Submitted URL: http://pastebin.com/mKwEvj9s
Effective URL: https://pastebin.com/mKwEvj9s
Submission: On September 26 via manual from ZA

Summary

This website contacted 32 IPs in 4 countries across 28 domains to perform 174 HTTP transactions. The main IP is 104.20.209.21, located in San Francisco, United States and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is pastebin.com.
TLS certificate: Issued by COMODO ECC Domain Validation Secure S... on April 27th 2018. Valid for: 6 months.
This is the only time pastebin.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 104.20.208.21 13335 (CLOUDFLAR...)
47 104.20.209.21 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
2 204.11.109.77 33419 (TRIBAL-FU...)
1 108.161.189.78 12989 (HWNG)
1 2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
17 204.11.109.67 33419 (TRIBAL-FU...)
6 204.11.109.66 33419 (TRIBAL-FU...)
1 204.11.109.68 33419 (TRIBAL-FU...)
3 54.230.95.173 16509 (AMAZON-02)
3 2400:cb00:204... 13335 (CLOUDFLAR...)
3 2600:9000:200... 16509 (AMAZON-02)
3 178.162.133.150 60781 (LEASEWEB-...)
3 185.33.223.206 29990 (ASN-APPNEXUS)
2 2400:cb00:204... 13335 (CLOUDFLAR...)
2 151.101.132.166 54113 (FASTLY)
3 2a00:1450:400... 15169 (GOOGLE)
4 185.33.223.204 29990 (ASN-APPNEXUS)
2 2606:4700:30:... 13335 (CLOUDFLAR...)
6 2a00:1450:400... 15169 (GOOGLE)
12 172.217.22.34 15169 (GOOGLE)
7 2a00:1450:400... 15169 (GOOGLE)
2 74.214.194.133 59940 (PULSEPOIN...)
2 13 151.101.134.2 54113 (FASTLY)
5 2a00:1450:400... 15169 (GOOGLE)
1 3 23.43.115.95 20940 (AKAMAI-ASN1)
8 151.101.134.49 54113 (FASTLY)
1 1 35.201.85.158 15169 (GOOGLE)
3 3 18.196.144.59 16509 (AMAZON-02)
1 1 216.58.205.226 15169 (GOOGLE)
2 2 54.171.22.132 16509 (AMAZON-02)
1 1 34.211.85.62 16509 (AMAZON-02)
1 192.132.33.27 18568 (BIDTELLECT)
3 3 18.153.11.25 16509 (AMAZON-02)
8 2400:cb00:204... 13335 (CLOUDFLAR...)
3 54.230.95.37 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
174 32
Apex Domain
Subdomains
Transfer
48 pastebin.com
pastebin.com
170 KB
29 taboola.com
cdn.taboola.com
trc.taboola.com
15.taboola.com
match.taboola.com
images.taboola.com
vidstat.taboola.com
imprammp.taboola.com
convammp.taboola.com
wf.taboola.com
503 KB
24 tribalfusion.com
s.tribalfusion.com
66 KB
14 doubleclick.net
stats.g.doubleclick.net
securepubads.g.doubleclick.net
cm.g.doubleclick.net
254 KB
12 googlesyndication.com
tpc.googlesyndication.com
pagead2.googlesyndication.com
95 KB
7 adnxs.com
ib.adnxs.com
5 KB
6 cloudfront.net
d2na2p72vtqyok.cloudfront.net
df80k0z3fi8zg.cloudfront.net
372 KB
4 contextweb.com
tag-st.contextweb.com
bid.contextweb.com
24 KB
3 stackassets.com
cdnp0.stackassets.com
cdnp2.stackassets.com
177 KB
3 bidswitch.net
x.bidswitch.net
2 KB
3 mfadsrvr.com
rtb.mfadsrvr.com
2 KB
3 scorecardresearch.com
sb.scorecardresearch.com
2 KB
3 google.com
adservice.google.com
513 B
3 google.de
adservice.google.de
513 B
3 googletagservices.com
www.googletagservices.com
16 KB
3 sonobi.com
apex.go.sonobi.com
1 KB
3 insticator.com
geoip.insticator.com
1 KB
2 adsrvr.org
match.adsrvr.org
850 B
2 districtm.io
cdn.districtm.io
2 districtm.ca
prebid.districtm.ca
13 KB
2 google-analytics.com
www.google-analytics.com
16 KB
2 exponential.com
tags.expo9.exponential.com
5 KB
1 gstatic.com
csi.gstatic.com
56 B
1 bttrack.com
bttrack.com
383 B
1 storygize.net
www.storygize.net
450 B
1 exposebox.com
server.exposebox.com
290 B
1 servedby-buysellads.com
m.servedby-buysellads.com
12 KB
1 googletagmanager.com
www.googletagmanager.com
28 KB
174 28
Domain Requested by
48 pastebin.com 1 redirects pastebin.com
tags.expo9.exponential.com
s.tribalfusion.com
securepubads.g.doubleclick.net
24 s.tribalfusion.com tags.expo9.exponential.com
s.tribalfusion.com
12 securepubads.g.doubleclick.net www.googletagservices.com
securepubads.g.doubleclick.net
pastebin.com
8 vidstat.taboola.com cdn.taboola.com
vidstat.taboola.com
pastebin.com
8 trc.taboola.com 2 redirects cdn.taboola.com
pastebin.com
7 tpc.googlesyndication.com securepubads.g.doubleclick.net
pastebin.com
7 ib.adnxs.com df80k0z3fi8zg.cloudfront.net
prebid.districtm.ca
pastebin.com
5 pagead2.googlesyndication.com securepubads.g.doubleclick.net
3 x.bidswitch.net 3 redirects
3 rtb.mfadsrvr.com 3 redirects
3 sb.scorecardresearch.com 1 redirects cdn.taboola.com
pastebin.com
3 cdn.taboola.com securepubads.g.doubleclick.net
cdn.taboola.com
pastebin.com
3 adservice.google.com www.googletagservices.com
3 adservice.google.de www.googletagservices.com
3 www.googletagservices.com d2na2p72vtqyok.cloudfront.net
3 apex.go.sonobi.com df80k0z3fi8zg.cloudfront.net
3 df80k0z3fi8zg.cloudfront.net d2na2p72vtqyok.cloudfront.net
3 geoip.insticator.com d2na2p72vtqyok.cloudfront.net
3 d2na2p72vtqyok.cloudfront.net pastebin.com
2 cdnp0.stackassets.com pastebin.com
2 wf.taboola.com vidstat.taboola.com
2 convammp.taboola.com pastebin.com
2 images.taboola.com pastebin.com
2 match.taboola.com pastebin.com
2 match.adsrvr.org 2 redirects
2 bid.contextweb.com tag-st.contextweb.com
2 cdn.districtm.io prebid.districtm.ca
2 tag-st.contextweb.com df80k0z3fi8zg.cloudfront.net
2 prebid.districtm.ca df80k0z3fi8zg.cloudfront.net
2 www.google-analytics.com 1 redirects www.googletagmanager.com
2 tags.expo9.exponential.com pastebin.com
1 csi.gstatic.com tpc.googlesyndication.com
1 cdnp2.stackassets.com pastebin.com
1 imprammp.taboola.com pastebin.com
1 bttrack.com pastebin.com
1 www.storygize.net 1 redirects
1 cm.g.doubleclick.net 1 redirects
1 server.exposebox.com 1 redirects
1 15.taboola.com cdn.taboola.com
1 stats.g.doubleclick.net pastebin.com
1 m.servedby-buysellads.com pastebin.com
1 www.googletagmanager.com pastebin.com
174 42

This site contains links to these domains. Also see Links.

Domain
deals.pastebin.com
creativecommons.org
steadfast.net
facebook.com
twitter.com
Subject Issuer Validity Valid
ssl509085.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2018-04-27 -
2018-11-03
6 months crt.sh
*.google-analytics.com
Google Internet Authority G3
2018-08-28 -
2018-11-20
3 months crt.sh
*.expo9.exponential.com
Go Daddy Secure Certificate Authority - G2
2016-09-29 -
2018-10-30
2 years crt.sh
*.servedby-buysellads.com
COMODO RSA Domain Validation Secure Server CA
2016-12-28 -
2019-02-16
2 years crt.sh
*.g.doubleclick.net
Google Internet Authority G3
2018-09-04 -
2018-11-27
3 months crt.sh
*.tribalfusion.com
Go Daddy Secure Certificate Authority - G2
2015-09-03 -
2018-10-07
3 years crt.sh
*.cloudfront.net
DigiCert Global CA G2
2017-11-22 -
2018-11-21
a year crt.sh
*.insticator.com
COMODO RSA Organization Validation Secure Server CA
2018-05-25 -
2020-08-26
2 years crt.sh
*.go.sonobi.com
Go Daddy Secure Certificate Authority - G2
2017-01-04 -
2019-02-04
2 years crt.sh
*.adnxs.com
DigiCert ECC Secure Server CA
2018-01-25 -
2019-01-25
a year crt.sh
*.districtm.ca
COMODO RSA Organization Validation Secure Server CA
2017-09-05 -
2018-10-06
a year crt.sh
*.contextweb.com
DigiCert SHA2 Secure Server CA
2018-07-07 -
2020-06-03
2 years crt.sh
districtm.io
CloudFlare Inc ECC CA-2
2018-04-26 -
2019-04-26
a year crt.sh
*.google.com
Google Internet Authority G3
2018-09-11 -
2018-12-04
3 months crt.sh
tpc.googlesyndication.com
Google Internet Authority G3
2018-08-28 -
2018-11-20
3 months crt.sh
f2.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3
2018-09-06 -
2019-09-07
a year crt.sh
*.scorecardresearch.com
COMODO RSA Organization Validation Secure Server CA
2017-12-06 -
2018-12-26
a year crt.sh
g2.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3
2018-09-13 -
2019-01-17
4 months crt.sh
*.bttrack.com
COMODO RSA Domain Validation Secure Server CA
2016-03-24 -
2019-04-14
3 years crt.sh
ssl768612.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2018-08-10 -
2019-02-16
6 months crt.sh
stackassets.com
Amazon
2017-11-22 -
2018-12-22
a year crt.sh

This page contains 30 frames:

Primary Page: https://pastebin.com/mKwEvj9s
Frame ID: 91598F7A5EB3786AB0218F419D1453A2
Requests: 46 HTTP requests in this frame

Frame: https://s.tribalfusion.com/real/tags/Pastebincom/Safe/tags.js
Frame ID: 4E53360E355FFCD0EE42D76C110FE0A5
Requests: 3 HTTP requests in this frame

Frame: https://s.tribalfusion.com/real/tags/Pastebincom/Safe/tags.js
Frame ID: D874337D5A32CB7C67D2DBB5DD68CE51
Requests: 3 HTTP requests in this frame

Frame: https://s.tribalfusion.com/real/tags/Pastebincom/Safe/tags.js
Frame ID: 0FBBA9FC115249B0F9293818E4836AF9
Requests: 3 HTTP requests in this frame

Frame: https://s.tribalfusion.com/real/tags/Pastebincom/SnackbarSafe/tags.js
Frame ID: 03005870AC956E1A5926C42434647091
Requests: 2 HTTP requests in this frame

Frame: https://pastebin.com/adserver/728x90_custom_safe.php
Frame ID: 67FEAA6C039E0634B94DB4AA22B73824
Requests: 19 HTTP requests in this frame

Frame: https://s.tribalfusion.com/p.media?clickID=a1mQgM3AZbGpb3K0sYTYGFX1c7vnqBP5U3WVUbEWm73Qa3RSsUMPtfx0WjsWAbw4cJ5XF3DTPau4AU6R6bH2dMsXHnZbpW6o3mMY4GjdUsJdUcbhP63oWtZbTUUM15benVT7oWaJdPTvIRcfZbQFAvRW7cUVM54r6uodZamXq2y2HQZdQVfZa4mMZapHZaNUHYaXFU91UYXumZaf4V&mediaDataID=5436426&mediaName=frame.html
Frame ID: 8AD14B2812DC7AFCFEC16E78F92E415B
Requests: 1 HTTP requests in this frame

Frame: https://s.tribalfusion.com/p.media?clickID=a3mQCN36rY5creTGnlVVf8SPMyTdMVTbM03UEnWanvVqM7SaJZdQV7ZbQbZamSWUiWsj34Uupod6M0amv2dbFPcfA4PBLpHToVWYa0bUkXr790qqtRFFHWUJQVW3WmFQsPrBMYqvy5Tbg5E32naBG1rZbfUWMRoArBps7sptMB2Evi5ter3AfLnFQZb0VQXXVQY1cvnMdbbyfOdV8&mediaDataID=7423766&mediaName=frame.html
Frame ID: 357EAAD29EA30F51EF82E1BD54BF43B6
Requests: 1 HTTP requests in this frame

Frame: https://s.tribalfusion.com/p.media?clickID=a5mQCNVWbhXrnaXrZbk1T6MSFFAUrM2WdJ3mFJoPFfNYano3a3k2aQ3nEJBXbbfUdr0mPnJpGrumWnD3EZbh2Wio56nKmUfJ0G7U1cvV1cBnnEvT3rJVTFvZaW6rTPqb2QGvNQHfr1tJsWAYM3GM10UUDT6im2PQeRPMH3WUM1WMZbpdEv36QT5GY9VsnlVVfjSmFoYTYcy0TZdEK&mediaDataID=6719746&mediaName=frame.html
Frame ID: 0300043476FCB0890BCA424F56F8D5FB
Requests: 1 HTTP requests in this frame

Frame: https://s.tribalfusion.com/p.media?clickID=a7mQCN0G30YsYU0Vrunqj42rM4TUBGVP74PqMXQsQMQW7xYHnoT6Uy3cr2YFvDTPau4AU6R6fI4HUr0WBKmHAN5AJU4V7fVcB8UcB8SmMoUtFWUUn05bTwWTvvVaJ8QqrGScjCPrItSd38VcYQ2Fuxmtqr0qqp4WbCPsZbE46BKmdAtVWBcXU3d1F771T6oSFJZbYc3eylZajGE&mediaDataID=6453196&mediaName=frame.html
Frame ID: 037513B5CF28AD6167B1CD5548042939
Requests: 1 HTTP requests in this frame

Frame: https://s.tribalfusion.com/p.media?clickID=a9mQCNVcMjWs7gRAJnTHQ3TFjY2bTqVajpVaQcQE3FSsbZaRFmpPHQ9VGQV5UTxmHyMXamx4dnZbSVjG4mJZbpHEmTtYdYFbi1UQiXaIMSFnZbUFBYVWF3orYvPr7NYqFn5q7d4T3RmTZbGXUfdTtBVoAnBnV7mmHrJ5qZbk3HIp5AnLprMZd0GvWYVn5XVBpmajQ2rF20sjry8rayZd&mediaDataID=4056396&mediaName=frame.html
Frame ID: B3BB879A6C386457860571A1D9221DAC
Requests: 1 HTTP requests in this frame

Frame: https://s.tribalfusion.com/p.media?clickID=abmQCN1Uj90qeORFvZdWbUSWWMUmbbtQFrqYq3r5EJa4EU2oarC1rbcTWJQnPYBncfuoWnB5EY95deq5AvZamUvIXc7VXGZb2XGnNpTF42rM2VUnEW6j4REjSQGYMQHUu1WZbxVPYp2sn1YrnZbUAPq2PUePmMA4WQOXdBZbmt6O4mJT3sr7VcY6WVJhPAMmTWQRTUMPQVADyOxQcu&mediaDataID=6546596&mediaName=frame.html
Frame ID: 589C427FD806951AA6842298249825E6
Requests: 1 HTTP requests in this frame

Frame: https://s.tribalfusion.com/p.media?clickID=admQgMXGZbnpEBQ2bUUVbnAVPj1RTY5ScUsQdBO1HvnWA3m4cYUYUnZbUPuq5mZb7RmrA2H3O0tJCntEw36YT5G39Vsv6UsF8PAvoTWFPTbM05bEnUErvTEBcQqBZcQVbLQUqoSt7aVV3R5rXqnWZaOXaev4dMZdQsrZd2mnIoWipUWbhXrrkYUje1E6OSrBCUrM4TtJiwITdpP&mediaDataID=5406476&mediaName=frame.html
Frame ID: C05525F4120EB7A8DD66C9BBA2151C06
Requests: 1 HTTP requests in this frame

Frame: https://s.tribalfusion.com/p.media?clickID=afmQCNPPnoUtY5UbfX3bIuVTYrWqQ9PEBZdScJLPbavRdU8UcjU2FPqntAsYaXp2HjZbQVjE2m3FmtAsTWQ7YFr8YrQl1aesPbBCWUMSWWnWmbQnPrvq1EZbN5qBa4T75mqJLYFffUHZbVn6UZdms3qmHnJ3TZbh5tiN3mvLmbrZd0VvW1c33XGfynaZbW5FM4WrbBV67T2tvgqUapmn&mediaDataID=6530936&mediaName=frame.html
Frame ID: 673EE50D38BA1D65456E88CE140A76FA
Requests: 1 HTTP requests in this frame

Frame: https://s.tribalfusion.com/p.media?clickID=ahmQCNPbMZbUFU3WtMXnbFxRbjpXq3p4EUk4Tv1mE7IYU7dWtrRoAYZcmVUppWYJ3aF93des3AjEpbMZcXGfPXGY00cnMmTbV5UZbSTFZbZcV6YTPTb1QGBtSt3t1WjuVPbN2VrVXbnDTm2q5mncQPBE4WUO0HBKpdAo3PB05GMeUsM6UcbfPPUOUWnTWbFR2UItVTjv0dUTqBhLfe&mediaDataID=8039566&mediaName=frame.html
Frame ID: 2C707891F34617EC43C69BA258DAAA8A
Requests: 1 HTTP requests in this frame

Frame: https://pastebin.com/adserver/160x600_custom_safe.php
Frame ID: 14BD36238E9E8ADDF9BFD3137362504E
Requests: 19 HTTP requests in this frame

Frame: https://s.tribalfusion.com/p.media?clickID=almQCNWrJP3rEoWE7sVq3lPqZbZaSVjJQbupRtvbWGv54bTroWyr0qXy3tQGPVFZa4PBFotAqVWFf0rnaYUYf1EenRFBBTUU4TtBXorjxQrZbNYTFs5qYk2afPmqfIYFUaUdJ1mmUBnGQqpdUH2qnl5teN5PvZaprvE0sfWXGJ30VJypT7U5UUQVrFHUPYVQqn4PGZbM3EJZcsQleeb&mediaDataID=6680176&mediaName=frame.html
Frame ID: 5C615D24238E6D7842AEE5A2459BE52C
Requests: 1 HTTP requests in this frame

Frame: https://s.tribalfusion.com/p.media?clickID=aBmQCNTtMWmbFnRbMMXqQy4Tbc5EYXnEMCYFZb6UW7Xm63ZdpsfmmHYG2Tve2dEN56nEnbMZa0GMX1s320GvxmqbR3rZbPWFbCUAf1REYQPGrMQdUO1WroT6jn2VUUXbZbZcTPXv46neP6ZbE3tnn1dMZcpdEo5mBS3sngVVJ7VGJiS6ZbOWd3VWrj33UenUaUxWa36PqBF5bZbvsXvyoZb&mediaDataID=7665496&mediaName=frame.html
Frame ID: BB373E5AA69815AC0B73EFF597000783
Requests: 1 HTTP requests in this frame

Frame: https://s.tribalfusion.com/p.media?clickID=aDmQCNUAUTPTMXPGQnPdBr0WntTmvv3cB5XbUKT6mw4mvcRPrA4WMm1HrJmteo5AJ15cr8Vc3lUsbeRPFuTHYQUUr22bIxUqbsTTrlPqvFSGQIPUqpPHfkWsn54r6smHAyXETp2dUBPcJC5ArJmdAyTHQ70brk1bYkXTenSUMAWUYXTtY0mFboRFZbyXqQp4qUaRWMfsCiNJ2&mediaDataID=6807466&mediaName=frame.html
Frame ID: 79A061DFF01AEF05476FA2638C93BF95
Requests: 1 HTTP requests in this frame

Frame: https://s.tribalfusion.com/p.media?clickID=aFmQCNUqYvVEU8SE3ZbSsFCQUExSWn9VGbU4ruomteOXT2M4WjFSGFD56MZcptiyTtYfXrnc1UZb7XqitRbJHTr35VWB1nrBmRUMn1Evy4qja4q7XmqnC1r3hUdfXmmfZancUvotUJ3EMl2WZam4mFIprMEXVfP1cYVXsvynTFR3FUQTFfFUAnYPqQXSsrOPHBw0Wvu0SvItW6Qmc&mediaDataID=6347136&mediaName=frame.html
Frame ID: EF9E4A3A63CEEB760D22F2CACE92DD18
Requests: 1 HTTP requests in this frame

Frame: https://pastebin.com/adserver/300x250_custom_safe.php
Frame ID: E9B3180682A8C6A9307B999EC6685733
Requests: 13 HTTP requests in this frame

Frame: https://cdn.districtm.io/ids/index.html
Frame ID: F4D8F2F94ABCE18505E4A43868F1C1A6
Requests: 1 HTTP requests in this frame

Frame: https://cdn.districtm.io/ids/index.html
Frame ID: 0AB106F6CE8E47106AEF5E42A448577D
Requests: 1 HTTP requests in this frame

Frame: https://cdn.taboola.com/libtrc/insticator-network/loader.js
Frame ID: CD81B358BF6F0CEC4FF75BDE5DBC9A99
Requests: 25 HTTP requests in this frame

Frame: https://ib.adnxs.com/getuidnb?https://trc.taboola.com/sg/appnexus-network/1/rtb-h/?taboola_hm=$UID
Frame ID: 378AC1BCC7912D6A9BB86F08CB6BD5A6
Requests: 8 HTTP requests in this frame

Frame: https://imprammp.taboola.com/st?cipid=8110425&ttype=0&cirid=33DA9DA9A8621164001198827245&cicmp=1682805&cijs=1&dast=V7ocwCFgO_B61VNgia5QS_B61VNgia5QUAAAAGBuIHG7MZMZgjBnNBnE0Wi9lmuVyOBrvRZLCcTEGDWJ6v6W84SJo-o-kgaTjNBs1gMLysBmvoQNPp8Lnu9YKH5_SyOO12jd_tV3t5L9rVubkDAAAAwAOA0nwwxA8gAEAEAAAAgAQAAAAARUDFv4XABQAAAAAGgEFpggYA1AcAwEMACADAgAIJwED_XQnARef1CQAAAAAAAAAAy____38MwF5wlgxARmvdjUEPwIMPwIMQAABA1lBZyZfwIsGoAVEBYhEjAAAAAMr9Fv-jSZ1QWVQBABCkWwFcAQAEmFXs2ERm6Q5KvIUBAAAEjC3Qw-L3mx12jd_tMgAAAAAAAAAAs_-zfzQhojOptKAVtkW1X0AAgLVfQAAANnUDAHgLgAs6glYMBqsLiNkBAAAA3P3____rgdhk4nGMnKOJzWVzzWY2x24zmyxmq4nHZJitZpPtNcxtVlWWV-n1aRDL8zX9DQdJ02c0HSQNp9mgGQyGl9VgfhO2GK0mk81yOFsuJoPhaDga7U_AdgOcoOFwsNgNFrvFYjhZTEaD5WCBAjGY4IQMR5vJarRb7SbL4WQ0mm0mG6Ro1Wo22gyGq9lkttuthoPhcjRCitYsZpPJYjZa7jaD5WQ0GE6GQ4Qpz27i2kxMa5lhslyLhjPbWuIyudzCzWC1WO1mHpfD4xa9PqbLwjQybkZeFAxY2IvgIp0o7Z7T0-Mw_S1vwcNzelmcdotYojlZpBPZZV-bTDyOkXM0sblsrtnM5thtZpPFbDXxmAyz1Wyyb3l2E9dmYlrLDJPlWjSc2dYSl8nlFm4Gq8VqN_O4HB636PUxXRamkXEz8jdWm91yNRotN_vGarNbrkaj5WbfoTN8V5-z0XRNeTwuZ_Lb0o1mDoPCZbB4fxLTYtqdHTy_39GpUl00xobsm1CYDR6DQRFLBKeLdCJ6GU8XsUTytEgnGsNqYbFMBovRyLZaOEe2hWM3mrk8M5fDN9xsZhaxRGm6SCd6tdf3sl2dm4v6jw4xGs4lq8VctJpLVqNVAgAAAAAAAABYwpx5EwAAAAA!&excid=22&tst=1&docw=0
Frame ID: 79C5D405E4DDD31AAFCEC23A2281BEA3
Requests: 1 HTTP requests in this frame

Frame: https://pastebin.com/adserver/160x600_criteo_pb_safe.php
Frame ID: 190C55564DE232D6E6155833E5CDE9C9
Requests: 5 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/pagead/js/r20180919/r20110914/activeview/osd_listener.js
Frame ID: 8FDA01444E987F72C55E4A5D082975E7
Requests: 6 HTTP requests in this frame

Frame: https://pastebin.com/adserver/728x90_criteo_pb_safe.php
Frame ID: 0A0FDCBDEB431B575F87BD165CB7ABB0
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/pagead/js/r20180919/r20110914/activeview/osd_listener.js
Frame ID: B4633EA0D6859B63D05979AB200071DF
Requests: 4 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://pastebin.com/mKwEvj9s HTTP 301
    https://pastebin.com/mKwEvj9s Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • env /^_bsa/i

Overall confidence: 100%
Detected patterns
  • headers server /cloudflare/i

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
  • env /^gaGlobal$/i

Overall confidence: 100%
Detected patterns
  • env /^google_tag_manager$/i

Overall confidence: 100%
Detected patterns
  • script /jquery.*\.js/i
  • env /^jQuery$/i

Page Statistics

174
Requests

98 %
HTTPS

34 %
IPv6

28
Domains

42
Subdomains

32
IPs

4
Countries

1760 kB
Transfer

6520 kB
Size

11
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://pastebin.com/mKwEvj9s HTTP 301
    https://pastebin.com/mKwEvj9s Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 24
  • https://www.google-analytics.com/r/collect?v=1&_v=j69&a=608159535&t=pageview&_s=1&dl=https%3A%2F%2Fpastebin.com%2FmKwEvj9s&ul=en-us&de=UTF-8&dt=Emotet%2025%2F09%2F2018%20-%20Pastebin.com&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUAB~&jid=1315175872&gjid=1106528075&cid=858357356.1537954490&tid=UA-58643-34&_gid=1014346891.1537954490&_r=1&gtm=u9h&z=830698423 HTTP 302
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-58643-34&cid=858357356.1537954490&jid=1315175872&_gid=1014346891.1537954490&gjid=1106528075&_v=j69&z=830698423
Request Chain 112
  • https://sb.scorecardresearch.com/b?c1=7&c2=13739933&c3=20121515121&ns__t=1537954493226&ns_c=UTF-8&ns_if=1&cv=3.1&c8=&c7=https%3A%2F%2Fpastebin.com%2Fadserver%2F300x250_custom_safe.php&c9= HTTP 302
  • https://sb.scorecardresearch.com/b2?c1=7&c2=13739933&c3=20121515121&ns__t=1537954493226&ns_c=UTF-8&ns_if=1&cv=3.1&c8=&c7=https%3A%2F%2Fpastebin.com%2Fadserver%2F300x250_custom_safe.php&c9=
Request Chain 116
  • https://server.exposebox.com/rcm HTTP 302
  • https://trc.taboola.com/sg/exposebox-network/1/rtb-h?taboola_hm=_4r82oyv
Request Chain 117
  • https://rtb.mfadsrvr.com/sync?ssp=taboola HTTP 302
  • https://rtb.mfadsrvr.com/ul_cb/sync?ssp=taboola HTTP 302
  • https://trc.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=2076078c-162c-4c54-83ac-5bf1b8c8bbbd
Request Chain 118
  • https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_cm&google_sc HTTP 302
  • https://trc.taboola.com/sg/google-network/1/rtb-h/?taboola_hm=CAESEJBdfRJAnoOoJb21ut6Nnls&google_cver=1
Request Chain 119
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=054f32o&ttd_tpi=1 HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=054f32o&ttd_tpi=1 HTTP 302
  • https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=cbadbf77-3a08-41c3-8c90-0760d5107fa8 HTTP 302
  • https://match.taboola.com/sg/thetradedesk-network/1/rtb-h?taboola_hm=cbadbf77-3a08-41c3-8c90-0760d5107fa8&tbid=e37b53b4-f029-48f6-bede-8305157fceac-tuct2a4d83d
Request Chain 120
  • https://www.storygize.net/ccm/4b560cdd-91f9-422b-adb7-e9dff26bc3ad?u=e37b53b4-f029-48f6-bede-8305157fceac-tuct2a4d83d HTTP 302
  • https://trc.taboola.com/sg/storygize-network/1/rtb-h?taboola_hm=15e35c40-7797-4060-9061-ed57320faf49
Request Chain 122
  • https://x.bidswitch.net/sync?ssp=taboola HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?ssp=taboola HTTP 302
  • https://rtb.mfadsrvr.com/sync?ssp=bidswitch&bidswitch_ssp_id=taboola&bsw_user_id=89130db7-7830-4b35-9c11-933a28d3b8d3 HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=250&expires=14&user_id=2076078c-162c-4c54-83ac-5bf1b8c8bbbd&ssp=taboola HTTP 302
  • https://trc.taboola.com/sg/bidswitch-network/1/rtb-h/?taboola_hm=89130db7-7830-4b35-9c11-933a28d3b8d3 HTTP 302
  • https://match.taboola.com/sg/bidswitch-network/1/rtb-h?taboola_hm=89130db7-7830-4b35-9c11-933a28d3b8d3&tbid=e37b53b4-f029-48f6-bede-8305157fceac-tuct2a4d83d

174 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request mKwEvj9s
pastebin.com/
Redirect Chain
  • http://pastebin.com/mKwEvj9s
  • https://pastebin.com/mKwEvj9s
57 KB
10 KB
Document
General
Full URL
https://pastebin.com/mKwEvj9s
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
559b99fee06ae5833d7863a0b0f8156c48edc9063d2d3f62e65150c65e9f85a7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
pastebin.com
:scheme
https
:path
/mKwEvj9s
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding
gzip, deflate
cookie
__cfduid=ded850b56f952231fae82c319ac0b125d1537954489
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
date
Wed, 26 Sep 2018 09:34:50 GMT
content-type
text/html; charset=utf-8
x-frame-options
SAMEORIGIN
x-content-type-options
nosniff
content-encoding
gzip
vary
Accept-Encoding
x-xss-protection
1; mode=block
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
4604bcaa5bb364db-FRA

