domainbaru-9fc.pages.dev
188.114.97.3  Public Scan Open in urlscan Pro

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions Everything HTML Script Fetch XHR CSS Image Font Expand all
2 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H3	200	Primary Request / Show response domainbaru-9fc.pages.dev/done/	7 KB 3 KB	97ms 61ms	Document text/html	188.114.97.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://domainbaru-9fc.pages.dev/done/?id=KIKOTOTO Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 66082d10459f199f15d26878a6ff16d0a58e8b08e62473c14a64dd53c4bbb14c Security Headers Name Value X-Content-Type-Options nosniff Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36 Response headers access-control-allow-origin * alt-svc h3=":443"; ma=86400 cache-control public, max-age=0, must-revalidate cf-ray 946b55d44f0ed579-AMS content-encoding br content-type text/html; charset=utf-8 date Wed, 28 May 2025 05:26:06 GMT link <https://cdn.ampproject.org/v0.js>; rel="preload"; as=script nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} priority u=0,i referrer-policy strict-origin-when-cross-origin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QPEiKO2gcB13d9Covyh%2Bbk0ZIMPX%2BKvtzAMFel6bmEst2M5yExwNnFQKE4GpTLVbYBgBs1WShnM2R3DrJmNgCUSCoTH%2Fad%2FsuVMrRkTYgm3QlWyW%2BtjSnIy0rUU2hakGsBDbKMaXL0KlK9o%3D"}],"group":"cf-nel","max_age":604800} server cloudflare server-timing cfL4;desc="?proto=QUIC&rtt=14806&min_rtt=14591&rtt_var=3244&sent=13&recv=9&lost=0&retrans=0&sent_bytes=4181&recv_bytes=4473&delivery_rate=39542&cwnd=12000&unsent_bytes=0&cid=8409e551a11858f8&ts=68&x=1" cfExtPri cfHdrFlush;dur=0 vary Accept-Encoding x-content-type-options nosniff
GET H2	200	v0.js Show response cdn.ampproject.org/	278 KB 72 KB	160ms 49ms	Script text/javascript	2a00:1450:4001:80b::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/v0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 27f09232a4cd828446c1f25dc7d1f94cd309e27421e737925dc7228b377d2b91 Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36 Referer https://domainbaru-9fc.pages.dev/ Response headers content-encoding br etag "779a6ff65bc2cd8a" report-to {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]} x-content-type-options nosniff expires Wed, 28 May 2025 05:26:06 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Wed, 28 May 2025 05:26:06 GMT content-type text/javascript; charset=UTF-8 vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp cache-control private, max-age=3000, stale-while-revalidate=1206600 timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="amphtml-china-available" content-length 73100 x-xss-protection 0 server sffe
GET DATA	200 OK	truncated /	84 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b3c2e19910e07c5474b60548d1f73ba263d32598237c8862cf0632abc8c8547a Request headers User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36 Referer Response headers Content-Type image/svg+xml;charset=utf-8
GET DATA	200 OK	truncated /	84 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash cf69f64cd0bba1bfd9bfdc6ccbca1dc895586e321a292f527a45a666b14f5322 Request headers User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36 Referer Response headers Content-Type image/svg+xml;charset=utf-8
GET H2	200	gacoflash.gif ik.imagekit.io/expx/	118 KB 119 KB	132ms 43ms	Image image/webp	2600:9000:2127:e200:15:c281:3500:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://ik.imagekit.io/expx/gacoflash.gif Requested by Host: domainbaru-9fc.pages.dev URL: https://domainbaru-9fc.pages.dev/done/?id=KIKOTOTO Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2127:e200:15:c281:3500:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash 55459a6ee692c3b7c8252792e9cff5174e1efc86070da28a8aac2c20f5217cd6 Request headers User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36 Referer https://domainbaru-9fc.pages.dev/ Response headers x-request-id 56be9634-4576-4726-838d-6098215b6625 etag "b7474359ae30dec92ac5d0444d265bfd" age 2493712 access-control-allow-methods GET alt-svc h3=":443"; ma=86400 x-cache Hit from cloudfront x-amz-cf-id vfF1J4mrXq8vLijdbq2E4jhLi3B_MR1d2sl_KVPO5U1i8CdJC21tvA== date Tue, 29 Apr 2025 08:44:15 GMT content-type image/webp vary Accept x-server ImageKit.io last-modified Thu, 20 Feb 2025 01:59:50 GMT access-control-allow-headers * cache-control public, s-maxage=31536000, max-age=31536000, must-revalidate timing-allow-origin * via 1.1 bb5a1c03f2335d92378a3e68542733da.cloudfront.net (CloudFront), 1.1 2a9856881d192b485d1bf1928e98c7ec.cloudfront.net (CloudFront) access-control-allow-origin * content-length 120642 x-amz-cf-pop PRG50-C1
