www.hedan.rr.nu Open in urlscan Pro
172.66.47.11 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.hedan.rr.nu/
Submission: On July 05 via api (July 5th 2024, 11:52:00 am UTC) from US — Scanned from DE

Summary HTTP 68 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 17 IPs in 6 countries across 12 domains to perform 68 HTTP transactions. The main IP is 172.66.47.11, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.hedan.rr.nu.
TLS certificate: Issued by E6 on July 5th 2024. Valid for: 3 months.

This is the only time www.hedan.rr.nu was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
14	172.66.47.11 172.66.47.11	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2620:1ec:29:1... 2620:1ec:29:1::45	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
9	2a04:4e42:600... 2a04:4e42:600::485	54113 (FASTLY) (FASTLY)
1	154.85.69.9 154.85.69.9	139057 (LDPL-AS-A...) (LDPL-AS-AP LEGEND DYNASTY PTE. LTD.)
5 7	116.207.181.224 116.207.181.224	136191 (CHINATELE...) (CHINATELECOM-HUBEI-YICHANG-IDC YICHANG)
1	2a00:1450:400... 2a00:1450:4001:80b::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:829::2003	15169 (GOOGLE) (GOOGLE)
8	20.231.53.73 20.231.53.73	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
14	151.101.129.229 151.101.129.229	54113 (FASTLY) (FASTLY)
2	110.42.2.205 110.42.2.205	136188 (CHINATELE...) (CHINATELECOM-ZHEJIANG-NINGBO-IDC NINGBO)
3	101.42.40.156 101.42.40.156	45090 (TENCENT-N...) (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited)
2	113.13.246.102 113.13.246.102	4134 (CHINANET-...) (CHINANET-BACKBONE No.31)
4 8	45.154.12.123 45.154.12.123	138195 (MOACKCOLT...) (MOACKCOLTD-AS-AP MOACK.Co.LTD)
1 2	13.74.129.1 13.74.129.1	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	2620:1ec:c11:... 2620:1ec:c11::237	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	240e:c3:2800:... 240e:c3:2800:200:8000::99	63838 (CT-HUNAN-...) (CT-HUNAN-HENGYANG-IDC Hengyang)
1	2404:2280:1cc... 2404:2280:1cc:0:3::a	24429 (TAOBAO Zh...) (TAOBAO Zhejiang Taobao Network Co.)
68	17

14 172.66.47.11 (United States)

ASN13335 (CLOUDFLARENET, US)

www.hedan.rr.nu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:29:1::45 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a04:4e42:600::485 (United States)

ASN54113 (FASTLY, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fastly.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 154.85.69.9 (Singapore, Singapore)

ASN139057 (LDPL-AS-AP LEGEND DYNASTY PTE. LTD., SG)

cdn.bootcss.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 116.207.181.224 (China) 5 redirects

ASN136191 (CHINATELECOM-HUBEI-YICHANG-IDC YICHANG, Hubei Province, P.R.China., CN)

myhkw.cn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 20.231.53.73 (Washington, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

q.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 151.101.129.229 (San Francisco, United States)

ASN54113 (FASTLY, US)

fastly.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 110.42.2.205 (China)

ASN136188 (CHINATELECOM-ZHEJIANG-NINGBO-IDC NINGBO, ZHEJIANG Province, P.R.China., CN)

api.myhkw.cn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 101.42.40.156 (Beijing, China)

ASN45090 (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN)

cdn.myhkw.cn	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 113.13.246.102 (China)

ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN)

api.tongjiniao.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 45.154.12.123 (United Kingdom) 4 redirects

ASN138195 (MOACKCOLTD-AS-AP MOACK.Co.LTD, KR)

img.paulzzh.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.74.129.1 (Dublin, Ireland) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:c11::237 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 240e:c3:2800:200:8000::99 (China)

ASN63838 (CT-HUNAN-HENGYANG-IDC Hengyang, CN)

p3.music.126.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2404:2280:1cc:0:3::a (Singapore)

ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN)

m801.music.126.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
23	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 381 fastly.jsdelivr.net — Cisco Umbrella Rank: 43046	877 KB
14	rr.nu www.hedan.rr.nu	8 MB
12	myhkw.cn 5 redirects myhkw.cn api.myhkw.cn cdn.myhkw.cn	158 KB
12	clarity.ms 1 redirects www.clarity.ms — Cisco Umbrella Rank: 743 q.clarity.ms — Cisco Umbrella Rank: 7690 c.clarity.ms — Cisco Umbrella Rank: 1434	30 KB
8	paulzzh.com 4 redirects img.paulzzh.com	2 MB
2	126.net p3.music.126.net — Cisco Umbrella Rank: 130632 m801.music.126.net — Cisco Umbrella Rank: 86334	127 KB
2	tongjiniao.com api.tongjiniao.com — Cisco Umbrella Rank: 383645	5 KB
2	gstatic.com fonts.gstatic.com	46 KB
1	bing.com 1 redirects c.bing.com — Cisco Umbrella Rank: 224	762 B
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 83	885 B
1	bootcss.com cdn.bootcss.com — Cisco Umbrella Rank: 68048	1 KB
0	ctose.cn Failed apii.ctose.cn Failed
68	12

	Domain	Requested by
17	fastly.jsdelivr.net	cdn.jsdelivr.net fastly.jsdelivr.net www.hedan.rr.nu
14	www.hedan.rr.nu	www.hedan.rr.nu
8	img.paulzzh.com	4 redirects
8	q.clarity.ms	www.clarity.ms
7	myhkw.cn	5 redirects www.hedan.rr.nu cdn.jsdelivr.net
6	cdn.jsdelivr.net	www.hedan.rr.nu
3	cdn.myhkw.cn	www.hedan.rr.nu api.myhkw.cn
2	c.clarity.ms	1 redirects
2	api.tongjiniao.com	www.hedan.rr.nu api.tongjiniao.com
2	api.myhkw.cn	www.hedan.rr.nu api.myhkw.cn
2	fonts.gstatic.com	fonts.googleapis.com
2	www.clarity.ms	www.hedan.rr.nu www.clarity.ms
1	m801.music.126.net
1	p3.music.126.net
1	c.bing.com	1 redirects
1	fonts.googleapis.com	cdn.jsdelivr.net
1	cdn.bootcss.com	www.hedan.rr.nu
0	apii.ctose.cn Failed	www.hedan.rr.nu
68	18

This site contains links to these domains. Also see Links.

Domain
forum.hedan.link
qm.qq.com
map.hedan.link
jq.qq.com

Subject Issuer	Validity	Valid
www.hedan.rr.nu E6	`2024-07-05` - `2024-10-03`	3 months	crt.sh
www.clarity.ms DigiCert TLS RSA SHA256 2020 CA1	`2023-12-07` - `2024-12-07`	a year	crt.sh
jsdelivr.net GlobalSign Atlas R3 DV TLS CA 2023 Q3	`2023-09-27` - `2024-10-28`	a year	crt.sh
*.bootcss.com Sectigo RSA Domain Validation Secure Server CA	`2024-01-03` - `2025-02-02`	a year	crt.sh
myhkw.cn TrustAsia RSA DV TLS CA G2	`2024-04-28` - `2025-04-28`	a year	crt.sh
upload.video.google.com WR2	`2024-06-13` - `2024-09-05`	3 months	crt.sh
*.gstatic.com WR2	`2024-06-13` - `2024-09-05`	3 months	crt.sh
a.clarity.ms Microsoft Azure RSA TLS Issuing CA 08	`2024-06-23` - `2025-06-18`	a year	crt.sh
*.tongjiniao.com Sectigo RSA Domain Validation Secure Server CA	`2023-10-22` - `2024-10-21`	a year	crt.sh
api.myhkw.cn TrustAsia RSA DV TLS CA G2	`2024-03-28` - `2025-03-28`	a year	crt.sh
cdn.myhkw.cn TrustAsia RSA DV TLS CA G2	`2024-04-12` - `2025-04-12`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.hedan.rr.nu/
Frame ID: 7CE0EDF57234047C0157450128F8BA99
Requests: 69 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

方块核弹世界-ChimeTown-铃铛小镇服务器

Detected technologies

Semantic UI (UI frameworks) Expand

Overall confidence: 100%
Detected patterns

/semantic(?:-([\d.]+))?(?:\.min)?\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

68
Requests

84 %
HTTPS

41 %
IPv6

12
Domains

18
Subdomains

17
IPs

6
Countries

11144 kB
Transfer

15802 kB
Size

10
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://forum.hedan.link/
Title: 在论坛上讨论游戏论坛

Search URL Search Domain Scan URL

URL: http://qm.qq.com/cgi-bin/qm/qr?_wv=10Q7&k=_vMnqnZaH251z9ztxxaItJ7dX-HMn7EI&authKey=qn38QwO25MZJnqnZaH251z9ztxxaItJ7yGP4km0n42128892BhxPXIerkVnkNsWCHT&noverify=0&group_code=242128892
Title: 交流，反馈bug 加入qq群

Search URL Search Domain Scan URL

URL: http://map.hedan.link/
Title: 在卫星图上看世界卫星图

Search URL Search Domain Scan URL

URL: https://jq.qq.com/?_wv=1027&k=3S8qB8Tk
Title: 加入玩家群聊

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 46

https://myhkw.cn/api/playercss?id=demo HTTP 302
https://api.myhkw.cn/cache/css/player-l.css?v=20240630

Request Chain 47

https://myhkw.cn/api/playlist?id=demo HTTP 302
https://cdn.myhkw.cn/cache/playlist/demo.js?v=20240430-1720109201

Request Chain 53

https://img.paulzzh.com/touhou/random?0.9458146323980605 HTTP 302
https://img.paulzzh.com/touhou/konachan/image/586e2fd214d9277af9e353cebdfa584b.jpg

Request Chain 54

https://c.clarity.ms/c.gif HTTP 302
https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=F11526CD2C964345981B4FFE46DE92BB&RedC=c.clarity.ms&MXFR=066B0C5D385E677A313C18EE3C5E69C2 HTTP 302
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=F11526CD2C964345981B4FFE46DE92BB&MUID=0C9605CDD0B862423E67117ED16A631C

Request Chain 56

https://myhkw.cn/api/pic?song=2144209098&pic=109951169484028770&type=wy&id=demo&sign=749/n7RxhZX4Y HTTP 302
https://p3.music.126.net/y1h40wgnEzAJKGN0IksUsg==/109951169484028770.jpg?param=300y300

Request Chain 57

https://myhkw.cn/api/url?song=2144209098&type=wy&id=demo&sign=749/n7RxhZX4Y HTTP 302
https://m801.music.126.net/20240705201632/6b1d29d953a008cfbd4ab15950a2abb7/jdymusic/obj/wo3DlMOGwrbDjj7DisKw/35121150388/9599/98ef/5bfc/83bceee69e40dea5aa652fa9f7430735.mp3