Redirect headers

Date
Wed, 26 Sep 2018 09:34:49 GMT
Content-Type
text/html
Transfer-Encoding
chunked
Connection
keep-alive
Set-Cookie
__cfduid=ded850b56f952231fae82c319ac0b125d1537954489; expires=Thu, 26-Sep-19 09:34:49 GMT; path=/; domain=.pastebin.com; HttpOnly
location
https://pastebin.com/mKwEvj9s
X-XSS-Protection
1; mode=block
Server
cloudflare
CF-RAY
4604bca986ee6511-FRA
js
www.googletagmanager.com/gtag/
77 KB
28 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-58643-34
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:812::2008 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Google Tag Manager (scaffolding) /
Resource Hash
2edf1da7b4a91689ba05070803ba3c47845944c56ac4a843556d47146d1967fb
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pastebin.com/mKwEvj9s
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:50 GMT
content-encoding
gzip
server
Google Tag Manager (scaffolding)
access-control-allow-headers
Cache-Control
status
200
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
http://www.googletagmanager.com
cache-control
private, max-age=900
access-control-allow-credentials
true
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
28170
x-xss-protection
1; mode=block
expires
Wed, 26 Sep 2018 09:34:50 GMT
jquery.min.js
pastebin.com/js/
82 KB
30 KB
Script
General
Full URL
https://pastebin.com/js/jquery.min.js
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/js/jquery.min.js
pragma
no-cache
cookie
__cfduid=ded850b56f952231fae82c319ac0b125d1537954489
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/mKwEvj9s
:scheme
https
:method
GET
Referer
https://pastebin.com/mKwEvj9s
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:50 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Wed, 16 Dec 2015 04:15:00 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
public, max-age=7776000
cf-ray
4604bcab3c8164db-FRA
x-xss-protection
1; mode=block
expires
Tue, 25 Dec 2018 09:34:50 GMT
pastebin.min.v3.js
pastebin.com/js/
36 KB
12 KB
Script
General
Full URL
https://pastebin.com/js/pastebin.min.v3.js
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c553d405e7a0d873f69083ecb231e12a1123206c612d8fd8c675e9eabb264f3d
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/js/pastebin.min.v3.js
pragma
no-cache
cookie
__cfduid=ded850b56f952231fae82c319ac0b125d1537954489
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/mKwEvj9s
:scheme
https
:method
GET
Referer
https://pastebin.com/mKwEvj9s
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:50 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Tue, 11 Sep 2018 09:27:31 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/x-javascript
status
200
cache-control
public, max-age=7776000
cf-ray
4604bcab3c8464db-FRA
x-xss-protection
1; mode=block
expires
Tue, 25 Dec 2018 09:34:50 GMT
pastebin.min.v6.css
pastebin.com/i/
40 KB
9 KB
Stylesheet
General
Full URL
https://pastebin.com/i/pastebin.min.v6.css
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
37786f0724c1e728e8a1dfd225f12c5e9804c04a3a6eb0bc3795e7df67a51f64
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/pastebin.min.v6.css
pragma
no-cache
cookie
__cfduid=ded850b56f952231fae82c319ac0b125d1537954489
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/mKwEvj9s
:scheme
https
:method
GET
Referer
https://pastebin.com/mKwEvj9s
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:50 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Thu, 14 Jun 2018 11:15:30 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
public, max-age=7776000
cf-ray
4604bcab3c8264db-FRA
x-xss-protection
1; mode=block
expires
Tue, 25 Dec 2018 09:34:50 GMT
text.css
pastebin.com/cache/css_lang/
706 B
412 B
Stylesheet
General
Full URL
https://pastebin.com/cache/css_lang/text.css
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7f494312dd58dd6d0a14eaa75c5a8b438827f919577f62a9d86f9048c91af7f6
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/cache/css_lang/text.css
pragma
no-cache
cookie
__cfduid=ded850b56f952231fae82c319ac0b125d1537954489
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/css,*/*;q=0.1
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/mKwEvj9s
:scheme
https
:method
GET
Referer
https://pastebin.com/mKwEvj9s
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:50 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Mon, 20 Feb 2017 09:15:56 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
public, max-age=7776000
cf-ray
4604bcab3c8364db-FRA
x-xss-protection
1; mode=block
expires
Tue, 25 Dec 2018 09:34:50 GMT
guest.png
pastebin.com/i/
1 KB
1 KB
Image
General
Full URL
https://pastebin.com/i/guest.png
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
3a0173182211c356718cc39291f5753a21fefe7422665f2bcd2a2798e02e846b
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/guest.png
pragma
no-cache
cookie
__cfduid=ded850b56f952231fae82c319ac0b125d1537954489
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/mKwEvj9s
:scheme
https
:method
GET
Referer
https://pastebin.com/mKwEvj9s
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:50 GMT
cf-cache-status
HIT
last-modified
Wed, 16 Dec 2015 04:15:00 GMT
server
cloudflare
etag
"5670e544-480"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=7776000
accept-ranges
bytes
cf-ray
4604bcab3c8564db-FRA
content-length
1152
x-xss-protection
1; mode=block
expires
Tue, 25 Dec 2018 09:34:50 GMT
t.gif
pastebin.com/i/
43 B
125 B
Image
General
Full URL
https://pastebin.com/i/t.gif
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ed1b73c6b4690cde9b521865b58e031293209bc0b2ba2b5716ecf4bf9885ee4b
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/t.gif
pragma
no-cache
cookie
__cfduid=ded850b56f952231fae82c319ac0b125d1537954489
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/mKwEvj9s
:scheme
https
:method
GET
Referer
https://pastebin.com/mKwEvj9s
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:50 GMT
cf-cache-status
HIT
last-modified
Wed, 16 Dec 2015 04:15:00 GMT
server
cloudflare
etag
"5670e544-2b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
status
200
cache-control
public, max-age=7776000
accept-ranges
bytes
cf-ray
4604bcab7cbf64db-FRA
content-length
43
x-xss-protection
1; mode=block
expires
Tue, 25 Dec 2018 09:34:50 GMT
tags.js
tags.expo9.exponential.com/tags/Pastebincom/Safe/
7 KB
3 KB
Script
General
Full URL
https://tags.expo9.exponential.com/tags/Pastebincom/Safe/tags.js
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
204.11.109.77 Emeryville, United States, ASN33419 (TRIBAL-FUSION - Exponential Interactive, Inc., US),
Reverse DNS
tags.expo9.exponential.com
Software
/
Resource Hash
c0e84e667672bf1c1c675beab334b374919c2a76172ddf890e48ac57b182f5ee

Request headers

Referer
https://pastebin.com/mKwEvj9s
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 26 Sep 2018 09:34:50 GMT
Content-Encoding
gzip
X-Function
151
X-Reuse-Index
1
ETag
5909443542969422214
Vary
Accept-Encoding
P3P
CP="NOI DEVo TAIa OUR BUS"
Cache-Control
max-age=3600, public
Last-Modified
Fri, 21 Jun 2013 00:18:47 GMT
Connection
keep-alive
Content-Type
application/x-javascript
Content-Length
2306
Expires
Wed, 26 Sep 2018 10:34:50 GMT
hello.png
pastebin.com/i/
4 KB
4 KB
Image
General
Full URL
https://pastebin.com/i/hello.png
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8040db06855291ee0489a814aee5d975ce5acfe272b26ec98597b005e4d5789f
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/hello.png
pragma
no-cache
cookie
__cfduid=ded850b56f952231fae82c319ac0b125d1537954489
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/mKwEvj9s
:scheme
https
:method
GET
Referer
https://pastebin.com/mKwEvj9s
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:50 GMT
cf-cache-status
HIT
last-modified
Fri, 01 Jun 2018 07:07:42 GMT
server
cloudflare
etag
"5b10f0be-e3f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=7776000
accept-ranges
bytes
cf-ray
4604bcab7cc064db-FRA
content-length
3647
x-xss-protection
1; mode=block
expires
Tue, 25 Dec 2018 09:34:50 GMT
tags.js
tags.expo9.exponential.com/tags/Pastebincom/SnackbarSafe/
7 KB
3 KB
Script
General
Full URL
https://tags.expo9.exponential.com/tags/Pastebincom/SnackbarSafe/tags.js
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
204.11.109.77 Emeryville, United States, ASN33419 (TRIBAL-FUSION - Exponential Interactive, Inc., US),
Reverse DNS
tags.expo9.exponential.com
Software
/
Resource Hash
c0e84e667672bf1c1c675beab334b374919c2a76172ddf890e48ac57b182f5ee

Request headers

Referer
https://pastebin.com/mKwEvj9s
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 26 Sep 2018 09:34:50 GMT
Content-Encoding
gzip
X-Function
151
X-Reuse-Index
1
ETag
5909443542969422214
Vary
Accept-Encoding
P3P
CP="NOI DEVo TAIa OUR BUS"
Cache-Control
max-age=3600, public
Last-Modified
Fri, 21 Jun 2013 00:18:47 GMT
Connection
keep-alive
Content-Type
application/x-javascript
Content-Length
2306
Expires
Wed, 26 Sep 2018 10:34:50 GMT
monetization.js
m.servedby-buysellads.com/
38 KB
12 KB
Script
General
Full URL
https://m.servedby-buysellads.com/monetization.js
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
108.161.189.78 Los Angeles, United States, ASN12989 (HWNG, NL),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
1e78caa75f3cf9ab0bb3425ac479d7d21ab76001a07b13e5d999404a4589f9f0

Request headers

Referer
https://pastebin.com/mKwEvj9s
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 26 Sep 2018 09:34:50 GMT
Content-Encoding
gzip
Last-Modified
Tue, 28 Aug 2018 13:13:52 GMT
Server
NetDNA-cache/2.2
x-amz-request-id
DC7E1C4F0F244E19
ETag
W/"0d6d42588db1de58ff2d6e6f9cc4742f"
Transfer-Encoding
chunked
X-Cache
HIT
Content-Type
application/javascript
Cache-Control
max-age=86400
Connection
keep-alive
x-amz-id-2
AmGT1KB0JIlxsHfc2vj5G88GpkfG+UU0g0UCfOa3PtaiJFoSnrUpKfSvyGi25gYjKxzW1dz9OYg=
Expires
Thu, 27 Sep 2018 09:34:50 GMT
linebg.png
pastebin.com/i/
375 B
451 B
Image
General
Full URL
https://pastebin.com/i/linebg.png
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d45d1b49b5918ea0ffa0b3d119995b96b558147f618f0ea1897906252be7bcb4
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/linebg.png
pragma
no-cache
cookie
__cfduid=ded850b56f952231fae82c319ac0b125d1537954489
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/i/pastebin.min.v6.css
:scheme
https
:method
GET
Referer
https://pastebin.com/i/pastebin.min.v6.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:50 GMT
cf-cache-status
HIT
last-modified
Wed, 16 Dec 2015 04:15:00 GMT
server
cloudflare
etag
"5670e544-177"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=7776000
accept-ranges
bytes
cf-ray
4604bcab7cc364db-FRA
content-length
375
x-xss-protection
1; mode=block
expires
Tue, 25 Dec 2018 09:34:50 GMT
pro_btn_hover.png
pastebin.com/i/
729 B
805 B
Image
General
Full URL
https://pastebin.com/i/pro_btn_hover.png
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f5154cd93dc27142f30bf0d10c32b64f107b81f89cc4801e296623cdbafef6bc
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/pro_btn_hover.png
pragma
no-cache
cookie
__cfduid=ded850b56f952231fae82c319ac0b125d1537954489
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/i/pastebin.min.v6.css
:scheme
https
:method
GET
Referer
https://pastebin.com/i/pastebin.min.v6.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:50 GMT
cf-cache-status
HIT
last-modified
Wed, 16 Dec 2015 04:15:00 GMT
server
cloudflare
etag
"5670e544-2d9"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=7776000
accept-ranges
bytes
cf-ray
4604bcab7cc464db-FRA
content-length
729
x-xss-protection
1; mode=block
expires
Tue, 25 Dec 2018 09:34:50 GMT
public.png
pastebin.com/i/
2 KB
2 KB
Image
General
Full URL
https://pastebin.com/i/public.png
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1fb72c2609597452b616197d9cf4bd65e48e5ceb998936aeee8ee8994b1c403a
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/public.png
pragma
no-cache
cookie
__cfduid=ded850b56f952231fae82c319ac0b125d1537954489
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/i/pastebin.min.v6.css
:scheme
https
:method
GET
Referer
https://pastebin.com/i/pastebin.min.v6.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:50 GMT
cf-cache-status
HIT
last-modified
Wed, 16 Dec 2015 04:15:00 GMT
server
cloudflare
etag
"5670e544-7d3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=7776000
accept-ranges
bytes
cf-ray
4604bcab7cc564db-FRA
content-length
2003
x-xss-protection
1; mode=block
expires
Tue, 25 Dec 2018 09:34:50 GMT
header_bg.png
pastebin.com/i/
191 B
266 B
Image
General
Full URL
https://pastebin.com/i/header_bg.png
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7a735f35356d3ca513b6c242e3f4c1034557e01faaa774b4e14feaef46ecdaac
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/header_bg.png
pragma
no-cache
cookie
__cfduid=ded850b56f952231fae82c319ac0b125d1537954489
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/i/pastebin.min.v6.css
:scheme
https
:method
GET
Referer
https://pastebin.com/i/pastebin.min.v6.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:50 GMT
cf-cache-status
HIT
last-modified
Wed, 16 Dec 2015 04:15:00 GMT
server
cloudflare
etag
"5670e544-bf"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=7776000
accept-ranges
bytes
cf-ray
4604bcab7cc664db-FRA
content-length
191
x-xss-protection
1; mode=block
expires
Tue, 25 Dec 2018 09:34:50 GMT
dd_settings.png
pastebin.com/i/
1 KB
1 KB
Image
General
Full URL
https://pastebin.com/i/dd_settings.png
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2aa1657cc01cbd5e50c8a6de27ea8e811cf8c2bb8d182d8946c628ad3fe0b4e3
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/dd_settings.png
pragma
no-cache
cookie
__cfduid=ded850b56f952231fae82c319ac0b125d1537954489
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/i/pastebin.min.v6.css
:scheme
https
:method
GET
Referer
https://pastebin.com/i/pastebin.min.v6.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:50 GMT
cf-cache-status
HIT
last-modified
Wed, 16 Dec 2015 04:15:00 GMT
server
cloudflare
etag
"5670e544-4ee"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=7776000
accept-ranges
bytes
cf-ray
4604bcab7cc764db-FRA
content-length
1262
x-xss-protection
1; mode=block
expires
Tue, 25 Dec 2018 09:34:50 GMT
dd_alerts.png
pastebin.com/i/
915 B
993 B
Image
General
Full URL
https://pastebin.com/i/dd_alerts.png
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
df418a54adb533554fec3e2a4fb348625f539469f11380963942511835a3c771
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/dd_alerts.png
pragma
no-cache
cookie
__cfduid=ded850b56f952231fae82c319ac0b125d1537954489
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/i/pastebin.min.v6.css
:scheme
https
:method
GET
Referer
https://pastebin.com/i/pastebin.min.v6.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:50 GMT
cf-cache-status
HIT
last-modified
Wed, 16 Dec 2015 04:15:00 GMT
server
cloudflare
etag
"5670e544-393"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=7776000
accept-ranges
bytes
cf-ray
4604bcab7cc964db-FRA
content-length
915
x-xss-protection
1; mode=block
expires
Tue, 25 Dec 2018 09:34:50 GMT
dd_messages.png
pastebin.com/i/
1 KB
1 KB
Image
General
Full URL
https://pastebin.com/i/dd_messages.png
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
fd1fd8dff30cc102766aa53409d2f292e413e5b9b4be66814c697c90e1c48da3
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/dd_messages.png
pragma
no-cache
cookie
__cfduid=ded850b56f952231fae82c319ac0b125d1537954489
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/i/pastebin.min.v6.css
:scheme
https
:method
GET
Referer
https://pastebin.com/i/pastebin.min.v6.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:50 GMT
cf-cache-status
HIT
last-modified
Wed, 16 Dec 2015 04:15:00 GMT
server
cloudflare
etag
"5670e544-44b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=7776000
accept-ranges
bytes
cf-ray
4604bcab7cca64db-FRA
content-length
1099
x-xss-protection
1; mode=block
expires
Tue, 25 Dec 2018 09:34:50 GMT
dd_pastebin.png
pastebin.com/i/
667 B
743 B
Image
General
Full URL
https://pastebin.com/i/dd_pastebin.png
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7fc2927c6ecc0e0402558ef08cdac15420bf7699cc9c5976f2ae72a3af10d0d1
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/dd_pastebin.png
pragma
no-cache
cookie
__cfduid=ded850b56f952231fae82c319ac0b125d1537954489
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/i/pastebin.min.v6.css
:scheme
https
:method
GET
Referer
https://pastebin.com/i/pastebin.min.v6.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:50 GMT
cf-cache-status
HIT
last-modified
Wed, 16 Dec 2015 04:15:00 GMT
server
cloudflare
etag
"5670e544-29b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=7776000
accept-ranges
bytes
cf-ray
4604bcab7ccb64db-FRA
content-length
667
x-xss-protection
1; mode=block
expires
Tue, 25 Dec 2018 09:34:50 GMT
menu_down.png
pastebin.com/i/
506 B
581 B
Image
General
Full URL
https://pastebin.com/i/menu_down.png
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
56c4ce67d315f88d68e3e1a5a52049bc892096c4aab3e534226c29704886af20
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/menu_down.png
pragma
no-cache
cookie
__cfduid=ded850b56f952231fae82c319ac0b125d1537954489
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/i/pastebin.min.v6.css
:scheme
https
:method
GET
Referer
https://pastebin.com/i/pastebin.min.v6.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:50 GMT
cf-cache-status
HIT
last-modified
Wed, 16 Dec 2015 04:15:00 GMT
server
cloudflare
etag
"5670e544-1fa"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=7776000
accept-ranges
bytes
cf-ray
4604bcab8ccd64db-FRA
content-length
506
x-xss-protection
1; mode=block
expires
Tue, 25 Dec 2018 09:34:50 GMT
search.png
pastebin.com/i/
1 KB
1 KB
Image
General
Full URL
https://pastebin.com/i/search.png
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
dcf1268c850c2e448c01958bd3fc92fe2ae6a661353ac6238104ebfb57b04cbd
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/search.png
pragma
no-cache
cookie
__cfduid=ded850b56f952231fae82c319ac0b125d1537954489
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/i/pastebin.min.v6.css
:scheme
https
:method
GET
Referer
https://pastebin.com/i/pastebin.min.v6.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:50 GMT
cf-cache-status
HIT
last-modified
Wed, 16 Dec 2015 04:15:00 GMT
server
cloudflare
etag
"5670e544-595"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=7776000
accept-ranges
bytes
cf-ray
4604bcab8cce64db-FRA
content-length
1429
x-xss-protection
1; mode=block
expires
Tue, 25 Dec 2018 09:34:50 GMT
add_2.png
pastebin.com/i/
491 B
566 B
Image
General
Full URL
https://pastebin.com/i/add_2.png
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
637dd01675f7015d068b7cadcfdf32607fec872ed3ef04ef9013d203a57e2f59
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/add_2.png
pragma
no-cache
cookie
__cfduid=ded850b56f952231fae82c319ac0b125d1537954489
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/i/pastebin.min.v6.css
:scheme
https
:method
GET
Referer
https://pastebin.com/i/pastebin.min.v6.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:50 GMT
cf-cache-status
HIT
last-modified
Wed, 16 Dec 2015 04:15:00 GMT
server
cloudflare
etag
"5670e544-1eb"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=7776000
accept-ranges
bytes
cf-ray
4604bcab8ccf64db-FRA
content-length
491
x-xss-protection
1; mode=block
expires
Tue, 25 Dec 2018 09:34:50 GMT
pastebin_logo_side_outline.png
pastebin.com/i/
18 KB
18 KB
Image
General
Full URL
https://pastebin.com/i/pastebin_logo_side_outline.png
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a0bb893da5412b75e25ef7bb44285e3e0de74c550f7a2a7e40cb5fd29f82ba41
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/pastebin_logo_side_outline.png
pragma
no-cache
cookie
__cfduid=ded850b56f952231fae82c319ac0b125d1537954489
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/i/pastebin.min.v6.css
:scheme
https
:method
GET
Referer
https://pastebin.com/i/pastebin.min.v6.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:50 GMT
cf-cache-status
HIT
last-modified
Wed, 16 Dec 2015 04:15:00 GMT
server
cloudflare
etag
"5670e544-4660"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=7776000
accept-ranges
bytes
cf-ray
4604bcab8cd064db-FRA
content-length
18016
x-xss-protection
1; mode=block
expires
Tue, 25 Dec 2018 09:34:50 GMT
analytics.js
www.google-analytics.com/
39 KB
16 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-58643-34
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:812::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
ed17a6e7532cc3065f9fbd8f607dfd30e09b4531ada9f7cb5732a2bf6cf6744c
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://pastebin.com/mKwEvj9s
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 13 Sep 2018 23:12:19 GMT
server
Golfe2
age
6944
date
Wed, 26 Sep 2018 07:39:06 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
16173
expires
Wed, 26 Sep 2018 09:39:06 GMT
collect
stats.g.doubleclick.net/r/
Redirect Chain
  • https://www.google-analytics.com/r/collect?v=1&_v=j69&a=608159535&t=pageview&_s=1&dl=https%3A%2F%2Fpastebin.com%2FmKwEvj9s&ul=en-us&de=UTF-8&dt=Emotet%2025%2F09%2F2018%20-%20Pastebin.com&sd=24-bit&...
  • https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-58643-34&cid=858357356.1537954490&jid=1315175872&_gid=1014346891.1537954490&gjid=1106528075&_v=j69&z=830698423
35 B
102 B
Image
General
Full URL
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-58643-34&cid=858357356.1537954490&jid=1315175872&_gid=1014346891.1537954490&gjid=1106528075&_v=j69&z=830698423
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:400c:c00::9d , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://pastebin.com/mKwEvj9s
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Wed, 26 Sep 2018 09:34:50 GMT
status
200
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
35
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 26 Sep 2018 09:34:50 GMT
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
302
location
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-58643-34&cid=858357356.1537954490&jid=1315175872&_gid=1014346891.1537954490&gjid=1106528075&_v=j69&z=830698423
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
416
expires
Fri, 01 Jan 1990 00:00:00 GMT
tags.js
s.tribalfusion.com/real/tags/Pastebincom/Safe/ Frame 4E53
58 KB
14 KB
Script
General
Full URL
https://s.tribalfusion.com/real/tags/Pastebincom/Safe/tags.js
Requested by
Host: tags.expo9.exponential.com
URL: https://tags.expo9.exponential.com/tags/Pastebincom/Safe/tags.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
204.11.109.67 Emeryville, United States, ASN33419 (TRIBAL-FUSION - Exponential Interactive, Inc., US),
Reverse DNS
a.tribalfusion.com
Software
/
Resource Hash
f9a12108fbbe82e3cc882d935fdbf1aaf80ec4d74b09947d574919f60eadf199

Request headers

Referer
https://pastebin.com/mKwEvj9s
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 26 Sep 2018 09:34:51 GMT
Content-Encoding
gzip
X-Function
151
X-Reuse-Index
1
ETag
16581811717367587091
Vary
Accept-Encoding
P3P
CP="NOI DEVo TAIa OUR BUS"
Cache-Control
max-age=3600, private
Last-Modified
Mon, 11 Jun 2018 04:07:30 GMT
Connection
keep-alive
Content-Type
application/x-javascript
Content-Length
13900
Expires
Wed, 26 Sep 2018 10:34:51 GMT
expire.png
pastebin.com/i/
2 KB
2 KB
Image
General
Full URL
https://pastebin.com/i/expire.png
Requested by
Host: tags.expo9.exponential.com
URL: https://tags.expo9.exponential.com/tags/Pastebincom/Safe/tags.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
700e718b3a30ca8a9b4b19aecaa62b457998559eddc0eb7f1f8bc5d483738154
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/expire.png
pragma
no-cache
cookie
__cfduid=ded850b56f952231fae82c319ac0b125d1537954489; _ga=GA1.2.858357356.1537954490; _gid=GA1.2.1014346891.1537954490; _gat_gtag_UA_58643_34=1
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/i/pastebin.min.v6.css
:scheme
https
:method
GET
Referer
https://pastebin.com/i/pastebin.min.v6.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:50 GMT
cf-cache-status
HIT
last-modified
Wed, 16 Dec 2015 04:15:00 GMT
server
cloudflare
etag
"5670e544-6c1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=7776000
accept-ranges
bytes
cf-ray
4604bcb0493f64db-FRA
content-length
1729
x-xss-protection
1; mode=block
expires
Tue, 25 Dec 2018 09:34:50 GMT
views.png
pastebin.com/i/
1 KB
2 KB
Image
General
Full URL
https://pastebin.com/i/views.png
Requested by
Host: tags.expo9.exponential.com
URL: https://tags.expo9.exponential.com/tags/Pastebincom/Safe/tags.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6e4d2d5f2bc5a257b2fb037354fe5318591688dcf734375eaa0abd9d2d211642
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/views.png
pragma
no-cache
cookie
__cfduid=ded850b56f952231fae82c319ac0b125d1537954489; _ga=GA1.2.858357356.1537954490; _gid=GA1.2.1014346891.1537954490; _gat_gtag_UA_58643_34=1
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/i/pastebin.min.v6.css
:scheme
https
:method
GET
Referer
https://pastebin.com/i/pastebin.min.v6.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:50 GMT
cf-cache-status
HIT
last-modified
Wed, 16 Dec 2015 04:15:00 GMT
server
cloudflare
etag
"5670e544-5aa"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=7776000
accept-ranges
bytes
cf-ray
4604bcb0494164db-FRA
content-length
1450
x-xss-protection
1; mode=block
expires
Tue, 25 Dec 2018 09:34:50 GMT
date.png
pastebin.com/i/
1 KB
1 KB
Image
General
Full URL
https://pastebin.com/i/date.png
Requested by
Host: tags.expo9.exponential.com
URL: https://tags.expo9.exponential.com/tags/Pastebincom/Safe/tags.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1ea8e3c5b76d5a78f7e206a10dae6b1ad359a2987bb83278e2071bf3952751df
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/date.png
pragma
no-cache
cookie
__cfduid=ded850b56f952231fae82c319ac0b125d1537954489; _ga=GA1.2.858357356.1537954490; _gid=GA1.2.1014346891.1537954490; _gat_gtag_UA_58643_34=1
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/i/pastebin.min.v6.css
:scheme
https
:method
GET
Referer
https://pastebin.com/i/pastebin.min.v6.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:50 GMT
cf-cache-status
HIT
last-modified
Wed, 16 Dec 2015 04:15:00 GMT
server
cloudflare
etag
"5670e544-4b3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=7776000
accept-ranges
bytes
cf-ray
4604bcb0494364db-FRA
content-length
1203
x-xss-protection
1; mode=block
expires
Tue, 25 Dec 2018 09:34:50 GMT
user.png
pastebin.com/i/
2 KB
2 KB
Image
General
Full URL
https://pastebin.com/i/user.png
Requested by
Host: tags.expo9.exponential.com
URL: https://tags.expo9.exponential.com/tags/Pastebincom/Safe/tags.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
3a49cd5f8860e1d7c8c2b572d35fa1ebd8dd94b39f62f4e7d641cc524f99e383
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/user.png
pragma
no-cache
cookie
__cfduid=ded850b56f952231fae82c319ac0b125d1537954489; _ga=GA1.2.858357356.1537954490; _gid=GA1.2.1014346891.1537954490; _gat_gtag_UA_58643_34=1
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/i/pastebin.min.v6.css
:scheme
https
:method
GET
Referer
https://pastebin.com/i/pastebin.min.v6.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:50 GMT
cf-cache-status
HIT
last-modified
Wed, 16 Dec 2015 04:15:00 GMT
server
cloudflare
etag
"5670e544-6c9"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=7776000
accept-ranges
bytes
cf-ray
4604bcb0494464db-FRA
content-length
1737
x-xss-protection
1; mode=block
expires
Tue, 25 Dec 2018 09:34:50 GMT
twitter_svg.png
pastebin.com/i/
1 KB
2 KB
Image
General
Full URL
https://pastebin.com/i/twitter_svg.png
Requested by
Host: tags.expo9.exponential.com
URL: https://tags.expo9.exponential.com/tags/Pastebincom/Safe/tags.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2a8f23d3c4e9b734cbbdc94448337ef2598d61bcdd475dd5a4d1b7fdaf019152
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/twitter_svg.png
pragma
no-cache
cookie
__cfduid=ded850b56f952231fae82c319ac0b125d1537954489; _ga=GA1.2.858357356.1537954490; _gid=GA1.2.1014346891.1537954490; _gat_gtag_UA_58643_34=1
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/i/pastebin.min.v6.css
:scheme
https
:method
GET
Referer
https://pastebin.com/i/pastebin.min.v6.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:50 GMT
cf-cache-status
HIT
last-modified
Wed, 16 Dec 2015 04:15:00 GMT
server
cloudflare
etag
"5670e544-5d2"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=7776000
accept-ranges
bytes
cf-ray
4604bcb0494564db-FRA
content-length
1490
x-xss-protection
1; mode=block
expires
Tue, 25 Dec 2018 09:34:50 GMT
facebook_svg.png
pastebin.com/i/
794 B
869 B
Image
General
Full URL
https://pastebin.com/i/facebook_svg.png
Requested by
Host: tags.expo9.exponential.com
URL: https://tags.expo9.exponential.com/tags/Pastebincom/Safe/tags.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cfda531c613a3bacfd789e014cd6f5c9c792d50f136dc15c7aa65144a2af1f7a
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/facebook_svg.png
pragma
no-cache
cookie
__cfduid=ded850b56f952231fae82c319ac0b125d1537954489; _ga=GA1.2.858357356.1537954490; _gid=GA1.2.1014346891.1537954490; _gat_gtag_UA_58643_34=1
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/i/pastebin.min.v6.css
:scheme
https
:method
GET
Referer
https://pastebin.com/i/pastebin.min.v6.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:50 GMT
cf-cache-status
HIT
last-modified
Wed, 16 Dec 2015 04:15:00 GMT
server
cloudflare
etag
"5670e544-31a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=7776000
accept-ranges
bytes
cf-ray
4604bcb0494664db-FRA
content-length
794
x-xss-protection
1; mode=block
expires
Tue, 25 Dec 2018 09:34:50 GMT
steadfast_1.png
pastebin.com/i/
1 KB
1 KB
Image
General
Full URL
https://pastebin.com/i/steadfast_1.png
Requested by
Host: tags.expo9.exponential.com
URL: https://tags.expo9.exponential.com/tags/Pastebincom/Safe/tags.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
3fb852db1cd132dda2e5b283b43d7cc7debe88e4ec803db31613aa472ae72009
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/steadfast_1.png
pragma
no-cache
cookie
__cfduid=ded850b56f952231fae82c319ac0b125d1537954489; _ga=GA1.2.858357356.1537954490; _gid=GA1.2.1014346891.1537954490; _gat_gtag_UA_58643_34=1
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/i/pastebin.min.v6.css
:scheme
https
:method
GET
Referer
https://pastebin.com/i/pastebin.min.v6.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:50 GMT
cf-cache-status
HIT
last-modified
Wed, 16 Dec 2015 04:15:00 GMT
server
cloudflare
etag
"5670e544-4dd"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=7776000
accept-ranges
bytes
cf-ray
4604bcb0494764db-FRA
content-length
1245
x-xss-protection
1; mode=block
expires
Tue, 25 Dec 2018 09:34:50 GMT
tags.js
s.tribalfusion.com/real/tags/Pastebincom/Safe/ Frame D874
58 KB
14 KB
Script
General
Full URL
https://s.tribalfusion.com/real/tags/Pastebincom/Safe/tags.js
Requested by
Host: tags.expo9.exponential.com
URL: https://tags.expo9.exponential.com/tags/Pastebincom/Safe/tags.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
204.11.109.67 Emeryville, United States, ASN33419 (TRIBAL-FUSION - Exponential Interactive, Inc., US),
Reverse DNS
a.tribalfusion.com
Software
/
Resource Hash
f9a12108fbbe82e3cc882d935fdbf1aaf80ec4d74b09947d574919f60eadf199

