json;charset=UTF-8
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 /
ad-events.flashtalking.com/state/8243818;4753811;0;202;31FFADB5-05B1-27FE-DAE4-6C628FA3D2F4/ Frame 1D35 0
66 B 17ms
16ms Image
text/plain 54.172.88.56
AMAZON-AES

General

Check archive.org

Download Go to Show image

Full URL: https://ad-events.flashtalking.com/state/8243818;4753811;0;202;31FFADB5-05B1-27FE-DAE4-6C628FA3D2F4/?cachebuster=765687592
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.172.88.56 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-172-88-56.compute-1.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

content-length: 0
date: Thu, 17 Apr 2025 15:26:52 GMT
content-type: text/plain; charset=utf-8
server: awselb/2.0

POST
H/1.1 200
OK cors Show response
data.ad-score.com/data/ Frame 1D35 1 B
320 B 38ms
36ms Fetch
text/plain 130.211.115.4
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Download Go to

Full URL: https://data.ad-score.com/data/cors?pm_st=jDUaiDEkmvXLiDNAPVGbzKsjxeqgxQLR-FE7fPshldVTrKD8d3XLPEk3APg==-E03FOMVja1XmMQ==&pm_ct=f4af5d1e334d119410578d30&pm_pl=1744903610451&pm_td=1953&pid=1000925&en=1.1&callback=__pm_glbl_flJfdJn0KbjeaUMf2ewGFOsy._gc5&tt=g&v=3406626
Requested by: Host: js.ad-score.com
URL: https://js.ad-score.com/score.min.js?pid=1000925&tt=g
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 130.211.115.4 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 4.115.211.130.bc.googleusercontent.com
Software: /
Resource Hash: 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain
Referer: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/

Response headers

Access-Control-Allow-Origin: https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
Content-Length: 1
Date: Thu, 17 Apr 2025 15:26:52 GMT
Content-Type: text/plain; charset=utf-8
Connection: keep-alive
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: POST

POST
H2 200 967.json Show response
id5-sync.com/g/v2/ 853 B
1 KB 103ms
101ms Fetch
application/json 162.19.138.116
OVH OVH SAS

General

Check archive.org

Download Go to

Full URL

https://id5-sync.com/g/v2/967.json

Requested by

Host: datacygnal.io
URL: https://datacygnal.io/ots-126-1758947244.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.116 Frankfurt am Main, Germany, ASN16276 (OVH OVH SAS, FR),

Reverse DNS

ns31533567.ip-162-19-138.eu

Software

Resource Hash

411a31a958a0ba5224cc2ecb8b46d18df15c155e64e47f58dd55fd4bc619caf6

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://kr.buddysecret.com/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
expires: Thu, 01 Jan 1970 00:00:00 GMT
access-control-allow-origin: https://kr.buddysecret.com
p3p: CP="CAO PSA OUR"
date: Thu, 17 Apr 2025 15:26:52 GMT
content-type: application/json
vary: Origin

GET sodar
ep1.adtrafficquality.google/pagead/ 0
0

POST
H3 204 collect
analytics.google.com/g/ 0
0 21ms
21ms Fetch
text/plain 2001:4860:4802:34::181
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-21EKGFLRB3&gtm=45je54f1v882275148za200&_p=1744903607511&gcd=13l3l3l3l1l1&npa=0&dma=0&tcfd=10000&tag_exp=102509682~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103130498~103130500&cid=1243215478.1744903608&ul=en-us&sr=1600x1200&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_eu=EEAIAAI&_s=2&sid=1744903608&sct=1&seg=0&dl=https%3A%2F%2Fkr.buddysecret.com%2F&dt=BuddySecret%20%7C%20%EC%B9%9C%EA%B5%AC%EB%93%A4%EC%9D%84%20%EB%8B%B9%EC%8B%A0%EC%9D%98%20%EB%B9%84%EB%B0%80%20%EC%9D%BC%EA%B8%B0%EC%97%90%20%EC%B0%B8%EC%97%AC%EC%8B%9C%EC%BC%9C%20%EB%B3%B4%EC%84%B8%EC%9A%94.&en=scroll&epn.percent_scrolled=90&_et=109&tfd=8207
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-21EKGFLRB3&l=dataLayer&cx=c&gtm=457e54f1za200&tag_exp=102509682~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:34::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:153:0
report-to: {"group":"ascnsrsggc:153:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:153:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://kr.buddysecret.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:153:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 15:26:53 GMT
content-type: text/plain
server: Golfe2

POST
H3 204 collect
analytics.google.com/g/ 0
0 19ms
19ms Fetch
text/plain 2001:4860:4802:34::181
GOOGLE