Request Chain 58

https://myhkw.cn/api/lyrics?song=2144209098&type=wy&id=demo&sign=749/n7RxhZX4Y&ksc=54&_=1720180285011 HTTP 302
https://cdn.myhkw.cn/cache/lyrics/wy-2144209098-b1iFf46SqiyN6.js?v=20240430-1720109201

Request Chain 62

https://img.paulzzh.com/touhou/random?0.6461772809886324 HTTP 302
https://img.paulzzh.com/touhou/konachan/image/fa4b177419fce5c8de4ae4f0c125a11d.jpg

Request Chain 64

https://img.paulzzh.com/touhou/random?0.7010095440573152 HTTP 302
https://img.paulzzh.com/touhou/konachan/image/56682a25b9dc3fc46d6a20df2fccf69c.jpg

Request Chain 66

https://img.paulzzh.com/touhou/random?0.6524199555166075 HTTP 302
https://img.paulzzh.com/touhou/konachan/jpeg/5d3df11fd766a1751322be73ca4a44ab.jpg

68 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3 200 Primary Request / Show response
www.hedan.rr.nu/ 77 KB
49 KB 397ms
101ms Document
text/html 172.66.47.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.hedan.rr.nu/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.47.11 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fc544e095e9c62b22290d8eaf5812e29023d77e9d7cfb0155fd1ac9315bf75fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-origin: *
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=0, must-revalidate
cf-ray: 89e724987dcc3603-FRA
content-encoding: br
content-type: text/html; charset=utf-8
date: Fri, 05 Jul 2024 11:51:24 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VZ53PLAHBK0dtjeW7D2ZzyA5IvdlPF937t9Epa5A1CbyseYmKm%2FvyRV3F%2FesMHR0yM7VhBNdbWVFl59utNpnyHPIY91Q9B0nllsBGPVYcXFn6iyhJU7f1rKyt%2FmYQuwRWZ0%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
x-content-type-options: nosniff

GET
H3 200 css.css
www.hedan.rr.nu/css/ 11 KB
3 KB 50ms
50ms Stylesheet
text/css 172.66.47.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.hedan.rr.nu/css/css.css

Requested by

Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.47.11 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fa501844318e06fadf4d4f127ad2be47b7ff55cd9409baf70a7368b14c0302ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 05 Jul 2024 11:51:24 GMT
content-encoding: br
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"0b69cbe335f5a607d66ba28e97f9329d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r3isX21Ihrrii4GX%2FVDqHDSwRKqum1OJ3wnxpikve8CXGZjwwDx9IemTIMlZp%2FG3dPkso0JUA7Fp%2BKnIT0WZ7BF%2FeJ7ffDFFUSWIm1zyuwpSvdhIuGCuxeRKOrDPfspNlNs%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
cf-ray: 89e724992ed63603-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 main.js Show response
www.hedan.rr.nu/static/js/ 77 KB
49 KB 70ms
69ms Script
text/html 172.66.47.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.hedan.rr.nu/static/js/main.js

Requested by

Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.47.11 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fc544e095e9c62b22290d8eaf5812e29023d77e9d7cfb0155fd1ac9315bf75fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 05 Jul 2024 11:51:24 GMT
content-encoding: br
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6tpIEa4d6IaCUEBNHCn%2BdMWw3VVjP81LGbVpjq2AMiFWGSROZBnJmnjYuK%2FGYfsRoH3jc1UEBHRDSrjcXixFN9TFDAQhJvMeX9Yki5qoQ%2FuMCI9InSaHo8CqtsvhxmE7Dcs%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
cf-ray: 89e724992ed83603-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 logo.png
www.hedan.rr.nu/img/ 1 MB
1 MB 1008ms
1008ms Image
image/png 172.66.47.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.hedan.rr.nu/img/logo.png

Requested by

Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.47.11 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b140ce5cbf9bf2a79282a7b988a91f412dd4e0683d5175fa542f8fe66081f9b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 05 Jul 2024 11:51:24 GMT
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "7a63d84654b49a718ae853b8872d612c"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BZSunArtXgNRdx0O1LckoB0y82OkEmwBxyC%2Fs60drnG1QZOJxgZjuKRCXnBvXYEzKFRYbchW98QoM5LC1jn3jkLSLoCn8CDlTR6wNmPJBa8m6gCmgpNtNK1wItEEYbxwF7g%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
cf-ray: 89e72499cf813603-FRA
alt-svc: h3=":443"; ma=86400
content-length: 1096720

GET
H3 200 bird.png
www.hedan.rr.nu/img/ 24 KB
25 KB 1162ms
1161ms Image
image/png 172.66.47.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.hedan.rr.nu/img/bird.png

Requested by

Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.47.11 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

775800ecf32595fac19e09efeefe175104c8f58086958278d5fe5456b629baa0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 05 Jul 2024 11:51:24 GMT
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "14a913eea8eed6a4fb4ed6789a2b4946"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9zkCh3xbZSu5jYMZcnoPLjqFclrbfnsgMuAx4kx4qJLrqMJff5%2FBkF9HzvXmAAZ6AiNa5gDjNq8zK5dK18Nau9QnxDTXxWqH43DJzslJgvzxl6UdP03QxCifTSnxyjeriGI%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
cf-ray: 89e72499cf823603-FRA
alt-svc: h3=":443"; ma=86400
content-length: 24865

GET
H3 200 st.png
www.hedan.rr.nu/img/ 184 KB
184 KB 116ms
116ms Image
image/png 172.66.47.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.hedan.rr.nu/img/st.png

Requested by

Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.47.11 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

734cb8c4e906c83e72713a3aff5a2b8b1f2e1eed50f08bdfab890adef5f43557

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 05 Jul 2024 11:51:24 GMT
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "787dfb1cc1aa1fb96c80db0f93784746"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SxFpgbGYYFyI4kJX0Ua1ig3YE9dKD2CjMDcBL7x0514pb1KTtuubPi4HxohFYJpng6FKGu9uJBYe59FX7sLQB60y8GeyDqsC%2FjCq1G3RZXYBFeuNBfwYf99yMOgf0eLXqGw%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
cf-ray: 89e724992edb3603-FRA
alt-svc: h3=":443"; ma=86400
content-length: 188036

GET
H3 200 forum.png
www.hedan.rr.nu/img/ 4 MB
4 MB 95ms
95ms Image
image/png 172.66.47.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.hedan.rr.nu/img/forum.png

Requested by

Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.47.11 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cebaf3897d64760fa3fde87d5ff7e6806c895c87b3dcc4494137e14b817c3900

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 05 Jul 2024 11:51:24 GMT
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "89ae6ed587ad2fa9ee500d50d45154fc"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2kgiipfVJmXE%2BYOvJP9V1HYX4iDYw8gsmTig8pBBCt2ZSXH%2FzFg5w0E96JtycN6kYEwFfE2HWAjVeIatIkI1iCU%2B6bgO%2FnFbUtLqi3dRZVywVPDD2gtdbzdG%2FxuWH%2Fu%2F29E%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
cf-ray: 89e724992edc3603-FRA
alt-svc: h3=":443"; ma=86400
content-length: 4142179

GET
H3 200 bugs.png
www.hedan.rr.nu/img/ 2 MB
2 MB 672ms
670ms Image
image/png 172.66.47.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.hedan.rr.nu/img/bugs.png

Requested by

Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.47.11 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c75c6c164c77e9cb9293e5c767c83e8ad459fd69da30644add1daf3ae7e75996

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 05 Jul 2024 11:51:24 GMT
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "c094c336e3c1befbb53c61a58bcab9b8"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fKR8cgva04O%2F3M7YUFWe7HmEAAWOeKXzgfUvQcIoCR%2Bm5rOoKqSpNMtJ%2FffsyFVsvjI0Ht2wheC6BrjJ%2Br97%2FFnX8e8eHkxa2j%2BerGkL%2B4ieA7Z0Xe0yh4FezU0GwvVS5FU%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
cf-ray: 89e72499cf7b3603-FRA
alt-svc: h3=":443"; ma=86400
content-length: 2521721

GET
H3 200 map.png
www.hedan.rr.nu/img/ 186 KB
187 KB 978ms
976ms Image
image/png 172.66.47.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.hedan.rr.nu/img/map.png

Requested by

Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.47.11 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

455ecebc82403fdcfdc760886996690b4793c4d86834577fd99861fbb50b4bfe

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 05 Jul 2024 11:51:24 GMT
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "1d6681c88e225244a873f5c380d3f4d2"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QSy1UU0AjqLjokF%2Bhm1OGDq48Lcs7Eb1NzPEQKWP%2BmRsL5eQzSw90T%2F76q%2Fy%2Bz3v9qaw9JYBuoBlhV2akeHlxXhXbCWc8bfWk4x2T5luLAoxiqc%2BMcybyhYc12zDiNPfvmI%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
cf-ray: 89e72499cf7e3603-FRA
alt-svc: h3=":443"; ma=86400
content-length: 190865

GET
H2 200 gjs1z5cvkr Show response
www.clarity.ms/tag/ 637 B
1000 B 392ms
202ms Script
application/x-javascript 2620:1ec:29:1::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/tag/gjs1z5cvkr
Requested by: Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:29:1::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: d1f56fc38e8d50795552832c4b20432fedee68a763682b9fc648fc95b7c0c334

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: -1
date: Fri, 05 Jul 2024 11:51:24 GMT
x-azure-ref: 20240705T115124Z-15b895685ccqjjt8vg64q1zygw000000043g0000000009wm
x-cache: CONFIG_NOCACHE
content-type: application/x-javascript
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 637
request-context: appId=cid-v1:2f7711a9-b21e-4abe-a9d6-5b0ce5d18b64

GET
H2 200 font-awesome.min.css
cdn.jsdelivr.net/npm/font-awesome/css/ 30 KB
7 KB 117ms
54ms Stylesheet
text/css 2a04:4e42:600::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/font-awesome/css/font-awesome.min.css

Requested by

Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 05 Jul 2024 11:51:24 GMT
x-content-type-options: nosniff
content-encoding: br
age: 40054
x-jsd-version: 4.7.0
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 7114
x-served-by: cache-fra-etou8220033-FRA
x-jsd-version-type: version
etag: W/"7918-USx9eQM+MCipvmG1QM8aaHDIlvg"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 semantic.min.css
cdn.jsdelivr.net/semantic-ui/2.2.4/ 537 KB
81 KB 118ms
55ms Stylesheet
text/css 2a04:4e42:600::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/semantic-ui/2.2.4/semantic.min.css

Requested by

Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

050c1211e2f1b838207de3de15da3757dd3aadcbdc269912018aff2ea736a12a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Fri, 05 Jul 2024 11:51:24 GMT
age: 811625
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 83012
x-served-by: cache-fra-etou8220033-FRA
etag: W/"86243-07ZDO+Btgeq8oMe1q0O1wfgFsKk"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 jquery.min.js Show response
cdn.jsdelivr.net/npm/jquery@3.2/dist/ 85 KB
31 KB 163ms
101ms Script
application/javascript 2a04:4e42:600::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/jquery@3.2/dist/jquery.min.js

