anyfile-notepad.semaan.ca Open in urlscan Pro
172.105.61.58 Public Scan

Software

ESF /

Resource Hash

5848fed0499a99763526e2178efc1bec18842259a88cb1cf12600be9ddabbdcd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 19 Oct 2023 12:09:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 19 Oct 2023 12:09:36 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 19 Oct 2023 12:09:36 GMT

GET
H2 200 application-8ac8a8e77829523edc80484f0aaae715f1532137.min.css
anyfile-notepad.semaan.ca/assets/ 300 KB
300 KB 761ms
759ms Stylesheet
text/css 172.105.61.58
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://anyfile-notepad.semaan.ca/assets/application-8ac8a8e77829523edc80484f0aaae715f1532137.min.css
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app?state=%7B%22ids%22:%5B%221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%22%5D,%22action%22:%22open%22,%22resourceKeys%22:%7B%7D%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.105.61.58 Mumbai, India, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS: 172-105-61-58.ip.linodeusercontent.com
Software: Caddy /
Resource Hash: 3d9d832a8392beea801da416111f4da7a68a574fc4d0d64709b468a0f795f425

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/app?state=%7B%22ids%22:%5B%221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%22%5D,%22action%22:%22open%22,%22resourceKeys%22:%7B%7D%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:37 GMT
x-afn-server: afn-srv-v2-mum-1
x-afn-frontend-version: 2
last-modified: Sun, 30 Jul 2023 00:52:32 GMT
server: Caddy
content-type: text/css; charset=utf-8
access-control-allow-origin: *
accept-ranges: bytes
content-length: 307287

GET
H2 200 application-8ac8a8e77829523edc80484f0aaae715f1532137.min.js Show response
anyfile-notepad.semaan.ca/assets/ 653 KB
653 KB 761ms
760ms Script
application/javascript 172.105.61.58
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://anyfile-notepad.semaan.ca/assets/application-8ac8a8e77829523edc80484f0aaae715f1532137.min.js
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app?state=%7B%22ids%22:%5B%221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%22%5D,%22action%22:%22open%22,%22resourceKeys%22:%7B%7D%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.105.61.58 Mumbai, India, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS: 172-105-61-58.ip.linodeusercontent.com
Software: Caddy /
Resource Hash: d05e631c8d0e5f8e85e4b97a33f40aeca825caa30783371af6d725f48e490c0e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/app?state=%7B%22ids%22:%5B%221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%22%5D,%22action%22:%22open%22,%22resourceKeys%22:%7B%7D%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:37 GMT
x-afn-server: afn-srv-v2-mum-1
x-afn-frontend-version: 2
last-modified: Sun, 30 Jul 2023 00:52:32 GMT
server: Caddy
content-type: application/javascript
access-control-allow-origin: *
accept-ranges: bytes
content-length: 668241

GET
H2 200 ace.js Show response
anyfile-notepad.semaan.ca/ace.js/ 353 KB
353 KB 761ms
760ms Script
application/javascript 172.105.61.58
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://anyfile-notepad.semaan.ca/ace.js/ace.js
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app?state=%7B%22ids%22:%5B%221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%22%5D,%22action%22:%22open%22,%22resourceKeys%22:%7B%7D%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.105.61.58 Mumbai, India, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS: 172-105-61-58.ip.linodeusercontent.com
Software: Caddy /
Resource Hash: e9ce598bb515c234eb962bbafbd1128d45f6c2755538a9b5e04a72ee58ec333e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/app?state=%7B%22ids%22:%5B%221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%22%5D,%22action%22:%22open%22,%22resourceKeys%22:%7B%7D%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:37 GMT
x-afn-server: afn-srv-v2-mum-1
x-afn-frontend-version: 2
last-modified: Sun, 30 Jul 2023 00:52:32 GMT
server: Caddy
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
accept-ranges: bytes
content-length: 360977
expires: 0

GET
H2 200 ext-language_tools.js Show response
anyfile-notepad.semaan.ca/ace.js/ 34 KB
34 KB 762ms
760ms Script
application/javascript 172.105.61.58
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://anyfile-notepad.semaan.ca/ace.js/ext-language_tools.js
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app?state=%7B%22ids%22:%5B%221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%22%5D,%22action%22:%22open%22,%22resourceKeys%22:%7B%7D%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.105.61.58 Mumbai, India, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS: 172-105-61-58.ip.linodeusercontent.com
Software: Caddy /
Resource Hash: 91bfbf51e788250c288a29c462a958ec5a8c5ed80aa542dd2ef439eb4384de2e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/app?state=%7B%22ids%22:%5B%221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%22%5D,%22action%22:%22open%22,%22resourceKeys%22:%7B%7D%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:37 GMT
x-afn-server: afn-srv-v2-mum-1
x-afn-frontend-version: 2
last-modified: Sun, 30 Jul 2023 00:52:32 GMT
server: Caddy
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
accept-ranges: bytes
content-length: 35073
expires: 0