General

Check archive.org

Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-9QKBNZJYL1&gtm=45je54f1h1v899789978za200zb843104604&_p=1744903607511&gcd=13l3l3l3l1l1&npa=0&dma=0&tcfd=10000&tag_exp=102509683~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103116025~103130498~103130500&cid=1243215478.1744903608&ecid=1138323896&ul=en-us&sr=1600x1200&are=1&frm=0&pscdl=noapi&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pae=1&_eu=AAgAAAI&_s=2&sid=1744903608&sct=1&seg=0&dl=https%3A%2F%2Fkr.buddysecret.com%2F&dt=BuddySecret%20%7C%20%EC%B9%9C%EA%B5%AC%EB%93%A4%EC%9D%84%20%EB%8B%B9%EC%8B%A0%EC%9D%98%20%EB%B9%84%EB%B0%80%20%EC%9D%BC%EA%B8%B0%EC%97%90%20%EC%B0%B8%EC%97%AC%EC%8B%9C%EC%BC%9C%20%EB%B3%B4%EC%84%B8%EC%9A%94.&en=page_location&_et=58&tfd=8520
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-9QKBNZJYL1&l=dataLayer&cx=c&gtm=45He54f1h1v843104604za200&tag_exp=102509683~102803279~102813109~102887800~102926062~103027016~103051953~103055465~103077950~103106314~103106316~103116026
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:34::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Referer: https://kr.buddysecret.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:153:0
report-to: {"group":"ascnsrsggc:153:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:153:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://kr.buddysecret.com
cross-origin-opener-policy-report-only: same-origin; report-to=ascnsrsggc:153:0
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 17 Apr 2025 15:26:53 GMT
content-type: text/plain
server: Golfe2

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.google.com
URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTyMAJP-n093rvNqEKDpQ1pcyhSHoEbwXbjqcyYN-XqWD7mEsNFOpuOBEh67ZNZrAN9JMy5s4Rd4L3dCeni34FejNS9Cg

Domain: www.google.com
URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQ_eBRkwgFnjVKHNFIomaNnWpNooWQPz-xfCvr-amUVLfwsQp9LOu8yiBOnncc7Gv9qFydVPUuve0HPYvT9wAGQQJoF1w

Domain: df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
URL: blob:https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/3e6a72db-fb6c-4d17-b585-91cc45364890

Domain: df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
URL: blob:https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/5dd4c944-9926-4142-bee7-39878307420c

Domain: df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
URL: blob:https://df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com/c2e87b32-0c60-4799-813b-a83b3de025a7

Domain: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=232&li=gda_r20250410&jk=760403915646792&rc=

Domain: ep1.adtrafficquality.google
URL: https://ep1.adtrafficquality.google/pagead/sodar?id=sodar2&v=232&t=2&li=gda_r20250410&jk=760403915646792&bg=!cnGlcT7NAAZDHFaHYxw7ADQBe5WfOJPiFzRoVrA4KqUXVaDMJBifDTkwTmnAzfgo-YGQXSzHS32LZ79ehRpTBSLCApdCAgAAAHNSAAAABWgBB34ANrb8eM8ZOA6o_ZkF4AH7ERLVtgW8Iv4AFFLRu57XTShVS38iaIcgybKBCGSszuzFnBarRfPTxwoA19ql7es_wgsRKsiBoq288xy635oaqfboN4zc389dV5DNQ5HOGstDbvAGqMmOIAG0N0eSBOGHPuKPWqtjbma9t7eD-QP351mAKL1OIKyU3u0ZzkTO85oR75_7SCQ9m0w3Gz9NIEBONwIVrwgpx4_AlS0xx0ziDBDzrYZyls6FwQgYMF5PtHCpp6kaVCQvgoOvcBJ0435_RHlpsJhnbncaiz6iVUQ1Z_5d-J1yEQUjquhevkfjULDpyV936R31mmKXV5GSNSKtj2EX3bnGH2W6kbYFxuWx2HYvmQJSklAP4I9bQZt2qUxNFSxhjORJcFk6teVHXRJs7rKpDmdqvaZaiPfy1M2dGZKHu97_NHOJLVp3P574kAgLfOZBdh_9W6Tqe2QdFg-GduN-JAwFEgiUiYhTyXQkxgMLOOM5Q3fIpYqyBTCnGJsQ4MfvYZpV_8vwyeyaaNHixNmR2Oc41bCfRosb17IPkUNzsvjyWC66a0f2CKU1GeXFXR9UQQBZL00lgYrb8JjcoU6tWb_WZGyo6_86FDAX9XMfM7KoXLnmGdCsgSislSRjeUBf3czxXRO45uKEogjPPhQ0rUCIAYmob9kJ9UADdtSafCxoTK055CS2DcEEIAnI1uqYq7Tm9338uqpR8JLY-J10A1cpGLv9Uq96G-8-QvowGWFQbCCKGFunR6CfqoKpiiUUGz8m937fv9MB7Y2oJrsZi2KLYx7gmgFIHKgAkVQpNytlkAcD63wyQgbzrrLx8-pVUjuIiljbl33HzkOjU_J8zQbGkgGNFhTqE7jvP6Y8Xcua8mmKnT7ukzwwcfCu-MUhV82-Bxod-bK-fuM-cfKXm1MlmboUI7WtGadzYs3n2w9wmPlxn3XIu8s-QBR3YXWMawnSQIKZ0oQgWLyaCLaznMPYnt52ZJW2KHktalR3PbYlgOanyiyZZmqBg5AqJoLV7HxgyIYRw05yvExJ5YjXTvVhG_L3tWHm4s-mq9PnafCdD7tU9HsHjpUnav_6qJb2WRyIkkNNHgQFqSDbhyvaaxtUU15t-FjLwQzOQVNk0ixm3he0DS1BBeqhhF-RqUoWln2E