GET H2	200	judi-slot-gacor.jpg blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj4fTGRVgxO9U9CkuuYkjgbmP9SlY1r7tHYdU33ceNOuILu3PVNSyctw0LQinALLDIAGlRjXVgLeO48MPsdYwnZHNpoenmiCv7XHfSKk6Isdz9sK12N2E1jlKD0PiI480gpobDFaG9EIs5b0si4...	214 KB 215 KB	483ms 363ms	Image image/jpeg	2a00:1450:4001:829::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj4fTGRVgxO9U9CkuuYkjgbmP9SlY1r7tHYdU33ceNOuILu3PVNSyctw0LQinALLDIAGlRjXVgLeO48MPsdYwnZHNpoenmiCv7XHfSKk6Isdz9sK12N2E1jlKD0PiI480gpobDFaG9EIs5b0si4ablr2QUaMnGpJfYejKGR2EgBabwB3eHT71N7vGPsXlx-/s800/judi-slot-gacor.jpg Requested by Host: domainbaru-9fc.pages.dev URL: https://domainbaru-9fc.pages.dev/done/?id=KIKOTOTO Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software fife / Resource Hash 24c5e4105a7fe4270a8f850da6d25f40af1653098edc359652e80cc4c7a5684e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36 Referer https://domainbaru-9fc.pages.dev/ Response headers access-control-expose-headers Content-Length cache-control public, max-age=86400, no-transform etag "v2f83" x-content-type-options nosniff expires Thu, 29 May 2025 05:26:07 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 219299 date Wed, 28 May 2025 05:26:07 GMT x-xss-protection 0 content-type image/jpeg vary Origin server fife content-disposition inline;filename="judi-slot-gacor.jpg"
GET H3	200	amp-auto-lightbox-0.1.js Show response cdn.ampproject.org/rtv/012504091801000/v0/	8 KB 3 KB	68ms 24ms	Script text/javascript	172.217.18.1 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012504091801000/v0/amp-auto-lightbox-0.1.js Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/v0.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.217.18.1 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra02s19-in-f1.1e100.net Software sffe / Resource Hash 28019b1d5cbaadc2bfb33bcb9d59378e164155dd32cf119798f0c580f9dfd1cc Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36 Origin https://domainbaru-9fc.pages.dev Referer https://domainbaru-9fc.pages.dev/ Response headers content-encoding br etag "8c21af8a72cbf02f" age 45058 report-to {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]} x-content-type-options nosniff expires Wed, 27 May 2026 16:55:09 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 27 May 2025 16:55:09 GMT content-type text/javascript; charset=UTF-8 vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp cache-control public, max-age=31536000 timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="amphtml-china-available" content-length 2974 x-xss-protection 0 server sffe
GET H3	200	amp-loader-0.1.js Show response cdn.ampproject.org/rtv/012504091801000/v0/	12 KB 4 KB	64ms 23ms	Script text/javascript	172.217.18.1 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://cdn.ampproject.org/rtv/012504091801000/v0/amp-loader-0.1.js Requested by Host: cdn.ampproject.org URL: https://cdn.ampproject.org/v0.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.217.18.1 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra02s19-in-f1.1e100.net Software sffe / Resource Hash e15cddf5674096e6df431cc5c64daf302e8c62962f4bf32340b39de3ec6a00ef Security Headers Name Value Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36 Origin https://domainbaru-9fc.pages.dev Referer https://domainbaru-9fc.pages.dev/ Response headers content-encoding br etag "151c942c5ec8b7fe" age 45059 report-to {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]} x-content-type-options nosniff expires Wed, 27 May 2026 16:55:08 GMT alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 date Tue, 27 May 2025 16:55:08 GMT content-type text/javascript; charset=UTF-8 vary Accept-Encoding strict-transport-security max-age=31536000; includeSubDomains; preload content-security-policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp cache-control public, max-age=31536000 timing-allow-origin * cross-origin-resource-policy cross-origin accept-ranges bytes access-control-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="amphtml-china-available" content-length 3942 x-xss-protection 0 server sffe
GET H3	200	pngtree-slot-logo-rhombus-background-png-image_4029498.png png.pngtree.com/png-clipart/20211112/ourmid/	19 KB 20 KB	81ms 23ms	Other image/png	104.18.2.157 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://png.pngtree.com/png-clipart/20211112/ourmid/pngtree-slot-logo-rhombus-background-png-image_4029498.png Protocol H3 Security QUIC, , AES_128_GCM Server 104.18.2.157 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5c049c5d254deb29c9a07caae89eaa982209c65428417083310b039293e8968b Request headers User-Agent Mozilla/5.0 (Linux; Android 11) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Mobile Safari/537.36 Referer https://domainbaru-9fc.pages.dev/ Response headers cf-cache-status HIT etag "4f3e7d9aeed0745247654420664f1a44" age 454488 expires Sun, 30 Nov 2025 05:26:07 GMT alt-svc h3=":443"; ma=86400 server-timing cfExtPri date Wed, 28 May 2025 05:26:07 GMT content-type image/png last-modified Wed, 14 May 2025 16:17:58 GMT vary Accept-Encoding priority u=1,i x-amz-id-2 r4RmIGFfadfE4ihd1OoC9ER5/SCJEyFkfwKHPmfzGSYF6qRALivuQYQQxp6EKJSdCaOGSHwtLEI= cache-control public, max-age=16070400 x-amz-request-id P0FJBY8B91AE4Y0E cf-ray 946b55dacb05fba4-AMS accept-ranges bytes content-length 19803 server cloudflare x-amz-server-side-encryption AES256