Requested by

Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 05 Jul 2024 11:51:24 GMT
x-content-type-options: nosniff
content-encoding: br
age: 17354
x-jsd-version: 3.2.1
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 31984
x-served-by: cache-fra-etou8220033-FRA
x-jsd-version-type: version
etag: W/"15283-EFUBjCirQQh++czv5BFgaJPavqI"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 semantic.min.js Show response
cdn.jsdelivr.net/semantic-ui/2.2.4/ 269 KB
67 KB 117ms
55ms Script
application/javascript 2a04:4e42:600::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/semantic-ui/2.2.4/semantic.min.js

Requested by

Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

06561773aec97881597f18ec78be970815858bb330c4aa14105eab3c8cc79813

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
x-content-type-options: nosniff
date: Fri, 05 Jul 2024 11:51:24 GMT
age: 1503061
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 67979
x-served-by: cache-fra-etou8220033-FRA
etag: W/"433a0-DtY0XSdutfvWhsaTOgbjYvnF1Ak"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 jquery.scrollTo.min.js Show response
cdn.jsdelivr.net/npm/jquery.scrollto@2.1.2/ 2 KB
2 KB 115ms
53ms Script
application/javascript 2a04:4e42:600::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/jquery.scrollto@2.1.2/jquery.scrollTo.min.js

Requested by

Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

ed04b5707b07ef987720582b14ab1d8662871e95aa17cdac6fff6f34ba9caacd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 05 Jul 2024 11:51:24 GMT
x-content-type-options: nosniff
content-encoding: br
age: 1401894
x-jsd-version: 2.1.2
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 1357
x-served-by: cache-fra-etou8220033-FRA
x-jsd-version-type: version
etag: W/"98f-WLY0jlgHHtauqlQXy4RmBiZdk9g"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 autoload.js Show response
cdn.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/ 2 KB
1 KB 182ms
120ms Script
application/javascript 2a04:4e42:600::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/autoload.js

Requested by

Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

acd8cc92baa460bfc303aca613f09f7912be7615999e30a453c6acb316b4d534

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 05 Jul 2024 11:51:24 GMT
x-content-type-options: nosniff
content-encoding: br
age: 28227
x-jsd-version: 0.9.0
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 1115
x-served-by: cache-fra-etou8220033-FRA
x-jsd-version-type: version
etag: W/"7df-LZ4N/mlwFqyDQhqPv7g36r1joFw"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 canvas-nest.min.js Show response
cdn.bootcss.com/canvas-nest.js/1.0.1/ 2 KB
1 KB 1428ms
1109ms Script
text/javascript 154.85.69.9
LDPL-AS-AP LEGEND...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.bootcss.com/canvas-nest.js/1.0.1/canvas-nest.min.js
Requested by: Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 154.85.69.9 Singapore, Singapore, ASN139057 (LDPL-AS-AP LEGEND DYNASTY PTE. LTD., SG),
Reverse DNS
Software: nginx /
Resource Hash: 485463b08985a0daa7c07c82972e1e09c90d665726f8180fe7dc358f7fcb5a3e

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: Fri, 05 Jul 2024 11:51:25 GMT
pragma: no-cache
date: Fri, 05 Jul 2024 11:51:25 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PATCH, PUT, DELETE, OPTIONS
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Authorization, Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, X-CSRF-TOKEN, X-Requested-With,token
x-ser: BC77_lt-qinghai-xining-7-cache-9, BC31_US-Georgia-atlanta-1-cache-4, BC8_DE-Frankfurt-Frankfurt-11-cache-1

GET autoload.js
apii.ctose.cn/live2d/Source-One/default/ 0
0

GET
H/1.1 200
OK player.js Show response
myhkw.cn/player/js/ 82 KB
29 KB 2127ms
583ms Script
application/javascript 116.207.181.224
CHINATELECOM-HUBE...

General

Check archive.org

Show headers Download Go to

Full URL

https://myhkw.cn/player/js/player.js

Requested by

Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

116.207.181.224 , China, ASN136191 (CHINATELECOM-HUBEI-YICHANG-IDC YICHANG, Hubei Province, P.R.China., CN),

Reverse DNS

Software

Byte-nginx /

Resource Hash

190948952131adf151e50aa94c281280992382a048030b7daae0e42e0939356c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Strict-Transport-Security: max-age=31536000
Content-Encoding: gzip
via: bdengine-75f66ccb55-zknx4
Date: Fri, 05 Jul 2024 11:51:26 GMT
x-tt-trace-tag: id=5
Age: 0
Transfer-Encoding: chunked
X-Bdcdn-Cache-Status: TCP_MISS
Connection: keep-alive
x-request-id: 144dfec65dd3a1640eba76654f0ded81
Last-Modified: Mon, 27 May 2024 02:08:34 GMT
Server: Byte-nginx
Etag: W/"6653eb22-1478d"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
x-request-ip: 217.114.218.20
Cache-Control: max-age=43200
x-response-cinfo: 217.114.218.20
x-response-cache: miss
Expires: Fri, 05 Jul 2024 23:51:26 GMT

GET
DATA 200
OK truncated
/ 43 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 427f7a363b07e17ab7900d38d315c2bb2e4e66f8239f837c72de4321931117d9

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 5dd408c68e0e2e3ee933d777.gif
www.hedan.rr.nu/static/images/ 31 KB
31 KB 1163ms
1163ms Image
text/html 172.66.47.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.hedan.rr.nu/static/images/5dd408c68e0e2e3ee933d777.gif

Requested by

Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.47.11 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 05 Jul 2024 11:51:24 GMT
content-encoding: br
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QmzVO7QCTzJdR%2FprwDJ5M%2BBab%2BFS9wYs7X9EcsrcjoOK8irLPSvO6K8XrTPd7asL70ioCOjNwTPvJd%2Fqy4mzjp%2FOt12shhRmxGxKloKA2sOpQgMCKf%2BSU40UhkNZtnAlTlo%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
cf-ray: 89e72499cf853603-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 bg_c.png
www.hedan.rr.nu/style/images/ 14 KB
14 KB 1180ms
1180ms Image
text/html 172.66.47.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.hedan.rr.nu/style/images/bg_c.png

Requested by

Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/css/css.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.47.11 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/css/css.css
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 05 Jul 2024 11:51:24 GMT
content-encoding: br
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AD46we9riH2N01qgBrwLwKsloK4wnxwTYvWRkAhplGDHh6aa6s8WdhcrN6Ma2z9pUhvqbWwZeKFB9Q%2FO9hw1v6IA54QsYBAL%2FcriMX9FZfLpTngAFzBujQh8pKPWiFfo42s%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
cf-ray: 89e72499cf883603-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 t01bded47820389b871.png
www.hedan.rr.nu/style/images/ 47 KB
47 KB 1184ms
1184ms Image
text/html 172.66.47.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.hedan.rr.nu/style/images/t01bded47820389b871.png

Requested by

Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/css/css.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.47.11 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/css/css.css
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 05 Jul 2024 11:51:24 GMT
content-encoding: br
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=75szyPvcKyMnh7jtlgHkeZD%2B5tNklHeBaVyDlNlyYfJNx%2B19e1H7XLM9yPQKmknLeI4o85eLHKmKcLy4g9OAcehjlNcgX7qVlxsibAIJ5CB2V%2FeAo6c6yl%2F0qmtucCld2ao%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
cf-ray: 89e72499cf8a3603-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 bg_cover.png
www.hedan.rr.nu/style/images/ 31 KB
31 KB 1186ms
1186ms Image
text/html 172.66.47.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.hedan.rr.nu/style/images/bg_cover.png

Requested by

Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/css/css.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.47.11 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/css/css.css
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 05 Jul 2024 11:51:24 GMT
content-encoding: br
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jW5EE1KyfEoiykSPVJpX7CNM9XSqeQ0EcPcRwFZfDVXZaEQRJbSzifAC8C8KuMkbNXzoms%2FwkZhGmqbmGRnyc%2FQ37HdBf8WTgUnB3xiMmQKDl4kgI4UXXd7eZGfo838XAcQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
cf-ray: 89e72499cf8c3603-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 css
fonts.googleapis.com/ 3 KB
885 B 278ms
40ms Stylesheet
text/css 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:400,700,400italic,700italic&subset=latin

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/semantic-ui/2.2.4/semantic.min.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

5e245f87c91e4cc60c4f66311f2691f187b9f710259f5f75cd6beff7598d6ddd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://cdn.jsdelivr.net/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Fri, 05 Jul 2024 11:51:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Fri, 05 Jul 2024 11:28:49 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 05 Jul 2024 11:51:24 GMT

GET
H2 200 clarity.js Show response
www.clarity.ms/s/0.7.34/ 61 KB
26 KB 124ms
123ms Script
application/javascript 2620:1ec:29:1::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/s/0.7.34/clarity.js
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/tag/gjs1z5cvkr
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:29:1::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: fffc6ed23cfeabaaace717503bfabd907816869c8c5ff38a2127b8284e8c5988

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 05 Jul 2024 11:51:24 GMT
content-encoding: br
last-modified: Thu, 23 May 2024 23:20:12 GMT
etag: W/"0x8DC7B7EE5574D78"
vary: Accept-Encoding
x-azure-ref: 20240705T115124Z-15b895685ccqjjt8vg64q1zygw000000043g0000000009wu
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
x-ms-request-id: 10d6d463-701e-0001-3003-cd7107000000
cache-control: public, max-age=86400
x-cache: TCP_HIT
x-ms-version: 2018-03-28
x-fd-int-roxy-purgeid: 51562430

GET
H2 200 S6uyw4BMUTPHjx4wXg.woff2
fonts.gstatic.com/s/lato/v24/ 23 KB
24 KB 97ms
23ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6uyw4BMUTPHjx4wXg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:400,700,400italic,700italic&subset=latin

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://fonts.googleapis.com/
Origin: https://www.hedan.rr.nu
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 02 Jul 2024 14:56:54 GMT
x-content-type-options: nosniff
age: 248071
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23580
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:17:22 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 02 Jul 2025 14:56:54 GMT

GET
H2 200 S6u9w4BMUTPHh6UVSwiPGQ.woff2
fonts.gstatic.com/s/lato/v24/ 23 KB
23 KB 118ms
43ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v24/S6u9w4BMUTPHh6UVSwiPGQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Lato:400,700,400italic,700italic&subset=latin

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://fonts.googleapis.com/
Origin: https://www.hedan.rr.nu
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 04 Jul 2024 18:06:58 GMT
x-content-type-options: nosniff
age: 63867
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23040
x-xss-protection: 0
last-modified: Tue, 02 May 2023 15:07:25 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 04 Jul 2025 18:06:58 GMT

GET
H2 200 waifu.css
fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/ 5 KB
1 KB 49ms
40ms Stylesheet
text/css 2a04:4e42:600::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/waifu.css