Verdicts & Comments Add Verdict or Comment

167 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

71 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.buddysecret.com/	1970-01-21 04:43:10	Name: _sharedid Value: 4dbe9c3d-e1b9-48d1-aa16-adee33e4a6ec
.buddysecret.com/	1970-01-21 04:43:10	Name: _sharedid_cst Value: zix7LPQsHA%3D%3D
.prebid.a-mo.net/	1970-01-21 13:27:19	Name: __amc Value: 1_1744903607_1744903607
.a-mo.net/	1970-01-21 13:27:19	Name: amuid2 Value: 92530333-6254-46cf-b4ac-a7e5ccb66ff5
.a-mo.net/	1970-01-21 13:27:19	Name: pamuid2 Value: 92530333-6254-46cf-b4ac-a7e5ccb66ff5
.prebid.a-mo.net/	1970-01-21 13:27:19	Name: psd_amuid2 Value: 92530333-6254-46cf-b4ac-a7e5ccb66ff5
.prebid.a-mo.net/	1970-01-21 13:27:19	Name: sd_amuid2 Value: 92530333-6254-46cf-b4ac-a7e5ccb66ff5
.openx.net/	1970-01-21 13:27:19	Name: receive-cookie-deprecation Value: 1
.adnxs.com/	1970-01-21 06:51:19	Name: XANDR_PANID Value: k572KbtnH9saVyaaVlgQcKW-oDWNsMaW5_pqa6Y-A7IOPHCA2KBkYty9igne4I2hnfgch1qhRmduNBL7_XaPlBFYnHMS73XgyN7zkLaFwzI.
.adnxs.com/	1970-01-21 06:51:19	Name: icu Value: ChgI9MVrEAoYASABKAEwt7uEwAY4AUABSAEQt7uEwAYYAA..
.adnxs.com/	1970-01-21 06:51:19	Name: receive-cookie-deprecation Value: 1
.adnxs.com/	1970-01-21 06:51:19	Name: uuid2 Value: 797361846402895092
.kr.buddysecret.com/	1970-01-21 14:03:19	Name: IABGPP_HDR_GppString Value: DBABLA~BAAAAAAAAACA.QA
.buddysecret.com/	1970-01-21 06:51:19	Name: _gcl_au Value: 1.1.905920845.1744903608
.buddysecret.com/	1970-01-21 14:17:43	Name: _ga_21EKGFLRB3 Value: GS1.1.1744903608.1.0.1744903608.60.0.0
.buddysecret.com/	1970-01-21 04:43:10	Name: _gid Value: GA1.2.1489070139.1744903608
.buddysecret.com/	1970-01-21 04:41:43	Name: _gat_gtag_UA_126527512_14 Value: 1
.buddysecret.com/	1970-01-21 04:41:43	Name: _gat_gtag_UA_192512597_12 Value: 1
.buddysecret.com/	1970-01-21 06:51:19	Name: _fbp Value: fb.1.1744903608540.250262110880106616
.buddysecret.com/	1970-01-21 14:17:43	Name: _ga_DBTY2304E3 Value: GS1.1.1744903608.1.0.1744903608.0.0.0
.buddysecret.com/	1970-01-21 14:17:43	Name: _ga Value: GA1.1.1243215478.1744903608
.buddysecret.com/	1970-01-21 14:17:43	Name: _ga_9QKBNZJYL1 Value: GS1.1.1744903608.1.0.1744903608.60.0.1138323896
.doubleclick.net/	1970-01-21 14:17:43	Name: IDE Value: AHWqTUmCetX43iE3kCCBcsLkb6SD3DgfbnMG6Zxj8BQ67lIE1SW6Wc4IebXp7904
.buddysecret.com/	1970-01-21 14:03:19	Name: __gads Value: ID=1051657067099282:T=1744903608:RT=1744903608:S=ALNI_MZYOr_KuFhQUYPbLeVfQBbVuYU6_Q
.buddysecret.com/	1970-01-21 14:03:19	Name: __gpi Value: UID=0000109eb569878b:T=1744903608:RT=1744903608:S=ALNI_MYgqj7avAVGxAXTwcFcfn_A4hngAw
.buddysecret.com/	1970-01-21 09:00:55	Name: __eoi Value: ID=f446477f6fcd2beb:T=1744903608:RT=1744903608:S=AA-AfjYQNSsCCugbxSRHGsW81ioe
.casalemedia.com/	1970-01-21 13:27:19	Name: CMID Value: aAEdudHM6qoAAFqKAFRrgAAA
.casalemedia.com/	1970-01-21 06:51:19	Name: CMPS Value: 3808
.casalemedia.com/	1970-01-21 06:51:19	Name: CMPRO Value: 3808
.adnxs.com/	1970-01-21 06:51:19	Name: anj Value: dTM7k!M41.D>6NRF']wIg2In:BAWj!!1yIE`fS1ueD1W-044)d+]UfbW9.jBnt@s0(^K6N.#@unPUnQ2Co5Bg8oP0P(hw9P-HC_#tv8356fO
.doubleclick.net/	1970-01-21 09:00:55	Name: APC Value: AfxxVi5wwCjnwTMjY7RnQQp3OkxphsaGdunSsKGjJIGJujC_Hftw0g
.doubleclick.net/	1970-01-21 09:00:55	Name: receive-cookie-deprecation Value: 1
.adkernel.com/	1970-01-21 05:01:53	Name: ADK_EX_11 Value: 1
.adkernel.com/	1970-01-21 05:24:55	Name: ADKUID Value: A5604340807415637079
.adsrvr.org/	1970-01-21 13:27:19	Name: TDID Value: bf49abcf-ee05-4cae-a7b6-3876fc0ea9ef
sync.srv.stackadapt.com/	1970-01-21 13:27:19	Name: sa-user-id Value: s%3A0-25a744f8-f721-5f4c-5833-b7c07c020435.n3VLlkvMT4bFhhGcwJJ84ljjIxj3Xj4EyRm%2FCR5gApo
.srv.stackadapt.com/	1970-01-21 13:27:19	Name: sa-user-id Value: s%3A0-25a744f8-f721-5f4c-5833-b7c07c020435.n3VLlkvMT4bFhhGcwJJ84ljjIxj3Xj4EyRm%2FCR5gApo