Request headers

Referer
https://pastebin.com/mKwEvj9s
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 26 Sep 2018 09:34:51 GMT
Content-Encoding
gzip
X-Function
151
X-Reuse-Index
1
ETag
16581811717367587091
Vary
Accept-Encoding
P3P
CP="NOI DEVo TAIa OUR BUS"
Cache-Control
max-age=3600, private
Last-Modified
Mon, 11 Jun 2018 04:07:30 GMT
Connection
keep-alive
Content-Type
application/x-javascript
Content-Length
13900
Expires
Wed, 26 Sep 2018 10:34:51 GMT
info.png
pastebin.com/i/
2 KB
2 KB
Image
General
Full URL
https://pastebin.com/i/info.png
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
703d23efcb49183ab7f2795739f547fcd42c3d73e77f47b6c614892bb6666cea
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/info.png
pragma
no-cache
cookie
__cfduid=ded850b56f952231fae82c319ac0b125d1537954489; _ga=GA1.2.858357356.1537954490; _gid=GA1.2.1014346891.1537954490; _gat_gtag_UA_58643_34=1
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/i/pastebin.min.v6.css
:scheme
https
:method
GET
Referer
https://pastebin.com/i/pastebin.min.v6.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:50 GMT
cf-cache-status
HIT
last-modified
Wed, 16 Dec 2015 04:15:00 GMT
server
cloudflare
etag
"5670e544-68c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=7776000
accept-ranges
bytes
cf-ray
4604bcb0595264db-FRA
content-length
1676
x-xss-protection
1; mode=block
expires
Tue, 25 Dec 2018 09:34:50 GMT
tags.js
s.tribalfusion.com/real/tags/Pastebincom/Safe/ Frame 0FBB
58 KB
14 KB
Script
General
Full URL
https://s.tribalfusion.com/real/tags/Pastebincom/Safe/tags.js
Requested by
Host: tags.expo9.exponential.com
URL: https://tags.expo9.exponential.com/tags/Pastebincom/Safe/tags.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
204.11.109.66 Emeryville, United States, ASN33419 (TRIBAL-FUSION - Exponential Interactive, Inc., US),
Reverse DNS
a.tribalfusion.com
Software
/
Resource Hash
f9a12108fbbe82e3cc882d935fdbf1aaf80ec4d74b09947d574919f60eadf199

Request headers

Referer
https://pastebin.com/mKwEvj9s
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 26 Sep 2018 09:34:51 GMT
Content-Encoding
gzip
X-Function
151
X-Reuse-Index
1
ETag
16581811717367587091
Vary
Accept-Encoding
P3P
CP="NOI DEVo TAIa OUR BUS"
Cache-Control
max-age=3600, private
Last-Modified
Mon, 11 Jun 2018 04:07:30 GMT
Connection
keep-alive
Content-Type
application/x-javascript
Content-Length
13900
Expires
Wed, 26 Sep 2018 10:34:51 GMT
twitter_circle.png
pastebin.com/i/
954 B
1 KB
Image
General
Full URL
https://pastebin.com/i/twitter_circle.png
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9db7a21dd14ba20bee6dc27da7e4cd799a936e9b1b5dee203f24d503b2e89b7f
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/twitter_circle.png
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/i/pastebin.min.v6.css
:scheme
https
:method
GET
Referer
https://pastebin.com/i/pastebin.min.v6.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:51 GMT
cf-cache-status
HIT
status
200
content-length
954
x-xss-protection
1; mode=block
last-modified
Wed, 16 Dec 2015 04:15:00 GMT
server
cloudflare
etag
"5670e544-3ba"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
cache-control
public, max-age=7776000
set-cookie
__cfduid=d5b51f2e1bc61419a36d590ac7344a3421537954491; expires=Thu, 26-Sep-19 09:34:51 GMT; path=/; domain=.pastebin.com; HttpOnly
accept-ranges
bytes
cf-ray
4604bcb0c9d764db-FRA
expires
Tue, 25 Dec 2018 09:34:51 GMT
facebook_circle.png
pastebin.com/i/
818 B
895 B
Image
General
Full URL
https://pastebin.com/i/facebook_circle.png
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
71f870b7243ed05cae8e4707adb82c8d6b30174bcd83e5d9b7c60bdee8bdbb6b
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/facebook_circle.png
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/i/pastebin.min.v6.css
:scheme
https
:method
GET
Referer
https://pastebin.com/i/pastebin.min.v6.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:51 GMT
cf-cache-status
HIT
status
200
content-length
818
x-xss-protection
1; mode=block
last-modified
Wed, 16 Dec 2015 04:15:00 GMT
server
cloudflare
etag
"5670e544-332"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
cache-control
public, max-age=7776000
set-cookie
__cfduid=d5b51f2e1bc61419a36d590ac7344a3421537954491; expires=Thu, 26-Sep-19 09:34:51 GMT; path=/; domain=.pastebin.com; HttpOnly
accept-ranges
bytes
cf-ray
4604bcb0c9d864db-FRA
expires
Tue, 25 Dec 2018 09:34:51 GMT
footer_linux.png
pastebin.com/i/
4 KB
5 KB
Image
General
Full URL
https://pastebin.com/i/footer_linux.png
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e1ec9f1acf0830d76c1a807a32cd47398e0bcbc6dfac6d4792f2a3ab78cd4a29
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/footer_linux.png
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/i/pastebin.min.v6.css
:scheme
https
:method
GET
Referer
https://pastebin.com/i/pastebin.min.v6.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:51 GMT
cf-cache-status
HIT
status
200
content-length
4571
x-xss-protection
1; mode=block
last-modified
Wed, 16 Dec 2015 04:15:00 GMT
server
cloudflare
etag
"5670e544-11db"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
cache-control
public, max-age=7776000
set-cookie
__cfduid=d5b51f2e1bc61419a36d590ac7344a3421537954491; expires=Thu, 26-Sep-19 09:34:51 GMT; path=/; domain=.pastebin.com; HttpOnly
accept-ranges
bytes
cf-ray
4604bcb0c9d964db-FRA
expires
Tue, 25 Dec 2018 09:34:51 GMT
footer_opera.png
pastebin.com/i/
3 KB
3 KB
Image
General
Full URL
https://pastebin.com/i/footer_opera.png
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
520fcb233d72b3e30c4491aab4ac425baac5faa0918b47491419a8d7bdeff387
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/footer_opera.png
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/i/pastebin.min.v6.css
:scheme
https
:method
GET
Referer
https://pastebin.com/i/pastebin.min.v6.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:51 GMT
cf-cache-status
HIT
status
200
content-length
2756
x-xss-protection
1; mode=block
last-modified
Wed, 16 Dec 2015 04:15:00 GMT
server
cloudflare
etag
"5670e544-ac4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
cache-control
public, max-age=7776000
set-cookie
__cfduid=d5b51f2e1bc61419a36d590ac7344a3421537954491; expires=Thu, 26-Sep-19 09:34:51 GMT; path=/; domain=.pastebin.com; HttpOnly
accept-ranges
bytes
cf-ray
4604bcb0c9da64db-FRA
expires
Tue, 25 Dec 2018 09:34:51 GMT
footer_macosx.png
pastebin.com/i/
3 KB
3 KB
Image
General
Full URL
https://pastebin.com/i/footer_macosx.png
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ea834ee6d3c746a617db8d9bcfe8fb91cda36b1ff34c1c5771f45f833bdcec3b
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/footer_macosx.png
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/i/pastebin.min.v6.css
:scheme
https
:method
GET
Referer
https://pastebin.com/i/pastebin.min.v6.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:51 GMT
cf-cache-status
HIT
status
200
content-length
2865
x-xss-protection
1; mode=block
last-modified
Wed, 16 Dec 2015 04:15:00 GMT
server
cloudflare
etag
"5670e544-b31"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
cache-control
public, max-age=7776000
set-cookie
__cfduid=d5b51f2e1bc61419a36d590ac7344a3421537954491; expires=Thu, 26-Sep-19 09:34:51 GMT; path=/; domain=.pastebin.com; HttpOnly
accept-ranges
bytes
cf-ray
4604bcb0c9db64db-FRA
expires
Tue, 25 Dec 2018 09:34:51 GMT
footer_android.png
pastebin.com/i/
2 KB
2 KB
Image
General
Full URL
https://pastebin.com/i/footer_android.png
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
79b2fa9032215e3dff51865bbe0024d7cb9b3f1914b1fb79944347dbfe48374b
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/footer_android.png
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/i/pastebin.min.v6.css
:scheme
https
:method
GET
Referer
https://pastebin.com/i/pastebin.min.v6.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:51 GMT
cf-cache-status
HIT
status
200
content-length
2469
x-xss-protection
1; mode=block
last-modified
Wed, 16 Dec 2015 04:15:00 GMT
server
cloudflare
etag
"5670e544-9a5"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
cache-control
public, max-age=7776000
set-cookie
__cfduid=d5b51f2e1bc61419a36d590ac7344a3421537954491; expires=Thu, 26-Sep-19 09:34:51 GMT; path=/; domain=.pastebin.com; HttpOnly
accept-ranges
bytes
cf-ray
4604bcb0c9dc64db-FRA
expires
Tue, 25 Dec 2018 09:34:51 GMT
footer_windows.png
pastebin.com/i/
2 KB
2 KB
Image
General
Full URL
https://pastebin.com/i/footer_windows.png
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1e46d7ead177a073e065d10eead66856f03521f60ebab4def0d58c9c971ecd16
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/footer_windows.png
pragma
no-cache
cookie
__cfduid=d5b51f2e1bc61419a36d590ac7344a3421537954491
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/i/pastebin.min.v6.css
:scheme
https
:method
GET
Referer
https://pastebin.com/i/pastebin.min.v6.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:51 GMT
cf-cache-status
HIT
last-modified
Wed, 16 Dec 2015 04:15:00 GMT
server
cloudflare
etag
"5670e544-710"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=7776000
accept-ranges
bytes
cf-ray
4604bcb0d9e564db-FRA
content-length
1808
x-xss-protection
1; mode=block
expires
Tue, 25 Dec 2018 09:34:51 GMT
footer_ios.png
pastebin.com/i/
3 KB
3 KB
Image
General
Full URL
https://pastebin.com/i/footer_ios.png
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
df85c7193b05044e0cc8443a8122e92051590e6b86eb0668e43e175a7e7868f8
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/footer_ios.png
pragma
no-cache
cookie
__cfduid=d5b51f2e1bc61419a36d590ac7344a3421537954491
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/i/pastebin.min.v6.css
:scheme
https
:method
GET
Referer
https://pastebin.com/i/pastebin.min.v6.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:51 GMT
cf-cache-status
HIT
last-modified
Wed, 16 Dec 2015 04:15:00 GMT
server
cloudflare
etag
"5670e544-bc3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=7776000
accept-ranges
bytes
cf-ray
4604bcb0d9e664db-FRA
content-length
3011
x-xss-protection
1; mode=block
expires
Tue, 25 Dec 2018 09:34:51 GMT
footer_firefox.png
pastebin.com/i/
3 KB
3 KB
Image
General
Full URL
https://pastebin.com/i/footer_firefox.png
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
de9f869660ffdfc25464f11930933413a3e1efa363dfd35267b9ba7843731adc
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/footer_firefox.png
pragma
no-cache
cookie
__cfduid=d5b51f2e1bc61419a36d590ac7344a3421537954491
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/i/pastebin.min.v6.css
:scheme
https
:method
GET
Referer
https://pastebin.com/i/pastebin.min.v6.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:51 GMT
cf-cache-status
HIT
last-modified
Wed, 16 Dec 2015 04:15:00 GMT
server
cloudflare
etag
"5670e544-c6a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=7776000
accept-ranges
bytes
cf-ray
4604bcb0d9e764db-FRA
content-length
3178
x-xss-protection
1; mode=block
expires
Tue, 25 Dec 2018 09:34:51 GMT
footer_chrome.png
pastebin.com/i/
3 KB
3 KB
Image
General
Full URL
https://pastebin.com/i/footer_chrome.png
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
96a39b4bca3cb02f0fd18724047cff37cf7ca2ed43240e1631a101e2e308dbd9
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/footer_chrome.png
pragma
no-cache
cookie
__cfduid=d5b51f2e1bc61419a36d590ac7344a3421537954491
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/i/pastebin.min.v6.css
:scheme
https
:method
GET
Referer
https://pastebin.com/i/pastebin.min.v6.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:51 GMT
cf-cache-status
HIT
last-modified
Wed, 16 Dec 2015 04:15:00 GMT
server
cloudflare
etag
"5670e544-bae"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=7776000
accept-ranges
bytes
cf-ray
4604bcb0d9ea64db-FRA
content-length
2990
x-xss-protection
1; mode=block
expires
Tue, 25 Dec 2018 09:34:51 GMT
close_promo.png
pastebin.com/i/
1 KB
1 KB
Image
General
Full URL
https://pastebin.com/i/close_promo.png
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
3e2c5ee3e670df454c774cd417f12f4ca3083db68091f9184fb29efd2af4877b
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/close_promo.png
pragma
no-cache
cookie
__cfduid=d5b51f2e1bc61419a36d590ac7344a3421537954491
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/i/pastebin.min.v6.css
:scheme
https
:method
GET
Referer
https://pastebin.com/i/pastebin.min.v6.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:51 GMT
cf-cache-status
HIT
last-modified
Fri, 05 May 2017 08:52:39 GMT
server
cloudflare
etag
"590c3d57-594"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=7776000
accept-ranges
bytes
cf-ray
4604bcb0d9ec64db-FRA
content-length
1428
x-xss-protection
1; mode=block
expires
Tue, 25 Dec 2018 09:34:51 GMT
tags.js
s.tribalfusion.com/real/tags/Pastebincom/SnackbarSafe/ Frame 0300
58 KB
14 KB
Script
General
Full URL
https://s.tribalfusion.com/real/tags/Pastebincom/SnackbarSafe/tags.js
Requested by
Host: tags.expo9.exponential.com
URL: https://tags.expo9.exponential.com/tags/Pastebincom/Safe/tags.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
204.11.109.67 Emeryville, United States, ASN33419 (TRIBAL-FUSION - Exponential Interactive, Inc., US),
Reverse DNS
a.tribalfusion.com
Software
/
Resource Hash
519da9ab367d112f8fe3fec314abf6bc3fb23aba4f0e2414679b61692de3b796

Request headers

Referer
https://pastebin.com/mKwEvj9s
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 26 Sep 2018 09:34:51 GMT
Content-Encoding
gzip
X-Function
151
X-Reuse-Index
1
ETag
15443014881432072688
Vary
Accept-Encoding
P3P
CP="NOI DEVo TAIa OUR BUS"
Cache-Control
max-age=3600, private
Last-Modified
Mon, 11 Jun 2018 04:07:30 GMT
Connection
keep-alive
Content-Type
application/x-javascript
Content-Length
13906
Expires
Wed, 26 Sep 2018 10:34:51 GMT
cd-top-arrow.png
pastebin.com/i/
451 B
526 B
Image
General
Full URL
https://pastebin.com/i/cd-top-arrow.png
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b800c476dbffdc764f06f0267e3d5b0f8ae0a0c3764ff4e7787f7f388455dd27
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/cd-top-arrow.png
pragma
no-cache
cookie
__cfduid=d5b51f2e1bc61419a36d590ac7344a3421537954491
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/i/pastebin.min.v6.css
:scheme
https
:method
GET
Referer
https://pastebin.com/i/pastebin.min.v6.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:51 GMT
cf-cache-status
HIT
last-modified
Wed, 16 Dec 2015 04:15:00 GMT
server
cloudflare
etag
"5670e544-1c3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=7776000
accept-ranges
bytes
cf-ray
4604bcb12a7a64db-FRA
content-length
451
x-xss-protection
1; mode=block
expires
Tue, 25 Dec 2018 09:34:51 GMT
displayAd.js
s.tribalfusion.com/ Frame D874
678 B
849 B
Script
General
Full URL
https://s.tribalfusion.com/displayAd.js?dver=0.8&th=7415410238
Requested by
Host: s.tribalfusion.com
URL: https://s.tribalfusion.com/real/tags/Pastebincom/Safe/tags.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
204.11.109.67 Emeryville, United States, ASN33419 (TRIBAL-FUSION - Exponential Interactive, Inc., US),
Reverse DNS
a.tribalfusion.com
Software
/
Resource Hash
ffc6c1c168b6613e20ddc95146945d248e2084485cb45e0f5e7a712d75913682

Request headers

Referer
https://pastebin.com/mKwEvj9s
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 26 Sep 2018 09:34:52 GMT
Content-Encoding
gzip
X-Function
153
X-Reuse-Index
2
Vary
Accept-Encoding
P3P
CP="NOI DEVo TAIa OUR BUS"
Cache-Control
private
Last-Modified
Tue, 04 Apr 2017 05:09:56 GMT
Connection
keep-alive
Content-Type
application/x-javascript
Content-Length
332
Expires
Tue, 25 Dec 2018 09:34:52 GMT
displayAd.js
s.tribalfusion.com/ Frame 4E53
677 B
848 B
Script
General
Full URL
https://s.tribalfusion.com/displayAd.js?dver=0.8&th=7415410238
Requested by
Host: s.tribalfusion.com
URL: https://s.tribalfusion.com/real/tags/Pastebincom/Safe/tags.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
204.11.109.67 Emeryville, United States, ASN33419 (TRIBAL-FUSION - Exponential Interactive, Inc., US),
Reverse DNS
a.tribalfusion.com
Software
/
Resource Hash
5e5329aaa32275144cd1ef4372bce662d70537b7634ed634382bdf073733b0da

Request headers

Referer
https://pastebin.com/mKwEvj9s
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 26 Sep 2018 09:34:52 GMT
Content-Encoding
gzip
X-Function
153
X-Reuse-Index
2
Vary
Accept-Encoding
P3P
CP="NOI DEVo TAIa OUR BUS"
Cache-Control
private
Last-Modified
Tue, 04 Apr 2017 05:09:56 GMT
Connection
keep-alive
Content-Type
application/x-javascript
Content-Length
330
Expires
Tue, 25 Dec 2018 09:34:52 GMT
displayAd.js
s.tribalfusion.com/ Frame 0FBB
677 B
846 B
Script
General
Full URL
https://s.tribalfusion.com/displayAd.js?dver=0.8&th=7415410238
Requested by
Host: s.tribalfusion.com
URL: https://s.tribalfusion.com/real/tags/Pastebincom/Safe/tags.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
204.11.109.66 Emeryville, United States, ASN33419 (TRIBAL-FUSION - Exponential Interactive, Inc., US),
Reverse DNS
a.tribalfusion.com
Software
/
Resource Hash
a8eb48099d32b3108a4273a28e92db693e2546cfa9a928b4201c6b08ece437a2

Request headers

Referer
https://pastebin.com/mKwEvj9s
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 26 Sep 2018 09:34:52 GMT
Content-Encoding
gzip
X-Function
153
X-Reuse-Index
2
Vary
Accept-Encoding
P3P
CP="NOI DEVo TAIa OUR BUS"
Cache-Control
private
Last-Modified
Tue, 04 Apr 2017 05:09:56 GMT
Connection
keep-alive
Content-Type
application/x-javascript
Content-Length
331
Expires
Tue, 25 Dec 2018 09:34:52 GMT
displayAd.js
s.tribalfusion.com/ Frame 0300
677 B
847 B
Script
General
Full URL
https://s.tribalfusion.com/displayAd.js?dver=0.8&th=7415410238
Requested by
Host: s.tribalfusion.com
URL: https://s.tribalfusion.com/real/tags/Pastebincom/SnackbarSafe/tags.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
204.11.109.67 Emeryville, United States, ASN33419 (TRIBAL-FUSION - Exponential Interactive, Inc., US),
Reverse DNS
a.tribalfusion.com
Software
/
Resource Hash
ad643f5214c7db9384cba8e4afc92c18ac1acc0805b3a662038d2c82dc9f134b

Request headers

Referer
https://pastebin.com/mKwEvj9s
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 26 Sep 2018 09:34:52 GMT
Content-Encoding
gzip
X-Function
153
X-Reuse-Index
2
Vary
Accept-Encoding
P3P
CP="NOI DEVo TAIa OUR BUS"
Cache-Control
private
Last-Modified
Tue, 04 Apr 2017 05:09:56 GMT
Connection
keep-alive
Content-Type
application/x-javascript
Content-Length
330
Expires
Tue, 25 Dec 2018 09:34:52 GMT
j.ad
s.tribalfusion.com/ Frame D874
8 KB
4 KB
Script
General
Full URL
https://s.tribalfusion.com/j.ad?flashVer=0&ver=1.28&th=7415410238&tagKey=3415125809&loaderVer=0.1&site=pastebincom&adSpace=safe&center=1&json=1&callback=e9Manager.setSingleAdResponse&env=display&size=970x250,728x90&busted=1&url=https%3A%2F%2Fpastebin.com%2FmKwEvj9s&f=0&p=14423062&tKey=aOmneMnGUnpdML2TFk3WZapSpbMRSlj7V&a=1&adContainerId=richmedia_2&rnd=14422418
Requested by
Host: s.tribalfusion.com
URL: https://s.tribalfusion.com/real/tags/Pastebincom/Safe/tags.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
204.11.109.67 Emeryville, United States, ASN33419 (TRIBAL-FUSION - Exponential Interactive, Inc., US),
Reverse DNS
a.tribalfusion.com
Software
/
Resource Hash
4a9aa566504b0e6345c794c122b76c7a40cf176093e5e08a4e9ffdc9f0caba39

Request headers

Referer
https://pastebin.com/mKwEvj9s
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Content-Encoding
gzip
X-Function
101
X-Reuse-Index
3
Vary
Accept-Encoding
P3P
CP="NOI DEVo TAIa OUR BUS"
Cache-Control
private, no-cache, no-store, proxy-revalidate
Connection
keep-alive
Content-Type
application/x-javascript; charset=utf-8
Content-Length
3450
Expires
0
j.ad
s.tribalfusion.com/ Frame 4E53
4 KB
2 KB
Script
General
Full URL
https://s.tribalfusion.com/j.ad?flashVer=0&ver=1.28&th=7415410238&tagKey=3415125809&loaderVer=0.1&site=pastebincom&adSpace=safe&center=1&json=1&callback=e9Manager.setSingleAdResponse&env=display&size=160x600,120x600&busted=1&url=https%3A%2F%2Fpastebin.com%2FmKwEvj9s&f=0&p=14423062&tKey=aRmneMoH3C2aY92dun56FLMGvORSltpP&a=3&adContainerId=richmedia_4&rnd=14417046
Requested by
Host: s.tribalfusion.com
URL: https://s.tribalfusion.com/real/tags/Pastebincom/Safe/tags.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
204.11.109.67 Emeryville, United States, ASN33419 (TRIBAL-FUSION - Exponential Interactive, Inc., US),
Reverse DNS
a.tribalfusion.com
Software
/
Resource Hash
8c65572e19ed78b068ece6d1aaf3d93ab7ef76fe3afdbfbccf7e30822a48ba1e

Request headers

Referer
https://pastebin.com/mKwEvj9s
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Content-Encoding
gzip
X-Function
101
X-Reuse-Index
3
Vary
Accept-Encoding
P3P
CP="NOI DEVo TAIa OUR BUS"
Cache-Control
private, no-cache, no-store, proxy-revalidate
Connection
keep-alive
Content-Type
application/x-javascript; charset=utf-8
Content-Length
1870
Expires
0
j.ad
s.tribalfusion.com/ Frame 0FBB
603 B
978 B
Script
General
Full URL
https://s.tribalfusion.com/j.ad?flashVer=0&ver=1.28&th=7415410238&tagKey=3415125809&loaderVer=0.1&site=pastebincom&adSpace=safe&center=1&json=1&callback=e9Manager.setSingleAdResponse&env=display&size=300x600,300x250&busted=1&url=https%3A%2F%2Fpastebin.com%2FmKwEvj9s&f=0&p=14423062&tKey=a7mneMXG3QXGQT1VnNnqFSQcYdRSlCsn&a=5&adContainerId=richmedia_6&rnd=14417781
Requested by
Host: s.tribalfusion.com
URL: https://s.tribalfusion.com/real/tags/Pastebincom/Safe/tags.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
204.11.109.66 Emeryville, United States, ASN33419 (TRIBAL-FUSION - Exponential Interactive, Inc., US),
Reverse DNS
a.tribalfusion.com
Software
/
Resource Hash
33fdf456221b02535a285d71f273349e3d3fb9871bcdddaa232920413895bb35

Request headers

Referer
https://pastebin.com/mKwEvj9s
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Content-Encoding
gzip
X-Function
101
X-Reuse-Index
3
Vary
Accept-Encoding
P3P
CP="NOI DEVo TAIa OUR BUS"
Cache-Control
private, no-cache, no-store, proxy-revalidate
Connection
keep-alive
Content-Type
application/x-javascript; charset=utf-8
Content-Length
486
Expires
0
728x90_custom_safe.php
pastebin.com/adserver/ Frame 67FE
1 KB
737 B
Document
General
Full URL
https://pastebin.com/adserver/728x90_custom_safe.php
Requested by
Host: s.tribalfusion.com
URL: https://s.tribalfusion.com/real/tags/Pastebincom/Safe/tags.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1e0be450b0ad7f16cbf145edfa3f727f0c16bfafd24f7cf2fab717f0a8fa982f
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
pastebin.com
:scheme
https
:path
/adserver/728x90_custom_safe.php
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://pastebin.com/mKwEvj9s
accept-encoding
gzip, deflate
cookie
__cfduid=d5b51f2e1bc61419a36d590ac7344a3421537954491
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://pastebin.com/mKwEvj9s

Response headers

status
200
date
Wed, 26 Sep 2018 09:34:52 GMT
content-type
text/html
vary
Accept-Encoding
x-xss-protection
1; mode=block
content-encoding
gzip
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
4604bcb8ea7064db-FRA
p.media
s.tribalfusion.com/ Frame 8AD1
0
0
Document
General
Full URL
https://s.tribalfusion.com/p.media?clickID=a1mQgM3AZbGpb3K0sYTYGFX1c7vnqBP5U3WVUbEWm73Qa3RSsUMPtfx0WjsWAbw4cJ5XF3DTPau4AU6R6bH2dMsXHnZbpW6o3mMY4GjdUsJdUcbhP63oWtZbTUUM15benVT7oWaJdPTvIRcfZbQFAvRW7cUVM54r6uodZamXq2y2HQZdQVfZa4mMZapHZaNUHYaXFU91UYXumZaf4V&mediaDataID=5436426&mediaName=frame.html
Requested by
Host: s.tribalfusion.com
URL: https://s.tribalfusion.com/real/tags/Pastebincom/Safe/tags.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
204.11.109.67 Emeryville, United States, ASN33419 (TRIBAL-FUSION - Exponential Interactive, Inc., US),
Reverse DNS
a.tribalfusion.com
Software
/
Resource Hash

Request headers

Host
s.tribalfusion.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://pastebin.com/mKwEvj9s
Accept-Encoding
gzip, deflate
Cookie
ANON_ID=aJnrmep26UNRe4OCbB8AZaJKOQHA8RS0vO48D9xZaRdvU15rXe4SrUIJTIYaqbnQWZcoZaqj
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://pastebin.com/mKwEvj9s

Response headers

P3P
CP="NOI DEVo TAIa OUR BUS"
X-Function
102
X-Reuse-Index
4
Pragma
no-cache
Cache-Control
private, no-cache, no-store, proxy-revalidate
Content-Type
text/html; charset=utf-8
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Length
263
Expires
0
Connection
keep-alive
p.media
s.tribalfusion.com/ Frame 357E
0
0
Document
General
Full URL
https://s.tribalfusion.com/p.media?clickID=a3mQCN36rY5creTGnlVVf8SPMyTdMVTbM03UEnWanvVqM7SaJZdQV7ZbQbZamSWUiWsj34Uupod6M0amv2dbFPcfA4PBLpHToVWYa0bUkXr790qqtRFFHWUJQVW3WmFQsPrBMYqvy5Tbg5E32naBG1rZbfUWMRoArBps7sptMB2Evi5ter3AfLnFQZb0VQXXVQY1cvnMdbbyfOdV8&mediaDataID=7423766&mediaName=frame.html
Requested by
Host: s.tribalfusion.com
URL: https://s.tribalfusion.com/real/tags/Pastebincom/Safe/tags.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
204.11.109.67 Emeryville, United States, ASN33419 (TRIBAL-FUSION - Exponential Interactive, Inc., US),
Reverse DNS
a.tribalfusion.com
Software
/
Resource Hash

Request headers

Host
s.tribalfusion.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://pastebin.com/mKwEvj9s
Accept-Encoding
gzip, deflate
Cookie
ANON_ID=aJnrmep26UNRe4OCbB8AZaJKOQHA8RS0vO48D9xZaRdvU15rXe4SrUIJTIYaqbnQWZcoZaqj
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://pastebin.com/mKwEvj9s

Response headers

P3P
CP="NOI DEVo TAIa OUR BUS"
X-Function
102
X-Reuse-Index
4
Pragma
no-cache
Cache-Control
private, no-cache, no-store, proxy-revalidate
Content-Type
text/html; charset=utf-8
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Length
170
Expires
0
Connection
keep-alive
p.media
s.tribalfusion.com/ Frame 0300
0
0
Document
General
Full URL
https://s.tribalfusion.com/p.media?clickID=a5mQCNVWbhXrnaXrZbk1T6MSFFAUrM2WdJ3mFJoPFfNYano3a3k2aQ3nEJBXbbfUdr0mPnJpGrumWnD3EZbh2Wio56nKmUfJ0G7U1cvV1cBnnEvT3rJVTFvZaW6rTPqb2QGvNQHfr1tJsWAYM3GM10UUDT6im2PQeRPMH3WUM1WMZbpdEv36QT5GY9VsnlVVfjSmFoYTYcy0TZdEK&mediaDataID=6719746&mediaName=frame.html
Requested by
Host: s.tribalfusion.com
URL: https://s.tribalfusion.com/real/tags/Pastebincom/Safe/tags.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
204.11.109.67 Emeryville, United States, ASN33419 (TRIBAL-FUSION - Exponential Interactive, Inc., US),
Reverse DNS
a.tribalfusion.com
Software
/
Resource Hash

Request headers

Host
s.tribalfusion.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://pastebin.com/mKwEvj9s
Accept-Encoding
gzip, deflate
Cookie
ANON_ID=aJnrmep26UNRe4OCbB8AZaJKOQHA8RS0vO48D9xZaRdvU15rXe4SrUIJTIYaqbnQWZcoZaqj
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://pastebin.com/mKwEvj9s