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/autoload.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

9610bbc4db6f94e7c35f7f8112635a6f66996b69f59bcdca9eafcf1289f3e192

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 05 Jul 2024 11:51:25 GMT
x-content-type-options: nosniff
content-encoding: br
age: 26206
x-jsd-version: 0.9.0
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 1061
x-served-by: cache-fra-etou8220033-FRA
x-jsd-version-type: version
etag: W/"1349-IFANr7FuywwY52CqrawHsCO6oVo"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 live2d.min.js Show response
fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/ 148 KB
41 KB 51ms
43ms Script
application/javascript 2a04:4e42:600::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/live2d.min.js

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/autoload.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

2135c76b0a63d0f6c9c48df746d0eec6ead131999ba6f9678488472e95e1edd6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 05 Jul 2024 11:51:25 GMT
x-content-type-options: nosniff
content-encoding: br
age: 19415
x-jsd-version: 0.9.0
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 42242
x-served-by: cache-fra-etou8220033-FRA
x-jsd-version-type: version
etag: W/"24f9d-lDg/th3oFcP4Bq4/EQJrvP44QII"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 waifu-tips.js Show response
fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/ 12 KB
5 KB 49ms
41ms Script
application/javascript 2a04:4e42:600::485
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/waifu-tips.js

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/autoload.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

f5977b6a02d773e4d59939dac292a13ea324db2b75ac69bd947124fe97e5a537

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 05 Jul 2024 11:51:25 GMT
x-content-type-options: nosniff
content-encoding: br
age: 24447
x-jsd-version: 0.9.0
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 4621
x-served-by: cache-fra-etou8220033-FRA
x-jsd-version-type: version
etag: W/"2e24-nJ8kEU5OLie/Bli6AfVwLRWNxlg"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

POST
H/1.1 204
No Content collect Show response
q.clarity.ms/ 0
279 B 394ms
133ms XHR
text/plain 20.231.53.73
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://q.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.34/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.231.53.73 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept: application/x-clarity-gzip
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Access-Control-Allow-Origin: https://www.hedan.rr.nu
Date: Fri, 05 Jul 2024 11:51:25 GMT
Access-Control-Allow-Credentials: true
Server: nginx
Connection: keep-alive
Vary: Origin
Request-Context: appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8

GET
H3 200 model_list.json Show response
fastly.jsdelivr.net/gh/fghrsh/live2d_api/ 2 KB
849 B 80ms
36ms Fetch
application/json 151.101.129.229
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fastly.jsdelivr.net/gh/fghrsh/live2d_api/model_list.json

Requested by

Host: fastly.jsdelivr.net
URL: https://fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/waifu-tips.js

Protocol

Security

QUIC, , AES_256_GCM

Server

151.101.129.229 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

7ed2434b5c1a9b5ae6498c3ab49742b4ba63de914cba8d37035f0072d3c2404c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 05 Jul 2024 11:51:25 GMT
x-content-type-options: nosniff
content-encoding: br
age: 36238
x-jsd-version: 1.0.1
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 494
x-served-by: cache-fra-etou8220027-FRA
x-jsd-version-type: version
etag: W/"674-5X9m1mMOU+NK/DwSIDkdJivsUK0"
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H3 200 waifu-tips.json Show response
fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/ 11 KB
5 KB 81ms
37ms Fetch
application/json 151.101.129.229
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/waifu-tips.json

Requested by

Host: fastly.jsdelivr.net
URL: https://fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/waifu-tips.js

Protocol

Security

QUIC, , AES_256_GCM

Server

151.101.129.229 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

8785a3daf3723b7a8f708249b4cdd10faefcbfb1c70546a00d4fa92ea6197fbb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 05 Jul 2024 11:51:25 GMT
x-content-type-options: nosniff
content-encoding: br
age: 29574
x-jsd-version: 0.9.0
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 5028
x-served-by: cache-fra-etou8220027-FRA
x-jsd-version-type: version
etag: W/"2d1c-rJaQFqZ8liM2qrulZBaBuzUPV4U"
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H3 200 index.json Show response
fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/ 1 KB
717 B 32ms
31ms XHR
application/json 151.101.129.229
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/index.json

Requested by

Host: fastly.jsdelivr.net
URL: https://fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/live2d.min.js

Protocol

Security

QUIC, , AES_256_GCM

Server

151.101.129.229 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

b718cca2727a8043608202e3adccb528433f15e14a30e9d752d047ac5fd123bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 05 Jul 2024 11:51:25 GMT
x-content-type-options: nosniff
content-encoding: br
age: 9510
x-jsd-version: 1.0.1
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 364
x-served-by: cache-fra-etou8220027-FRA
x-jsd-version-type: version
etag: W/"537-PuSMBXf54kkeGutzZrRkznlTed8"
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H3 200 model.moc Show response
fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/ 99 KB
99 KB 34ms
34ms XHR
application/octet-stream 151.101.129.229
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/model.moc

Requested by

Host: fastly.jsdelivr.net
URL: https://fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/live2d.min.js

Protocol

Security

QUIC, , AES_256_GCM

Server

151.101.129.229 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

f19c7a20bf7eafcc1ef303b9c9c52d0face97aa0990129aeddec8d5e089d1ef5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 05 Jul 2024 11:51:25 GMT
x-content-type-options: nosniff
age: 41007
x-jsd-version: 1.0.1
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 101353
x-served-by: cache-fra-etou8220027-FRA
x-jsd-version-type: version
etag: W/"18be9-7Evs37ZKciqHiqae2EKQQ0Avclk"
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H3 200 default-costume.png
fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/textures/ 445 KB
446 KB 50ms
50ms Image
image/png 151.101.129.229
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/textures/default-costume.png

Requested by

Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/

Protocol

Security

QUIC, , AES_256_GCM

Server

151.101.129.229 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

42804a9e7164fbefa4144704c963a7e3a06d389ec83d0a731e5c902cea594043

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Origin: https://www.hedan.rr.nu
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 05 Jul 2024 11:51:25 GMT
x-content-type-options: nosniff
age: 17420
x-jsd-version: 1.0.1
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 455918
x-served-by: cache-fra-etou8220027-FRA
x-jsd-version-type: version
etag: W/"6f4ee-zdl5Jl0LhU3YZ5EZ1zwu6jDg430"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H3 200 Breath1.mtn Show response
fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/motions/ 3 KB
4 KB 44ms
44ms XHR
application/octet-stream 151.101.129.229
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/motions/Breath1.mtn

Requested by

Host: fastly.jsdelivr.net
URL: https://fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/live2d.min.js

Protocol

Security

QUIC, , AES_256_GCM

Server

151.101.129.229 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

21c4df569b781c179cf31af94f160d786c7b8242bedeea5bc4e9be321c5be906

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 05 Jul 2024 11:51:25 GMT
x-content-type-options: nosniff
age: 25077
x-jsd-version: 1.0.1
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 3283
x-served-by: cache-fra-etou8220027-FRA
x-jsd-version-type: version
etag: W/"cd3-6f4q1oumauLL+NL0ZiuumzFEscw"
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H3 200 Breath2.mtn Show response
fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/motions/ 6 KB
7 KB 56ms
55ms XHR
application/octet-stream 151.101.129.229
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/motions/Breath2.mtn

Requested by

Host: fastly.jsdelivr.net
URL: https://fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/live2d.min.js

Protocol

Security

QUIC, , AES_256_GCM

Server

151.101.129.229 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

e073ab0c5ad4ffe4bad2ddac87433a6937e10e0c40a84e6a6c285dc2c8890d6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 05 Jul 2024 11:51:25 GMT
x-content-type-options: nosniff
age: 2387
x-jsd-version: 1.0.1
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 6489
x-served-by: cache-fra-etou8220027-FRA
x-jsd-version-type: version
etag: W/"1959-HBs1QZ4jcyfl1vcYe3c40rhT+pI"
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H3 200 Breath3.mtn Show response
fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/motions/ 9 KB
9 KB 46ms
45ms XHR
application/octet-stream 151.101.129.229
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/motions/Breath3.mtn

Requested by

Host: fastly.jsdelivr.net
URL: https://fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/live2d.min.js

Protocol

Security

QUIC, , AES_256_GCM

Server

151.101.129.229 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

1eb42542e7f5b645f4b83ceac7bae8194d1b86fa2602385da22286fe8a330a98

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 05 Jul 2024 11:51:25 GMT
x-content-type-options: nosniff
age: 2883
x-jsd-version: 1.0.1
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 9363
x-served-by: cache-fra-etou8220027-FRA
x-jsd-version-type: version
etag: W/"2493-hIwnQKC4JKU8WSyAUs4GRTsco0Y"
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H3 200 Breath5.mtn Show response
fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/motions/ 12 KB
13 KB 52ms
51ms XHR
application/octet-stream 151.101.129.229
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/motions/Breath5.mtn

Requested by

Host: fastly.jsdelivr.net
URL: https://fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/live2d.min.js

Protocol

Security

QUIC, , AES_256_GCM

Server

151.101.129.229 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

c5f8f19c7cbec6a8107e742297fb4e79fd781121ad468ec30e37b058f5494556

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 05 Jul 2024 11:51:25 GMT
x-content-type-options: nosniff
age: 37937
x-jsd-version: 1.0.1
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 12530
x-served-by: cache-fra-etou8220027-FRA
x-jsd-version-type: version
etag: W/"30f2-30VVHrCFvWDsDaKqBTv1DTYvj5g"
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H3 200 Breath7.mtn Show response
fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/motions/ 9 KB
9 KB 53ms
53ms XHR
application/octet-stream 151.101.129.229
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/motions/Breath7.mtn

Requested by

Host: fastly.jsdelivr.net
URL: https://fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/live2d.min.js

Protocol

Security

QUIC, , AES_256_GCM

Server

151.101.129.229 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

d34775b817bf40359e2d9dd90749d5e32355e3ed2325700e80b90347fb65558c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 05 Jul 2024 11:51:25 GMT
x-content-type-options: nosniff
age: 22894
x-jsd-version: 1.0.1
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 9310
x-served-by: cache-fra-etou8220027-FRA
x-jsd-version-type: version
etag: W/"245e-HPzLJPkqBz6fZEyqpm1PZCaV2HM"
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H3 200 Breath8.mtn Show response
fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/motions/ 12 KB
13 KB 54ms
53ms XHR
application/octet-stream 151.101.129.229
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/motions/Breath8.mtn

Requested by

Host: fastly.jsdelivr.net
URL: https://fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/live2d.min.js

Protocol

Security

QUIC, , AES_256_GCM

Server

151.101.129.229 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

71958456c6d32df0e3120ab972e0caa220108f11628e65617c26b83a313b86e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 05 Jul 2024 11:51:25 GMT
x-content-type-options: nosniff
age: 7835
x-jsd-version: 1.0.1
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 12528
x-served-by: cache-fra-etou8220027-FRA
x-jsd-version-type: version
etag: W/"30f0-0rit+8rxB/YXzZQBz3y6wma5Icc"
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H3 200 Breath9.mtn Show response
fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/motions/ 10 KB
10 KB 45ms
44ms XHR
application/octet-stream 151.101.129.229
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/motions/Breath9.mtn