sync.srv.stackadapt.com/	1970-01-21 13:27:19	Name: sa-user-id-v2 Value: s%3AJadE-PchX0xYM7fAfAIENQW16oY.I0gVsW9vUsRw%2FlJy784VzsJ0%2BS%2BhBRQYobq984cW3Og
.srv.stackadapt.com/	1970-01-21 13:27:19	Name: sa-user-id-v2 Value: s%3AJadE-PchX0xYM7fAfAIENQW16oY.I0gVsW9vUsRw%2FlJy784VzsJ0%2BS%2BhBRQYobq984cW3Og
sync.srv.stackadapt.com/	1970-01-21 13:27:19	Name: sa-user-id-v3 Value: s%3AAQAKIEgH5wOz9NO5PStU46rmbXzsJbTOzAYU5i4bqwST5fnMENYBGAQgubuEwAYwAToEV7wH0kIEPnkqQQ.lwZmH5%2Bmh8g8wNvcmRDboQf%2FKbr8wZERbS28k1cOLnY
.srv.stackadapt.com/	1970-01-21 13:27:19	Name: sa-user-id-v3 Value: s%3AAQAKIEgH5wOz9NO5PStU46rmbXzsJbTOzAYU5i4bqwST5fnMENYBGAQgubuEwAYwAToEV7wH0kIEPnkqQQ.lwZmH5%2Bmh8g8wNvcmRDboQf%2FKbr8wZERbS28k1cOLnY
.doubleclick.net/	1970-01-21 04:41:47	Name: DSID Value: NO_DATA
.doubleclick.net/	1970-01-21 05:24:55	Name: ar_debug Value: 1
.bidr.io/	1970-01-21 14:10:17	Name: bito Value: AAEJZ07QAjsAABxp7gLqPg
.bidr.io/	1970-01-21 14:10:17	Name: bitoIsSecure Value: ok
.adsrvr.org/	1970-01-21 13:27:19	Name: TDCPM Value: CAESFQoGZ29vZ2xlEgsI8MKm5snz_j0QBRgFIAEoAjILCJCDhZPg8_49EAU4AQ..
.zemanta.com/	1970-01-21 13:27:19	Name: zuid Value: Mg5V96T9j-0WpkccSGg1
.flashtalking.com/	1970-01-21 14:11:07	Name: flashtalkingad1 Value: "GUID=6316AF57AD7364"
.outbrain.com/	1970-01-21 13:27:19	Name: obuid Value: d90a8f44-6ad9-4b84-a205-808e48dc40b4
.sharethrough.com/	1970-01-21 05:24:55	Name: stx_user_id Value: fb1d9fca-f07a-43b1-9059-f1a14a3934a7
.teads.tv/	1970-01-21 13:25:53	Name: tt_viewer Value: 51962d35-217a-4d8e-b930-10b591316c37
.tremorhub.com/	1970-01-21 13:27:40	Name: tvid Value: 696f1bb62b494d5eaa2c83540f624ffd
.tremorhub.com/	1970-01-21 14:17:43	Name: tv_UIDF Value:
.tremorhub.com/	1970-01-21 04:48:55	Name: tvssa Value: 1744903610152
.creativecdn.com/	1970-01-21 13:27:19	Name: g Value: 6RO3yRVxwzCHzOdEHN1j_1744903610143
.creativecdn.com/	1970-01-21 13:27:19	Name: ts Value: 1744903610
.tribalfusion.com/	1970-01-21 06:51:19	Name: ANON_ID Value: abnoeUxlqLOnJVsVVdNZbWa2abuyGZbysViZbKXm2Eh
.mediago.io/	1970-01-21 13:27:19	Name: __mguid_ Value: 8313d59ad30eefa62o9vud00m9lik2f6
.travelaudience.com/	1970-01-21 14:10:31	Name: _tracker Value: %7B%22UUID%22%3A%224ADBE953-DC2D-4530-2710-9804523B2999%22%7D
.flashtalking.com/	1970-01-21 13:27:19	Name: _D9J Value: 5aee456b63ce4c55b6f2fdfb777bae8e
.c.appier.net/	1970-01-21 13:27:19	Name: _auid Value: cu6ExjpPB3OP3E8Yuh0BaA
.crwdcntrl.net/	1970-01-21 11:10:30	Name: _cc_dc Value: 0
.crwdcntrl.net/	1970-01-21 11:10:30	Name: _cc_id Value: 4f47a67fbb9351169c16378c531dcecd
.crwdcntrl.net/	1970-01-21 11:10:31	Name: _cc_cc Value: "ACZ4nGNQMEkzMU80M09LSrI0NjU0NLNMNjQzNrdINjU2TElOTU5hAIIMRtndDAgAAEpPCiw%3D"
.crwdcntrl.net/	1970-01-21 11:10:31	Name: _cc_aud Value: "ABR4nGNgYGDIYJTdzQAHAA80AUI%3D"
.buddysecret.com/	1970-01-21 04:43:10	Name: panoramaId_expiry Value: 1744990011890
.buddysecret.com/	1970-01-21 11:10:31	Name: _cc_id Value: 4f47a67fbb9351169c16378c531dcecd
.criteo.com/	1970-01-21 14:03:19	Name: cto_bundle Value: m6pt8F81TE9jJTJCOHB2Z0FEZWZvaFF6SFIzS2NoREFSWlRZTld4VkJ6TmhJJTJGU1BqREdZaGlmQ3V1ZVBjMUh2YjQ4d2Q5RkVBVWF5N2tCZ2klMkZSWmJNQTNIc1dMazFKcDY5Q0hHNnl0S29BQ1o3a2ZCc3JjWENGclk1WGd5Y3FxYU52WlJBQw
.buddysecret.com/	1970-01-21 14:02:43	Name: cto_bundle Value: 2Lozrl9vVWR6V3k1aFNVVkdCZjdtaFc4em5lcXZpZGQ2b3EzczRNdVI3NWdxb1VTNTBzSFFINGJyakVaakdOd0pwYWFQRlBSVXlJMnh0OHd5bUt2eHFxczREZEdaTW51R1N0MWozdndHbFF2MlpBTDhSbjJXMGhydlJzTDN6SnY1QUsxJTJC
.buddysecret.com/	1970-01-21 14:02:43	Name: cto_bidid Value: x7bz0l9KTGpEeGM5bnBXTHhoaUM5dkdESkJQaFZnd0VEVlVkb2VTNGxHY01UZSUyRkU0c1NyNk1OYjQyeVVOQmY1RGZFamlERXZQbm52bnQ1MTVRblFsNk9DWjJRJTNEJTNE
.id5-sync.com/	1970-01-21 06:51:19	Name: id5 Value: 24013250-c977-720e-bd52-ccad38ca2c3d#1744903612087#2