Response headers

P3P
CP="NOI DEVo TAIa OUR BUS"
X-Function
102
X-Reuse-Index
3
Pragma
no-cache
Cache-Control
private, no-cache, no-store, proxy-revalidate
Content-Type
text/html; charset=utf-8
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Length
321
Expires
0
Connection
keep-alive
p.media
s.tribalfusion.com/ Frame 0375
0
0
Document
General
Full URL
https://s.tribalfusion.com/p.media?clickID=a7mQCN0G30YsYU0Vrunqj42rM4TUBGVP74PqMXQsQMQW7xYHnoT6Uy3cr2YFvDTPau4AU6R6fI4HUr0WBKmHAN5AJU4V7fVcB8UcB8SmMoUtFWUUn05bTwWTvvVaJ8QqrGScjCPrItSd38VcYQ2Fuxmtqr0qqp4WbCPsZbE46BKmdAtVWBcXU3d1F771T6oSFJZbYc3eylZajGE&mediaDataID=6453196&mediaName=frame.html
Requested by
Host: s.tribalfusion.com
URL: https://s.tribalfusion.com/real/tags/Pastebincom/Safe/tags.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
204.11.109.66 Emeryville, United States, ASN33419 (TRIBAL-FUSION - Exponential Interactive, Inc., US),
Reverse DNS
a.tribalfusion.com
Software
/
Resource Hash

Request headers

Host
s.tribalfusion.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://pastebin.com/mKwEvj9s
Accept-Encoding
gzip, deflate
Cookie
ANON_ID=aJnrmep26UNRe4OCbB8AZaJKOQHA8RS0vO48D9xZaRdvU15rXe4SrUIJTIYaqbnQWZcoZaqj
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://pastebin.com/mKwEvj9s

Response headers

P3P
CP="NOI DEVo TAIa OUR BUS"
X-Function
102
X-Reuse-Index
4
Pragma
no-cache
Cache-Control
private, no-cache, no-store, proxy-revalidate
Content-Type
text/html; charset=utf-8
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Length
201
Expires
0
Connection
keep-alive
p.media
s.tribalfusion.com/ Frame B3BB
0
0
Document
General
Full URL
https://s.tribalfusion.com/p.media?clickID=a9mQCNVcMjWs7gRAJnTHQ3TFjY2bTqVajpVaQcQE3FSsbZaRFmpPHQ9VGQV5UTxmHyMXamx4dnZbSVjG4mJZbpHEmTtYdYFbi1UQiXaIMSFnZbUFBYVWF3orYvPr7NYqFn5q7d4T3RmTZbGXUfdTtBVoAnBnV7mmHrJ5qZbk3HIp5AnLprMZd0GvWYVn5XVBpmajQ2rF20sjry8rayZd&mediaDataID=4056396&mediaName=frame.html
Requested by
Host: s.tribalfusion.com
URL: https://s.tribalfusion.com/real/tags/Pastebincom/Safe/tags.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
204.11.109.67 Emeryville, United States, ASN33419 (TRIBAL-FUSION - Exponential Interactive, Inc., US),
Reverse DNS
a.tribalfusion.com
Software
/
Resource Hash

Request headers

Host
s.tribalfusion.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://pastebin.com/mKwEvj9s
Accept-Encoding
gzip, deflate
Cookie
ANON_ID=aJnrmep26UNRe4OCbB8AZaJKOQHA8RS0vO48D9xZaRdvU15rXe4SrUIJTIYaqbnQWZcoZaqj
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://pastebin.com/mKwEvj9s

Response headers

P3P
CP="NOI DEVo TAIa OUR BUS"
X-Function
102
X-Reuse-Index
5
Pragma
no-cache
Cache-Control
private, no-cache, no-store, proxy-revalidate
Content-Type
text/html; charset=utf-8
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Length
196
Expires
0
Connection
keep-alive
p.media
s.tribalfusion.com/ Frame 589C
0
0
Document
General
Full URL
https://s.tribalfusion.com/p.media?clickID=abmQCN1Uj90qeORFvZdWbUSWWMUmbbtQFrqYq3r5EJa4EU2oarC1rbcTWJQnPYBncfuoWnB5EY95deq5AvZamUvIXc7VXGZb2XGnNpTF42rM2VUnEW6j4REjSQGYMQHUu1WZbxVPYp2sn1YrnZbUAPq2PUePmMA4WQOXdBZbmt6O4mJT3sr7VcY6WVJhPAMmTWQRTUMPQVADyOxQcu&mediaDataID=6546596&mediaName=frame.html
Requested by
Host: s.tribalfusion.com
URL: https://s.tribalfusion.com/real/tags/Pastebincom/Safe/tags.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
204.11.109.67 Emeryville, United States, ASN33419 (TRIBAL-FUSION - Exponential Interactive, Inc., US),
Reverse DNS
a.tribalfusion.com
Software
/
Resource Hash

Request headers

Host
s.tribalfusion.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://pastebin.com/mKwEvj9s
Accept-Encoding
gzip, deflate
Cookie
ANON_ID=aJnrmep26UNRe4OCbB8AZaJKOQHA8RS0vO48D9xZaRdvU15rXe4SrUIJTIYaqbnQWZcoZaqj
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://pastebin.com/mKwEvj9s

Response headers

P3P
CP="NOI DEVo TAIa OUR BUS"
X-Function
102
X-Reuse-Index
5
Pragma
no-cache
Cache-Control
private, no-cache, no-store, proxy-revalidate
Content-Type
text/html; charset=utf-8
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Length
290
Expires
0
Connection
keep-alive
p.media
s.tribalfusion.com/ Frame C055
0
0
Document
General
Full URL
https://s.tribalfusion.com/p.media?clickID=admQgMXGZbnpEBQ2bUUVbnAVPj1RTY5ScUsQdBO1HvnWA3m4cYUYUnZbUPuq5mZb7RmrA2H3O0tJCntEw36YT5G39Vsv6UsF8PAvoTWFPTbM05bEnUErvTEBcQqBZcQVbLQUqoSt7aVV3R5rXqnWZaOXaev4dMZdQsrZd2mnIoWipUWbhXrrkYUje1E6OSrBCUrM4TtJiwITdpP&mediaDataID=5406476&mediaName=frame.html
Requested by
Host: s.tribalfusion.com
URL: https://s.tribalfusion.com/real/tags/Pastebincom/Safe/tags.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
204.11.109.67 Emeryville, United States, ASN33419 (TRIBAL-FUSION - Exponential Interactive, Inc., US),
Reverse DNS
a.tribalfusion.com
Software
/
Resource Hash

Request headers

Host
s.tribalfusion.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://pastebin.com/mKwEvj9s
Accept-Encoding
gzip, deflate
Cookie
ANON_ID=aJnrmep26UNRe4OCbB8AZaJKOQHA8RS0vO48D9xZaRdvU15rXe4SrUIJTIYaqbnQWZcoZaqj
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://pastebin.com/mKwEvj9s

Response headers

P3P
CP="NOI DEVo TAIa OUR BUS"
X-Function
102
X-Reuse-Index
4
Pragma
no-cache
Cache-Control
private, no-cache, no-store, proxy-revalidate
Content-Type
text/html; charset=utf-8
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Length
270
Expires
0
Connection
keep-alive
p.media
s.tribalfusion.com/ Frame 673E
0
0
Document
General
Full URL
https://s.tribalfusion.com/p.media?clickID=afmQCNPPnoUtY5UbfX3bIuVTYrWqQ9PEBZdScJLPbavRdU8UcjU2FPqntAsYaXp2HjZbQVjE2m3FmtAsTWQ7YFr8YrQl1aesPbBCWUMSWWnWmbQnPrvq1EZbN5qBa4T75mqJLYFffUHZbVn6UZdms3qmHnJ3TZbh5tiN3mvLmbrZd0VvW1c33XGfynaZbW5FM4WrbBV67T2tvgqUapmn&mediaDataID=6530936&mediaName=frame.html
Requested by
Host: s.tribalfusion.com
URL: https://s.tribalfusion.com/real/tags/Pastebincom/Safe/tags.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
204.11.109.66 Emeryville, United States, ASN33419 (TRIBAL-FUSION - Exponential Interactive, Inc., US),
Reverse DNS
a.tribalfusion.com
Software
/
Resource Hash

Request headers

Host
s.tribalfusion.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://pastebin.com/mKwEvj9s
Accept-Encoding
gzip, deflate
Cookie
ANON_ID=aJnrmep26UNRe4OCbB8AZaJKOQHA8RS0vO48D9xZaRdvU15rXe4SrUIJTIYaqbnQWZcoZaqj
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://pastebin.com/mKwEvj9s

Response headers

P3P
CP="NOI DEVo TAIa OUR BUS"
X-Function
102
X-Reuse-Index
5
Pragma
no-cache
Cache-Control
private, no-cache, no-store, proxy-revalidate
Content-Type
text/html; charset=utf-8
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Length
233
Expires
0
Connection
keep-alive
p.media
s.tribalfusion.com/ Frame 2C70
0
0
Document
General
Full URL
https://s.tribalfusion.com/p.media?clickID=ahmQCNPbMZbUFU3WtMXnbFxRbjpXq3p4EUk4Tv1mE7IYU7dWtrRoAYZcmVUppWYJ3aF93des3AjEpbMZcXGfPXGY00cnMmTbV5UZbSTFZbZcV6YTPTb1QGBtSt3t1WjuVPbN2VrVXbnDTm2q5mncQPBE4WUO0HBKpdAo3PB05GMeUsM6UcbfPPUOUWnTWbFR2UItVTjv0dUTqBhLfe&mediaDataID=8039566&mediaName=frame.html
Requested by
Host: s.tribalfusion.com
URL: https://s.tribalfusion.com/real/tags/Pastebincom/Safe/tags.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
204.11.109.67 Emeryville, United States, ASN33419 (TRIBAL-FUSION - Exponential Interactive, Inc., US),
Reverse DNS
a.tribalfusion.com
Software
/
Resource Hash

Request headers

Host
s.tribalfusion.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://pastebin.com/mKwEvj9s
Accept-Encoding
gzip, deflate
Cookie
ANON_ID=aJnrmep26UNRe4OCbB8AZaJKOQHA8RS0vO48D9xZaRdvU15rXe4SrUIJTIYaqbnQWZcoZaqj
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://pastebin.com/mKwEvj9s

Response headers

P3P
CP="NOI DEVo TAIa OUR BUS"
X-Function
102
X-Reuse-Index
6
Pragma
no-cache
Cache-Control
private, no-cache, no-store, proxy-revalidate
Content-Type
text/html; charset=utf-8
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Length
261
Expires
0
Connection
keep-alive
160x600_custom_safe.php
pastebin.com/adserver/ Frame 14BD
1 KB
761 B
Document
General
Full URL
https://pastebin.com/adserver/160x600_custom_safe.php
Requested by
Host: s.tribalfusion.com
URL: https://s.tribalfusion.com/real/tags/Pastebincom/Safe/tags.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
558100561843d20afe325e0e04c0742827a8c575ecd7ea1142749bb93d9c14cd
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
pastebin.com
:scheme
https
:path
/adserver/160x600_custom_safe.php
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://pastebin.com/mKwEvj9s
accept-encoding
gzip, deflate
cookie
__cfduid=d5b51f2e1bc61419a36d590ac7344a3421537954491
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://pastebin.com/mKwEvj9s

Response headers

status
200
date
Wed, 26 Sep 2018 09:34:52 GMT
content-type
text/html
vary
Accept-Encoding
x-xss-protection
1; mode=block
content-encoding
gzip
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
4604bcb92a9364db-FRA
p.media
s.tribalfusion.com/ Frame 5C61
0
0
Document
General
Full URL
https://s.tribalfusion.com/p.media?clickID=almQCNWrJP3rEoWE7sVq3lPqZbZaSVjJQbupRtvbWGv54bTroWyr0qXy3tQGPVFZa4PBFotAqVWFf0rnaYUYf1EenRFBBTUU4TtBXorjxQrZbNYTFs5qYk2afPmqfIYFUaUdJ1mmUBnGQqpdUH2qnl5teN5PvZaprvE0sfWXGJ30VJypT7U5UUQVrFHUPYVQqn4PGZbM3EJZcsQleeb&mediaDataID=6680176&mediaName=frame.html
Requested by
Host: s.tribalfusion.com
URL: https://s.tribalfusion.com/real/tags/Pastebincom/Safe/tags.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
204.11.109.67 Emeryville, United States, ASN33419 (TRIBAL-FUSION - Exponential Interactive, Inc., US),
Reverse DNS
a.tribalfusion.com
Software
/
Resource Hash

Request headers

Host
s.tribalfusion.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://pastebin.com/mKwEvj9s
Accept-Encoding
gzip, deflate
Cookie
ANON_ID=aenrmeu4YUMAqcn63g8W6jcyBfI8gkWZbVX9HxtCVx7vXlC1KKwQrf9xeny0UMBWZcoY2Q
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://pastebin.com/mKwEvj9s

Response headers

P3P
CP="NOI DEVo TAIa OUR BUS"
X-Function
102
X-Reuse-Index
6
Pragma
no-cache
Cache-Control
private, no-cache, no-store, proxy-revalidate
Content-Type
text/html; charset=utf-8
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Length
198
Expires
0
Connection
keep-alive
p.media
s.tribalfusion.com/ Frame BB37
0
0
Document
General
Full URL
https://s.tribalfusion.com/p.media?clickID=aBmQCNTtMWmbFnRbMMXqQy4Tbc5EYXnEMCYFZb6UW7Xm63ZdpsfmmHYG2Tve2dEN56nEnbMZa0GMX1s320GvxmqbR3rZbPWFbCUAf1REYQPGrMQdUO1WroT6jn2VUUXbZbZcTPXv46neP6ZbE3tnn1dMZcpdEo5mBS3sngVVJ7VGJiS6ZbOWd3VWrj33UenUaUxWa36PqBF5bZbvsXvyoZb&mediaDataID=7665496&mediaName=frame.html
Requested by
Host: s.tribalfusion.com
URL: https://s.tribalfusion.com/real/tags/Pastebincom/Safe/tags.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
204.11.109.67 Emeryville, United States, ASN33419 (TRIBAL-FUSION - Exponential Interactive, Inc., US),
Reverse DNS
a.tribalfusion.com
Software
/
Resource Hash

Request headers

Host
s.tribalfusion.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://pastebin.com/mKwEvj9s
Accept-Encoding
gzip, deflate
Cookie
ANON_ID=aenrmeu4YUMAqcn63g8W6jcyBfI8gkWZbVX9HxtCVx7vXlC1KKwQrf9xeny0UMBWZcoY2Q
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://pastebin.com/mKwEvj9s

Response headers

P3P
CP="NOI DEVo TAIa OUR BUS"
X-Function
102
X-Reuse-Index
5
Pragma
no-cache
Cache-Control
private, no-cache, no-store, proxy-revalidate
Content-Type
text/html; charset=utf-8
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Length
179
Expires
0
Connection
keep-alive
p.media
s.tribalfusion.com/ Frame 79A0
0
0
Document
General
Full URL
https://s.tribalfusion.com/p.media?clickID=aDmQCNUAUTPTMXPGQnPdBr0WntTmvv3cB5XbUKT6mw4mvcRPrA4WMm1HrJmteo5AJ15cr8Vc3lUsbeRPFuTHYQUUr22bIxUqbsTTrlPqvFSGQIPUqpPHfkWsn54r6smHAyXETp2dUBPcJC5ArJmdAyTHQ70brk1bYkXTenSUMAWUYXTtY0mFboRFZbyXqQp4qUaRWMfsCiNJ2&mediaDataID=6807466&mediaName=frame.html
Requested by
Host: s.tribalfusion.com
URL: https://s.tribalfusion.com/real/tags/Pastebincom/Safe/tags.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
204.11.109.66 Emeryville, United States, ASN33419 (TRIBAL-FUSION - Exponential Interactive, Inc., US),
Reverse DNS
a.tribalfusion.com
Software
/
Resource Hash

Request headers

Host
s.tribalfusion.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://pastebin.com/mKwEvj9s
Accept-Encoding
gzip, deflate
Cookie
ANON_ID=aenrmeu4YUMAqcn63g8W6jcyBfI8gkWZbVX9HxtCVx7vXlC1KKwQrf9xeny0UMBWZcoY2Q
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://pastebin.com/mKwEvj9s

Response headers

P3P
CP="NOI DEVo TAIa OUR BUS"
X-Function
102
X-Reuse-Index
6
Pragma
no-cache
Cache-Control
private, no-cache, no-store, proxy-revalidate
Content-Type
text/html; charset=utf-8
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Length
253
Expires
0
Connection
keep-alive
p.media
s.tribalfusion.com/ Frame EF9E
0
0
Document
General
Full URL
https://s.tribalfusion.com/p.media?clickID=aFmQCNUqYvVEU8SE3ZbSsFCQUExSWn9VGbU4ruomteOXT2M4WjFSGFD56MZcptiyTtYfXrnc1UZb7XqitRbJHTr35VWB1nrBmRUMn1Evy4qja4q7XmqnC1r3hUdfXmmfZancUvotUJ3EMl2WZam4mFIprMEXVfP1cYVXsvynTFR3FUQTFfFUAnYPqQXSsrOPHBw0Wvu0SvItW6Qmc&mediaDataID=6347136&mediaName=frame.html
Requested by
Host: s.tribalfusion.com
URL: https://s.tribalfusion.com/real/tags/Pastebincom/Safe/tags.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
204.11.109.68 Emeryville, United States, ASN33419 (TRIBAL-FUSION - Exponential Interactive, Inc., US),
Reverse DNS
a.tribalfusion.com
Software
/
Resource Hash

Request headers

Host
s.tribalfusion.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer
https://pastebin.com/mKwEvj9s
Accept-Encoding
gzip, deflate
Cookie
ANON_ID=aenrmeu4YUMAqcn63g8W6jcyBfI8gkWZbVX9HxtCVx7vXlC1KKwQrf9xeny0UMBWZcoY2Q
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://pastebin.com/mKwEvj9s

Response headers

P3P
CP="NOI DEVo TAIa OUR BUS"
X-Function
102
X-Reuse-Index
1
Pragma
no-cache
Cache-Control
private, no-cache, no-store, proxy-revalidate
Content-Type
text/html; charset=utf-8
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Length
234
Expires
0
Connection
keep-alive
300x250_custom_safe.php
pastebin.com/adserver/ Frame E9B3
1 KB
794 B
Document
General
Full URL
https://pastebin.com/adserver/300x250_custom_safe.php
Requested by
Host: s.tribalfusion.com
URL: https://s.tribalfusion.com/real/tags/Pastebincom/Safe/tags.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
129948bf393b3c2ea03e5695b36f2a2b929de22ca5806b77a815e07faba27e41
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
pastebin.com
:scheme
https
:path
/adserver/300x250_custom_safe.php
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://pastebin.com/mKwEvj9s
accept-encoding
gzip, deflate
cookie
__cfduid=d5b51f2e1bc61419a36d590ac7344a3421537954491
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://pastebin.com/mKwEvj9s

Response headers

status
200
date
Wed, 26 Sep 2018 09:34:52 GMT
content-type
text/html
vary
Accept-Encoding
x-xss-protection
1; mode=block
content-encoding
gzip
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
4604bcb93aa264db-FRA
024e069d-525f-46a7-911a-7c59471d8c75.js
d2na2p72vtqyok.cloudfront.net/client-embed/ Frame E9B3
677 KB
164 KB
Script
General
Full URL
https://d2na2p72vtqyok.cloudfront.net/client-embed/024e069d-525f-46a7-911a-7c59471d8c75.js
Requested by
Host: pastebin.com
URL: https://pastebin.com/adserver/300x250_custom_safe.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.230.95.173 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-95-173.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
d337470be7440b8619ecf1b47d686e83a616d67cf3a8d06ffb248b667dbc5561

Request headers

Referer
https://pastebin.com/adserver/300x250_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 25 Sep 2018 20:35:22 GMT
Content-Encoding
gzip
Last-Modified
Fri, 21 Sep 2018 23:34:27 GMT
Server
AmazonS3
Age
46771
Vary
Accept-Encoding
X-Cache
Hit from cloudfront
x-amz-version-id
He6NZ7jEZcWmru0Vg..EO12EDyI3787m
Via
1.1 d41256fff4c52560b6f36cf42caee95d.cloudfront.net (CloudFront)
Cache-Control
max-age=900,public
Transfer-Encoding
chunked
Connection
keep-alive
Content-Type
application/javascript
X-Amz-Cf-Id
qaYaQ1azgNNPnw_9LFXXxvEFPFHsfPFIfzgEIpXk2ytBB_S_XyGK1g==
/
geoip.insticator.com/json/ Frame E9B3
189 B
576 B
XHR
General
Full URL
https://geoip.insticator.com/json/
Requested by
Host: d2na2p72vtqyok.cloudfront.net
URL: https://d2na2p72vtqyok.cloudfront.net/client-embed/024e069d-525f-46a7-911a-7c59471d8c75.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2400:cb00:2048:1::6814:180b , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
fe5d90987bf2ca2df28ab7ebf44be9a6b99433f6827577c7e5e7fc92c09ac49f

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://pastebin.com/adserver/300x250_custom_safe.php
Origin
https://pastebin.com

Response headers

cf-ray
4604bcba6d4263cd-FRA
date
Wed, 26 Sep 2018 09:34:52 GMT
via
1.1 vegur
server
cloudflare
status
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin
content-type
application/json
access-control-allow-origin
https://pastebin.com
x-ratelimit-remaining
9999
access-control-allow-credentials
true
x-ratelimit-reset
3600
x-ratelimit-limit
10000
x-database-date
Tue, 25 Sep 2018 15:49:44 GMT
content-encoding
gzip
instbid_pubwise.js
df80k0z3fi8zg.cloudfront.net/files/ Frame E9B3
138 KB
43 KB
Script
General
Full URL
https://df80k0z3fi8zg.cloudfront.net/files/instbid_pubwise.js
Requested by
Host: d2na2p72vtqyok.cloudfront.net
URL: https://d2na2p72vtqyok.cloudfront.net/client-embed/024e069d-525f-46a7-911a-7c59471d8c75.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:200c:d200:10:3422:3f00:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5c2b1bed79700fe5d259a53ba106725d3b0cd135cde665db35a2134f45c1eb6a

Request headers

Referer
https://pastebin.com/adserver/300x250_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Thu, 20 Sep 2018 22:21:07 GMT
content-encoding
gzip
last-modified
Tue, 10 Jul 2018 18:58:06 GMT
server
AmazonS3
age
40400
vary
Accept-Encoding
x-cache
Hit from cloudfront
x-amz-version-id
txw80dM1pP2UiWWgdFVCHLsY5s5GkDtM
status
200
content-type
application/javascript
x-amz-cf-id
M-3HxjBuJSDUtXDL11bzxi7glKZyqeNVJig5r9tiqjEP7tS1v-rK2w==
via
1.1 f51b809c33f0bb5b1d5504f4df0c0a3f.cloudfront.net (CloudFront)
trinity.js
apex.go.sonobi.com/ Frame E9B3
70 B
539 B
Script
General
Full URL
https://apex.go.sonobi.com/trinity.js?key_maker={%222b17de576b4905%22:%224c4c920a6cf262ee66db|300x250%22}&cv=sbi_10e0b4b99b8da6&ref=pastebin.com
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid_pubwise.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.150 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-apex.go.sonobi.com
Software
sonobi-go /
Resource Hash
28d88fd2114e3c599d9772095a2034f81882bc4d1b614a48fdcdf421c6d15db6
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pastebin.com/adserver/300x250_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 26 Sep 2018 09:34:52 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
apex-ams-1-6-10
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
text/javascript
Content-Length
70
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT
024e069d-525f-46a7-911a-7c59471d8c75.js
d2na2p72vtqyok.cloudfront.net/client-embed/ Frame 14BD
677 KB
402 B
Script
General
Full URL
https://d2na2p72vtqyok.cloudfront.net/client-embed/024e069d-525f-46a7-911a-7c59471d8c75.js
Requested by
Host: pastebin.com
URL: https://pastebin.com/adserver/160x600_custom_safe.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.230.95.173 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-95-173.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
d337470be7440b8619ecf1b47d686e83a616d67cf3a8d06ffb248b667dbc5561

Request headers

If-Modified-Since
Fri, 21 Sep 2018 23:34:27 GMT
Referer
https://pastebin.com/adserver/160x600_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 26 Sep 2018 09:34:52 GMT
Via
1.1 d41256fff4c52560b6f36cf42caee95d.cloudfront.net (CloudFront)
Server
AmazonS3
Age
46771
Vary
Accept-Encoding
X-Cache
Hit from cloudfront
x-amz-version-id
He6NZ7jEZcWmru0Vg..EO12EDyI3787m
Cache-Control
max-age=900,public
Connection
keep-alive
X-Amz-Cf-Id
-GfsrGf0OoYqtt6Fg4z4EFTt1q_inQUDxx3GAcgCZPhfPpWxi38uoQ==
024e069d-525f-46a7-911a-7c59471d8c75.js
d2na2p72vtqyok.cloudfront.net/client-embed/ Frame 67FE
677 KB
164 KB
Script
General
Full URL
https://d2na2p72vtqyok.cloudfront.net/client-embed/024e069d-525f-46a7-911a-7c59471d8c75.js
Requested by
Host: pastebin.com
URL: https://pastebin.com/adserver/728x90_custom_safe.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.230.95.173 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-95-173.fra2.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
d337470be7440b8619ecf1b47d686e83a616d67cf3a8d06ffb248b667dbc5561

Request headers

Referer
https://pastebin.com/adserver/728x90_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Tue, 25 Sep 2018 20:35:22 GMT
Content-Encoding
gzip
Last-Modified
Fri, 21 Sep 2018 23:34:27 GMT
Server
AmazonS3
Age
46771
Vary
Accept-Encoding
X-Cache
Hit from cloudfront
x-amz-version-id
He6NZ7jEZcWmru0Vg..EO12EDyI3787m
Via
1.1 d41256fff4c52560b6f36cf42caee95d.cloudfront.net (CloudFront)
Cache-Control
max-age=900,public
Transfer-Encoding
chunked
Connection
keep-alive
Content-Type
application/javascript
X-Amz-Cf-Id
YVW6sJjQ5cSaEC23UVnIFi9oYJAx7AyN2B7Ugp1Dk41Mtcudemw9uQ==
/
geoip.insticator.com/json/ Frame 14BD
189 B
349 B
XHR
General
Full URL
https://geoip.insticator.com/json/
Requested by
Host: d2na2p72vtqyok.cloudfront.net
URL: https://d2na2p72vtqyok.cloudfront.net/client-embed/024e069d-525f-46a7-911a-7c59471d8c75.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2400:cb00:2048:1::6814:180b , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
fe5d90987bf2ca2df28ab7ebf44be9a6b99433f6827577c7e5e7fc92c09ac49f

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://pastebin.com/adserver/160x600_custom_safe.php
Origin
https://pastebin.com

Response headers

cf-ray
4604bcbb5e1b63cd-FRA
date
Wed, 26 Sep 2018 09:34:53 GMT
via
1.1 vegur
server
cloudflare
status
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin
content-type
application/json
access-control-allow-origin
https://pastebin.com
x-ratelimit-remaining
9999
access-control-allow-credentials
true
x-ratelimit-reset
3600
x-ratelimit-limit
10000
x-database-date
Tue, 25 Sep 2018 17:52:35 GMT
content-encoding
gzip
instbid_pubwise.js
df80k0z3fi8zg.cloudfront.net/files/ Frame 14BD
138 KB
0
Script
General
Full URL
https://df80k0z3fi8zg.cloudfront.net/files/instbid_pubwise.js
Requested by
Host: d2na2p72vtqyok.cloudfront.net
URL: https://d2na2p72vtqyok.cloudfront.net/client-embed/024e069d-525f-46a7-911a-7c59471d8c75.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:200c:d200:10:3422:3f00:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5c2b1bed79700fe5d259a53ba106725d3b0cd135cde665db35a2134f45c1eb6a

Request headers

Response headers

date
Thu, 20 Sep 2018 22:21:07 GMT
content-encoding
gzip
last-modified
Tue, 10 Jul 2018 18:58:06 GMT
server
AmazonS3
age
40400
vary
Accept-Encoding
x-cache
Hit from cloudfront
x-amz-version-id
txw80dM1pP2UiWWgdFVCHLsY5s5GkDtM
status
200
content-type
application/javascript
x-amz-cf-id
M-3HxjBuJSDUtXDL11bzxi7glKZyqeNVJig5r9tiqjEP7tS1v-rK2w==
via
1.1 f51b809c33f0bb5b1d5504f4df0c0a3f.cloudfront.net (CloudFront)
trinity.js
apex.go.sonobi.com/ Frame 14BD
70 B
475 B
Script
General
Full URL
https://apex.go.sonobi.com/trinity.js?key_maker={%2228a18f0c33ae17%22:%224c4c920a6cf262ee66db|160x600%22}&cv=sbi_1315fbef1cc501&ref=pastebin.com
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid_pubwise.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.150 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-apex.go.sonobi.com
Software
sonobi-go /
Resource Hash
ee6485a4dd94ffbc4d0b5894b7b38eec511d309b55b4ed657aca6d904b7d5c63
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pastebin.com/adserver/160x600_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 26 Sep 2018 09:34:52 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
apex-ams-1-6-10
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
text/javascript
Content-Length
70
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT
prebid
ib.adnxs.com/ut/v3/ Frame 14BD
19 B
709 B
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid_pubwise.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.223.206 , European Union, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
Software
nginx/1.13.4 /
Resource Hash
2544182fb9a0a2f65dac966c91bcbcb8239798c4c5d8278f0fd6d9f4056d301e
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pastebin.com/adserver/160x600_custom_safe.php
Origin
https://pastebin.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Wed, 26 Sep 2018 09:34:54 GMT
X-Proxy-Origin
148.251.45.254; 148.251.45.254; 301.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.74:80
AN-X-Request-Uuid
d31b471d-2d96-4883-9637-a830f7b4b51c
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://pastebin.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
19
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
lib.js
prebid.districtm.ca/ Frame 14BD
21 KB
7 KB
Script
General
Full URL
https://prebid.districtm.ca/lib.js
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid_pubwise.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2400:cb00:2048:1::6814:10f3 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ed6ad3c41fd07450891bcb21c80e5bf2a742c6e9415d7ae7caa125edae136650

Request headers

Referer
https://pastebin.com/adserver/160x600_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:52 GMT
content-encoding
gzip
cf-cache-status
HIT
x-amz-request-id
AAE310FEFE7B822A
cf-ray
4604bcbbbf819ab8-FRA
status
200
last-modified
Thu, 05 Apr 2018 16:30:36 GMT
x-amz-id-2
sBS8glPqMFtcLHHMCsEBXsNvUSiRDbXMle1UUoMUsRWLYsQ3x3I82pujYWlk4ZvtpPH2aKoiCkE=
cf-bgj
minify
server
cloudflare
etag
W/"f85ea173704c12c034ed19a7a9389068"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-version-id
3bS4VITibJMcxm4G6C3aLv4zyVPcsnkF
cache-control
public, max-age=86400
content-type
text/javascript
expires
Thu, 27 Sep 2018 09:34:52 GMT
getjs.static.js
tag-st.contextweb.com/ Frame 14BD
32 KB
11 KB
Script
General
Full URL
https://tag-st.contextweb.com/getjs.static.js
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid_pubwise.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.132.166 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
2797a5a31f878305121024bf4f2271f8059dcc6c2b24efde2994c09631bed34f