15 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

object| AMP_CONFIG object| AMP_EXP object| AMP object| __AMP_LOG function| HTMLElementOrig object| __AMP_ERRORS object| __AMP_MODE function| __AMP_REPORT_ERROR object| __AMP_TOP object| __AMP_SERVICES object| __AMP__EXPERIMENT_TOGGLES object| __AMP_URL_CACHE boolean| __AMP_TAG object| __AMP_EXTENDED_ELEMENTS function| __AMP_BASE_CE_CLASS

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.pngtree.com/	1970-01-21 05:40:11	Name: __cf_bm Value: Lu9WabSV91.a5kM9R3qycNOpIsWUZfxesoSQEy4JxY8-1748409967-1.0.1.1-Emi4gwrXbLLAfei2616ixq.vZfbJV4h62CHgmgkxKH3SdYQUOOj_TWcm2vkhyhgOsg7Y3RJYy0fbIssb9WlkW860mgp9uzOycBaVAwamzD8

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

blogger.googleusercontent.com
cdn.ampproject.org
domainbaru-9fc.pages.dev
ik.imagekit.io
png.pngtree.com
104.18.2.157
172.217.18.1
188.114.97.3
2600:9000:2127:e200:15:c281:3500:93a1
2a00:1450:4001:80b::2001
2a00:1450:4001:829::2001
24c5e4105a7fe4270a8f850da6d25f40af1653098edc359652e80cc4c7a5684e
27f09232a4cd828446c1f25dc7d1f94cd309e27421e737925dc7228b377d2b91
28019b1d5cbaadc2bfb33bcb9d59378e164155dd32cf119798f0c580f9dfd1cc
55459a6ee692c3b7c8252792e9cff5174e1efc86070da28a8aac2c20f5217cd6
5c049c5d254deb29c9a07caae89eaa982209c65428417083310b039293e8968b
66082d10459f199f15d26878a6ff16d0a58e8b08e62473c14a64dd53c4bbb14c
b3c2e19910e07c5474b60548d1f73ba263d32598237c8862cf0632abc8c8547a
cf69f64cd0bba1bfd9bfdc6ccbca1dc895586e321a292f527a45a666b14f5322
e15cddf5674096e6df431cc5c64daf302e8c62962f4bf32340b39de3ec6a00ef