8 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html Message: [GroupMarkerNotSet(crbug.com/242999)!:A0E01C00441F0000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.
javascript	info	URL: https://js.ad-score.com/score.min.js?pid=1000925&tt=g(Line 1) Message: WebGPU is experimental on this platform. See https://github.com/gpuweb/gpuweb/wiki/Implementation-Status#implementation-status
rendering	warning	URL: https://js.ad-score.com/score.min.js?pid=1000925&tt=g(Line 1) Message: Failed to create WebGPU Context Provider
javascript	info	URL: https://js.ad-score.com/score.min.js?pid=1000925&tt=g(Line 1) Message: WebGPU is experimental on this platform. See https://github.com/gpuweb/gpuweb/wiki/Implementation-Status#implementation-status
rendering	warning	URL: https://js.ad-score.com/score.min.js?pid=1000925&tt=g(Line 1) Message: Failed to create WebGPU Context Provider
javascript	info	URL: https://js.ad-score.com/score.min.js?pid=1000925&tt=g(Line 1) Message: WebGPU is experimental on this platform. See https://github.com/gpuweb/gpuweb/wiki/Implementation-Status#implementation-status
rendering	warning	URL: https://js.ad-score.com/score.min.js?pid=1000925&tt=g(Line 1) Message: Failed to create WebGPU Context Provider
rendering	warning	URL: https://ep2.adtrafficquality.google/sodar/sodar2/232/runner.html Message: [GroupMarkerNotSet(crbug.com/242999)!:A0E01C00441F0000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader flag to opt in to lower security guarantees for trusted content.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	ALLOW_FROM http://dc2-staging.holagames.io, ALLOW_FROM https://dc2-staging.holagames.io