Requested by

Host: fastly.jsdelivr.net
URL: https://fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/live2d.min.js

Protocol

Security

QUIC, , AES_256_GCM

Server

151.101.129.229 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

1a694fe6913171fcd6a000ce17bf774f84a9e9c0fb14df9ff1961baeeec3f23b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 05 Jul 2024 11:51:25 GMT
x-content-type-options: nosniff
age: 30553
x-jsd-version: 1.0.1
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 9882
x-served-by: cache-fra-etou8220027-FRA
x-jsd-version-type: version
etag: W/"269a-4Yuji2K0F9yz4t974VzLnEh3iNY"
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H3 200 Sleeping.mtn Show response
fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/motions/ 24 KB
25 KB 45ms
45ms XHR
application/octet-stream 151.101.129.229
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/motions/Sleeping.mtn

Requested by

Host: fastly.jsdelivr.net
URL: https://fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/live2d.min.js

Protocol

Security

QUIC, , AES_256_GCM

Server

151.101.129.229 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

fe42aebb3acdf53d4edaef71733067238d10b6a78aad19299c3a24b06db1b4fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Fri, 05 Jul 2024 11:51:25 GMT
x-content-type-options: nosniff
age: 633
x-jsd-version: 1.0.1
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 25043
x-served-by: cache-fra-etou8220027-FRA
x-jsd-version-type: version
etag: W/"61d3-fNTCqWHqtE+crIz0neloUMXb0g0"
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H3 200 Breath1.mtn Show response
fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/motions/ 3 KB
0 41ms
41ms XHR
application/octet-stream 151.101.129.229
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://fastly.jsdelivr.net/gh/fghrsh/live2d_api/model/Potion-Maker/Tia/motions/Breath1.mtn

Requested by

Host: fastly.jsdelivr.net
URL: https://fastly.jsdelivr.net/gh/stevenjoezhang/live2d-widget@latest/live2d.min.js

Protocol

Security

QUIC, , AES_256_GCM

Server

151.101.129.229 San Francisco, United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

21c4df569b781c179cf31af94f160d786c7b8242bedeea5bc4e9be321c5be906

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 05 Jul 2024 11:51:25 GMT
x-content-type-options: nosniff
age: 25077
x-jsd-version: 1.0.1
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 3283
x-served-by: cache-fra-etou8220027-FRA
x-jsd-version-type: version
etag: W/"cd3-6f4q1oumauLL+NL0ZiuumzFEscw"
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

POST
H/1.1 204
No Content collect Show response
q.clarity.ms/ 0
279 B 121ms
121ms XHR
text/plain 20.231.53.73
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://q.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.34/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.231.53.73 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept: application/x-clarity-gzip
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Access-Control-Allow-Origin: https://www.hedan.rr.nu
Date: Fri, 05 Jul 2024 11:51:26 GMT
Access-Control-Allow-Credentials: true
Server: nginx
Connection: keep-alive
Vary: Origin
Request-Context: appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8

GET
H/1.1

200
OK

player-l.css
api.myhkw.cn/cache/css/
Redirect Chain

https://myhkw.cn/api/playercss?id=demo
https://api.myhkw.cn/cache/css/player-l.css?v=20240630

27 KB
6 KB

1378ms
235ms

Stylesheet
text/css

110.42.2.205
CHINATELECOM-ZHEJ...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.myhkw.cn/cache/css/player-l.css?v=20240630
Requested by: Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/
Protocol: HTTP/1.1
Server: 110.42.2.205 , China, ASN136188 (CHINATELECOM-ZHEJIANG-NINGBO-IDC NINGBO, ZHEJIANG Province, P.R.China., CN),
Reverse DNS
Software: nginx /
Resource Hash: 9dd2b5c4ab64c7d98baee85a3e4bed2ad319dd8548b191aed554a8ffdb44b0ae

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.hedan.rr.nu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

Date: Fri, 05 Jul 2024 11:59:19 GMT
Content-Encoding: gzip
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/css
Access-Control-Allow-Origin: *
wb_list: not_in_list
Access-Control-Allow-Credentials: true
cache_hit: hit
Access-Control-Allow-Headers: x-csrf-token,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
Content-Length: 5585

Redirect headers

Date: Fri, 05 Jul 2024 11:51:26 GMT
Strict-Transport-Security: max-age=31536000
via: bdengine-75f66ccb55-zknx4
x-tt-trace-tag: id=5
Transfer-Encoding: chunked
X-Bdcdn-Cache-Status: TCP_MISS
Connection: keep-alive
x-request-id: 9e101ac60dc2f2955329e7496069ce85
Server: Byte-nginx
Access-Control-Max-Age: 1800
Access-Control-Allow-Methods: GET, POST, PATCH, PUT, DELETE, OPTIONS
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://api.myhkw.cn/cache/css/player-l.css?v=20240630
x-request-ip: 217.114.218.20
Cache-Control: no-cache,must-revalidate
Access-Control-Allow-Credentials: true
x-response-cinfo: 217.114.218.20
x-response-cache: miss
Access-Control-Allow-Headers: Authorization, Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, X-CSRF-TOKEN, X-Requested-With

GET
H2

200

demo.js Show response
cdn.myhkw.cn/cache/playlist/
Redirect Chain

https://myhkw.cn/api/playlist?id=demo
https://cdn.myhkw.cn/cache/playlist/demo.js?v=20240430-1720109201

286 KB
108 KB

3342ms
1542ms

XHR
application/javascript

101.42.40.156
TENCENT-NET-AP Sh...

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.myhkw.cn/cache/playlist/demo.js?v=20240430-1720109201

Requested by

Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/

Protocol

Server

101.42.40.156 Beijing, China, ASN45090 (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),

Reverse DNS

Software

nginx /

Resource Hash

1091869ea9381acffa3fc0e788eecf199747ff18241a79f94fc444f5da3e80de

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.hedan.rr.nu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Fri, 05 Jul 2024 11:51:29 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
last-modified: Thu, 04 Jul 2024 16:05:10 GMT
server: nginx
etag: W/"6686c836-477b3"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=43200
access-control-allow-credentials: true
access-control-allow-headers: x-csrf-token,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
expires: Fri, 05 Jul 2024 23:51:29 GMT

Redirect headers

Date: Fri, 05 Jul 2024 11:51:27 GMT
Strict-Transport-Security: max-age=31536000
via: bdengine-75f66ccb55-lpsqd
x-tt-trace-tag: id=5
Transfer-Encoding: chunked
X-Bdcdn-Cache-Status: TCP_MISS
Connection: keep-alive
x-request-id: 9e914ffbb827a3b235643f1c4019ed98
Server: Byte-nginx
Access-Control-Max-Age: 1800
Access-Control-Allow-Methods: GET, POST, PATCH, PUT, DELETE, OPTIONS
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cdn.myhkw.cn/cache/playlist/demo.js?v=20240430-1720109201
x-request-ip: 217.114.218.20
Cache-Control: no-cache,must-revalidate
Access-Control-Allow-Credentials: true
x-response-cinfo: 217.114.218.20
x-response-cache: miss
Access-Control-Allow-Headers: Authorization, Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, X-CSRF-TOKEN, X-Requested-With

GET
H2 200 c Show response
api.tongjiniao.com/ 11 KB
4 KB 999ms
270ms Script
text/plain 113.13.246.102
CHINANET-BACKBONE...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.tongjiniao.com/c?_=610877997219291136
Requested by: Host: www.hedan.rr.nu
URL: https://www.hedan.rr.nu/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 113.13.246.102 , China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),
Reverse DNS
Software: nginx /
Resource Hash: 45cd9f34002a0f28737e26b85712c88fcca730d8d1f65ec4aa33c7925184c240

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 05 Jul 2024 11:51:27 GMT
content-encoding: br
server: nginx
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
cache-control: no-cache,no-store, no-cache
access-control-allow-credentials: true
access-control-allow-headers: DNT,Keep-Alive,User-Agent,Cache-Control,Content-Type,Authorization
content-length: 4186

POST
H2 200 r Show response
api.tongjiniao.com/ 42 B
305 B 686ms
233ms XHR
application/json 113.13.246.102
CHINANET-BACKBONE...

General

Check archive.org

Show headers Download Go to

Full URL: https://api.tongjiniao.com/r?t=1720180287&p=667818288559321088
Requested by: Host: api.tongjiniao.com
URL: https://api.tongjiniao.com/c?_=610877997219291136
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 113.13.246.102 , China, ASN4134 (CHINANET-BACKBONE No.31,Jin-rong Street, CN),
Reverse DNS
Software: nginx /
Resource Hash: 7ee2a3a5e4b1e50bb31b22d8399f9917073e0421d56c5da3699371ec79af2082

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
sec-ch-ua-platform: "Win32"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Fri, 05 Jul 2024 11:51:28 GMT
content-encoding: br
server: nginx
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: no-cache,no-store, no-cache
access-control-allow-credentials: true
access-control-allow-headers: DNT,Keep-Alive,User-Agent,Cache-Control,Content-Type,Authorization
content-length: 46

GET
H/1.1 200
OK link.cur
api.myhkw.cn/player/css/ 4 KB
5 KB 236ms
236ms Image
application/octet-stream 110.42.2.205
CHINATELECOM-ZHEJ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://api.myhkw.cn/player/css/link.cur
Requested by: Host: api.myhkw.cn
URL: https://api.myhkw.cn/cache/css/player-l.css?v=20240630
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 110.42.2.205 , China, ASN136188 (CHINATELECOM-ZHEJIANG-NINGBO-IDC NINGBO, ZHEJIANG Province, P.R.China., CN),
Reverse DNS
Software: nginx /
Resource Hash: 4cb477acd16dffe9da6c574ca89f9e912ae001ea9a6300ca5673aa7b3784ca97

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://api.myhkw.cn/cache/css/player-l.css?v=20240630
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Fri, 05 Jul 2024 11:59:20 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: application/octet-stream
Access-Control-Allow-Origin: *
wb_list: not_in_list
Access-Control-Allow-Credentials: true
cache_hit: hit
Access-Control-Allow-Headers: x-csrf-token,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
Content-Length: 4286

GET
H2 200 myhkfont.woff2
cdn.myhkw.cn/player/icon/ 3 KB
3 KB 917ms
231ms Font
font/woff2 101.42.40.156
TENCENT-NET-AP Sh...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.myhkw.cn/player/icon/myhkfont.woff2
Requested by: Host: api.myhkw.cn
URL: https://api.myhkw.cn/cache/css/player-l.css?v=20240630
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 101.42.40.156 Beijing, China, ASN45090 (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),
Reverse DNS
Software: nginx /
Resource Hash: b2ff75abc0e0ccbd083a87b45e64c9a62f1f6ca32c46445240026a246d30254c