Request headers

Referer
https://pastebin.com/adserver/160x600_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 26 Sep 2018 09:34:52 GMT
Content-Encoding
gzip
Age
1614
X-Cache
HIT
P3P
policyref="/TagPublish/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
Connection
keep-alive
CW-FEServer
ams-prts01.pulse.prod
Content-Length
11149
X-Served-By
cache-mad9432-MAD
Server
nginx
X-Timer
S1537954493.869570,VS0,VE0
ETag
24e3b1b6dd83b252f1213e42689762834e238463
Content-Type
application/x-javascript
Via
1.1 varnish
Cache-Control
max-age=432000, public
Accept-Ranges
bytes
X-Cache-Hits
301
prebid
ib.adnxs.com/ut/v3/ Frame 14BD
19 B
709 B
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid_pubwise.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.223.206 , European Union, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
Software
nginx/1.13.4 /
Resource Hash
2544182fb9a0a2f65dac966c91bcbcb8239798c4c5d8278f0fd6d9f4056d301e
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pastebin.com/adserver/160x600_custom_safe.php
Origin
https://pastebin.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Wed, 26 Sep 2018 09:34:54 GMT
X-Proxy-Origin
148.251.45.254; 148.251.45.254; 301.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.54:80
AN-X-Request-Uuid
a1893e6d-c5f7-4a35-b50e-7a91aca5cb45
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://pastebin.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
19
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
gpt.js
www.googletagservices.com/tag/js/ Frame E9B3
21 KB
8 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: d2na2p72vtqyok.cloudfront.net
URL: https://d2na2p72vtqyok.cloudfront.net/client-embed/024e069d-525f-46a7-911a-7c59471d8c75.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:806::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
39d704fb385057b46c2781380576a8c4f3a1df6cf5f4c82efbc4830e4ef5449a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pastebin.com/adserver/300x250_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"8 / 119 of 1000 / last-modified: 1537573516"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
7934
x-xss-protection
1; mode=block
expires
Wed, 26 Sep 2018 09:34:52 GMT
/
geoip.insticator.com/json/ Frame 67FE
189 B
313 B
XHR
General
Full URL
https://geoip.insticator.com/json/
Requested by
Host: d2na2p72vtqyok.cloudfront.net
URL: https://d2na2p72vtqyok.cloudfront.net/client-embed/024e069d-525f-46a7-911a-7c59471d8c75.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2400:cb00:2048:1::6814:180b , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
fe5d90987bf2ca2df28ab7ebf44be9a6b99433f6827577c7e5e7fc92c09ac49f

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://pastebin.com/adserver/728x90_custom_safe.php
Origin
https://pastebin.com

Response headers

cf-ray
4604bcbbce7e63cd-FRA
date
Wed, 26 Sep 2018 09:34:53 GMT
via
1.1 vegur
server
cloudflare
status
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Origin
content-type
application/json
access-control-allow-origin
https://pastebin.com
x-ratelimit-remaining
9998
access-control-allow-credentials
true
x-ratelimit-reset
3599
x-ratelimit-limit
10000
x-database-date
Tue, 25 Sep 2018 15:49:44 GMT
content-encoding
gzip
instbid_pubwise.js
df80k0z3fi8zg.cloudfront.net/files/ Frame 67FE
138 KB
0
Script
General
Full URL
https://df80k0z3fi8zg.cloudfront.net/files/instbid_pubwise.js
Requested by
Host: d2na2p72vtqyok.cloudfront.net
URL: https://d2na2p72vtqyok.cloudfront.net/client-embed/024e069d-525f-46a7-911a-7c59471d8c75.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:200c:d200:10:3422:3f00:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5c2b1bed79700fe5d259a53ba106725d3b0cd135cde665db35a2134f45c1eb6a

Request headers

Response headers

date
Thu, 20 Sep 2018 22:21:07 GMT
content-encoding
gzip
last-modified
Tue, 10 Jul 2018 18:58:06 GMT
server
AmazonS3
age
40400
vary
Accept-Encoding
x-cache
Hit from cloudfront
x-amz-version-id
txw80dM1pP2UiWWgdFVCHLsY5s5GkDtM
status
200
content-type
application/javascript
x-amz-cf-id
M-3HxjBuJSDUtXDL11bzxi7glKZyqeNVJig5r9tiqjEP7tS1v-rK2w==
via
1.1 f51b809c33f0bb5b1d5504f4df0c0a3f.cloudfront.net (CloudFront)
lib.js
prebid.districtm.ca/ Frame 67FE
21 KB
6 KB
Script
General
Full URL
https://prebid.districtm.ca/lib.js
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid_pubwise.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2400:cb00:2048:1::6814:10f3 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ed6ad3c41fd07450891bcb21c80e5bf2a742c6e9415d7ae7caa125edae136650

Request headers

Referer
https://pastebin.com/adserver/728x90_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:52 GMT
content-encoding
gzip
cf-cache-status
HIT
x-amz-request-id
AAE310FEFE7B822A
cf-ray
4604bcbbefbe9ab8-FRA
status
200
last-modified
Thu, 05 Apr 2018 16:30:36 GMT
x-amz-id-2
sBS8glPqMFtcLHHMCsEBXsNvUSiRDbXMle1UUoMUsRWLYsQ3x3I82pujYWlk4ZvtpPH2aKoiCkE=
cf-bgj
minify
server
cloudflare
etag
W/"f85ea173704c12c034ed19a7a9389068"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-version-id
3bS4VITibJMcxm4G6C3aLv4zyVPcsnkF
cache-control
public, max-age=86400
content-type
text/javascript
expires
Thu, 27 Sep 2018 09:34:52 GMT
prebid
ib.adnxs.com/ut/v3/ Frame 67FE
19 B
710 B
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid_pubwise.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.223.206 , European Union, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
Software
nginx/1.13.4 /
Resource Hash
2544182fb9a0a2f65dac966c91bcbcb8239798c4c5d8278f0fd6d9f4056d301e
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pastebin.com/adserver/728x90_custom_safe.php
Origin
https://pastebin.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Wed, 26 Sep 2018 09:34:54 GMT
X-Proxy-Origin
148.251.45.254; 148.251.45.254; 301.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.103:80
AN-X-Request-Uuid
20fbfce7-0306-427b-9697-992ae5df16ce
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://pastebin.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
19
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
trinity.js
apex.go.sonobi.com/ Frame 67FE
70 B
475 B
Script
General
Full URL
https://apex.go.sonobi.com/trinity.js?key_maker={%22647cd79a9bf0f1%22:%224c4c920a6cf262ee66db|728x90%22}&cv=sbi_5681ec2142b937&ref=pastebin.com
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid_pubwise.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.162.133.150 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
ams-1-apex.go.sonobi.com
Software
sonobi-go /
Resource Hash
0cde18bbcac49e0ca2157589893e54db709a5533dde8d9cf46fb00754a8962f4
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pastebin.com/adserver/728x90_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 26 Sep 2018 09:34:52 GMT
Server
sonobi-go
Vary
negotiate,Accept-Encoding
X-Go-Server
apex-ams-1-6-10
P3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache, no-store, private
Tcn
Choice
Content-Type
text/javascript
Content-Length
70
X-Xss-Protection
0
Expires
Sat, 26 Jul 1997 05:00:00 GMT
prebid
ib.adnxs.com/ut/v3/ Frame 67FE
19 B
709 B
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid_pubwise.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.223.204 , European Union, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
Software
nginx/1.13.4 /
Resource Hash
2544182fb9a0a2f65dac966c91bcbcb8239798c4c5d8278f0fd6d9f4056d301e
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pastebin.com/adserver/728x90_custom_safe.php
Origin
https://pastebin.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
text/plain

Response headers

Pragma
no-cache
Date
Wed, 26 Sep 2018 09:34:54 GMT
X-Proxy-Origin
148.251.45.254; 148.251.45.254; 319.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.73:80
AN-X-Request-Uuid
87b9e017-e2e4-456a-ba79-b4abcfd59e77
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://pastebin.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
19
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
getjs.static.js
tag-st.contextweb.com/ Frame 67FE
32 KB
11 KB
Script
General
Full URL
https://tag-st.contextweb.com/getjs.static.js
Requested by
Host: df80k0z3fi8zg.cloudfront.net
URL: https://df80k0z3fi8zg.cloudfront.net/files/instbid_pubwise.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.132.166 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
2797a5a31f878305121024bf4f2271f8059dcc6c2b24efde2994c09631bed34f

Request headers

Referer
https://pastebin.com/adserver/728x90_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 26 Sep 2018 09:34:52 GMT
Content-Encoding
gzip
Age
1614
X-Cache
HIT
P3P
policyref="/TagPublish/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
Connection
keep-alive
CW-FEServer
ams-prts01.pulse.prod
Content-Length
11149
X-Served-By
cache-mad9424-MAD
Server
nginx
X-Timer
S1537954493.916542,VS0,VE0
ETag
24e3b1b6dd83b252f1213e42689762834e238463
Content-Type
application/x-javascript
Via
1.1 varnish
Cache-Control
max-age=432000, public
Accept-Ranges
bytes
X-Cache-Hits
270
index.html
cdn.districtm.io/ids/ Frame F4D8
0
0
Document
General
Full URL
https://cdn.districtm.io/ids/index.html
Requested by
Host: prebid.districtm.ca
URL: https://prebid.districtm.ca/lib.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::681c:13e8 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
cdn.districtm.io
:scheme
https
:path
/ids/index.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://pastebin.com/adserver/160x600_custom_safe.php
accept-encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://pastebin.com/adserver/160x600_custom_safe.php

Response headers

status
200
date
Wed, 26 Sep 2018 09:34:52 GMT
content-type
text/html
set-cookie
__cfduid=dd2746e309de83236a093ee14ea36ebd61537954492; expires=Thu, 26-Sep-19 09:34:52 GMT; path=/; domain=.districtm.io; HttpOnly
last-modified
Wed, 22 Aug 2018 21:49:26 GMT
cache-control
s-maxage=1209600, max-age=14400
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
4604bcbc08e3becb-FRA
content-encoding
gzip
prebid
ib.adnxs.com/ut/v3/ Frame 14BD
19 B
709 B
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: prebid.districtm.ca
URL: https://prebid.districtm.ca/lib.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.223.204 , European Union, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
Software
nginx/1.13.4 /
Resource Hash
2544182fb9a0a2f65dac966c91bcbcb8239798c4c5d8278f0fd6d9f4056d301e
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pastebin.com/adserver/160x600_custom_safe.php
Origin
https://pastebin.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Wed, 26 Sep 2018 09:34:54 GMT
X-Proxy-Origin
148.251.45.254; 148.251.45.254; 319.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.53:80
AN-X-Request-Uuid
bd0314d9-c879-4eb5-8129-f5602c7da1c7
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://pastebin.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
19
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
integrator.js
adservice.google.de/adsid/ Frame E9B3
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=pastebin.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81f::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pastebin.com/adserver/300x250_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 26 Sep 2018 09:34:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
104
x-xss-protection
1; mode=block
integrator.js
adservice.google.com/adsid/ Frame E9B3
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=pastebin.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81f::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pastebin.com/adserver/300x250_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 26 Sep 2018 09:34:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
104
x-xss-protection
1; mode=block
pubads_impl_249.js
securepubads.g.doubleclick.net/gpt/ Frame E9B3
182 KB
63 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_249.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.217.22.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s16-in-f34.1e100.net
Software
sffe /
Resource Hash
308b88046da3cb8c99042d803173dee196d6501925fd3c86ccf8f9e2d7f7d04a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pastebin.com/adserver/300x250_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 13 Sep 2018 13:39:46 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
64039
x-xss-protection
1; mode=block
expires
Wed, 26 Sep 2018 09:34:52 GMT
index.html
cdn.districtm.io/ids/ Frame 0AB1
0
0
Document
General
Full URL
https://cdn.districtm.io/ids/index.html
Requested by
Host: prebid.districtm.ca
URL: https://prebid.districtm.ca/lib.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700:30::681c:13e8 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

:method
GET
:authority
cdn.districtm.io
:scheme
https
:path
/ids/index.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://pastebin.com/adserver/728x90_custom_safe.php
accept-encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://pastebin.com/adserver/728x90_custom_safe.php

Response headers

status
200
date
Wed, 26 Sep 2018 09:34:52 GMT
content-type
text/html
set-cookie
__cfduid=d040b74de3f2bd697f0556c13db7d196d1537954492; expires=Thu, 26-Sep-19 09:34:52 GMT; path=/; domain=.districtm.io; HttpOnly
last-modified
Wed, 22 Aug 2018 21:49:26 GMT
cache-control
s-maxage=1209600, max-age=14400
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
4604bcbc08e4becb-FRA
content-encoding
gzip
prebid
ib.adnxs.com/ut/v3/ Frame 67FE
19 B
709 B
XHR
General
Full URL
https://ib.adnxs.com/ut/v3/prebid
Requested by
Host: prebid.districtm.ca
URL: https://prebid.districtm.ca/lib.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.223.204 , European Union, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
Software
nginx/1.13.4 /
Resource Hash
2544182fb9a0a2f65dac966c91bcbcb8239798c4c5d8278f0fd6d9f4056d301e
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://pastebin.com/adserver/728x90_custom_safe.php
Origin
https://pastebin.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Wed, 26 Sep 2018 09:34:54 GMT
X-Proxy-Origin
148.251.45.254; 148.251.45.254; 319.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.52:80
AN-X-Request-Uuid
68a0f8a9-91f6-4600-abfe-aad637cdbe74
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://pastebin.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
19
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/ Frame E9B3
4 KB
2 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=571789340490489&correlator=1939775986545229&output=json_html&callback=googletag.impl.pubads.callbackProxy1&impl=fif&adsid=NT&eid=21062068%2C21061764%2C21062330&vrg=249&guci=1.2.0.0.2.2.0&sc=1&sfv=1-0-29&iu=%2F27794161%2Fpastebin.com_Web_300x250_1&sz=300x250&scp=refurl%3Dpastebin.com%26floor_group%3Dctrl_group%26hour%3D9%26tier%3D1%26instBid_bidder%3Dnofill%26instBid_pb%3D0%26instBid_adid%3Dnofill%26instBid_size%3D300x250%26impression_type%3Dinitial_load&cookie_enabled=1&cdm=pastebin.com&bc=7&lmt=1537954492&dt=1537954492865&dlt=1537954492468&idt=379&ea=0&frm=23&biw=1585&bih=1200&isw=300&ish=250&oid=3&adx=552&ady=7826&adk=2819743242&gut=v2&ifi=1&ifk=1390418613&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=2&iag=15&url=https%3A%2F%2Fpastebin.com%2Fadserver%2F300x250_custom_safe.php&ref=https%3A%2F%2Fpastebin.com%2FmKwEvj9s&top=https%3A%2F%2Fpastebin.com%2FmKwEvj9s&dssz=9&icsg=8234&std=3&vis=1&dmc=8&scr_x=0&scr_y=0&ga_vid=1091885744.1537954493&ga_sid=1537954493&ga_hid=261770071&fws=0
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_249.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.217.22.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s16-in-f34.1e100.net
Software
cafe /
Resource Hash
37adf45803a6a17bd0a2161af32daae616cbcd301964b9e05901df3b2caf222b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://pastebin.com/adserver/300x250_custom_safe.php
Origin
https://pastebin.com

Response headers

date
Wed, 26 Sep 2018 09:34:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
2323
x-xss-protection
1; mode=block
google-lineitem-id
4593464314
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138226533122
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
https://pastebin.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_rendering_249.js
securepubads.g.doubleclick.net/gpt/ Frame E9B3
51 KB
19 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_249.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_249.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.217.22.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s16-in-f34.1e100.net
Software
sffe /
Resource Hash
f7eeefc1dd6f250f4c4b89a1fef2d0fb85b280042059f1f2ee0d11de20c34e98
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pastebin.com/adserver/300x250_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:52 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 13 Sep 2018 13:39:46 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
19757
x-xss-protection
1; mode=block
expires
Wed, 26 Sep 2018 09:34:52 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-29/html/ Frame E9B3
0
0
Other
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-29/html/container.html?n=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_249.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:812::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Purpose
prefetch
Referer
https://pastebin.com/adserver/300x250_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

expires
Fri, 13 Sep 2019 20:57:16 GMT
cache-control
public, immutable, max-age=31536000
last-modified
Mon, 11 Jun 2018 14:38:59 GMT
content-type
text/html
tag
bid.contextweb.com/header/ Frame 14BD
0
603 B
XHR
General
Full URL
https://bid.contextweb.com/header/tag?tagver=1&ca=BID&cp=561664&ct=633319&cf=160X600&rq=1&dw=160&cwu=https%3A%2F%2Fpastebin.com%2FmKwEvj9s&cwr=&mrnd=41497157&if=2&tl=1&pxy=1222,552&cxy=160,600&dxy=1585,8223&tz=0&ln=en-US
Requested by
Host: tag-st.contextweb.com
URL: https://tag-st.contextweb.com/getjs.static.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
74.214.194.133 Amsterdam, Netherlands, ASN59940 (PULSEPOINT-EU, NL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://pastebin.com/adserver/160x600_custom_safe.php
Origin
https://pastebin.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-type
text/plain

Response headers

Date
Wed, 26 Sep 2018 09:34:52 GMT
Server
nginx
CWDL
22/2528
Access-Control-Allow-Origin
https://pastebin.com
Access-Control-Expose-Headers
Access-Control-Allow-Origin
Access-Control-Allow-Credentials
true
Connection
keep-alive
CW-FEServer
ams-prts00.pulse.prod
CW-Server
ams-bid13
Content-Length
0
tag
bid.contextweb.com/header/ Frame 67FE
0
603 B
XHR
General
Full URL
https://bid.contextweb.com/header/tag?tagver=1&ca=BID&cp=561664&ct=633314&cf=728X90&rq=1&dw=728&cwu=https%3A%2F%2Fpastebin.com%2FmKwEvj9s&cwr=&mrnd=69503556&if=2&tl=1&pxy=204,116&cxy=728,90&dxy=1585,8223&tz=0&ln=en-US
Requested by
Host: tag-st.contextweb.com
URL: https://tag-st.contextweb.com/getjs.static.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
74.214.194.133 Amsterdam, Netherlands, ASN59940 (PULSEPOINT-EU, NL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://pastebin.com/adserver/728x90_custom_safe.php
Origin
https://pastebin.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-type
text/plain

Response headers

Date
Wed, 26 Sep 2018 09:34:52 GMT
Server
nginx
CWDL
22/2528
Access-Control-Allow-Origin
https://pastebin.com
Access-Control-Expose-Headers
Access-Control-Allow-Origin
Access-Control-Allow-Credentials
true
Connection
keep-alive
CW-FEServer
ams-prts00.pulse.prod
CW-Server
ams-bid04
Content-Length
0
loader.js
cdn.taboola.com/libtrc/insticator-network/ Frame CD81
211 KB
40 KB
Script
General
Full URL
https://cdn.taboola.com/libtrc/insticator-network/loader.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_249.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.134.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
b149801f7e6f98fbf2b3c99a3d72909de1127d141c31e8be49ebc21174b75015

Request headers

Referer
https://pastebin.com/adserver/300x250_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id
rE8HOMMRE7gWlNOhAZnN1WeG3NsglXJZ
content-encoding
gzip
etag
"f972b8347db8bd92df83d983fa283de5"
age
66
x-cache
HIT
status
200
x-amz-replication-status
PENDING
content-length
40765
x-amz-id-2
1azyeuXmcesa4+rcqJqQap+9Ax/dpyJyv7kIZdgr9bbZ8Kt4gNCJyNCauRFvMHeS88VJC61pOvw=
x-served-by
cache-mad9433-MAD
last-modified
Tue, 25 Sep 2018 13:36:19 GMT
server
AmazonS3
x-timer
S1537954493.062275,VS0,VE0
date
Wed, 26 Sep 2018 09:34:53 GMT
vary
Accept-Encoding
x-amz-request-id
22E803DE7C5AD369
via
1.1 varnish
cache-control
private,max-age=14401
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
x-cache-hits
565
osd_listener.js
tpc.googlesyndication.com/pagead/js/r20180919/r20110914/activeview/ Frame CD81
73 KB
27 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20180919/r20110914/activeview/osd_listener.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_249.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:812::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
3b7b82aade1ac93b4c8852e213584b051d50f592ede38d7ab45e12d863c6c1a0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pastebin.com/adserver/300x250_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 19 Sep 2018 18:59:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
570934
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
27066
x-xss-protection
1; mode=block
server
cafe
etag
1598727148269787311
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 03 Oct 2018 18:59:19 GMT
osd.js
pagead2.googlesyndication.com/pagead/ Frame E9B3
72 KB
26 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/osd.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_249.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:816::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
a5f24fc963982085e79d5445ae602b5fba30c972ed84763d39d869c16c732a2c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pastebin.com/adserver/300x250_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 08:39:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
3352
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
26901
x-xss-protection
1; mode=block
server
cafe
etag
11805512267064086570
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=3600
timing-allow-origin
*
expires
Wed, 26 Sep 2018 09:39:01 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame CD81
0
50 B
Image
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvYWj0X54cN5vVrAWXWiO8-fLWQJdV8glhui6orZZzTbM6343hqVxqnmDrtfTpCJ3WWNVWOerYVtWxqEftAaz8tVGy-D4UppbrcGYLMRpb2nWnFS7-K5cWELbgYnOLD-ZmgbD_enIDQ76XNYNrNL5bC7blypB4lfN8_l3eusn2qUOxOeuYuMIxFX6bt4lcwCTIhVpMdjpQytCPY3joPDbsN905EJlWeqyMetUKYWJIwp460mojl62AHQp1u4eLVATmFpYiTIg&sai=AMfl-YRUnhGB9qal3nBJgaEQHh3IbUB6VJE7DWEykDCHQT1gejwxRCiSXTxYUgRy1YKfmsqfdUX4hi6x42awfoANskOK8UIBaXVpSrKFjqQWXxU96vtc292ROkaKlg8&sig=Cg0ArKJSzJMCTzWLaTzXEAE&urlfix=1&adurl=
Requested by
Host: pastebin.com
URL: https://pastebin.com/adserver/300x250_custom_safe.php
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.217.22.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s16-in-f34.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pastebin.com/adserver/300x250_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 26 Sep 2018 09:34:53 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
0
x-xss-protection
1; mode=block
impl.325-17-RELEASE.js
cdn.taboola.com/libtrc/ Frame CD81
451 KB
124 KB
Script
General
Full URL
https://cdn.taboola.com/libtrc/impl.325-17-RELEASE.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/insticator-network/loader.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.134.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
67657c28fcf553c033a6442abec476993d853441cac02b5ca1c5580228451bd8

Request headers

Referer
https://pastebin.com/adserver/300x250_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id
MXAN3XQb3YQm95EoQqWajNrzJZt0u2F8
content-encoding
gzip
etag
"932fb6216e3eeece5400ef24f349009a"
age
276
x-cache
HIT
status
200
x-amz-replication-status
PENDING
content-length
126351
x-amz-id-2
2aIKMXkNX49i+OYNlsfnLWqFT6eJ/CP4uVdF9V2kX/tBBFRL+wB839JmeRH57IoAtGabBf6nd5k=
x-served-by
cache-mad9433-MAD
last-modified
Wed, 26 Sep 2018 09:30:14 GMT
server
AmazonS3
x-timer
S1537954493.234900,VS0,VE0
date
Wed, 26 Sep 2018 09:34:53 GMT
vary
Accept-Encoding
x-amz-request-id
CCD8A13B8D65AD70
via
1.1 varnish
cache-control
private,max-age=31536000
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
x-cache-hits
1293
beacon.js
sb.scorecardresearch.com/ Frame CD81
1 KB
1 KB
Script
General
Full URL
https://sb.scorecardresearch.com/beacon.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/insticator-network/loader.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.43.115.95 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-43-115-95.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
d0fd74148f4cbe78bd0e6328dc5ce5955f0a0ecdb1eb2919da4a7e596ac65912

Request headers

Referer
https://pastebin.com/adserver/300x250_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 26 Sep 2018 09:34:53 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=86400
Connection
keep-alive
Content-Length
901
Expires
Thu, 27 Sep 2018 09:34:53 GMT
truncated
/ Frame CD81
212 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
07741979791c1c8abd78a2a0bebd7e7bbcb42b9b103cf08015f073149422cf53

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/png
b2
sb.scorecardresearch.com/ Frame CD81
Redirect Chain
  • https://sb.scorecardresearch.com/b?c1=7&c2=13739933&c3=20121515121&ns__t=1537954493226&ns_c=UTF-8&ns_if=1&cv=3.1&c8=&c7=https%3A%2F%2Fpastebin.com%2Fadserver%2F300x250_custom_safe.php&c9=
  • https://sb.scorecardresearch.com/b2?c1=7&c2=13739933&c3=20121515121&ns__t=1537954493226&ns_c=UTF-8&ns_if=1&cv=3.1&c8=&c7=https%3A%2F%2Fpastebin.com%2Fadserver%2F300x250_custom_safe.php&c9=
0
248 B
Image
General
Full URL
https://sb.scorecardresearch.com/b2?c1=7&c2=13739933&c3=20121515121&ns__t=1537954493226&ns_c=UTF-8&ns_if=1&cv=3.1&c8=&c7=https%3A%2F%2Fpastebin.com%2Fadserver%2F300x250_custom_safe.php&c9=
Requested by
Host: pastebin.com
URL: https://pastebin.com/adserver/300x250_custom_safe.php
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.43.115.95 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-43-115-95.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://pastebin.com/adserver/300x250_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 26 Sep 2018 09:34:53 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://sb.scorecardresearch.com/b2?c1=7&c2=13739933&c3=20121515121&ns__t=1537954493226&ns_c=UTF-8&ns_if=1&cv=3.1&c8=&c7=https%3A%2F%2Fpastebin.com%2Fadserver%2F300x250_custom_safe.php&c9=
Pragma
no-cache
Date
Wed, 26 Sep 2018 09:34:53 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
json
trc.taboola.com/insticator-pastebin/trc/3/ Frame CD81
5 KB
3 KB
Script
General
Full URL
https://trc.taboola.com/insticator-pastebin/trc/3/json?tim=09%3A34%3A53.871&data=%7B%22id%22%3A539%2C%22ii%22%3A%22%2Fmkwevj9s%22%2C%22it%22%3A%22text%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22uifp%22%3Anull%2C%22vi%22%3A1537954493869%2C%22cv%22%3A%22325-17-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fpastebin.com%2FmKwEvj9s%22%2C%22bv%22%3A%220%22%2C%22ul%22%3A%5B%22en-US%22%5D%2C%22cmps%22%3A3%2C%22btv%22%3A%220%22%2C%22cos%22%3A%224g%22%2C%22bad%22%3A-1%2C%22bw%22%3A300%2C%22sw%22%3A1600%2C%22sh%22%3A1200%2C%22nsid%22%3A%22insticator-network%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-t2m%22%2C%22s%22%3A2%2C%22uim%22%3A%22thumbnails-a%3Apub%3Dinsticator-network%3Aabp%3D0%22%2C%22uip%22%3A%22Desktop%20Right%20Rail%20300x250%22%2C%22orig_uip%22%3A%22Desktop%20Right%20Rail%20300x250%22%2C%22cd%22%3A0%2C%22mw%22%3A250%7D%5D%2C%22cb%22%3A%22TRC.callbacks.recommendations_1%22%2C%22lt%22%3A%22normal%22%7D
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.325-17-RELEASE.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.134.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
b0bd71350e7df67e7ad3917f4d7e0a8ef424dd48cb3f4aa5254b9b33c7643679

Request headers

Referer
https://pastebin.com/adserver/300x250_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:54 GMT
content-encoding
gzip
access-control-allow-origin
*
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
status
200
x-cache-hits
0
x-served-by
cache-mad9433-MAD
server
nginx
x-timer
S1537954494.900447,VS0,VE107
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
via
1.1 varnish
access-control-allow-credentials
true
accept-ranges
bytes
expires
Thu, 01 Jan 1970 00:00:00 GMT
tb
15.taboola.com/ Frame CD81
16 KB
16 KB
Script
General
Full URL
https://15.taboola.com/tb?oid=15&pubnm=insticator-pastebin&unitType=226&tbloc=&pageType=text&pstn=Desktop%20Right%20Rail%20300x250&uuip=&cisrf=&cirf=https%3A%2F%2Fpastebin.com%2FmKwEvj9s&encoded=1&uid=e37b53b4-f029-48f6-bede-8305157fceac-tuct2a4d83d&variant=-100|1&callback=TRC.videoTagCallbacks.videoCallback1&cb=1537954494052&tagid=&cntry=DE&platform=1&sesid=62bc1d94bfef56ff17362165bcd06562&itemid=/mkwevj9s&viewid=1537954493869&geolat=&geoing=&deviceifa=&appid=&sd=v2_62bc1d94bfef56ff17362165bcd06562_e37b53b4-f029-48f6-bede-8305157fceac-tuct2a4d83d_1537954493_1537954493_CNawjgYQi5JGGK3r7KnhLCABKAEwODib4wlAgooQSJjEF1Cl7BBYAGAA&ri=c05ab22014d65a9d6a174fe3fea7833f&appname=&cdb=&gdprApplies=
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.325-17-RELEASE.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.134.49 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx/1.13.12 /
Resource Hash
6a45de868a2a546cbce60c97e9cd15a1df8348f779ce2ec240309c1c1c8f26b7