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.c.appier.net
a.tribalfusion.com
ad-events.flashtalking.com
ad.doubleclick.net
ads.travelaudience.com
agen-assets.ftstatic.com
ajs-assets.ftstatic.com
analytics.google.com
b1sync.outbrain.com
b1sync.zemanta.com
cdn.flashtalking.com
cdnjs.cloudflare.com
cm.g.doubleclick.net
cmp.inmobi.com
connect.facebook.net
creativecdn.com
d9.flashtalking.com
data.ad-score.com
datacygnal.io
df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
dsp.adkernel.com
dsum-sec.casalemedia.com
ep1.adtrafficquality.google
ep2.adtrafficquality.google
fonts.googleapis.com
fonts.gstatic.com
google.partners.tremorhub.com
googleads.g.doubleclick.net
gtrace.mediago.io
gum.criteo.com
ib.adnxs.com
id.crwdcntrl.net
id5-sync.com
img.holaquiz.com
js.ad-score.com
kr.buddysecret.com
lb.eu-1-id5-sync.com
match.adsrvr.org
match.prod.bidr.io
match.sharethrough.com
mug.criteo.com
onetag-sys.com
pagead2.googlesyndication.com
prebid.a-mo.net
prebid.media.net
rtb.openx.net
s.tribalfusion.com
s0.2mdn.net
secure.flashtalking.com
securepubads.g.doubleclick.net
servedby.flashtalking.com
stats.g.doubleclick.net
superal.github.io
sync.srv.stackadapt.com
sync.teads.tv
td.doubleclick.net
tpc.googlesyndication.com
www.facebook.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.gstatic.com
df7cd6cd05e9357c31227eac86e4db25.safeframe.googlesyndication.com
ep1.adtrafficquality.google
pagead2.googlesyndication.com
www.google.com
104.18.26.193
125.253.89.184
13.35.93.97
130.211.115.4
141.95.98.64
142.250.176.198
142.251.35.162
162.19.138.116
172.105.221.29
174.137.133.49
18.173.132.26
18.238.49.67
185.184.8.90
2001:4860:4802:34::181
2001:4860:4802:38::178
23.200.196.50
23.200.197.55
23.205.56.163
2600:1f10:4ce4:4a00:4bbd:8403:8768:c46
2600:9000:261f:dc00:a:deb0:3380:93a1
2600:9000:26fa:0:1b:cadc:ef40:93a1
2606:4700:20::ac43:4937
2606:4700:3030::6815:1001
2606:4700:3108::ac42:28a3
2606:4700:4400::6812:25c1
2606:4700:4400::ac40:963f
2606:4700::6811:180e
2606:50c0:8002::153
2607:f8b0:4004:c1b::9c
2607:f8b0:4006:808::2002
2607:f8b0:4006:808::2006
2607:f8b0:4006:80b::200a
2607:f8b0:4006:80c::2002
2607:f8b0:4006:80e::2003
2607:f8b0:4006:817::2001
2607:f8b0:4006:817::2004
2607:f8b0:4006:81c::2002
2607:f8b0:4006:81f::2001
2607:f8b0:4006:81f::2002
2607:f8b0:4006:821::2008
2607:f8b0:4006:822::2003
2607:f8b0:4006:823::2001
2620:100:a00b::12
2a03:2880:f012:10c:face:b00c:0:3
2a03:2880:f112:182:face:b00c:0:25de
3.210.88.34
3.212.200.160
3.224.67.107
3.33.220.150
34.120.63.153
35.190.0.66
35.208.249.213
35.227.252.103
50.31.142.127
51.222.239.232
52.203.204.178
54.172.88.56
54.224.103.108
68.67.160.75
68.67.181.230
74.119.117.17
00539d1b402fbbc6c6fb35b49a99f3573f58865cab316b25cf4be9ffb5cc4bf7
00af79d58e8976a1ddd7a3476b34d7d88d8da5e0221316d0af6430319760cf91
00dd44415498e7c266af756fdf35c8743e4f6e853d476d01ded93d50404c3711
043a2cafe2792001a17ef392d26032da56e99275f7b99068d5870f98d01bef7b
0b311a51d9647aa7e6642eb1ba3af1372b5aae8af8ee76074b47a9bc2e42576b
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0ba1a463f7811ae10ea114a0bcc044c05c391ec1fcb3dd5a7bd9d9bb3fe2b070
0fd28fece9ebd606b8b071460ebd3fc2ed7bc7a66ef91c8834f11dfacab4a849
164ca7a24ab94bfe887fb66299da549e20864b507b76d0f175a756e4f525db00
1657584221779c9f6943c52bb7fba23376c18be3e021da4168fab39d8bb7863a
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
197b9d70e037e56f81adad4e52bf3c3d6583daff6992553e8cfb7640a09fffb6
1ea50329b826918b0b803777e2f5ac48a3570aa1f9c06bc92b6a1731ae37654a
24e087a247bfe43281ae326b08e953b08bc3985f8f08c5a41acbb6bf95b7d8e3
261a186cd1fc151c1e2b9384debb7d79fbe6c09f9291e9856f6901d16409208e
262235b53289354531ed1c656f88f05a2af65e78b3fc0e1018024e599f47f46b