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://api.myhkw.cn/
Origin: https://www.hedan.rr.nu
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 05 Jul 2024 11:51:29 GMT
last-modified: Sun, 14 Nov 2021 10:29:27 GMT
server: nginx
etag: "6190e507-c68"
content-type: font/woff2
access-control-allow-origin: *
accept-ranges: bytes
content-length: 3176

POST
H/1.1 204
No Content collect Show response
q.clarity.ms/ 0
279 B 119ms
119ms XHR
text/plain 20.231.53.73
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://q.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.34/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.231.53.73 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept: application/x-clarity-gzip
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Access-Control-Allow-Origin: https://www.hedan.rr.nu
Date: Fri, 05 Jul 2024 11:51:28 GMT
Access-Control-Allow-Credentials: true
Server: nginx
Connection: keep-alive
Vary: Origin
Request-Context: appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8

GET
H2

200

586e2fd214d9277af9e353cebdfa584b.jpg
img.paulzzh.com/touhou/konachan/image/
Redirect Chain

https://img.paulzzh.com/touhou/random?0.9458146323980605
https://img.paulzzh.com/touhou/konachan/image/586e2fd214d9277af9e353cebdfa584b.jpg

221 KB
221 KB

457ms
457ms

Image
image/jpeg

45.154.12.123
MOACKCOLTD-AS-AP ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.paulzzh.com/touhou/konachan/image/586e2fd214d9277af9e353cebdfa584b.jpg

Protocol

Server

45.154.12.123 , United Kingdom, ASN138195 (MOACKCOLTD-AS-AP MOACK.Co.LTD, KR),

Reverse DNS

Software

nginx /

Resource Hash

fdc01648678f8f3cc842bc584dacbceb76d4913d2e9e820d12838478e29c4db7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.hedan.rr.nu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Fri, 05 Jul 2024 11:51:31 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
last-modified: Fri, 06 Aug 2021 19:46:07 GMT
server: nginx
etag: "610d917f-372f3"
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 226035
expires: Sun, 04 Aug 2024 11:51:31 GMT

Redirect headers

location: https://img.paulzzh.com/touhou/konachan/image/586e2fd214d9277af9e353cebdfa584b.jpg
access-control-allow-origin: *
date: Fri, 05 Jul 2024 11:51:30 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: nginx
content-length: 370
content-type: text/html; charset=utf-8

GET
H2

200

c.gif
c.clarity.ms/
Redirect Chain

https://c.clarity.ms/c.gif
https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=F11526CD2C964345981B4FFE46DE92BB&RedC=c.clarity.ms&MXFR=066B0C5D385E677A313C18EE3C5E69C2
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=F11526CD2C964345981B4FFE46DE92BB&MUID=0C9605CDD0B862423E67117ED16A631C

42 B
441 B

122ms
76ms

Image
image/gif

13.74.129.1
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=F11526CD2C964345981B4FFE46DE92BB&MUID=0C9605CDD0B862423E67117ED16A631C
Protocol: H2
Server: 13.74.129.1 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.hedan.rr.nu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 05 Jul 2024 11:51:29 GMT
last-modified: Tue, 25 Jun 2024 19:30:12 GMT
server: Microsoft-IIS/10.0
etag: "7473f1936c7da1:0"
x-powered-by: ASP.NET
content-type: image/gif
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-length: 42

Redirect headers

pragma: no-cache
date: Fri, 05 Jul 2024 11:51:29 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 4A4FB19A4FF54FBD89F4D5DA8EE8F896 Ref B: FRAEDGE1210 Ref C: 2024-07-05T11:51:30Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location: https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=F11526CD2C964345981B4FFE46DE92BB&MUID=0C9605CDD0B862423E67117ED16A631C
cache-control: private, no-cache, proxy-revalidate, no-store
content-length: 0

GET
H3 200 loading.gif
www.hedan.rr.nu/img/ 121 KB
121 KB 123ms
122ms Other
image/gif 172.66.47.11
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.hedan.rr.nu/img/loading.gif

Protocol

Security

QUIC, , AES_128_GCM

Server

172.66.47.11 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

541e8b7bb29cff24faf737079d4267649f5d2a05a30483a0fe6c86863ab0bb4e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 05 Jul 2024 11:51:29 GMT
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: "5afbc8171943bcdea6f50a657b798452"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wiNx8%2BM2hK%2FxDKCwSeZ0SgXawoyYETnfJaaMT3TAxO3iPxmt8dmiSyAMI10HqJVmnWrARuPt6JMKkeIVusbnrG%2BKnrjPmTGXvdzy2iIyVxgsckRWOto7SVfbwxwIccdRilc%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
cf-ray: 89e724ba285d3603-FRA
alt-svc: h3=":443"; ma=86400
content-length: 123516

GET
H2

200

109951169484028770.jpg
p3.music.126.net/y1h40wgnEzAJKGN0IksUsg==/
Redirect Chain

https://myhkw.cn/api/pic?song=2144209098&pic=109951169484028770&type=wy&id=demo&sign=749/n7RxhZX4Y
https://p3.music.126.net/y1h40wgnEzAJKGN0IksUsg==/109951169484028770.jpg?param=300y300

126 KB
127 KB

2324ms
355ms

Image
image/jpg

240e:c3:2800:200:8000::99
CT-HUNAN-HENGYANG...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p3.music.126.net/y1h40wgnEzAJKGN0IksUsg==/109951169484028770.jpg?param=300y300
Protocol: H2
Server: 240e:c3:2800:200:8000::99 , China, ASN63838 (CT-HUNAN-HENGYANG-IDC Hengyang, CN),
Reverse DNS
Software: Byte-nginx /
Resource Hash: d751057f008ca217326b558c4beca2c8ebd948b50c1f8cd06c3687355899a241

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.hedan.rr.nu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Fri, 05 Jul 2024 11:51:34 GMT
via: cache01.hyct
cdn-ip: 240e:c3:2800:200:8000::99
x-nos-request-id: 238fec300a82000000006680037a6334
x-tt-trace-tag: id=5
content-md5: 11af9ebc630fae049ffe89e690bf7f11
age: 514764
cdn-user-ip: 2001:1b60:2:240:3247::6
x-bdcdn-cache-status: TCP_HIT
x-nos-storage-class: STANDARD
content-length: 129443
x-request-id: 02f651a773c0507b897006949744660c
last-modified: Wed, 10 Apr 2024 10:11:33 Asia/Shanghai
server: Byte-nginx
cdn-source: volc
etag: 77fee26a88a0c51398fd2713906390ed-1
x-nos-requesttype: imageView
access-control-allow-methods: GET,POST,OPTIONS
content-type: image/jpg
access-control-allow-origin: *
cdn-cache: HIT
x-request-ip: 2001:1b60:2:240:3247::6
cache-control: max-age=31536000
access-control-allow-credentials: true
x-response-cinfo: 2001:1b60:2:240:3247::6
x-response-cache: edge_hit
timing-allow-origin: *
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

Redirect headers

Date: Fri, 05 Jul 2024 11:51:32 GMT
Strict-Transport-Security: max-age=31536000
via: bdengine-75f66ccb55-zknx4
x-tt-trace-tag: id=5
Transfer-Encoding: chunked
X-Bdcdn-Cache-Status: TCP_MISS
Connection: keep-alive
x-request-id: b9aeeb1069cf7b66e574395c7cb4535d
Server: Byte-nginx
Access-Control-Max-Age: 1800
Access-Control-Allow-Methods: GET, POST, PATCH, PUT, DELETE, OPTIONS
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://p3.music.126.net/y1h40wgnEzAJKGN0IksUsg==/109951169484028770.jpg?param=300y300
x-request-ip: 217.114.218.20
Cache-Control: no-cache,must-revalidate
Access-Control-Allow-Credentials: true
x-response-cinfo: 217.114.218.20
x-response-cache: miss
Access-Control-Allow-Headers: Authorization, Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, X-CSRF-TOKEN, X-Requested-With

GET
H2

206

83bceee69e40dea5aa652fa9f7430735.mp3
m801.music.126.net/20240705201632/6b1d29d953a008cfbd4ab15950a2abb7/jdymusic/obj/wo3DlMOGwrbDjj7DisKw/35121150388/9599/98ef/5bfc/
Redirect Chain

https://myhkw.cn/api/url?song=2144209098&type=wy&id=demo&sign=749/n7RxhZX4Y
https://m801.music.126.net/20240705201632/6b1d29d953a008cfbd4ab15950a2abb7/jdymusic/obj/wo3DlMOGwrbDjj7DisKw/35121150388/9599/98ef/5bfc/83bceee69e40dea5aa652fa9f7430735.mp3

3 MB
0

1395ms
34ms

Media
audio/mpeg

2404:2280:1cc:0:3::a
TAOBAO Zhejiang T...

General

Check archive.org

Show headers Download Go to

Full URL: https://m801.music.126.net/20240705201632/6b1d29d953a008cfbd4ab15950a2abb7/jdymusic/obj/wo3DlMOGwrbDjj7DisKw/35121150388/9599/98ef/5bfc/83bceee69e40dea5aa652fa9f7430735.mp3
Protocol: H2
Server: 2404:2280:1cc:0:3::a , Singapore, ASN24429 (TAOBAO Zhejiang Taobao Network Co.,Ltd, CN),
Reverse DNS
Software: Tengine /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.hedan.rr.nu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Wed, 10 Apr 2024 12:00:44 GMT
via: cache23.l2cm10-2[0,0,206-0,H], cache4.l2cm10-2[1,0], cache9.l2st3-1[0,0,206-0,H], cache9.l2st3-1[1,0], cache9.l2st3-1[1,0], cache15.l2hk2[0,0,206-0,H], cache13.l2hk2[1,0], cache39.l2fr1[0,0,206-0,H], cache25.l2fr1[1,0], ens-cache7.de5[0,0,206-0,H], ens-cache10.de5[2,0]
x-nos-object-name: obj%2Fwo3DlMOGwrbDjj7DisKw%2F35121150388%2F9599%2F98ef%2F5bfc%2F83bceee69e40dea5aa652fa9f7430735.mp3
x-nos-request-id: 387f699a-00d0-4fc1-91ba-3ecbd117d5b3
cdn-ip: 2404:2280:1cc:0:3::a
age: 7429850
x-swift-cachetime: 25644260
x-cache: HIT TCP_HIT dirn:12:756481540 mlen:0
cdn-user-ip: 2001:1b60:2:240:3247::6
Content-Range: bytes 0-3790892/3790893
content-disposition: inline; filename="obj%2Fwo3DlMOGwrbDjj7DisKw%2F35121150388%2F9599%2F98ef%2F5bfc%2F83bceee69e40dea5aa652fa9f7430735.mp3"
x-swift-savetime: Mon, 17 Jun 2024 16:36:24 GMT
x-nos-storage-class: STANDARD
Content-Length: 3790893
last-modified: Wed, 10 Apr 2024 09:43:36 GMT
server: Tengine
x-nos-meta-origin-md5: 83bceee69e40dea5aa652fa9f7430735
cdn-source: ali
etag: "83bceee69e40dea5aa652fa9f7430735"
x-nos-requesttype: GetObject
ali-swift-global-savetime: 1712750444
content-type: audio/mpeg; charset=UTF-8
access-control-allow-origin: *
access-control-allow-methods: GET,POST,OPTIONS
access-control-expose-headers: Content-Range, Last-Modified
access-control-allow-credentials: true
cache: state
timing-allow-origin: *
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
eagleid: a3b55c9e17201802941844009e