Request headers

Referer
https://pastebin.com/adserver/300x250_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

async
true
date
Wed, 26 Sep 2018 09:34:54 GMT
via
1.1 varnish
server
nginx/1.13.12
x-timer
S1537954494.083673,VS0,VE32
machineid
1416
status
200
x-cache
MISS
content-type
text/html;charset=ISO-8859-1
pragma
no-cache
expires
Sat, 26 Jul 1997 05:00:00 GMT
cache-control
no-cache,must-revalidate,no-store,max-age=0,s-maxage=0
x-cache-hits
0
accept-ranges
bytes
x-served-by
cache-mad9422-MAD
getuidnb
ib.adnxs.com/ Frame 378A
43 B
621 B
Image
General
Full URL
https://ib.adnxs.com/getuidnb?https://trc.taboola.com/sg/appnexus-network/1/rtb-h/?taboola_hm=$UID
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.223.204 , European Union, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS
Software
nginx/1.13.4 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 26 Sep 2018 09:34:56 GMT
X-Proxy-Origin
148.251.45.254; 148.251.45.254; 319.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.222:80
AN-X-Request-Uuid
ea43eb6a-4673-4c73-af17-870bc25d9691
Server
nginx/1.13.4
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
rtb-h
trc.taboola.com/sg/exposebox-network/1/ Frame 378A
Redirect Chain
  • https://server.exposebox.com/rcm
  • https://trc.taboola.com/sg/exposebox-network/1/rtb-h?taboola_hm=_4r82oyv
0
229 B
Image
General
Full URL
https://trc.taboola.com/sg/exposebox-network/1/rtb-h?taboola_hm=_4r82oyv
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.134.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:54 GMT
via
1.1 varnish
server
nginx
x-timer
S1537954494.117431,VS0,VE50
x-served-by
cache-mad9433-MAD
x-cache
MISS
status
204
x-cache-hits
0
accept-ranges
bytes
expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

date
Wed, 26 Sep 2018 09:34:54 GMT
via
1.1 google
x-powered-by
Express
status
302
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
location
//trc.taboola.com/sg/exposebox-network/1/rtb-h?taboola_hm=_4r82oyv
cache-control
max-age:0
alt-svc
clear
expires
0
rtb-h
trc.taboola.com/sg/mediaforcebidder-network/1/ Frame 378A
Redirect Chain
  • https://rtb.mfadsrvr.com/sync?ssp=taboola
  • https://rtb.mfadsrvr.com/ul_cb/sync?ssp=taboola
  • https://trc.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=2076078c-162c-4c54-83ac-5bf1b8c8bbbd
0
119 B
Image
General
Full URL
https://trc.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=2076078c-162c-4c54-83ac-5bf1b8c8bbbd
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.134.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:54 GMT
via
1.1 varnish
server
nginx
x-timer
S1537954494.142570,VS0,VE103
x-served-by
cache-mad9433-MAD
x-cache
MISS
status
204
x-cache-hits
0
accept-ranges
bytes
expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location
//trc.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=2076078c-162c-4c54-83ac-5bf1b8c8bbbd
Date
Wed, 26 Sep 2018 09:34:54 GMT
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
0
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
/
trc.taboola.com/sg/google-network/1/rtb-h/ Frame 378A
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_cm&google_sc
  • https://trc.taboola.com/sg/google-network/1/rtb-h/?taboola_hm=CAESEJBdfRJAnoOoJb21ut6Nnls&google_cver=1
0
133 B
Image
General
Full URL
https://trc.taboola.com/sg/google-network/1/rtb-h/?taboola_hm=CAESEJBdfRJAnoOoJb21ut6Nnls&google_cver=1
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.134.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:54 GMT
via
1.1 varnish
server
nginx
x-timer
S1537954494.103981,VS0,VE134
x-served-by
cache-mad9433-MAD
x-cache
MISS
status
204
x-cache-hits
0
accept-ranges
bytes
expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 26 Sep 2018 09:34:54 GMT
server
HTTP server (unknown)
status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://trc.taboola.com/sg/google-network/1/rtb-h/?taboola_hm=CAESEJBdfRJAnoOoJb21ut6Nnls&google_cver=1
cache-control
no-cache, must-revalidate
content-type
text/html; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
304
x-xss-protection
1; mode=block
expires
Fri, 01 Jan 1990 00:00:00 GMT
rtb-h
match.taboola.com/sg/thetradedesk-network/1/ Frame 378A
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=054f32o&ttd_tpi=1
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=054f32o&ttd_tpi=1
  • https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=cbadbf77-3a08-41c3-8c90-0760d5107fa8
  • https://match.taboola.com/sg/thetradedesk-network/1/rtb-h?taboola_hm=cbadbf77-3a08-41c3-8c90-0760d5107fa8&tbid=e37b53b4-f029-48f6-bede-8305157fceac-tuct2a4d83d
0
53 B
Image
General
Full URL
https://match.taboola.com/sg/thetradedesk-network/1/rtb-h?taboola_hm=cbadbf77-3a08-41c3-8c90-0760d5107fa8&tbid=e37b53b4-f029-48f6-bede-8305157fceac-tuct2a4d83d
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.134.49 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx/1.13.12 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:54 GMT
via
1.1 varnish
server
nginx/1.13.12
x-timer
S1537954494.424797,VS0,VE27
x-cache
MISS
status
200
x-cache-hits
0
accept-ranges
bytes
content-length
0
x-served-by
cache-mad9422-MAD

Redirect headers

date
Wed, 26 Sep 2018 09:34:54 GMT
via
1.1 varnish
server
nginx
x-timer
S1537954494.209461,VS0,VE84
x-served-by
cache-mad9433-MAD
status
302
x-cache
MISS
location
https://match.taboola.com/sg/thetradedesk-network/1/rtb-h?taboola_hm=cbadbf77-3a08-41c3-8c90-0760d5107fa8&tbid=e37b53b4-f029-48f6-bede-8305157fceac-tuct2a4d83d
x-cache-hits
0
accept-ranges
bytes
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 GMT
rtb-h
trc.taboola.com/sg/storygize-network/1/ Frame 378A
Redirect Chain
  • https://www.storygize.net/ccm/4b560cdd-91f9-422b-adb7-e9dff26bc3ad?u=e37b53b4-f029-48f6-bede-8305157fceac-tuct2a4d83d
  • https://trc.taboola.com/sg/storygize-network/1/rtb-h?taboola_hm=15e35c40-7797-4060-9061-ed57320faf49
0
133 B
Image
General
Full URL
https://trc.taboola.com/sg/storygize-network/1/rtb-h?taboola_hm=15e35c40-7797-4060-9061-ed57320faf49
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.134.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:54 GMT
via
1.1 varnish
server
nginx
x-timer
S1537954495.847933,VS0,VE57
x-served-by
cache-mad9433-MAD
x-cache
MISS
status
204
x-cache-hits
0
accept-ranges
bytes
expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location
https://trc.taboola.com/sg/storygize-network/1/rtb-h?taboola_hm=15e35c40-7797-4060-9061-ed57320faf49
Pragma
no-cache
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
P3P
CP ALL ADM DEV PSAi COM OUR OTRo STP IND ONL
Content-Length
0
Expires
0
cookiesync
bttrack.com/pixel/ Frame 378A
35 B
383 B
Image
General
Full URL
https://bttrack.com/pixel/cookiesync?source=14b8c562-d12b-418b-b680-ad517d5839ec
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
192.132.33.27 , United States, ASN18568 (BIDTELLECT - Bidtellect Inc., US),
Reverse DNS
27.bidtellect.com
Software
Microsoft-IIS/8.5 /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

X-ServerName
track003-dc3-va
Pragma
no-cache
Date
Wed, 26 Sep 2018 09:33:20 GMT
X-AspNetMvc-Version
5.2
Server
Microsoft-IIS/8.5
X-AspNet-Version
4.0.30319
P3P
CP="CAO DSP COR ADMo DEVo PSAo PSDo HISo IVAo IVDo OUR IND OTC"
Cache-Control
private,no-cache
Content-Type
image/gif
Content-Length
35
Expires
-1
rtb-h
match.taboola.com/sg/bidswitch-network/1/ Frame 378A
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=taboola
  • https://x.bidswitch.net/ul_cb/sync?ssp=taboola
  • https://rtb.mfadsrvr.com/sync?ssp=bidswitch&bidswitch_ssp_id=taboola&bsw_user_id=89130db7-7830-4b35-9c11-933a28d3b8d3
  • https://x.bidswitch.net/sync?dsp_id=250&expires=14&user_id=2076078c-162c-4c54-83ac-5bf1b8c8bbbd&ssp=taboola
  • https://trc.taboola.com/sg/bidswitch-network/1/rtb-h/?taboola_hm=89130db7-7830-4b35-9c11-933a28d3b8d3
  • https://match.taboola.com/sg/bidswitch-network/1/rtb-h?taboola_hm=89130db7-7830-4b35-9c11-933a28d3b8d3&tbid=e37b53b4-f029-48f6-bede-8305157fceac-tuct2a4d83d
0
53 B
Image
General
Full URL
https://match.taboola.com/sg/bidswitch-network/1/rtb-h?taboola_hm=89130db7-7830-4b35-9c11-933a28d3b8d3&tbid=e37b53b4-f029-48f6-bede-8305157fceac-tuct2a4d83d
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.134.49 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx/1.13.12 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:54 GMT
via
1.1 varnish
server
nginx/1.13.12
x-timer
S1537954494.424833,VS0,VE27
x-cache
MISS
status
200
x-cache-hits
0
accept-ranges
bytes
content-length
0
x-served-by
cache-mad9422-MAD

Redirect headers

date
Wed, 26 Sep 2018 09:34:54 GMT
via
1.1 varnish
server
nginx
x-timer
S1537954494.241975,VS0,VE51
x-served-by
cache-mad9433-MAD
status
302
x-cache
MISS
location
https://match.taboola.com/sg/bidswitch-network/1/rtb-h?taboola_hm=89130db7-7830-4b35-9c11-933a28d3b8d3&tbid=e37b53b4-f029-48f6-bede-8305157fceac-tuct2a4d83d
x-cache-hits
0
accept-ranges
bytes
content-length
0
expires
Thu, 01 Jan 1970 00:00:00 GMT
f539211219b796ffbb49949997c764f0.png
cdn.taboola.com/libtrc/static/thumbnails/ Frame CD81
254 B
669 B
Image
General
Full URL
https://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.134.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9

Request headers

Referer
https://pastebin.com/adserver/300x250_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-amz-version-id
hL.cyLD7Q4TL5ceY.7JQwF9m5IYI8mkC
via
1.1 varnish
etag
"dfa7b52c86e56bd67fa4002f6ed19854"
age
4757
x-cache
HIT
status
200
x-amz-replication-status
COMPLETED
content-length
254
x-amz-id-2
TX47+BqlleAxM193brYfA2qcBNse+3dNjRkHuq9+qXamCiE/I93Y983mxWXP4DLR1ATLDRGIAWE=
x-served-by
cache-mad9433-MAD
last-modified
Wed, 24 Jun 2015 07:14:11 GMT
server
AmazonS3
x-amz-meta-s3cmd-attrs
uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1377415166/atime:1435052450/md5:dfa7b52c86e56bd67fa4002f6ed19854/ctime:1422381567
x-timer
S1537954494.087819,VS0,VE0
date
Wed, 26 Sep 2018 09:34:54 GMT
x-amz-request-id
F49F83197640CDA0
cache-control
private,max-age=31536000
accept-ranges
bytes
content-type
image/png
x-cache-hits
7620
available
trc.taboola.com/insticator-pastebin/log/3/ Frame CD81
0
275 B
XHR
General
Full URL
https://trc.taboola.com/insticator-pastebin/log/3/available
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.325-17-RELEASE.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.134.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://pastebin.com/adserver/300x250_custom_safe.php
Origin
https://pastebin.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

pragma
no-cache
date
Wed, 26 Sep 2018 09:34:54 GMT
via
1.1 varnish
server
nginx
x-timer
S1537954494.096155,VS0,VE28
x-served-by
cache-mad9433-MAD
status
204
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
https://pastebin.com
cache-control
no-cache
access-control-allow-credentials
true
accept-ranges
bytes
content-type
image/gif
x-cache-hits
0
dc8cc2bd0febf339a3fc722ef2899b9a.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_200%2Cw_360%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ Frame CD81
11 KB
11 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_200%2Cw_360%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/dc8cc2bd0febf339a3fc722ef2899b9a.png
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.134.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
229863d30dc9a3df6594232b3249b999cb06b9940ec89c9ec3ba3099e80573c4

Request headers

Referer
https://pastebin.com/adserver/300x250_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:54 GMT
via
1.1 varnish
age
83263
x-cache
HIT
status
200
expiration
expiry-date="Wed, 05 Sep 2018 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_200%2Cw_360%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/dc8cc2bd0febf339a3fc722ef2899b9a.png
content-length
11183
x-served-by
cache-mad9433-MAD
last-modified
Sun, 05 Aug 2018 13:45:21 GMT
server
cloudinary
x-timer
S1537954494.103618,VS0,VE0
etag
"7ecf9d55ee62be77ffdc1ccae7a0fbaf"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
21
afdba03de7132a26196a3a7f37e9de89.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_200%2Cw_360%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ Frame CD81
11 KB
11 KB
Image
General
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_200%2Cw_360%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/afdba03de7132a26196a3a7f37e9de89.jpg
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.134.2 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
cloudinary /
Resource Hash
caf7148fb3522653d83fd90d52629e2158bb967c43983823f167c1213b2d1e8b

Request headers

Referer
https://pastebin.com/adserver/300x250_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:54 GMT
via
1.1 varnish
age
2583789
edge-cache-tag
448948098167541551537228126463764893733,409727528766170011329604497963433340809,29ecf9b93bbf306179626feeda1fab70
status
200, 200 OK
x-cache
HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_200%2Cw_360%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/afdba03de7132a26196a3a7f37e9de89.jpg
content-length
10931
x-request-id
d15b7c5056262dc2
x-served-by
cache-mad9433-MAD
last-modified
Tue, 21 Aug 2018 03:01:03 GMT
server
cloudinary
x-timer
S1537954494.103638,VS0,VE1
etag
"c543be74085cfbc0f87aec8585035441"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=2592000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1
creative_js.js
vidstat.taboola.com/vpaid/units/14_12_0/creatives/ Frame CD81
4 KB
2 KB
Script
General
Full URL
https://vidstat.taboola.com/vpaid/units/14_12_0/creatives/creative_js.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.325-17-RELEASE.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2400:cb00:2048:1::6811:914c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
10eba73b3641332bde05fa8d6223e7017ac5207673602247c35f358ea89e3092

Request headers

Referer
https://pastebin.com/adserver/300x250_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:54 GMT
via
1.1 ef13dd533b8dc9dcfdc35449cf88f808.cloudfront.net (CloudFront)
cf-cache-status
HIT
x-cache
Hit from cloudfront
status
200
x-amz-meta-mode
33188
content-encoding
gzip
content-type
application/javascript
x-amz-meta-uid
0
last-modified
Wed, 06 Sep 2017 08:46:00 GMT
server
cloudflare
etag
W/"0df6cb700db4e2c8b3b7dcb734e91cb0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-meta-gid
0
expires
Sat, 27 Oct 2018 09:34:54 GMT
cache-control
public, max-age=2678400
cf-ray
4604bcc4e987979e-FRA
x-amz-cf-id
fewjSqd0HZRjmo1TOLrv_prspgNIuP46Nzfrli-kaTX88l8SN0YV_A==
x-amz-meta-mtime
1499351521
st
imprammp.taboola.com/ Frame 79C5
0
0
Document
General
Full URL
https://imprammp.taboola.com/st?cipid=8110425&ttype=0&cirid=33DA9DA9A8621164001198827245&cicmp=1682805&cijs=1&dast=V7ocwCFgO_B61VNgia5QS_B61VNgia5QUAAAAGBuIHG7MZMZgjBnNBnE0Wi9lmuVyOBrvRZLCcTEGDWJ6v6W84SJo-o-kgaTjNBs1gMLysBmvoQNPp8Lnu9YKH5_SyOO12jd_tV3t5L9rVubkDAAAAwAOA0nwwxA8gAEAEAAAAgAQAAAAARUDFv4XABQAAAAAGgEFpggYA1AcAwEMACADAgAIJwED_XQnARef1CQAAAAAAAAAAy____38MwF5wlgxARmvdjUEPwIMPwIMQAABA1lBZyZfwIsGoAVEBYhEjAAAAAMr9Fv-jSZ1QWVQBABCkWwFcAQAEmFXs2ERm6Q5KvIUBAAAEjC3Qw-L3mx12jd_tMgAAAAAAAAAAs_-zfzQhojOptKAVtkW1X0AAgLVfQAAANnUDAHgLgAs6glYMBqsLiNkBAAAA3P3____rgdhk4nGMnKOJzWVzzWY2x24zmyxmq4nHZJitZpPtNcxtVlWWV-n1aRDL8zX9DQdJ02c0HSQNp9mgGQyGl9VgfhO2GK0mk81yOFsuJoPhaDga7U_AdgOcoOFwsNgNFrvFYjhZTEaD5WCBAjGY4IQMR5vJarRb7SbL4WQ0mm0mG6Ro1Wo22gyGq9lkttuthoPhcjRCitYsZpPJYjZa7jaD5WQ0GE6GQ4Qpz27i2kxMa5lhslyLhjPbWuIyudzCzWC1WO1mHpfD4xa9PqbLwjQybkZeFAxY2IvgIp0o7Z7T0-Mw_S1vwcNzelmcdotYojlZpBPZZV-bTDyOkXM0sblsrtnM5thtZpPFbDXxmAyz1Wyyb3l2E9dmYlrLDJPlWjSc2dYSl8nlFm4Gq8VqN_O4HB636PUxXRamkXEz8jdWm91yNRotN_vGarNbrkaj5WbfoTN8V5-z0XRNeTwuZ_Lb0o1mDoPCZbB4fxLTYtqdHTy_39GpUl00xobsm1CYDR6DQRFLBKeLdCJ6GU8XsUTytEgnGsNqYbFMBovRyLZaOEe2hWM3mrk8M5fDN9xsZhaxRGm6SCd6tdf3sl2dm4v6jw4xGs4lq8VctJpLVqNVAgAAAAAAAABYwpx5EwAAAAA!&excid=22&tst=1&docw=0
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.134.49 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx/1.13.12 /
Resource Hash

Request headers

:method
GET
:authority
imprammp.taboola.com
:scheme
https
:path
/st?cipid=8110425&ttype=0&cirid=33DA9DA9A8621164001198827245&cicmp=1682805&cijs=1&dast=V7ocwCFgO_B61VNgia5QS_B61VNgia5QUAAAAGBuIHG7MZMZgjBnNBnE0Wi9lmuVyOBrvRZLCcTEGDWJ6v6W84SJo-o-kgaTjNBs1gMLysBmvoQNPp8Lnu9YKH5_SyOO12jd_tV3t5L9rVubkDAAAAwAOA0nwwxA8gAEAEAAAAgAQAAAAARUDFv4XABQAAAAAGgEFpggYA1AcAwEMACADAgAIJwED_XQnARef1CQAAAAAAAAAAy____38MwF5wlgxARmvdjUEPwIMPwIMQAABA1lBZyZfwIsGoAVEBYhEjAAAAAMr9Fv-jSZ1QWVQBABCkWwFcAQAEmFXs2ERm6Q5KvIUBAAAEjC3Qw-L3mx12jd_tMgAAAAAAAAAAs_-zfzQhojOptKAVtkW1X0AAgLVfQAAANnUDAHgLgAs6glYMBqsLiNkBAAAA3P3____rgdhk4nGMnKOJzWVzzWY2x24zmyxmq4nHZJitZpPtNcxtVlWWV-n1aRDL8zX9DQdJ02c0HSQNp9mgGQyGl9VgfhO2GK0mk81yOFsuJoPhaDga7U_AdgOcoOFwsNgNFrvFYjhZTEaD5WCBAjGY4IQMR5vJarRb7SbL4WQ0mm0mG6Ro1Wo22gyGq9lkttuthoPhcjRCitYsZpPJYjZa7jaD5WQ0GE6GQ4Qpz27i2kxMa5lhslyLhjPbWuIyudzCzWC1WO1mHpfD4xa9PqbLwjQybkZeFAxY2IvgIp0o7Z7T0-Mw_S1vwcNzelmcdotYojlZpBPZZV-bTDyOkXM0sblsrtnM5thtZpPFbDXxmAyz1Wyyb3l2E9dmYlrLDJPlWjSc2dYSl8nlFm4Gq8VqN_O4HB636PUxXRamkXEz8jdWm91yNRotN_vGarNbrkaj5WbfoTN8V5-z0XRNeTwuZ_Lb0o1mDoPCZbB4fxLTYtqdHTy_39GpUl00xobsm1CYDR6DQRFLBKeLdCJ6GU8XsUTytEgnGsNqYbFMBovRyLZaOEe2hWM3mrk8M5fDN9xsZhaxRGm6SCd6tdf3sl2dm4v6jw4xGs4lq8VctJpLVqNVAgAAAAAAAABYwpx5EwAAAAA!&excid=22&tst=1&docw=0
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://pastebin.com/adserver/300x250_custom_safe.php
accept-encoding
gzip, deflate
cookie
t_gid=e37b53b4-f029-48f6-bede-8305157fceac-tuct2a4d83d; taboola_usg=GgQQtYtF; __cfduid=d12968b594b0abe3ab6d31b5210dd2c041537954494
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://pastebin.com/adserver/300x250_custom_safe.php

Response headers

status
200
server
nginx/1.13.12
content-type
text/html;charset=ISO-8859-1
accept-ranges
bytes
date
Wed, 26 Sep 2018 09:34:54 GMT
via
1.1 varnish
x-served-by
cache-mad9422-MAD
x-cache
MISS
x-cache-hits
0
x-timer
S1537954494.271030,VS0,VE28
cmTagWIDGET_ITEM.js
vidstat.taboola.com/vpaid/units/18_39_6/infra/ Frame CD81
434 KB
105 KB
Script
General
Full URL
https://vidstat.taboola.com/vpaid/units/18_39_6/infra/cmTagWIDGET_ITEM.js
Requested by
Host: vidstat.taboola.com
URL: https://vidstat.taboola.com/vpaid/units/14_12_0/creatives/creative_js.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2400:cb00:2048:1::6811:914c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
69fd709b3f40bfd62a312e06fb8d0d6ef2d3a39bbcc393a9ccd4c525278d8ca4

Request headers

Referer
https://pastebin.com/adserver/300x250_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:54 GMT
via
1.1 5d4ff22febf83d261f03aa068f5bdc04.cloudfront.net (CloudFront)
cf-cache-status
HIT
x-cache
Miss from cloudfront
status
200
x-amz-meta-mode
33188
content-encoding
gzip
content-type
application/javascript
x-amz-meta-uid
0
last-modified
Mon, 17 Sep 2018 14:22:01 GMT
server
cloudflare
etag
W/"1ae2159518ea5ea8115589373fbe2e97"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-meta-gid
0
expires
Sat, 27 Oct 2018 09:34:54 GMT
cache-control
public, max-age=2678400
cf-ray
4604bcc509bd979e-FRA
x-amz-cf-id
_qONkH95ECXr0ZIR0Sl3TL62VrSKpB4bOx_t3uMPTgNca7K0by3oew==
x-amz-meta-mtime
1537194096
cmOsUnit.css
vidstat.taboola.com/vpaid/units/18_39_6/assets/css/ Frame CD81
24 KB
5 KB
Stylesheet
General
Full URL
https://vidstat.taboola.com/vpaid/units/18_39_6/assets/css/cmOsUnit.css
Requested by
Host: vidstat.taboola.com
URL: https://vidstat.taboola.com/vpaid/units/14_12_0/creatives/creative_js.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2400:cb00:2048:1::6811:914c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1d60bccbae0161146c8731fbdbe888811749d34b080feb9efca7e742ef2d3707

Request headers

Referer
https://pastebin.com/adserver/300x250_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:54 GMT
via
1.1 dfb957c193e8f98057bb6f530c2816a9.cloudfront.net (CloudFront)
cf-cache-status
HIT
x-cache
Miss from cloudfront
status
200
x-amz-meta-mode
33188
content-encoding
gzip
content-type
text/css
x-amz-meta-uid
0
last-modified
Mon, 17 Sep 2018 14:21:50 GMT
server
cloudflare
etag
W/"42296368043631214ebef92c42621daf"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-meta-gid
0
expires
Sat, 27 Oct 2018 09:34:54 GMT
cache-control
public, max-age=2678400
cf-ray
4604bcc509bc979e-FRA
x-amz-cf-id
_BZEj6e74ikZxxawnZblyAVVS1ydD0wLmZtJjcAk-GWHEQefFNuEcg==
x-amz-meta-mtime
1537194093
OvaMediaPlayer.js
vidstat.taboola.com/vpaid/vPlayer/player/v9.4.1/ Frame CD81
585 KB
149 KB
Script
General
Full URL
https://vidstat.taboola.com/vpaid/vPlayer/player/v9.4.1/OvaMediaPlayer.js
Requested by
Host: vidstat.taboola.com
URL: https://vidstat.taboola.com/vpaid/units/18_39_6/infra/cmTagWIDGET_ITEM.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2400:cb00:2048:1::6811:914c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4255e08141d9e33d5ac5a9d7992524e3803d4311211c573f3ed938cfea1905d0

Request headers

Referer
https://pastebin.com/adserver/300x250_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:54 GMT
via
1.1 1d0fc03b30809d10a25a905ba30d8170.cloudfront.net (CloudFront)
cf-cache-status
HIT
x-cache
Hit from cloudfront
status
200
x-amz-meta-mode
33188
content-encoding
gzip
content-type
application/javascript
x-amz-meta-uid
0
last-modified
Mon, 17 Sep 2018 08:57:42 GMT
server
cloudflare
etag
W/"d7dfa698720db186f5838ca3038484f8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-meta-gid
0
expires
Sat, 27 Oct 2018 09:34:54 GMT
cache-control
public, max-age=2678400
cf-ray
4604bcc5da6e979e-FRA
x-amz-cf-id
kbp01H0fML5xGgD5WTMenLQ4nLM51TUltwr8ariqLCGwT8j_VtGSww==
x-amz-meta-mtime
1537174660
st
convammp.taboola.com/ Frame CD81
0
53 B
Image
General
Full URL
https://convammp.taboola.com/st?cijs=convusmp&ttype=45&cisd=convusmp&cipid=8110425&crid=4912065&dast=V74YoCFgO_B61VNgia5QS_B61VNgia5QUAAAAGBuIHHLMZMZgjBnNBnE0Wi9loMFgslsPhZDcZrYawMZsRgzliMBfE2WSxmG2Wy-VosBtNBsvJFDSI5fma_oaDpOkzmg6ShtNs0AwGw8tqsIYONJ0On-teL3h4Ti-L027X-N1-tZf3ol2dmzsAAAAAPAAozQdD_AACAEQAAAAASAAAAABQBFT8WwhcAAAAAGAAGJQmaABAfQAAPASAAAAMKJAADPTflQBcdF6fAAAAAAAAAACw_P___8cA7AVnyQBktNb1ADz4ADwQFSAWMQIAAACg3G_xP5rUCZVFFQAAQboVwBUAQIBZxY5NZBgAAEDA2AI9LH6_2WHX-N0uAwAAAAAAAAAw-z_7RxMiOpNKC1phW1T7BQQAWPsFBABgUzcAgLcAuKAjaMVgsLqAmB0AAADA3f___78eiE0mHsfIOZrYXDbXbGZz7DazyWK2mnhMhtlqNtlew9xmVWV5lV6fBrE8X9PfcJA0fUbTQdJwmg2awWB4WQ3mN2GL0Woy2SyHs-ViMhiOhqPR_gRsN8AJGg4Hi91gsVsshpPFZDRYDhYoEIMJTshwtJmsRrvVbrIcTkaj2WayQYpWrWajzWC4mk1mu91qOBguRyOkaM1iNpksZqPlbjNYTkaD4WQ4RJjy7CauzcS0lhkmy7VoOLOtJS6Tyy3cDFaL1W7mcTk8btHrY7osTCPjZuRFwYCFvQgu0onS7jk9PQ7T3_IWPDynl8Vpt4glmpNFOpFd9rXJxOMYOUcTm8vmms1sjt1mNlnMVhOPyTBbzSb7lmc3cW0mprXMMFmuRcOZbS1xmVxu4WawWqx2M4_L4XGLXh_TZWEaGTcjf2O12S1Xo9Fys2-sNrvlajRabvYdOsN39TkbTdeUx-NyJr8t3WjmMChcBov3JzEtpt3ZwfP7HZ0q1UVjbMi-CYXZ4DEYFLFEcLpIJ6KX8XQRSyRPi3SiMawWFstksBiNbKuFc2RbOHajmcszczl8w81mZhFLlKaLdKJXe30v29W5uaj_6BCj4VyyWsxFq7lkNVolAAAAAAAAAIAlzJk3AQAAAAA!&cmcv=&pix=31589837&cb=1537954494353&uv=18396&abt=bft_vA!mpu_vE!optb7_vB&unm=WIDGET_ITEM
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.134.49 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx/1.13.12 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://pastebin.com/adserver/300x250_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:54 GMT
via
1.1 varnish
server
nginx/1.13.12
x-timer
S1537954494.422698,VS0,VE28
x-cache
MISS
status
200
x-cache-hits
0
accept-ranges
bytes
content-length
0
x-served-by
cache-mad9422-MAD
st
convammp.taboola.com/ Frame CD81
0
65 B
Image
General
Full URL
https://convammp.taboola.com/st?cijs=convusmp&ttype=72&cisd=convusmp&cipid=8110425&crid=4912065&dast=V74YoCFgO_B61VNgia5QS_B61VNgia5QUAAAAGBuIHHLMZMZgjBnNBnE0Wi9loMFgslsPhZDcZrYawMZsRgzliMBfE2WSxmG2Wy-VosBtNBsvJFDSI5fma_oaDpOkzmg6ShtNs0AwGw8tqsIYONJ0On-teL3h4Ti-L027X-N1-tZf3ol2dmzsAAAAAPAAozQdD_AACAEQAAAAASAAAAABQBFT8WwhcAAAAAGAAGJQmaABAfQAAPASAAAAMKJAADPTflQBcdF6fAAAAAAAAAACw_P___8cA7AVnyQBktNb1ADz4ADwQFSAWMQIAAACg3G_xP5rUCZVFFQAAQboVwBUAQIBZxY5NZBgAAEDA2AI9LH6_2WHX-N0uAwAAAAAAAAAw-z_7RxMiOpNKC1phW1T7BQQAWPsFBABgUzcAgLcAuKAjaMVgsLqAmB0AAADA3f___78eiE0mHsfIOZrYXDbXbGZz7DazyWK2mnhMhtlqNtlew9xmVWV5lV6fBrE8X9PfcJA0fUbTQdJwmg2awWB4WQ3mN2GL0Woy2SyHs-ViMhiOhqPR_gRsN8AJGg4Hi91gsVsshpPFZDRYDhYoEIMJTshwtJmsRrvVbrIcTkaj2WayQYpWrWajzWC4mk1mu91qOBguRyOkaM1iNpksZqPlbjNYTkaD4WQ4RJjy7CauzcS0lhkmy7VoOLOtJS6Tyy3cDFaL1W7mcTk8btHrY7osTCPjZuRFwYCFvQgu0onS7jk9PQ7T3_IWPDynl8Vpt4glmpNFOpFd9rXJxOMYOUcTm8vmms1sjt1mNlnMVhOPyTBbzSb7lmc3cW0mprXMMFmuRcOZbS1xmVxu4WawWqx2M4_L4XGLXh_TZWEaGTcjf2O12S1Xo9Fys2-sNrvlajRabvYdOsN39TkbTdeUx-NyJr8t3WjmMChcBov3JzEtpt3ZwfP7HZ0q1UVjbMi-CYXZ4DEYFLFEcLpIJ6KX8XQRSyRPi3SiMawWFstksBiNbKuFc2RbOHajmcszczl8w81mZhFLlKaLdKJXe30v29W5uaj_6BCj4VyyWsxFq7lkNVolAAAAAAAAAIAlzJk3AQAAAAA!&cmcv=&pix=&cb=1537954494382&uv=18396&abt=bft_vA!mpu_vE!optb7_vB&unm=WIDGET_ITEM
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.134.49 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx/1.13.12 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://pastebin.com/adserver/300x250_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:54 GMT
via
1.1 varnish
server
nginx/1.13.12
x-timer
S1537954494.422827,VS0,VE27
x-cache
MISS
status
200
x-cache-hits
0
accept-ranges
bytes
content-length
0
x-served-by
cache-mad9422-MAD
loading2.png
vidstat.taboola.com/assets/ Frame CD81
24 KB
24 KB
Image
General
Full URL
https://vidstat.taboola.com/assets/loading2.png
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2400:cb00:2048:1::6811:914c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4f2b7e987474183ea3293084c5069b7a5227876ed8fa10da3dd3588ee7124c16

Request headers

Referer
https://pastebin.com/adserver/300x250_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:54 GMT
via
1.1 1d87c34bb2f20fda8e0841bc33179769.cloudfront.net (CloudFront)
cf-cache-status
HIT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-cache
Hit from cloudfront
status
200
x-amz-meta-mode
33188
content-type
image/png
content-length
24300
last-modified
Sun, 02 Jul 2017 14:25:04 GMT
server
cloudflare
etag
"ead84d746b6ee07ee78dc4243d7349c8"
x-amz-meta-uid
0
vary
Accept-Encoding
x-amz-meta-gid
0
expires
Sat, 27 Oct 2018 09:34:54 GMT
cache-control
public, max-age=2678400
accept-ranges
bytes
cf-ray
4604bcc5fa98979e-FRA
x-amz-cf-id
SXq5FS4tEDwdx7UAmfazwR2jw9V3Ody6yE7IWSZlwgbsg6ZDrnnWYw==
x-amz-meta-mtime
1498646328
repeat1.png
vidstat.taboola.com/assets/ Frame CD81
6 KB
6 KB
Image
General
Full URL
https://vidstat.taboola.com/assets/repeat1.png
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2400:cb00:2048:1::6811:914c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
177b008a096d3fa959480a10c4583da71a607a4221067319402ac3ce5f20cd1a