2a14e84adb8fb9735a8e414b7e168f3e5ff9bad71acb1cef9d597355c6d744fc
2a7e4bf63bc70f8c050d0d52aea5b15dddaaf64fd51036cd996130cbb5f58b14
2b3e41a2654e5211a6f6f7a4e46dc84227dd89f9e3b7d38bccd199171eab8087
2ea6b0765c26c3890b84b72d244500f51bbcdf8ff5b9307fd1742baaf74a1e5a
3049db58f204e8279193524985a52bbad008bfaac0b82caad5f064b54d7494d1
31e988de147264b3ff0990eac51ed08398a7346729cbd42b231876431fbb4020
3225d669e6d0d6fd0aafd6280328d1dad395444532eed8cf5190f0d6c6e8edda
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
3b090cf75f29091c1f0271d726f48f05386e46666021625d12acdf63a5aa9d43
3b6dfeb59f7464899e64068a09afaa80fdae61e9767a041f9bc60aae5362c599
40e0511952974c0f1299e247cfae41824b0c9de8d90cb2e87dee2bf4fc0e4d9d
411a31a958a0ba5224cc2ecb8b46d18df15c155e64e47f58dd55fd4bc619caf6
43324aeea4490ed1ade86f559e71f0708c76416c76d7231645eb4cd1c0915ea4
435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f
43c531a63af95a93af61eb653053e8eec420c24a49f5c6ba3b6cc2a2e0cf84c7
44fa9eae5a99b742fc9ecd104ed5e9b9f9d858590c4732bf860ab2175f30a458
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292
47fe168cff78df21234662a31024f35f3880bc92736637b0ccf1acd94a33a3e8
49b19f7f2d3d0fc9d2270cd1ebd79d468ca86cf308f33b063595863e3f392e98
4ac2e0ba21cfb2f0ca586f6e1033acf71a07c063b99fec4eae0d138d9cd54f2f
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4db2de8828c5ab292d741519e8ef19dcec43a348ef5b3dd4868f483db84af114
57c634fc97a7a5c89a37ec929687ebd2a8f531c6f1c0151bcf75b5949a80d34d
57f6d3807b91f5746bee342a67bb053029f637f59ed6afee9f224ab8ef394757
5856901d3159c27ccab3bdf9786682be92c1b55df22757a402288869445a1d51
5a6db48a22395fda1d956371b9cd94e2c1b66031764fd2a539b1e4e9132c52f6
5b21ad876eb91d28b2042311b9ff660e96a44673ee90da912f2d8bafc10b6054
5c7ee55fa8687f9c8a3ac3866aaeb29531641f15faca744db916ec442f9dd8d7
5c9aa6c380bb79fbc0df353d36d66a912f8c0d21cb30ed1c43a3af430deb173d
5e89733d8a8e055100cda68bf7a712ab0e1b24fefee7e39792b47cb5ff7c3cb1
5f7dbb21095f2f825e3545ff2708fba122c0c5a3d0852356339f234821acdd68
5fc08f524829bf1173c58d89452e7ab47bc10ec5f5397293a7b913340bbcd973
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
60cf08e6b7a432b3f2a36fcfc12e63683a47a57fa9bb4df0a9d000c16261c80c
61848dad75b06e2ccedf7d41c9a180cb8a7217a5e181c10a17e38acd7f487f0f
61ee34d49fdc21d7180385256087b54e7fe5351b20a6a82b10dcfec591dc7123
638f6c32140bec47fbade480a5417f878feff8366e1c4a5305d03c55fb90611d
662294921ca6240beb0f2aecb7f7ac23dd085b782bbe52a369b20226d26afe33
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
737473b145a0fb2d97963ba71104b42ea59d434e17d43de3db67ddffc24200ac
746df02e811af2d3ca508afa3890da5abc3c02216ec678ea534ec758c19344b3
74e226a6bc13e9512d2154b7c93d319b339e930cd09cc77bc210dca36a95e5ae
75e96fccb646b1eef77b4ca7fd38719d2f52841b2307f0b1a8cb1f66df6e90eb
77d21084014dcb10980c296e583371786b3886f5814d8357127f36f8c6045583
78ca0005131ba25ff6cd2b6c2f9c877550411b65ce8d3ea2dfd5853f97ed70ad
7b3ad4e08bc976d5f91a87059303ab382b09b09917a97d8e3c1f64f3f1f38710
7baed263e09ef3cc2cf23b357f390990fbc493f6a2d93893d0f31a875927dbb8
7c680c5a1acf6974b490e893f5c752a1183859a2661bf12c41e332e1c3b42109
7d219cea3316552d5927b5b7528f1192223374dd1b9dd58c48e5de057af6e3f1
87293aa389c2ae3691ad691ca7848a875fb0c35bfe5ec8489f2e016f9dec4339
90ba75c19b72476725ea229e71f1e9574be43dcf1d7b929e08f84c7476e0482d
94f1349f03cfb69bd52b7b5fce44eb3d58c7cf3eb79d8a7e48ad6afc0ed3e183
9a03674bfe83fe09eee7aae6106943918be73a009be21468c2bdb1b4ce958fdc
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9b37d726335bf66cf138264a88bd4faf1652194d417bf69c3115eb36d66d5590
9dec95894af322b087ab6e87f9c8ce66d849646cf33b375d33c957f4569ed081
a08acd55bb001aa85ced7f4f93a4a1446ca18a17689e872b59a9da81ebe0cd45
a5270b4442df921b38b1241f7152a12f1cc932633bae9ec745515477369e4939