Redirect headers

Date: Fri, 05 Jul 2024 11:51:32 GMT
Strict-Transport-Security: max-age=31536000
via: bdengine-75f66ccb55-lpsqd
x-tt-trace-tag: id=5
Transfer-Encoding: chunked
X-Bdcdn-Cache-Status: TCP_MISS
Connection: keep-alive
x-request-id: 3f289051480f62c052168674dae84a86
Server: Byte-nginx
Access-Control-Max-Age: 1800
Access-Control-Allow-Methods: GET, POST, PATCH, PUT, DELETE, OPTIONS
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://m801.music.126.net/20240705201632/6b1d29d953a008cfbd4ab15950a2abb7/jdymusic/obj/wo3DlMOGwrbDjj7DisKw/35121150388/9599/98ef/5bfc/83bceee69e40dea5aa652fa9f7430735.mp3
x-request-ip: 217.114.218.20
Cache-Control: no-cache,must-revalidate
Access-Control-Allow-Credentials: true
x-response-cinfo: 217.114.218.20
x-response-cache: miss
Access-Control-Allow-Headers: Authorization, Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, X-CSRF-TOKEN, X-Requested-With

GET
H2

200

wy-2144209098-b1iFf46SqiyN6.js Show response
cdn.myhkw.cn/cache/lyrics/
Redirect Chain

https://myhkw.cn/api/lyrics?song=2144209098&type=wy&id=demo&sign=749/n7RxhZX4Y&ksc=54&_=1720180285011
https://cdn.myhkw.cn/cache/lyrics/wy-2144209098-b1iFf46SqiyN6.js?v=20240430-1720109201

3 KB
1 KB

210ms
210ms

XHR
application/javascript

101.42.40.156
TENCENT-NET-AP Sh...

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.myhkw.cn/cache/lyrics/wy-2144209098-b1iFf46SqiyN6.js?v=20240430-1720109201

Protocol

Server

101.42.40.156 Beijing, China, ASN45090 (TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited, CN),

Reverse DNS

Software

nginx /

Resource Hash

4ca71aff6268498e0eda841d243a4296710019c2b03e581630e4e2b40940ed41

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.hedan.rr.nu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Fri, 05 Jul 2024 11:51:32 GMT
strict-transport-security: max-age=31536000
content-encoding: gzip
last-modified: Thu, 04 Jul 2024 16:05:14 GMT
server: nginx
etag: W/"6686c83a-ca7"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=43200
access-control-allow-credentials: true
access-control-allow-headers: x-csrf-token,DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
expires: Fri, 05 Jul 2024 23:51:32 GMT

Redirect headers

Date: Fri, 05 Jul 2024 11:51:32 GMT
Strict-Transport-Security: max-age=31536000
via: bdengine-75f66ccb55-lpsqd
x-tt-trace-tag: id=5
Transfer-Encoding: chunked
X-Bdcdn-Cache-Status: TCP_MISS
Connection: keep-alive
x-request-id: 15693de4eeed97417d4e6f2c2696bf4d
Server: Byte-nginx
Access-Control-Max-Age: 1800
Access-Control-Allow-Methods: GET, POST, PATCH, PUT, DELETE, OPTIONS
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cdn.myhkw.cn/cache/lyrics/wy-2144209098-b1iFf46SqiyN6.js?v=20240430-1720109201
x-request-ip: 217.114.218.20
Cache-Control: no-cache,must-revalidate
Access-Control-Allow-Credentials: true
x-response-cinfo: 217.114.218.20
x-response-cache: miss
Access-Control-Allow-Headers: Authorization, Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, X-CSRF-TOKEN, X-Requested-With

POST
H/1.1 204
No Content collect Show response
q.clarity.ms/ 0
279 B 386ms
144ms XHR
text/plain 20.231.53.73
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://q.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.34/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.231.53.73 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept: application/x-clarity-gzip
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Access-Control-Allow-Origin: https://www.hedan.rr.nu
Date: Fri, 05 Jul 2024 11:51:32 GMT
Access-Control-Allow-Credentials: true
Server: nginx
Connection: keep-alive
Vary: Origin
Request-Context: appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8

GET
H/1.1 200
OK color Show response
myhkw.cn/api/ 47 B
1 KB 281ms
281ms Script
application/x-javascript 116.207.181.224
CHINATELECOM-HUBE...

General

Check archive.org

Show headers Download Go to

Full URL

https://myhkw.cn/api/color?song=2144209098&type=wy&pic=109951169484028770&id=demo&sign=749%2Fn7RxhZX4Y&_=1720180285012

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/jquery@3.2/dist/jquery.min.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

116.207.181.224 , China, ASN136191 (CHINATELECOM-HUBEI-YICHANG-IDC YICHANG, Hubei Province, P.R.China., CN),

Reverse DNS

Software

Byte-nginx /

Resource Hash

2b072113d20de17990be4c43b88e695e5fb2b76d4bd232a2b9a2b20ccbfc4221

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Fri, 05 Jul 2024 11:51:35 GMT
Content-Encoding: gzip
via: bdengine-75f66ccb55-lpsqd
Strict-Transport-Security: max-age=31536000
x-tt-trace-tag: id=5
Transfer-Encoding: chunked
X-Bdcdn-Cache-Status: TCP_MISS
Connection: keep-alive
x-request-id: 1fceb44e7d30a8528476b42835a842d5
Server: Byte-nginx
Access-Control-Max-Age: 1800
Access-Control-Allow-Methods: GET, POST, PATCH, PUT, DELETE, OPTIONS
Content-Type: application/x-javascript; charset=utf-8
Access-Control-Allow-Origin: *
x-request-ip: 217.114.218.20
Vary: Accept-Encoding
Access-Control-Allow-Credentials: true
x-response-cinfo: 217.114.218.20
x-response-cache: miss
Access-Control-Allow-Headers: Authorization, Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, X-CSRF-TOKEN, X-Requested-With

POST
H/1.1 204
No Content collect Show response
q.clarity.ms/ 0
279 B 426ms
169ms XHR
text/plain 20.231.53.73
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://q.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.34/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.231.53.73 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept: application/x-clarity-gzip
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Access-Control-Allow-Origin: https://www.hedan.rr.nu
Date: Fri, 05 Jul 2024 11:51:37 GMT
Access-Control-Allow-Credentials: true
Server: nginx
Connection: keep-alive
Vary: Origin
Request-Context: appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8

GET
H2

200

fa4b177419fce5c8de4ae4f0c125a11d.jpg
img.paulzzh.com/touhou/konachan/image/
Redirect Chain

https://img.paulzzh.com/touhou/random?0.6461772809886324
https://img.paulzzh.com/touhou/konachan/image/fa4b177419fce5c8de4ae4f0c125a11d.jpg

87 KB
87 KB

388ms
388ms

Image
image/jpeg

45.154.12.123
MOACKCOLTD-AS-AP ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.paulzzh.com/touhou/konachan/image/fa4b177419fce5c8de4ae4f0c125a11d.jpg

Protocol

Server

45.154.12.123 , United Kingdom, ASN138195 (MOACKCOLTD-AS-AP MOACK.Co.LTD, KR),

Reverse DNS

Software

nginx /

Resource Hash

5502c2a10b71db8276582a2ec6cd9854d553c110953c307d69af0ea69753bfa9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.hedan.rr.nu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Fri, 05 Jul 2024 11:51:38 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
last-modified: Fri, 06 Aug 2021 19:28:57 GMT
server: nginx
etag: "610d8d79-15afa"
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 88826
expires: Sun, 04 Aug 2024 11:51:38 GMT

Redirect headers

location: https://img.paulzzh.com/touhou/konachan/image/fa4b177419fce5c8de4ae4f0c125a11d.jpg
access-control-allow-origin: *
date: Fri, 05 Jul 2024 11:51:38 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: nginx
content-length: 370
content-type: text/html; charset=utf-8

POST
H/1.1 204
No Content collect Show response
q.clarity.ms/ 0
279 B 164ms
164ms XHR
text/plain 20.231.53.73
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://q.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.34/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.231.53.73 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept: application/x-clarity-gzip
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Access-Control-Allow-Origin: https://www.hedan.rr.nu
Date: Fri, 05 Jul 2024 11:51:42 GMT
Access-Control-Allow-Credentials: true
Server: nginx
Connection: keep-alive
Vary: Origin
Request-Context: appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8

GET
H2

200

56682a25b9dc3fc46d6a20df2fccf69c.jpg
img.paulzzh.com/touhou/konachan/image/
Redirect Chain

https://img.paulzzh.com/touhou/random?0.7010095440573152
https://img.paulzzh.com/touhou/konachan/image/56682a25b9dc3fc46d6a20df2fccf69c.jpg

1 MB
1 MB

382ms
382ms

Image
image/jpeg

45.154.12.123
MOACKCOLTD-AS-AP ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.paulzzh.com/touhou/konachan/image/56682a25b9dc3fc46d6a20df2fccf69c.jpg

Protocol

Server

45.154.12.123 , United Kingdom, ASN138195 (MOACKCOLTD-AS-AP MOACK.Co.LTD, KR),

Reverse DNS

Software

nginx /

Resource Hash

6679d2d00ec4fa18186a59c720a2e60f14600825815218b622bc735f440215f4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.hedan.rr.nu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Fri, 05 Jul 2024 11:51:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
last-modified: Fri, 06 Aug 2021 19:41:16 GMT
server: nginx
etag: "610d905c-102b03"
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 1059587
expires: Sun, 04 Aug 2024 11:51:45 GMT

Redirect headers

location: https://img.paulzzh.com/touhou/konachan/image/56682a25b9dc3fc46d6a20df2fccf69c.jpg
access-control-allow-origin: *
date: Fri, 05 Jul 2024 11:51:45 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: nginx
content-length: 370
content-type: text/html; charset=utf-8

POST
H/1.1 204
No Content collect Show response
q.clarity.ms/ 0
279 B 395ms
141ms XHR
text/plain 20.231.53.73
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://q.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.34/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.231.53.73 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept: application/x-clarity-gzip
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Access-Control-Allow-Origin: https://www.hedan.rr.nu
Date: Fri, 05 Jul 2024 11:51:51 GMT
Access-Control-Allow-Credentials: true
Server: nginx
Connection: keep-alive
Vary: Origin
Request-Context: appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8