Request headers

Referer
https://pastebin.com/adserver/300x250_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:54 GMT
via
1.1 ba77f90aac0ddbc2c4c2c02062fac762.cloudfront.net (CloudFront)
cf-cache-status
HIT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-cache
Hit from cloudfront
status
200
x-amz-meta-mode
33188
content-type
image/png
content-length
6014
last-modified
Sun, 02 Jul 2017 14:25:32 GMT
server
cloudflare
etag
"ad69d3ccbd42fdc18c4945afb88cf12d"
x-amz-meta-uid
0
vary
Accept-Encoding
x-amz-meta-gid
0
expires
Sat, 27 Oct 2018 09:34:54 GMT
cache-control
public, max-age=2678400
accept-ranges
bytes
cf-ray
4604bcc5fa99979e-FRA
x-amz-cf-id
ErIyMZkdIt_8Qk8sPqLizFnA8xQf5QCh9_NqNOtwQ51UIRqykDC3Kw==
x-amz-meta-mtime
1498644755
dsm.js
vidstat.taboola.com/dsm/147/ Frame CD81
1 KB
587 B
Script
General
Full URL
https://vidstat.taboola.com/dsm/147/dsm.js
Requested by
Host:
URL: webpack-internal:///./index.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2400:cb00:2048:1::6811:914c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
44384b7f756f39aa333ff62c4fb468ea7a9f38651f404abceba16ef1f8da443a

Request headers

Referer
https://pastebin.com/adserver/300x250_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:54 GMT
via
1.1 f7b7cf90592cf6a380fd34cc45e9c4b5.cloudfront.net (CloudFront)
cf-cache-status
HIT
x-cache
Hit from cloudfront
status
200
content-encoding
gzip
last-modified
Thu, 13 Sep 2018 07:22:07 GMT
server
cloudflare
etag
W/"f846d942ac8b35e3adefd229e7549ee6"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=2678400
cf-ray
4604bcc68b26979e-FRA
x-amz-cf-id
BOGxpp-ijP0Rr5woV07j7ii61bwfW59GaSdEC_S41It1jpbgnW2YYQ==
expires
Sat, 27 Oct 2018 09:34:54 GMT
player.css
vidstat.taboola.com/vpaid/vPlayer/player/v9.4.1/assets/ Frame CD81
13 KB
2 KB
Stylesheet
General
Full URL
https://vidstat.taboola.com/vpaid/vPlayer/player/v9.4.1/assets/player.css
Requested by
Host: vidstat.taboola.com
URL: https://vidstat.taboola.com/vpaid/vPlayer/player/v9.4.1/OvaMediaPlayer.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2400:cb00:2048:1::6811:914c , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8d4abda5061c9d33e733bb24b12ce40bd129b0475e7e17882272923815836483

Request headers

Referer
https://pastebin.com/adserver/300x250_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:54 GMT
via
1.1 3283735112d0a322451d32ef038129c9.cloudfront.net (CloudFront)
cf-cache-status
HIT
x-cache
Hit from cloudfront
status
200
x-amz-meta-mode
33188
content-encoding
gzip
content-type
text/css
x-amz-meta-uid
0
last-modified
Mon, 17 Sep 2018 08:57:48 GMT
server
cloudflare
etag
W/"d94124a972f8fecd8b73d967871cc214"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-meta-gid
0
expires
Sat, 27 Oct 2018 09:34:54 GMT
cache-control
public, max-age=2678400
cf-ray
4604bcc68b27979e-FRA
x-amz-cf-id
n2OCnmCJQyXzE_Ss1XoBmWk82mYWQvCIB6uI8UhAEOr0AT_jnALM1w==
x-amz-meta-mtime
1531312566
VideoBidRequestHandlerServlet
wf.taboola.com/ Frame CD81
516 B
667 B
XHR
General
Full URL
https://wf.taboola.com/VideoBidRequestHandlerServlet?oid=15&width=300&height=168&pubid=169497&tagid=953497&crid=4912065&noaop=2&sortOrderType=0&cb=1537954494482&mimes=5,10,11,12&isvideo=0&plmd=2&mindur=1&maxdur=210&minbr=1&maxbr=10000&st=0&seq=1&pv=941&pt=1380527099&tz=0&viewable=true&ddast=V74YoCFgO_B61VNgia5QS_B61VNgia5QUAAAAGBuIHHLMZMZgjBnNBnE0Wi9loMFgslsPhZDcZrYawMZsRgzliMBfE2WSxmG2Wy-VosBtNBsvJFDSI5fma_oaDpOkzmg6ShtNs0AwGw8tqsIYONJ0On-teL3h4Ti-L027X-N1-tZf3ol2dmzsAAAAAPAAozQdD_AACAEQAAAAASAAAAABQBFT8WwhcAAAAAGAAGJQmaABAfQAAPASAAAAMKJAADPTflQBcdF6fAAAAAAAAAACw_P___8cA7AVnyQBktNb1ADz4ADwQFSAWMQIAAACg3G_xP5rUCZVFFQAAQboVwBUAQIBZxY5NZBgAAEDA2AI9LH6_2WHX-N0uAwAAAAAAAAAw-z_7RxMiOpNKC1phW1T7BQQAWPsFBABgUzcAgLcAuKAjaMVgsLqAmB0AAADA3f___78eiE0mHsfIOZrYXDbXbGZz7DazyWK2mnhMhtlqNtlew9xmVWV5lV6fBrE8X9PfcJA0fUbTQdJwmg2awWB4WQ3mN2GL0Woy2SyHs-ViMhiOhqPR_gRsN8AJGg4Hi91gsVsshpPFZDRYDhYoEIMJTshwtJmsRrvVbrIcTkaj2WayQYpWrWajzWC4mk1mu91qOBguRyOkaM1iNpksZqPlbjNYTkaD4WQ4RJjy7CauzcS0lhkmy7VoOLOtJS6Tyy3cDFaL1W7mcTk8btHrY7osTCPjZuRFwYCFvQgu0onS7jk9PQ7T3_IWPDynl8Vpt4glmpNFOpFd9rXJxOMYOUcTm8vmms1sjt1mNlnMVhOPyTBbzSb7lmc3cW0mprXMMFmuRcOZbS1xmVxu4WawWqx2M4_L4XGLXh_TZWEaGTcjf2O12S1Xo9Fys2-sNrvlajRabvYdOsN39TkbTdeUx-NyJr8t3WjmMChcBov3JzEtpt3ZwfP7HZ0q1UVjbMi-CYXZ4DEYFLFEcLpIJ6KX8XQRSyRPi3SiMawWFstksBiNbKuFc2RbOHajmcszczl8w81mZhFLlKaLdKJXe30v29W5uaj_6BCj4VyyWsxFq7lkNVolAAAAAAAAAIAlzJk3AQAAAAA!&proto=2,3,5,6&dtagid=1547735&dpubid=261495&abtst=bft_vA!mpu_vE!optb7_vB&mPre=0.0275&encoded=1&pstn=vforce2&cirf=https%3A%2F%2Fpastebin.com&callback=&en=1&wfv=1&cdb=&gdprApplies=false
Requested by
Host: vidstat.taboola.com
URL: https://vidstat.taboola.com/vpaid/vPlayer/player/v9.4.1/OvaMediaPlayer.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.134.49 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx/1.13.12 /
Resource Hash
10ae40113d0df511863e0b2d054535a3d1262370947c2ea36c7b23e3efca4fbf

Request headers

Referer
https://pastebin.com/adserver/300x250_custom_safe.php
Origin
https://pastebin.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-type
text/plain

Response headers

async
true
date
Wed, 26 Sep 2018 09:34:54 GMT
via
1.1 varnish
machineid
1404
x-cache
MISS
status
200
finished
true
content-length
516
x-served-by
cache-mad9422-MAD
pragma
no-cache
server
nginx/1.13.12
x-timer
S1537954495.512800,VS0,VE285
content-type
application/json;charset=ISO-8859-1
access-control-allow-origin
https://pastebin.com
expires
Sat, 26 Jul 1997 05:00:00 GMT
cache-control
no-cache,must-revalidate,no-store,max-age=0,s-maxage=0
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
gpt.js
www.googletagservices.com/tag/js/ Frame 14BD
21 KB
8 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: d2na2p72vtqyok.cloudfront.net
URL: https://d2na2p72vtqyok.cloudfront.net/client-embed/024e069d-525f-46a7-911a-7c59471d8c75.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:806::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
39d704fb385057b46c2781380576a8c4f3a1df6cf5f4c82efbc4830e4ef5449a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pastebin.com/adserver/160x600_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"8 / 541 of 1000 / last-modified: 1537573516"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
7934
x-xss-protection
1; mode=block
expires
Wed, 26 Sep 2018 09:34:54 GMT
integrator.js
adservice.google.de/adsid/ Frame 14BD
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=pastebin.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81f::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pastebin.com/adserver/160x600_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 26 Sep 2018 09:34:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
104
x-xss-protection
1; mode=block
integrator.js
adservice.google.com/adsid/ Frame 14BD
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=pastebin.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81f::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pastebin.com/adserver/160x600_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 26 Sep 2018 09:34:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
104
x-xss-protection
1; mode=block
pubads_impl_249.js
securepubads.g.doubleclick.net/gpt/ Frame 14BD
182 KB
63 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_249.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.217.22.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s16-in-f34.1e100.net
Software
sffe /
Resource Hash
308b88046da3cb8c99042d803173dee196d6501925fd3c86ccf8f9e2d7f7d04a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pastebin.com/adserver/160x600_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 13 Sep 2018 13:39:46 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
64039
x-xss-protection
1; mode=block
expires
Wed, 26 Sep 2018 09:34:54 GMT
gpt.js
www.googletagservices.com/tag/js/ Frame 67FE
21 KB
0
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: d2na2p72vtqyok.cloudfront.net
URL: https://d2na2p72vtqyok.cloudfront.net/client-embed/024e069d-525f-46a7-911a-7c59471d8c75.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:806::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
39d704fb385057b46c2781380576a8c4f3a1df6cf5f4c82efbc4830e4ef5449a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Response headers

date
Wed, 26 Sep 2018 09:34:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"8 / 541 of 1000 / last-modified: 1537573516"
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
7934
x-xss-protection
1; mode=block
expires
Wed, 26 Sep 2018 09:34:54 GMT
integrator.js
adservice.google.de/adsid/ Frame 67FE
109 B
171 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=pastebin.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81f::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pastebin.com/adserver/728x90_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 26 Sep 2018 09:34:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
104
x-xss-protection
1; mode=block
integrator.js
adservice.google.com/adsid/ Frame 67FE
109 B
171 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=pastebin.com
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:81f::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pastebin.com/adserver/728x90_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 26 Sep 2018 09:34:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status
200
cache-control
private, no-cache, no-store
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
104
x-xss-protection
1; mode=block
pubads_impl_249.js
securepubads.g.doubleclick.net/gpt/ Frame 67FE
182 KB
63 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_249.js
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.217.22.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s16-in-f34.1e100.net
Software
sffe /
Resource Hash
308b88046da3cb8c99042d803173dee196d6501925fd3c86ccf8f9e2d7f7d04a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pastebin.com/adserver/728x90_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 13 Sep 2018 13:39:46 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
64039
x-xss-protection
1; mode=block
expires
Wed, 26 Sep 2018 09:34:54 GMT
ads
securepubads.g.doubleclick.net/gampad/ Frame 14BD
5 KB
3 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2051864435947313&correlator=1166093020333011&output=json_html&callback=googletag.impl.pubads.callbackProxy1&impl=fif&adsid=NT&eid=21061742%2C21061764%2C21062287&vrg=249&guci=1.2.0.0.2.2.0&sc=1&sfv=1-0-29&iu=%2F27794161%2Fpastebin.com_Web_160x600_1&sz=160x600&scp=refurl%3Dpastebin.com%26floor_group%3Dexp_group_1%26hour%3D9%26tier%3D1%26instBid_bidder%3Dnofill%26instBid_pb%3D0%26instBid_adid%3Dnofill%26instBid_size%3D160x600%26impression_type%3Dinitial_load&cookie=ID%3D414370cffe75c2c6%3AT%3D1537954492%3AS%3DALNI_MaxfPAMWu40K4JJDMkJwCRw51sPdg&cdm=pastebin.com&bc=7&lmt=1537954494&dt=1537954494804&dlt=1537954492678&idt=2119&ea=0&frm=23&biw=1585&bih=1200&isw=160&ish=600&oid=3&adx=1222&ady=552&adk=1503365569&gut=v2&ifi=1&ifk=1320065300&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=2&iag=15&url=https%3A%2F%2Fpastebin.com%2Fadserver%2F160x600_custom_safe.php&ref=https%3A%2F%2Fpastebin.com%2FmKwEvj9s&top=https%3A%2F%2Fpastebin.com%2FmKwEvj9s&dssz=11&icsg=131114&std=3&vis=1&dmc=8&scr_x=0&scr_y=0&ga_vid=1690200702.1537954495&ga_sid=1537954495&ga_hid=885116845&fws=0
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_249.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.217.22.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s16-in-f34.1e100.net
Software
cafe /
Resource Hash
c86e6a3a0eeb2b17ec8aaa817c77e378788cbc42369476235130f35bc7b9360d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://pastebin.com/adserver/160x600_custom_safe.php
Origin
https://pastebin.com

Response headers

date
Wed, 26 Sep 2018 09:34:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
2825
x-xss-protection
1; mode=block
google-lineitem-id
4695132887
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138235173509
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
https://pastebin.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_rendering_249.js
securepubads.g.doubleclick.net/gpt/ Frame 14BD
51 KB
19 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_249.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_249.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.217.22.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s16-in-f34.1e100.net
Software
sffe /
Resource Hash
f7eeefc1dd6f250f4c4b89a1fef2d0fb85b280042059f1f2ee0d11de20c34e98
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pastebin.com/adserver/160x600_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 13 Sep 2018 13:39:46 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
19757
x-xss-protection
1; mode=block
expires
Wed, 26 Sep 2018 09:34:54 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-29/html/ Frame 14BD
0
0
Other
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-29/html/container.html?n=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_249.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:812::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Purpose
prefetch
Referer
https://pastebin.com/adserver/160x600_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

expires
Fri, 13 Sep 2019 20:57:16 GMT
cache-control
public, immutable, max-age=31536000
last-modified
Mon, 11 Jun 2018 14:38:59 GMT
content-type
text/html
ads
securepubads.g.doubleclick.net/gampad/ Frame 67FE
3 KB
2 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4124144904830661&correlator=982168897422078&output=json_html&callback=googletag.impl.pubads.callbackProxy1&impl=fif&adsid=NT&eid=21062458%2C21062378%2C21062506&vrg=249&guci=1.2.0.0.2.2.0&plat=1%3A32776%2C2%3A16809992&sc=1&sfv=1-0-29&iu=%2F27794161%2Fpastebin.com_Web_728x90_1&sz=728x90&scp=refurl%3Dpastebin.com%26floor_group%3Dctrl_group%26hour%3D9%26tier%3D1%26instBid_bidder%3Dnofill%26instBid_pb%3D0%26instBid_adid%3Dnofill%26instBid_size%3D728x90%26impression_type%3Dinitial_load&cookie=ID%3D414370cffe75c2c6%3AT%3D1537954492%3AS%3DALNI_MaxfPAMWu40K4JJDMkJwCRw51sPdg&cdm=pastebin.com&bc=7&lmt=1537954494&dt=1537954494842&dlt=1537954492679&idt=2156&ea=0&frm=23&biw=1585&bih=1200&isw=728&ish=90&oid=3&adx=204&ady=116&adk=1949062477&gut=v2&ifi=1&ifk=3995772453&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=2&iag=15&url=https%3A%2F%2Fpastebin.com%2Fadserver%2F728x90_custom_safe.php&ref=https%3A%2F%2Fpastebin.com%2FmKwEvj9s&top=https%3A%2F%2Fpastebin.com%2FmKwEvj9s&dssz=11&icsg=131114&std=3&vis=1&dmc=8&scr_x=0&scr_y=0&ga_vid=699309805.1537954495&ga_sid=1537954495&ga_hid=849003324&fws=0
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_249.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.217.22.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s16-in-f34.1e100.net
Software
cafe /
Resource Hash
75753909b96f2d940c6161d0dabac146263be116e0f972c5ef33eab659f82e5f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://pastebin.com/adserver/728x90_custom_safe.php
Origin
https://pastebin.com

Response headers

date
Wed, 26 Sep 2018 09:34:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
2019
x-xss-protection
1; mode=block
google-lineitem-id
4699964571
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138235650765
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
https://pastebin.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
pubads_impl_rendering_249.js
securepubads.g.doubleclick.net/gpt/ Frame 67FE
51 KB
19 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_249.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_249.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.217.22.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s16-in-f34.1e100.net
Software
sffe /
Resource Hash
f7eeefc1dd6f250f4c4b89a1fef2d0fb85b280042059f1f2ee0d11de20c34e98
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pastebin.com/adserver/728x90_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 13 Sep 2018 13:39:46 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
private, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
19757
x-xss-protection
1; mode=block
expires
Wed, 26 Sep 2018 09:34:54 GMT
container.html
tpc.googlesyndication.com/safeframe/1-0-29/html/ Frame 67FE
0
0
Other
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-29/html/container.html?n=2
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_249.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:812::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Purpose
prefetch
Referer
https://pastebin.com/adserver/728x90_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

expires
Fri, 13 Sep 2019 20:57:16 GMT
cache-control
public, immutable, max-age=31536000
last-modified
Mon, 11 Jun 2018 14:38:59 GMT
content-type
text/html
160x600_criteo_pb_safe.php
pastebin.com/adserver/ Frame 190C
6 KB
2 KB
Document
General
Full URL
https://pastebin.com/adserver/160x600_criteo_pb_safe.php
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_249.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
666414c47cd29d7785663b049f9ccae77fe1cc5768b885e8421f2f3485c4aa35
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
pastebin.com
:scheme
https
:path
/adserver/160x600_criteo_pb_safe.php
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://pastebin.com/adserver/160x600_custom_safe.php
accept-encoding
gzip, deflate
cookie
__cfduid=d5b51f2e1bc61419a36d590ac7344a3421537954491; visitorGeo=DE; Insticator.geoBlockAds-024e069d-525f-46a7-911a-7c59471d8c75=false; Insticator.geoBlockedEmbeds-024e069d-525f-46a7-911a-7c59471d8c75=[]; __gads=ID=414370cffe75c2c6:T=1537954492:S=ALNI_MaxfPAMWu40K4JJDMkJwCRw51sPdg; trc_cookie_storage=insticator-pastebin%253Asession-data%3Dv2_62bc1d94bfef56ff17362165bcd06562_e37b53b4-f029-48f6-bede-8305157fceac-tuct2a4d83d_1537954493_1537954493_CNawjgYQi5JGGK3r7KnhLCABKAEwODib4wlAgooQSJjEF1Cl7BBYAGAA%7Ctaboola%2520global%253Alocal-storage-keys%3D%255B%2522insticator-pastebin%253Asession-data%2522%252C%2522taboola%2520global%253Alspb%2522%252C%2522taboola%2520global%253Auser-id%2522%255D%7Ctaboola%2520global%253Alspb%3DCwsIIBCemhgMCwg_EJ6aGAwLCDsQnpoYDAsIQBCemhgMCwgkEJ6aGAwLCEIQnpoYDAsILRCemhgMCwgnEJ6aGAwMExQ%7Ctaboola%2520global%253Auser-id%3De37b53b4-f029-48f6-bede-8305157fceac-tuct2a4d83d
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://pastebin.com/adserver/160x600_custom_safe.php

Response headers

status
200
date
Wed, 26 Sep 2018 09:34:55 GMT
content-type
text/html
vary
Accept-Encoding
x-xss-protection
1; mode=block
content-encoding
gzip
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
4604bcc96a9c64db-FRA
osd_listener.js
tpc.googlesyndication.com/pagead/js/r20180919/r20110914/activeview/ Frame 8FDA
73 KB
0
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20180919/r20110914/activeview/osd_listener.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_249.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:812::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
3b7b82aade1ac93b4c8852e213584b051d50f592ede38d7ab45e12d863c6c1a0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Response headers

date
Wed, 19 Sep 2018 18:59:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
570934
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
27066
x-xss-protection
1; mode=block
server
cafe
etag
1598727148269787311
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 03 Oct 2018 18:59:19 GMT
truncated
/ Frame 8FDA
212 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
63b8585b495691eea732b292ae4afd19e3d22e395409842081e384127788728a

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/png
osd.js
pagead2.googlesyndication.com/pagead/ Frame 14BD
72 KB
26 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/osd.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_249.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:816::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
a5f24fc963982085e79d5445ae602b5fba30c972ed84763d39d869c16c732a2c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pastebin.com/adserver/160x600_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 08:39:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
3353
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
26901
x-xss-protection
1; mode=block
server
cafe
etag
11805512267064086570
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=3600
timing-allow-origin
*
expires
Wed, 26 Sep 2018 09:39:01 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 8FDA
0
61 B
Image
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvdv_hh2TdAQM2Cw-pYlFnDNkVy-NuJeLuZ7ggjBH8anHsU_di3FL1-A_9cYC17VJoCtjuXwslsiQdGIwj7pMTBgbAbwy7-0qiXr8sNjodO-ErrCd62ayEld1OHsOolScdxoheeh_MWv1svZ2jNnyS1jrO9POkCUqWVd4pozhm9SjvtcxIC_VmXHZDIb3klOFhk4qc9VXu6FHiLtXOSlmKp230qY2Gw6eVJWyXZEceJZ_xADk8e043BejD05DRM_hesSVxMeQ&sai=AMfl-YTaTvEXYvmAURulAKi2dOImxU8tkSSbSOSR79mv4HQ_Xa3Fotj3E9gRBeI8wEHxKDqO3iqqEZCauUqhhmZ1tZZGnjEYF20Cjemvefsga04vy6yCyDuCiKt2n9U&sig=Cg0ArKJSzMeV_ffAtwgsEAE&urlfix=1&adurl=
Requested by
Host: pastebin.com
URL: https://pastebin.com/adserver/160x600_custom_safe.php
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.217.22.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s16-in-f34.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pastebin.com/adserver/160x600_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 26 Sep 2018 09:34:54 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
0
x-xss-protection
1; mode=block
728x90_criteo_pb_safe.php
pastebin.com/adserver/ Frame 0A0F
531 B
398 B
Document
General
Full URL
https://pastebin.com/adserver/728x90_criteo_pb_safe.php
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_249.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
31b3179290d3dfefa893574ebdf639c5a2914ad1c3db5aff86bc666b491fcfca
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
pastebin.com
:scheme
https
:path
/adserver/728x90_criteo_pb_safe.php
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://pastebin.com/adserver/728x90_custom_safe.php
accept-encoding
gzip, deflate
cookie
__cfduid=d5b51f2e1bc61419a36d590ac7344a3421537954491; visitorGeo=DE; Insticator.geoBlockAds-024e069d-525f-46a7-911a-7c59471d8c75=false; Insticator.geoBlockedEmbeds-024e069d-525f-46a7-911a-7c59471d8c75=[]; __gads=ID=414370cffe75c2c6:T=1537954492:S=ALNI_MaxfPAMWu40K4JJDMkJwCRw51sPdg; trc_cookie_storage=insticator-pastebin%253Asession-data%3Dv2_62bc1d94bfef56ff17362165bcd06562_e37b53b4-f029-48f6-bede-8305157fceac-tuct2a4d83d_1537954493_1537954493_CNawjgYQi5JGGK3r7KnhLCABKAEwODib4wlAgooQSJjEF1Cl7BBYAGAA%7Ctaboola%2520global%253Alocal-storage-keys%3D%255B%2522insticator-pastebin%253Asession-data%2522%252C%2522taboola%2520global%253Alspb%2522%252C%2522taboola%2520global%253Auser-id%2522%255D%7Ctaboola%2520global%253Alspb%3DCwsIIBCemhgMCwg_EJ6aGAwLCDsQnpoYDAsIQBCemhgMCwgkEJ6aGAwLCEIQnpoYDAsILRCemhgMCwgnEJ6aGAwMExQ%7Ctaboola%2520global%253Auser-id%3De37b53b4-f029-48f6-bede-8305157fceac-tuct2a4d83d
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://pastebin.com/adserver/728x90_custom_safe.php

Response headers

status
200
date
Wed, 26 Sep 2018 09:34:55 GMT
content-type
text/html
vary
Accept-Encoding
x-xss-protection
1; mode=block
content-encoding
gzip
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
cf-ray
4604bcc9cadf64db-FRA
osd_listener.js
tpc.googlesyndication.com/pagead/js/r20180919/r20110914/activeview/ Frame B463
73 KB
0
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20180919/r20110914/activeview/osd_listener.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_249.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:812::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
3b7b82aade1ac93b4c8852e213584b051d50f592ede38d7ab45e12d863c6c1a0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Response headers

date
Wed, 19 Sep 2018 18:59:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
570934
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
27066
x-xss-protection
1; mode=block
server
cafe
etag
1598727148269787311
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 03 Oct 2018 18:59:19 GMT
truncated
/ Frame B463
214 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
375a2a466a52f4074746214e725a7d70d3b4fa97af3089659825cdaad939027a

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/png
osd.js
pagead2.googlesyndication.com/pagead/ Frame 67FE
72 KB
0
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/osd.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_249.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:816::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
a5f24fc963982085e79d5445ae602b5fba30c972ed84763d39d869c16c732a2c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Response headers

