Full URL

Query params

Fragment params (OAuth implicit flow tokens land here)

Referrer (where the victim came from)