a55e134ae31e9448a2ac35da6c36eaf59c9781b18494db9084962adc09f084fe
a72b844efddd899f13868bfdca594d670d8ee2ace65229668cec99261cff0512
a79d8eab8b4ab229954cf71bea78de20f4350e06b82f5a27a3e5c86f6f051e4b
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
ab0a4fd818ae651b0b4da61889b0543363fee8a750aeb9dd38e77ce6917d11bf
aec3d419d50f05781a96f223e18289aeb52598b5db39be82a7b71dc67d6a7947
af8c669f941e754271c71ba5714ac0e5247ce6c3d1b1638257e1b2862d33beaa
afdefcf0c1df347da2d28a48b4e662be32dab2715f9547d597a8e4e232f502f6
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b2c23c0748ec27b48c08bcde5dc7e6c1e19eac3cfe703140f7e2080f1d008be7
b3d93d7265fa0db918412c2f256a9830232b11cc60790bf84f01a48ad799c2ac
b633a587c652d02386c4f16f8c6f6aab7352d97f16367c3c40576214372dd628
b6f996cad5800270527eb13bf9b1bf2b0f386c8e0b8bb4a64c77af4f77077314
b6fcf52da7b7725cba7568a798d4034232bd375a2a48ae9786da94c65a697795
ba04c128644298545babb4bb2b698dc34c3fc1a69e8e7d1a13bb3698b0666b1d
bf5694b365ccfafd151d2195c9aa52e16a58f65fb5121f5aeabcb1863002a740
c173503f8ae4fdbb42c06c514edf25e62e81503e418ee3a0cdbd884e1a741444
c3ee7e7ce011e3e48b7abf57f0aac831f15ff20125aed0176475fede7f5deeaa
c72c5cdb8ee97ed1e23f49f9cc0884c795f9c70e85a566453d9701f12cebfe9f
c7c8816e0d9c509b8debec95cf0404371888ae6de2ae3ac2ba6a293a473de67e
c936bca314b30e3c48bbad667c920cac28e3e43b72f5f372c706e885a0aa2743
ca514553ce409ebb53bc624042b223f58dfa9abb71ebc1f1d7b356d64ed4cb14
d14d5bbdf0172db131ffa07cafec87939e5aa81963be1c63e0de95a64494000e
d36b373b44b77f016e4b7df913ba2da2a8025456f016bc794861f210c0e3ada3
d5ea70f50143025b50fca4d71ddb3ef7a543b341e0cc97ed44159e0edfac1c2e
d60668453877eac3e55b0d4b4ba8db95fd237171aa5388d7b5f31ce3763377b8
d76195d14edb2e4ff1482ec8fc09b9a0c7478cb78a6eefe681679a81e2a13489
d98cb0a1e156fddbf20389dc37e2ed4860fe71e9a691e34e41f3ba9516b805ac
d9a80f43d1162b529a3691b3329a11072753b21ac8700f1fb05c6915531cd761
db1117f0fdd5373304082a82f479dfeddfd5f87d0c3598f3fa7f589612da8cc3
db668b70fd0021a224a50338fc80f62881fc5e678e84987ff62785d86ab3f320
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e439bebf8de2df0582273906d2c1dceff2387c661efb2152ef1c28420ce4e7e5
e4a1f6bb4df43a4e3aded46465e55b8749b64817d13ed9557075c596d218c340
e5118140a15e5dbb471f19c06816bcfa44170878bd8fe0ade80c24b7a988d8ba
e61c66e4ec81d658d0b94beed9ea89b286d0a6dc8e733fa96884c4d2e58e8987
eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987
ecb2dbe5d73e1c489ea95d2cca25c8865e4b07c4b867da199341ba5ee20e87ef
edab41abdcaa963e405b4acfd986c0485c1ba0089e78043838deb4b7d42aa117
eef8bb0f7222bdb9159735d34e28cda50fd2b5bd9d26a7af08c8ca7c8ff4c9ce
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f5a6c43bdddf5a9ff1ac615e6038b9e2068271aef17a82addad82ba1c6143903
f61c6c2848203266c231c5690c5871675a612d38df19946c9d3167dc5bf34e0c
f75ada33b07cb31e16a0a0d3325961a22dc9526edb49bff04c31d7b7611f7025
fdc9964050bfa24c27a3c76c6791b3674292a5f352cbc83d7a4dc49595bc3fb1
fe32c45eca9ebd2b11a388fff10271ec51f59493a926cd45c60c8cbbfe9f2ee6
ff3de130872fe0fb5b770dfa2bc9f0daf8ab320403a34a60d089436f08d24f99

kr.buddysecret.com Open in urlscan Pro 2606:4700:3030::6815:1001 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

181 Requests

86 %HTTPS

48 %IPv6

44 Domains

62 Subdomains

49 IPs

7 Countries

4786 kBTransfer

11624 kBSize

71 Cookies

4 Outgoing links

Page URL History

Redirected requests

181 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 6 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

kr.buddysecret.com Open in urlscan Pro
2606:4700:3030::6815:1001 Public Scan

Screenshot
Live screenshot

Full Image

181
Requests

86 %
HTTPS

48 %
IPv6

44
Domains

62
Subdomains

49
IPs

7
Countries

4786 kB
Transfer

11624 kB
Size

71
Cookies

181 HTTP transactions
6 data transactions