date
Wed, 26 Sep 2018 08:39:01 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
3353
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
26901
x-xss-protection
1; mode=block
server
cafe
etag
11805512267064086570
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=3600
timing-allow-origin
*
expires
Wed, 26 Sep 2018 09:39:01 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame B463
0
61 B
Image
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuuctVgwX0jl1bZNWnzCIzrNhbd2ZBQMJtuHq_ig0zEuptOSzT_uLJh5P4JW6qXKEw0UYLmvap7hubc7YKi_TbMVzzOJRnOPf0_E0SPQgjWO0LfANBDeMe0Vm9K-UeFWm5MAXlj_ilR0qhf3lEIsyg5UM8Mx0ILlSBl9IEGhAzT6fplJCQDjoK18qLUlbDRjubND5YuEdVObhQmZXL6AehSUH898GyU3WIhU09YhvFbhi9RgXxRfuKMaq1gaWsCZKZzzyIT&sai=AMfl-YQv6p0Yt_8KWe1wPqG23TiMnq9GwmSdSpYE-_hZGa9viCOkRUZCgL5qHZvDma3nFoWjPq01z7grSdp_TqrdPBesBG4lXqA_b4XY2azkfTJT2VEcW6f1XE-DT_I&sig=Cg0ArKJSzPLTsopDYXqIEAE&urlfix=1&adurl=
Requested by
Host: pastebin.com
URL: https://pastebin.com/adserver/728x90_custom_safe.php
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
172.217.22.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s16-in-f34.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pastebin.com/adserver/728x90_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 26 Sep 2018 09:34:55 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
private
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
0
x-xss-protection
1; mode=block
deals-ribbon.svg
pastebin.com/i/ Frame 190C
103 B
273 B
Image
General
Full URL
https://pastebin.com/i/deals-ribbon.svg
Requested by
Host: pastebin.com
URL: https://pastebin.com/adserver/160x600_criteo_pb_safe.php
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d4398cc2de1c610a9268600b04ac981c6d6d4cca8ee5020613c4edfaa1e75171
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/deals-ribbon.svg
pragma
no-cache
cookie
__cfduid=d5b51f2e1bc61419a36d590ac7344a3421537954491; visitorGeo=DE; Insticator.geoBlockAds-024e069d-525f-46a7-911a-7c59471d8c75=false; Insticator.geoBlockedEmbeds-024e069d-525f-46a7-911a-7c59471d8c75=[]; __gads=ID=414370cffe75c2c6:T=1537954492:S=ALNI_MaxfPAMWu40K4JJDMkJwCRw51sPdg; trc_cookie_storage=insticator-pastebin%253Asession-data%3Dv2_62bc1d94bfef56ff17362165bcd06562_e37b53b4-f029-48f6-bede-8305157fceac-tuct2a4d83d_1537954493_1537954493_CNawjgYQi5JGGK3r7KnhLCABKAEwODib4wlAgooQSJjEF1Cl7BBYAGAA%7Ctaboola%2520global%253Alocal-storage-keys%3D%255B%2522insticator-pastebin%253Asession-data%2522%252C%2522taboola%2520global%253Alspb%2522%252C%2522taboola%2520global%253Auser-id%2522%255D%7Ctaboola%2520global%253Alspb%3DCwsIIBCemhgMCwg_EJ6aGAwLCDsQnpoYDAsIQBCemhgMCwgkEJ6aGAwLCEIQnpoYDAsILRCemhgMCwgnEJ6aGAwMExQ%7Ctaboola%2520global%253Auser-id%3De37b53b4-f029-48f6-bede-8305157fceac-tuct2a4d83d
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/adserver/160x600_criteo_pb_safe.php
:scheme
https
:method
GET
Referer
https://pastebin.com/adserver/160x600_criteo_pb_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:55 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Tue, 24 May 2016 16:37:17 GMT
server
cloudflare
etag
W/"5744833d-67"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
status
200
cache-control
public, max-age=7200
cf-ray
4604bcca2b5a64db-FRA
x-xss-protection
1; mode=block
expires
Wed, 26 Sep 2018 11:34:55 GMT
sale_4634_image.jpg
cdnp0.stackassets.com/8ef85cbb983ffa1060c78a865dd1a223840bd963/store/2452f7a80d3101a3bdec5b4fc949dc55f944925ba5659de23cc9fe8b33e8/ Frame 190C
129 KB
129 KB
Image
General
Full URL
https://cdnp0.stackassets.com/8ef85cbb983ffa1060c78a865dd1a223840bd963/store/2452f7a80d3101a3bdec5b4fc949dc55f944925ba5659de23cc9fe8b33e8/sale_4634_image.jpg
Requested by
Host: pastebin.com
URL: https://pastebin.com/adserver/160x600_criteo_pb_safe.php
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.230.95.37 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-95-37.fra2.r.cloudfront.net
Software
nginx/1.12.1 /
Resource Hash
56a7c6d8b487d69cdaa300814cd02bea378ef5a66aee33e920463d52776d721a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://pastebin.com/adserver/160x600_criteo_pb_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Mon, 10 Sep 2018 10:55:32 GMT
via
1.1 42eda27a8f21acb511ddb91858ee5d5b.cloudfront.net (CloudFront)
x-content-type-options
nosniff
last-modified
Mon, 10 Sep 2018 10:55:32 GMT
server
nginx/1.12.1
age
1377563
status
200
x-cache
Hit from cloudfront
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
content-disposition
inline; filename="sale_4634_image.jpg"
content-length
131840
x-amz-cf-id
jeQ9zxt8xFKtIhJ2ZPUvQsNE792Az2ObCCqxQi_hd4zTWlvq8SYG-w==
expires
Tue, 10 Sep 2019 10:55:32 GMT
sale_5899_primary_image.jpg
cdnp2.stackassets.com/bcf0bb55fcaf1db44b87816205c81ab0d66d4bd9/store/198721c90cee54cb521d7cc5d5b0650eefba5bd5347e58ed23faac39ff9f/ Frame 190C
28 KB
28 KB
Image
General
Full URL
https://cdnp2.stackassets.com/bcf0bb55fcaf1db44b87816205c81ab0d66d4bd9/store/198721c90cee54cb521d7cc5d5b0650eefba5bd5347e58ed23faac39ff9f/sale_5899_primary_image.jpg
Requested by
Host: pastebin.com
URL: https://pastebin.com/adserver/160x600_criteo_pb_safe.php
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.230.95.37 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-95-37.fra2.r.cloudfront.net
Software
nginx/1.12.1 /
Resource Hash
35915c3170e7f442b77a650e4ad6b866a6b2b1547248d6cf8574b901812b41a5
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://pastebin.com/adserver/160x600_criteo_pb_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 16 May 2018 19:51:30 GMT
via
1.1 42eda27a8f21acb511ddb91858ee5d5b.cloudfront.net (CloudFront)
x-content-type-options
nosniff
last-modified
Wed, 16 May 2018 19:51:30 GMT
server
nginx/1.12.1
age
11454205
status
200
x-cache
Hit from cloudfront
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
content-disposition
inline; filename="sale_5899_primary_image.jpg"
content-length
28628
x-amz-cf-id
Quohiue-aCGhAH5P9TZxnnQI8HozLOvLoRo1M2pMHi-Ji41G42mMng==
expires
Thu, 16 May 2019 19:51:30 GMT
sale_4878_primary_image.jpg
cdnp0.stackassets.com/f66843610c27078bc1e47cf27a78e182bb501fa3/store/375fa03a10b54c84a278673307669cd0371e5bed2c7305482158543d0846/ Frame 190C
19 KB
20 KB
Image
General
Full URL
https://cdnp0.stackassets.com/f66843610c27078bc1e47cf27a78e182bb501fa3/store/375fa03a10b54c84a278673307669cd0371e5bed2c7305482158543d0846/sale_4878_primary_image.jpg
Requested by
Host: pastebin.com
URL: https://pastebin.com/adserver/160x600_criteo_pb_safe.php
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.230.95.37 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-54-230-95-37.fra2.r.cloudfront.net
Software
nginx/1.12.1 /
Resource Hash
5332d6dc0c30261351ec1f0b50491834fc2c44af927075c1bbec5bab372d449f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://pastebin.com/adserver/160x600_criteo_pb_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Tue, 18 Sep 2018 17:53:20 GMT
via
1.1 42eda27a8f21acb511ddb91858ee5d5b.cloudfront.net (CloudFront)
x-content-type-options
nosniff
last-modified
Tue, 18 Sep 2018 17:53:20 GMT
server
nginx/1.12.1
age
661295
status
200
x-cache
Hit from cloudfront
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
content-disposition
inline; filename="sale_4878_primary_image.jpg"
content-length
19803
x-amz-cf-id
5x5MWUb7NsflvSE8HfPUHItSqYawJx865fnSuUUQixKidOC5SPER7A==
expires
Wed, 18 Sep 2019 17:53:20 GMT
rum.js
tpc.googlesyndication.com/pagead/js/r20180919/r20110914/ Frame 8FDA
42 KB
16 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20180919/r20110914/rum.js
Requested by
Host: pastebin.com
URL: https://pastebin.com/mKwEvj9s
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:812::2001 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
5c4bdb91d18bbb0dc7875f55a468cdb5dea73b931e316c14bc04f907ab000d6b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pastebin.com/adserver/160x600_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Fri, 21 Sep 2018 10:26:31 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
428904
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
15945
x-xss-protection
1; mode=block
server
cafe
etag
7476379871139986956
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 05 Oct 2018 10:26:31 GMT
csi
csi.gstatic.com/ Frame 8FDA
0
56 B
Other
General
Full URL
https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~jmiyeba0&chm=1&ctx=2&gqid=vlKrW9b-MciEtwe8u4mQBg&qqid=CNuK4fqu2N0CFYiu7QoddLUBJA&met.4=fb.3x~lb.44~ol.8j~idt.1mx~dt.2&met.3=197.42~123.41_3~121.44~118.48~118.4t_1~115.6y~118.7l~117.8i~113.93_4~112.91_6&met.1=1.jmiyeb0y~14.a~15.a~16.b~17.b~18.b~19.b~20.b~21.b~22.4b~23.4b&met.7=CBsQBSCOAThy~CAcQChgBII8BKI8BMI8BaI8BcI8BgAG60wGIAbLGBLABAbgBAQ~CCIQBhgBIJYBKJYBMMABOCtolgFwwAF4PbABAbgBAw~CBgQChgBILgCKLgCML8COAdouQJwvgJ4k32AAcl8iAGzzQKwAQG4AQM&met.2=15.4~16.dza
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/js/r20180919/r20110914/rum.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:400c:c0b::5e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://pastebin.com/adserver/160x600_custom_safe.php
Origin
https://pastebin.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Wed, 26 Sep 2018 09:34:55 GMT
last-modified
Wed, 21 Jan 2004 19:51:30 GMT
server
Golfe2
status
204
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
night_mode_leader.png
pastebin.com/i/ Frame 0A0F
30 KB
30 KB
Image
General
Full URL
https://pastebin.com/i/night_mode_leader.png
Requested by
Host: pastebin.com
URL: https://pastebin.com/adserver/728x90_criteo_pb_safe.php
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
104.20.209.21 San Francisco, United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
49ec52831ce1994f0efb8296f5df49ef3db5c9ba9ad6f2802446a1d90c4558c1
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

:path
/i/night_mode_leader.png
pragma
no-cache
cookie
__cfduid=d5b51f2e1bc61419a36d590ac7344a3421537954491; visitorGeo=DE; Insticator.geoBlockAds-024e069d-525f-46a7-911a-7c59471d8c75=false; Insticator.geoBlockedEmbeds-024e069d-525f-46a7-911a-7c59471d8c75=[]; __gads=ID=414370cffe75c2c6:T=1537954492:S=ALNI_MaxfPAMWu40K4JJDMkJwCRw51sPdg; trc_cookie_storage=insticator-pastebin%253Asession-data%3Dv2_62bc1d94bfef56ff17362165bcd06562_e37b53b4-f029-48f6-bede-8305157fceac-tuct2a4d83d_1537954493_1537954493_CNawjgYQi5JGGK3r7KnhLCABKAEwODib4wlAgooQSJjEF1Cl7BBYAGAA%7Ctaboola%2520global%253Alocal-storage-keys%3D%255B%2522insticator-pastebin%253Asession-data%2522%252C%2522taboola%2520global%253Alspb%2522%252C%2522taboola%2520global%253Auser-id%2522%255D%7Ctaboola%2520global%253Alspb%3DCwsIIBCemhgMCwg_EJ6aGAwLCDsQnpoYDAsIQBCemhgMCwgkEJ6aGAwLCEIQnpoYDAsILRCemhgMCwgnEJ6aGAwMExQ%7Ctaboola%2520global%253Auser-id%3De37b53b4-f029-48f6-bede-8305157fceac-tuct2a4d83d
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
pastebin.com
referer
https://pastebin.com/adserver/728x90_criteo_pb_safe.php
:scheme
https
:method
GET
Referer
https://pastebin.com/adserver/728x90_criteo_pb_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 26 Sep 2018 09:34:55 GMT
cf-cache-status
HIT
last-modified
Thu, 14 Jun 2018 12:11:58 GMT
server
cloudflare
etag
"5b225b8e-78df"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=7776000
accept-ranges
bytes
cf-ray
4604bccb2cb764db-FRA
content-length
30943
x-xss-protection
1; mode=block
expires
Tue, 25 Dec 2018 09:34:55 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 8FDA
42 B
122 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstB-DemGI3CpCvgFyAz7Lf61I652HnOAtwsjTB6yyol42LsStuc26kAoRRBjDCRQo0uFNMLfnLAPYOSQvD4MHb7TUcy0v3xbx4&sig=Cg0ArKJSzL8FZ-Y0NlWZEAE&adk=1503365569&tt=1010&bs=1585%2C1200&mtos=1011,1011,1011,1011,1011&tos=1011,0,0,0,0&p=552,1222,1152,1382&mms=1&mcvt=1011&rs=3&ht=0&tfs=8&tls=1019&mc=1&lte=1&bas=0&bac=0&avms=geo&rst=1537954494951&rpt=21&ps=1585%2C8313&ss=1600%2C1200&pt=10&deb=1-1-1-5-12-8-11-10&tvt=1013&is=160%2C600&op=1&iframe_loc=https%3A%2F%2Fpastebin.com%2Fadserver%2F160x600_custom_safe.php&r=v&id=osdim&uc=10&tgt=IFRAME&cl=1&cec=6&clc=1&cac=0&cd=160x600&v=r20180919
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:816::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pastebin.com/adserver/160x600_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 26 Sep 2018 09:34:55 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
42
x-xss-protection
1; mode=block
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame B463
42 B
122 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjss3ed4bJNSblaJQFyXxKq_pwdoa2nFXCa5aW8_NeC86OxqeVqGjs72WoW5pQcbSjKlbXHIq2iBxk0fIa8oAbttGrlPQte-Ksto&sig=Cg0ArKJSzHADx57eav02EAE&adk=1949062477&tt=1019&bs=1585%2C1200&mtos=1018,1018,1018,1018,1018&tos=1018,0,0,0,0&p=116,204,206,932&mms=1&mcvt=1018&rs=3&ht=0&tfs=9&tls=1027&mc=1&lte=1&bas=0&bac=0&avms=geo&rst=1537954495013&rpt=13&ps=1585%2C8313&ss=1600%2C1200&pt=9&deb=1-1-1-2-12-8-11-10&tvt=1021&is=728%2C90&op=1&iframe_loc=https%3A%2F%2Fpastebin.com%2Fadserver%2F728x90_custom_safe.php&r=v&id=osdim&uc=10&tgt=IFRAME&cl=1&cec=5&clc=1&cac=0&cd=728x90&v=r20180919
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:816::2002 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://pastebin.com/adserver/728x90_custom_safe.php
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 26 Sep 2018 09:34:56 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
status
200
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="44,43,39,35",quic=":443"; ma=2592000; v="44,43,39,35"
content-length
42
x-xss-protection
1; mode=block
expires
Fri, 01 Jan 1990 00:00:00 GMT
VideoBidRequestHandlerServlet
wf.taboola.com/ Frame CD81
660 B
766 B
XHR
General
Full URL
https://wf.taboola.com/VideoBidRequestHandlerServlet?oid=15&width=300&height=168&pubid=169497&tagid=953497&crid=4912065&noaop=2&sortOrderType=0&cb=1537954497686&mimes=5,10,11,12&isvideo=0&plmd=2&mindur=1&maxdur=210&minbr=1&maxbr=10000&st=0&seq=2&pv=941&pt=1380527099&tz=0&viewable=true&ddast=V74YoCFgO_B61VNgia5QS_B61VNgia5QUAAAAGBuIHHLMZMZgjBnNBnE0Wi9loMFgslsPhZDcZrYawMZsRgzliMBfE2WSxmG2Wy-VosBtNBsvJFDSI5fma_oaDpOkzmg6ShtNs0AwGw8tqsIYONJ0On-teL3h4Ti-L027X-N1-tZf3ol2dmzsAAAAAPAAozQdD_AACAEQAAAAASAAAAABQBFT8WwhcAAAAAGAAGJQmaABAfQAAPASAAAAMKJAADPTflQBcdF6fAAAAAAAAAACw_P___8cA7AVnyQBktNb1ADz4ADwQFSAWMQIAAACg3G_xP5rUCZVFFQAAQboVwBUAQIBZxY5NZBgAAEDA2AI9LH6_2WHX-N0uAwAAAAAAAAAw-z_7RxMiOpNKC1phW1T7BQQAWPsFBABgUzcAgLcAuKAjaMVgsLqAmB0AAADA3f___78eiE0mHsfIOZrYXDbXbGZz7DazyWK2mnhMhtlqNtlew9xmVWV5lV6fBrE8X9PfcJA0fUbTQdJwmg2awWB4WQ3mN2GL0Woy2SyHs-ViMhiOhqPR_gRsN8AJGg4Hi91gsVsshpPFZDRYDhYoEIMJTshwtJmsRrvVbrIcTkaj2WayQYpWrWajzWC4mk1mu91qOBguRyOkaM1iNpksZqPlbjNYTkaD4WQ4RJjy7CauzcS0lhkmy7VoOLOtJS6Tyy3cDFaL1W7mcTk8btHrY7osTCPjZuRFwYCFvQgu0onS7jk9PQ7T3_IWPDynl8Vpt4glmpNFOpFd9rXJxOMYOUcTm8vmms1sjt1mNlnMVhOPyTBbzSb7lmc3cW0mprXMMFmuRcOZbS1xmVxu4WawWqx2M4_L4XGLXh_TZWEaGTcjf2O12S1Xo9Fys2-sNrvlajRabvYdOsN39TkbTdeUx-NyJr8t3WjmMChcBov3JzEtpt3ZwfP7HZ0q1UVjbMi-CYXZ4DEYFLFEcLpIJ6KX8XQRSyRPi3SiMawWFstksBiNbKuFc2RbOHajmcszczl8w81mZhFLlKaLdKJXe30v29W5uaj_6BCj4VyyWsxFq7lkNVolAAAAAAAAAIAlzJk3AQAAAAA!&proto=2,3,5,6&dtagid=1547735&dpubid=261495&abtst=bft_vA!mpu_vE!optb7_vB&mPre=0.0275&encoded=1&pstn=vforce2&cirf=https%3A%2F%2Fpastebin.com&callback=&en=1&wfv=1&cdb=&gdprApplies=false
Requested by
Host: vidstat.taboola.com
URL: https://vidstat.taboola.com/vpaid/vPlayer/player/v9.4.1/OvaMediaPlayer.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.134.49 San Francisco, United States, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software
nginx/1.13.12 /
Resource Hash
1e5ca235c9d44e037835b162b0d866ec889eced18060faf0a4df496e9c460cd8

Request headers

Referer
https://pastebin.com/adserver/300x250_custom_safe.php
Origin
https://pastebin.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-type
text/plain

Response headers

async
true
date
Wed, 26 Sep 2018 09:34:57 GMT
via
1.1 varnish
machineid
1420
x-cache
MISS
status
200
finished
true
content-length
660
x-served-by
cache-mad9422-MAD
pragma
no-cache
server
nginx/1.13.12
x-timer
S1537954498.714074,VS0,VE68
content-type
application/json;charset=ISO-8859-1
access-control-allow-origin
https://pastebin.com
expires
Sat, 26 Jul 1997 05:00:00 GMT
cache-control
no-cache,must-revalidate,no-store,max-age=0,s-maxage=0
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0

Verdicts & Comments Add Verdict or Comment

67 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| gtag object| dataLayer object| google_tag_manager function| $ function| jQuery function| selectText function| showdiv function| confirmPost function| submitform function| checkTab function| processTab function| setSelectionRange function| replaceSelection function| catchTab function| stopEvent function| fliprows function| showold function| shownew function| showboth function| highlight function| getElementsByClassName function| twitpopup function| facebookpopup object| js function| createCookie function| autosize function| FuckAdBlock object| fuckAdBlock object| e9 string| GoogleAnalyticsObject function| ga object| google_tag_data object| gaplugins object| sa object| gaGlobal object| gaData object| e9Loader object| e9Manager undefined| e9AdSlots object| e9ObjectMap object| e9WaitingSlotsQueue function| getRealTagsScript function| getCurrentTagsScript function| createSameDomainIframeTag function| writeContentInIframe function| getFrameID function| getDivID function| createAndWriteContentInIframe function| processMultiTagsRequest function| processSingleTagsRequest function| canAsyncFrameBeDrawn function| getMaxSize object| _bsa function| _bsa_go function| _bsa_serving_callback object| _bsa_queue string| ignoretargeting function| abdd function| abnd object| $title function| isIE undefined| div object| e9PageData string| hasAlreadyServedSnackBar object| TRC number| taboola_view_id object| google_reactive_ads_global_state

11 Cookies

Domain/Path Name / Value
.taboola.com/ Name: taboola_usg
Value: GgwQ9KlBEPS5QxCutUM
.taboola.com/ Name: t_gid
Value: e37b53b4-f029-48f6-bede-8305157fceac-tuct2a4d83d
.taboola.com/ Name: __cfduid
Value: d12968b594b0abe3ab6d31b5210dd2c041537954494
.tribalfusion.com/ Name: ANON_ID
Value: axnuvnsKBR7rmDqU7tetaFZa4QRfPD8QfRM9bDvIUD44glePh07KP0wh01x7VQVLnPDHhDZbEZdaW6IBZdvRltRmqZc1jEcPBXAGxqn54
.districtm.io/ Name: __cfduid
Value: d040b74de3f2bd697f0556c13db7d196d1537954492
pastebin.com/ Name: trc_cookie_storage
Value: insticator-pastebin%253Asession-data%3Dv2_62bc1d94bfef56ff17362165bcd06562_e37b53b4-f029-48f6-bede-8305157fceac-tuct2a4d83d_1537954493_1537954493_CNawjgYQi5JGGK3r7KnhLCABKAEwODib4wlAgooQSJjEF1Cl7BBYAGAA%7Ctaboola%2520global%253Alocal-storage-keys%3D%255B%2522insticator-pastebin%253Asession-data%2522%252C%2522taboola%2520global%253Alspb%2522%252C%2522taboola%2520global%253Auser-id%2522%255D%7Ctaboola%2520global%253Alspb%3DCwsIIBCemhgMCwg_EJ6aGAwLCDsQnpoYDAsIQBCemhgMCwgkEJ6aGAwLCEIQnpoYDAsILRCemhgMCwgnEJ6aGAwMExQ%7Ctaboola%2520global%253Auser-id%3De37b53b4-f029-48f6-bede-8305157fceac-tuct2a4d83d
.pastebin.com/ Name: __gads
Value: ID=414370cffe75c2c6:T=1537954492:S=ALNI_MaxfPAMWu40K4JJDMkJwCRw51sPdg
pastebin.com/ Name: Insticator.geoBlockedEmbeds-024e069d-525f-46a7-911a-7c59471d8c75
Value: []
pastebin.com/ Name: visitorGeo
Value: DE
pastebin.com/ Name: Insticator.geoBlockAds-024e069d-525f-46a7-911a-7c59471d8c75
Value: false
.pastebin.com/ Name: __cfduid
Value: d5b51f2e1bc61419a36d590ac7344a3421537954491

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

15.taboola.com
adservice.google.com
adservice.google.de
apex.go.sonobi.com
bid.contextweb.com
bttrack.com
cdn.districtm.io
cdn.taboola.com
cdnp0.stackassets.com
cdnp2.stackassets.com
cm.g.doubleclick.net
convammp.taboola.com
csi.gstatic.com
d2na2p72vtqyok.cloudfront.net
df80k0z3fi8zg.cloudfront.net
geoip.insticator.com
ib.adnxs.com
images.taboola.com
imprammp.taboola.com
m.servedby-buysellads.com
match.adsrvr.org
match.taboola.com
pagead2.googlesyndication.com
pastebin.com
prebid.districtm.ca
rtb.mfadsrvr.com
s.tribalfusion.com
sb.scorecardresearch.com
securepubads.g.doubleclick.net
server.exposebox.com
stats.g.doubleclick.net
tag-st.contextweb.com
tags.expo9.exponential.com
tpc.googlesyndication.com
trc.taboola.com
vidstat.taboola.com
wf.taboola.com
www.google-analytics.com
www.googletagmanager.com
www.googletagservices.com
www.storygize.net
x.bidswitch.net
104.20.208.21
104.20.209.21
108.161.189.78
151.101.132.166
151.101.134.2
151.101.134.49
172.217.22.34
178.162.133.150
18.153.11.25
18.196.144.59
185.33.223.204
185.33.223.206
192.132.33.27
204.11.109.66
204.11.109.67
204.11.109.68
204.11.109.77
216.58.205.226
23.43.115.95
2400:cb00:2048:1::6811:914c
2400:cb00:2048:1::6814:10f3
2400:cb00:2048:1::6814:180b
2600:9000:200c:d200:10:3422:3f00:93a1
2606:4700:30::681c:13e8
2a00:1450:4001:806::2002
2a00:1450:4001:812::2001
2a00:1450:4001:812::2008
2a00:1450:4001:812::200e
2a00:1450:4001:816::2002
2a00:1450:4001:81f::2002
2a00:1450:400c:c00::9d
2a00:1450:400c:c0b::5e
34.211.85.62
35.201.85.158
54.171.22.132
54.230.95.173
54.230.95.37
74.214.194.133
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
07741979791c1c8abd78a2a0bebd7e7bbcb42b9b103cf08015f073149422cf53
0cde18bbcac49e0ca2157589893e54db709a5533dde8d9cf46fb00754a8962f4
10ae40113d0df511863e0b2d054535a3d1262370947c2ea36c7b23e3efca4fbf
10eba73b3641332bde05fa8d6223e7017ac5207673602247c35f358ea89e3092
129948bf393b3c2ea03e5695b36f2a2b929de22ca5806b77a815e07faba27e41
177b008a096d3fa959480a10c4583da71a607a4221067319402ac3ce5f20cd1a
1d60bccbae0161146c8731fbdbe888811749d34b080feb9efca7e742ef2d3707
1e0be450b0ad7f16cbf145edfa3f727f0c16bfafd24f7cf2fab717f0a8fa982f
1e46d7ead177a073e065d10eead66856f03521f60ebab4def0d58c9c971ecd16
1e5ca235c9d44e037835b162b0d866ec889eced18060faf0a4df496e9c460cd8
1e78caa75f3cf9ab0bb3425ac479d7d21ab76001a07b13e5d999404a4589f9f0
1ea8e3c5b76d5a78f7e206a10dae6b1ad359a2987bb83278e2071bf3952751df
1fb72c2609597452b616197d9cf4bd65e48e5ceb998936aeee8ee8994b1c403a
22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5
229863d30dc9a3df6594232b3249b999cb06b9940ec89c9ec3ba3099e80573c4
2544182fb9a0a2f65dac966c91bcbcb8239798c4c5d8278f0fd6d9f4056d301e
2797a5a31f878305121024bf4f2271f8059dcc6c2b24efde2994c09631bed34f
28d88fd2114e3c599d9772095a2034f81882bc4d1b614a48fdcdf421c6d15db6
2a8f23d3c4e9b734cbbdc94448337ef2598d61bcdd475dd5a4d1b7fdaf019152
2aa1657cc01cbd5e50c8a6de27ea8e811cf8c2bb8d182d8946c628ad3fe0b4e3
2edf1da7b4a91689ba05070803ba3c47845944c56ac4a843556d47146d1967fb
308b88046da3cb8c99042d803173dee196d6501925fd3c86ccf8f9e2d7f7d04a
31b3179290d3dfefa893574ebdf639c5a2914ad1c3db5aff86bc666b491fcfca
33fdf456221b02535a285d71f273349e3d3fb9871bcdddaa232920413895bb35
35915c3170e7f442b77a650e4ad6b866a6b2b1547248d6cf8574b901812b41a5
375a2a466a52f4074746214e725a7d70d3b4fa97af3089659825cdaad939027a
37786f0724c1e728e8a1dfd225f12c5e9804c04a3a6eb0bc3795e7df67a51f64
37adf45803a6a17bd0a2161af32daae616cbcd301964b9e05901df3b2caf222b
39d704fb385057b46c2781380576a8c4f3a1df6cf5f4c82efbc4830e4ef5449a
3a0173182211c356718cc39291f5753a21fefe7422665f2bcd2a2798e02e846b
3a49cd5f8860e1d7c8c2b572d35fa1ebd8dd94b39f62f4e7d641cc524f99e383
3b7b82aade1ac93b4c8852e213584b051d50f592ede38d7ab45e12d863c6c1a0
3e2c5ee3e670df454c774cd417f12f4ca3083db68091f9184fb29efd2af4877b
3fb852db1cd132dda2e5b283b43d7cc7debe88e4ec803db31613aa472ae72009
4255e08141d9e33d5ac5a9d7992524e3803d4311211c573f3ed938cfea1905d0
44384b7f756f39aa333ff62c4fb468ea7a9f38651f404abceba16ef1f8da443a
49ec52831ce1994f0efb8296f5df49ef3db5c9ba9ad6f2802446a1d90c4558c1
4a9aa566504b0e6345c794c122b76c7a40cf176093e5e08a4e9ffdc9f0caba39
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4f2b7e987474183ea3293084c5069b7a5227876ed8fa10da3dd3588ee7124c16
519da9ab367d112f8fe3fec314abf6bc3fb23aba4f0e2414679b61692de3b796
520fcb233d72b3e30c4491aab4ac425baac5faa0918b47491419a8d7bdeff387
5332d6dc0c30261351ec1f0b50491834fc2c44af927075c1bbec5bab372d449f
558100561843d20afe325e0e04c0742827a8c575ecd7ea1142749bb93d9c14cd
559b99fee06ae5833d7863a0b0f8156c48edc9063d2d3f62e65150c65e9f85a7
56a7c6d8b487d69cdaa300814cd02bea378ef5a66aee33e920463d52776d721a
56c4ce67d315f88d68e3e1a5a52049bc892096c4aab3e534226c29704886af20
5c2b1bed79700fe5d259a53ba106725d3b0cd135cde665db35a2134f45c1eb6a
5c4bdb91d18bbb0dc7875f55a468cdb5dea73b931e316c14bc04f907ab000d6b
5e5329aaa32275144cd1ef4372bce662d70537b7634ed634382bdf073733b0da
637dd01675f7015d068b7cadcfdf32607fec872ed3ef04ef9013d203a57e2f59
63b8585b495691eea732b292ae4afd19e3d22e395409842081e384127788728a
666414c47cd29d7785663b049f9ccae77fe1cc5768b885e8421f2f3485c4aa35
67657c28fcf553c033a6442abec476993d853441cac02b5ca1c5580228451bd8
69fd709b3f40bfd62a312e06fb8d0d6ef2d3a39bbcc393a9ccd4c525278d8ca4
6a45de868a2a546cbce60c97e9cd15a1df8348f779ce2ec240309c1c1c8f26b7
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6e4d2d5f2bc5a257b2fb037354fe5318591688dcf734375eaa0abd9d2d211642
700e718b3a30ca8a9b4b19aecaa62b457998559eddc0eb7f1f8bc5d483738154
703d23efcb49183ab7f2795739f547fcd42c3d73e77f47b6c614892bb6666cea
71f870b7243ed05cae8e4707adb82c8d6b30174bcd83e5d9b7c60bdee8bdbb6b
75753909b96f2d940c6161d0dabac146263be116e0f972c5ef33eab659f82e5f
79b2fa9032215e3dff51865bbe0024d7cb9b3f1914b1fb79944347dbfe48374b
7a735f35356d3ca513b6c242e3f4c1034557e01faaa774b4e14feaef46ecdaac
7f494312dd58dd6d0a14eaa75c5a8b438827f919577f62a9d86f9048c91af7f6
7fc2927c6ecc0e0402558ef08cdac15420bf7699cc9c5976f2ae72a3af10d0d1
8040db06855291ee0489a814aee5d975ce5acfe272b26ec98597b005e4d5789f
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8c65572e19ed78b068ece6d1aaf3d93ab7ef76fe3afdbfbccf7e30822a48ba1e
8d4abda5061c9d33e733bb24b12ce40bd129b0475e7e17882272923815836483
96a39b4bca3cb02f0fd18724047cff37cf7ca2ed43240e1631a101e2e308dbd9
9db7a21dd14ba20bee6dc27da7e4cd799a936e9b1b5dee203f24d503b2e89b7f
a0bb893da5412b75e25ef7bb44285e3e0de74c550f7a2a7e40cb5fd29f82ba41
a5f24fc963982085e79d5445ae602b5fba30c972ed84763d39d869c16c732a2c
a8eb48099d32b3108a4273a28e92db693e2546cfa9a928b4201c6b08ece437a2
ad643f5214c7db9384cba8e4afc92c18ac1acc0805b3a662038d2c82dc9f134b
b0bd71350e7df67e7ad3917f4d7e0a8ef424dd48cb3f4aa5254b9b33c7643679
b149801f7e6f98fbf2b3c99a3d72909de1127d141c31e8be49ebc21174b75015
b800c476dbffdc764f06f0267e3d5b0f8ae0a0c3764ff4e7787f7f388455dd27
c0e84e667672bf1c1c675beab334b374919c2a76172ddf890e48ac57b182f5ee
c553d405e7a0d873f69083ecb231e12a1123206c612d8fd8c675e9eabb264f3d
c86e6a3a0eeb2b17ec8aaa817c77e378788cbc42369476235130f35bc7b9360d
caf7148fb3522653d83fd90d52629e2158bb967c43983823f167c1213b2d1e8b
cfda531c613a3bacfd789e014cd6f5c9c792d50f136dc15c7aa65144a2af1f7a
d0fd74148f4cbe78bd0e6328dc5ce5955f0a0ecdb1eb2919da4a7e596ac65912
d337470be7440b8619ecf1b47d686e83a616d67cf3a8d06ffb248b667dbc5561
d4398cc2de1c610a9268600b04ac981c6d6d4cca8ee5020613c4edfaa1e75171
d45d1b49b5918ea0ffa0b3d119995b96b558147f618f0ea1897906252be7bcb4
dcf1268c850c2e448c01958bd3fc92fe2ae6a661353ac6238104ebfb57b04cbd
de9f869660ffdfc25464f11930933413a3e1efa363dfd35267b9ba7843731adc
df418a54adb533554fec3e2a4fb348625f539469f11380963942511835a3c771
df85c7193b05044e0cc8443a8122e92051590e6b86eb0668e43e175a7e7868f8
e1ec9f1acf0830d76c1a807a32cd47398e0bcbc6dfac6d4792f2a3ab78cd4a29
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea834ee6d3c746a617db8d9bcfe8fb91cda36b1ff34c1c5771f45f833bdcec3b
ed17a6e7532cc3065f9fbd8f607dfd30e09b4531ada9f7cb5732a2bf6cf6744c
ed1b73c6b4690cde9b521865b58e031293209bc0b2ba2b5716ecf4bf9885ee4b
ed6ad3c41fd07450891bcb21c80e5bf2a742c6e9415d7ae7caa125edae136650
ee6485a4dd94ffbc4d0b5894b7b38eec511d309b55b4ed657aca6d904b7d5c63
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f5154cd93dc27142f30bf0d10c32b64f107b81f89cc4801e296623cdbafef6bc
f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9
f7eeefc1dd6f250f4c4b89a1fef2d0fb85b280042059f1f2ee0d11de20c34e98
f9a12108fbbe82e3cc882d935fdbf1aaf80ec4d74b09947d574919f60eadf199
fd1fd8dff30cc102766aa53409d2f292e413e5b9b4be66814c697c90e1c48da3
fe5d90987bf2ca2df28ab7ebf44be9a6b99433f6827577c7e5e7fc92c09ac49f
ffc6c1c168b6613e20ddc95146945d248e2084485cb45e0f5e7a712d75913682