GET
H2

200

5d3df11fd766a1751322be73ca4a44ab.jpg
img.paulzzh.com/touhou/konachan/jpeg/
Redirect Chain

https://img.paulzzh.com/touhou/random?0.6524199555166075
https://img.paulzzh.com/touhou/konachan/jpeg/5d3df11fd766a1751322be73ca4a44ab.jpg

236 KB
236 KB

364ms
364ms

Image
image/jpeg

45.154.12.123
MOACKCOLTD-AS-AP ...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img.paulzzh.com/touhou/konachan/jpeg/5d3df11fd766a1751322be73ca4a44ab.jpg

Protocol

Server

45.154.12.123 , United Kingdom, ASN138195 (MOACKCOLTD-AS-AP MOACK.Co.LTD, KR),

Reverse DNS

Software

nginx /

Resource Hash

571826541b25322984ee2f549b7fa92df9b4bc5b6725cdb3ea9cedf42c9b7be6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://www.hedan.rr.nu/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

Response headers

date: Fri, 05 Jul 2024 11:51:55 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
last-modified: Fri, 06 Aug 2021 19:31:22 GMT
server: nginx
etag: "610d8e0a-3ae43"
content-type: image/jpeg
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 241219
expires: Sun, 04 Aug 2024 11:51:55 GMT

Redirect headers

location: https://img.paulzzh.com/touhou/konachan/jpeg/5d3df11fd766a1751322be73ca4a44ab.jpg
access-control-allow-origin: *
date: Fri, 05 Jul 2024 11:51:55 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
server: nginx
content-length: 368
content-type: text/html; charset=utf-8

POST
H/1.1 204
No Content collect Show response
q.clarity.ms/ 0
279 B 475ms
164ms XHR
text/plain 20.231.53.73
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://q.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.34/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 20.231.53.73 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="126", "Not:A-Brand";v="8", "Chromium";v="126"
Accept: application/x-clarity-gzip
Referer: https://www.hedan.rr.nu/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Access-Control-Allow-Origin: https://www.hedan.rr.nu
Date: Fri, 05 Jul 2024 11:51:59 GMT
Access-Control-Allow-Credentials: true
Server: nginx
Connection: keep-alive
Vary: Origin
Request-Context: appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: apii.ctose.cn
URL: https://apii.ctose.cn/live2d/Source-One/default/autoload.js

Verdicts & Comments Add Verdict or Comment

116 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

10 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.clarity.ms/	1970-01-21 06:35:16	Name: CLID Value: aabaac1212a2469985b1e967ba70ac56.20240705.20250705
.rr.nu/	1970-01-21 06:35:16	Name: _clck Value: 11sjjqh%7C2%7Cfn7%7C0%7C1647
.rr.nu/	1970-01-20 21:51:06	Name: _clsk Value: iq209g%7C1720180285496%7C1%7C1%7Cq.clarity.ms%2Fcollect
.bing.com/	1970-01-21 07:11:16	Name: MUID Value: 0C9605CDD0B862423E67117ED16A631C
.c.bing.com/	1970-01-20 21:59:45	Name: MR Value: 0
.c.bing.com/	1970-01-21 07:11:16	Name: SRM_B Value: 0C9605CDD0B862423E67117ED16A631C
.c.clarity.ms/	1969-12-31 23:59:59	Name: SM Value: C
.clarity.ms/	1970-01-21 07:11:16	Name: MUID Value: 0C9605CDD0B862423E67117ED16A631C
.c.clarity.ms/	1970-01-20 21:59:45	Name: MR Value: 0
.c.clarity.ms/	1970-01-20 21:49:40	Name: ANONCHK Value: 0

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://www.hedan.rr.nu/ Message: Refused to execute script from 'https://www.hedan.rr.nu/static/js/main.js' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.
network	error	URL: https://apii.ctose.cn/live2d/Source-One/default/autoload.js Message: Failed to load resource: net::ERR_BLOCKED_BY_RESPONSE.NotSameOrigin

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.myhkw.cn
api.tongjiniao.com
apii.ctose.cn
c.bing.com
c.clarity.ms
cdn.bootcss.com
cdn.jsdelivr.net
cdn.myhkw.cn
fastly.jsdelivr.net
fonts.googleapis.com
fonts.gstatic.com
img.paulzzh.com
m801.music.126.net
myhkw.cn
p3.music.126.net
q.clarity.ms
www.clarity.ms
www.hedan.rr.nu
apii.ctose.cn
101.42.40.156
110.42.2.205
113.13.246.102
116.207.181.224
13.74.129.1
151.101.129.229
154.85.69.9
172.66.47.11
20.231.53.73
2404:2280:1cc:0:3::a
240e:c3:2800:200:8000::99
2620:1ec:29:1::45
2620:1ec:c11::237
2a00:1450:4001:80b::200a
2a00:1450:4001:829::2003
2a04:4e42:600::485
45.154.12.123
050c1211e2f1b838207de3de15da3757dd3aadcbdc269912018aff2ea736a12a
06561773aec97881597f18ec78be970815858bb330c4aa14105eab3c8cc79813
1091869ea9381acffa3fc0e788eecf199747ff18241a79f94fc444f5da3e80de
190948952131adf151e50aa94c281280992382a048030b7daae0e42e0939356c
1a694fe6913171fcd6a000ce17bf774f84a9e9c0fb14df9ff1961baeeec3f23b
1eb42542e7f5b645f4b83ceac7bae8194d1b86fa2602385da22286fe8a330a98
2135c76b0a63d0f6c9c48df746d0eec6ead131999ba6f9678488472e95e1edd6
21c4df569b781c179cf31af94f160d786c7b8242bedeea5bc4e9be321c5be906
2b072113d20de17990be4c43b88e695e5fb2b76d4bd232a2b9a2b20ccbfc4221
427f7a363b07e17ab7900d38d315c2bb2e4e66f8239f837c72de4321931117d9
42804a9e7164fbefa4144704c963a7e3a06d389ec83d0a731e5c902cea594043
455ecebc82403fdcfdc760886996690b4793c4d86834577fd99861fbb50b4bfe
45cd9f34002a0f28737e26b85712c88fcca730d8d1f65ec4aa33c7925184c240
485463b08985a0daa7c07c82972e1e09c90d665726f8180fe7dc358f7fcb5a3e
4ca71aff6268498e0eda841d243a4296710019c2b03e581630e4e2b40940ed41
4cb477acd16dffe9da6c574ca89f9e912ae001ea9a6300ca5673aa7b3784ca97
541e8b7bb29cff24faf737079d4267649f5d2a05a30483a0fe6c86863ab0bb4e
5502c2a10b71db8276582a2ec6cd9854d553c110953c307d69af0ea69753bfa9
571826541b25322984ee2f549b7fa92df9b4bc5b6725cdb3ea9cedf42c9b7be6
5e245f87c91e4cc60c4f66311f2691f187b9f710259f5f75cd6beff7598d6ddd
6679d2d00ec4fa18186a59c720a2e60f14600825815218b622bc735f440215f4
71958456c6d32df0e3120ab972e0caa220108f11628e65617c26b83a313b86e8
734cb8c4e906c83e72713a3aff5a2b8b1f2e1eed50f08bdfab890adef5f43557
775800ecf32595fac19e09efeefe175104c8f58086958278d5fe5456b629baa0
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7ed2434b5c1a9b5ae6498c3ab49742b4ba63de914cba8d37035f0072d3c2404c
7ee2a3a5e4b1e50bb31b22d8399f9917073e0421d56c5da3699371ec79af2082
87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de
8785a3daf3723b7a8f708249b4cdd10faefcbfb1c70546a00d4fa92ea6197fbb
918b7dc3e2e2d015c16ce08b57bcb64d2253bafc1707658f361e72865498e537
9610bbc4db6f94e7c35f7f8112635a6f66996b69f59bcdca9eafcf1289f3e192
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9dd2b5c4ab64c7d98baee85a3e4bed2ad319dd8548b191aed554a8ffdb44b0ae
acd8cc92baa460bfc303aca613f09f7912be7615999e30a453c6acb316b4d534
b140ce5cbf9bf2a79282a7b988a91f412dd4e0683d5175fa542f8fe66081f9b5
b2ff75abc0e0ccbd083a87b45e64c9a62f1f6ca32c46445240026a246d30254c
b718cca2727a8043608202e3adccb528433f15e14a30e9d752d047ac5fd123bc
c447dd7677b419db7b21dbdfc6277c7816a913ffda76fd2e52702df538de0e49
c5f8f19c7cbec6a8107e742297fb4e79fd781121ad468ec30e37b058f5494556
c75c6c164c77e9cb9293e5c767c83e8ad459fd69da30644add1daf3ae7e75996
cebaf3897d64760fa3fde87d5ff7e6806c895c87b3dcc4494137e14b817c3900
d1f56fc38e8d50795552832c4b20432fedee68a763682b9fc648fc95b7c0c334
d34775b817bf40359e2d9dd90749d5e32355e3ed2325700e80b90347fb65558c
d751057f008ca217326b558c4beca2c8ebd948b50c1f8cd06c3687355899a241
e073ab0c5ad4ffe4bad2ddac87433a6937e10e0c40a84e6a6c285dc2c8890d6e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ed04b5707b07ef987720582b14ab1d8662871e95aa17cdac6fff6f34ba9caacd
f19c7a20bf7eafcc1ef303b9c9c52d0face97aa0990129aeddec8d5e089d1ef5
f5977b6a02d773e4d59939dac292a13ea324db2b75ac69bd947124fe97e5a537
fa501844318e06fadf4d4f127ad2be47b7ff55cd9409baf70a7368b14c0302ea
fc544e095e9c62b22290d8eaf5812e29023d77e9d7cfb0155fd1ac9315bf75fc
fdc01648678f8f3cc842bc584dacbceb76d4913d2e9e820d12838478e29c4db7
fe42aebb3acdf53d4edaef71733067238d10b6a78aad19299c3a24b06db1b4fe
fffc6ed23cfeabaaace717503bfabd907816869c8c5ff38a2127b8284e8c5988

www.hedan.rr.nu Open in urlscan Pro 172.66.47.11 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

68 Requests

84 %HTTPS

41 %IPv6

12 Domains

18 Subdomains

17 IPs

6 Countries

11144 kBTransfer

15802 kBSize

10 Cookies

4 Outgoing links

Redirected requests

68 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.hedan.rr.nu Open in urlscan Pro
172.66.47.11 Public Scan

Screenshot
Live screenshot

Full Image

68
Requests

84 %
HTTPS

41 %
IPv6

12
Domains

18
Subdomains

17
IPs

6
Countries

11144 kB
Transfer

15802 kB
Size

10
Cookies

68 HTTP transactions
1 data transactions