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 89 KB
29 KB 132ms
58ms Script
text/javascript 142.251.167.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f154.1e100.net

Software

cafe /

Resource Hash

5529b6175f7b12e64ade8d6ec87ee34c11ba72d21430f53bb9a7e708425ce46e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:36 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29313
x-xss-protection: 0
server: cafe
etag: 849 / 19649 / m202310160101 / config-hash: 12430834030162720919
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Thu, 19 Oct 2023 12:09:36 GMT

GET
H2 200 sdbmtiqbxqoopp7t3s9lq.js Show response
storage.googleapis.com/dbmtiqbxqoopp7t3s9lq/ 170 KB
171 KB 111ms
37ms Script
text/javascript 142.251.167.207
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://storage.googleapis.com/dbmtiqbxqoopp7t3s9lq/sdbmtiqbxqoopp7t3s9lq.js
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app?state=%7B%22ids%22:%5B%221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%22%5D,%22action%22:%22open%22,%22resourceKeys%22:%7B%7D%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.167.207 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: ww-in-f207.1e100.net
Software: UploadServer /
Resource Hash: 08b280a4f0643253a52d633ead8ba7441919dd32155433b061a6032d31453b7b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 11:17:12 GMT
age: 3144
x-guploader-uploadid: ADPycdsjGC0WFg6O18ycDrlWNFw3fb2ZfY7PdVWykHR2ZZBCjWzUymIL_wqRr6mxOQnr7b5U5VxnVoaKzIQP8YUt4bcoBdRQiQ3t
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 174265
last-modified: Thu, 19 Oct 2023 11:15:12 GMT
server: UploadServer
etag: "3ef537fdfae0face6e220c8bb8cc728e"
x-goog-generation: 1696938010514113
x-goog-hash: crc32c=Oug7Sw==, md5=PvU3/frg+s5uIgyLuMxyjg==
content-type: text/javascript
cache-control: public, max-age=3600
x-goog-stored-content-length: 174265
accept-ranges: bytes
expires: Thu, 19 Oct 2023 12:17:12 GMT

GET
H2 200 vdbmtiqbxqoopp7t3s9lq.js Show response
storage.googleapis.com/dbmtiqbxqoopp7t3s9lq/ 3 KB
3 KB 110ms
36ms Script
text/javascript 142.251.167.207
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://storage.googleapis.com/dbmtiqbxqoopp7t3s9lq/vdbmtiqbxqoopp7t3s9lq.js
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app?state=%7B%22ids%22:%5B%221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%22%5D,%22action%22:%22open%22,%22resourceKeys%22:%7B%7D%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.167.207 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: ww-in-f207.1e100.net
Software: UploadServer /
Resource Hash: f021848a846c74438092d280daa4bd2fbf31da24198db5940a8314898bdfc296

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 11:17:12 GMT
age: 3144
x-guploader-uploadid: ADPycdt1UsxMWBm6JMnYJ8hOw2ChqT8N91aamUM3FZdWNIevSyGZ9DRQDcYLXySuM22_eGC5en5CyU4ChzIgsKxulK3aIwuoy_AB
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2652
last-modified: Thu, 19 Oct 2023 11:15:11 GMT
server: UploadServer
etag: "aa9a8313552d27362417cdff6cbd47f6"
x-goog-generation: 1696975212011884
x-goog-hash: crc32c=vixfVA==, md5=qpqDE1UtJzYkF83/bL1H9g==
content-type: text/javascript
cache-control: public, max-age=3600
x-goog-stored-content-length: 2652
accept-ranges: bytes
expires: Thu, 19 Oct 2023 12:17:12 GMT

GET
H2 200 application-8ac8a8e77829523edc80484f0aaae715f1532137.css
anyfile-notepad.semaan.ca/assets/ 345 KB
345 KB 745ms
745ms Stylesheet
text/css 172.105.61.58
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://anyfile-notepad.semaan.ca/assets/application-8ac8a8e77829523edc80484f0aaae715f1532137.css
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app?state=%7B%22ids%22:%5B%221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%22%5D,%22action%22:%22open%22,%22resourceKeys%22:%7B%7D%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.105.61.58 Mumbai, India, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS: 172-105-61-58.ip.linodeusercontent.com
Software: Caddy /
Resource Hash: 33793536c303f159d303681369bde4cbab1962beacc194b0c5fda6aa9d9fe20e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/app?state=%7B%22ids%22:%5B%221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%22%5D,%22action%22:%22open%22,%22resourceKeys%22:%7B%7D%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:37 GMT
x-afn-server: afn-srv-v2-mum-1
x-afn-frontend-version: 2
last-modified: Sun, 30 Jul 2023 00:52:32 GMT
server: Caddy
content-type: text/css; charset=utf-8
access-control-allow-origin: *
accept-ranges: bytes
content-length: 353515

GET
H2 200 infolinks_main.js Show response
resources.infolinks.com/js/ 4 KB
3 KB 74ms
31ms Script
application/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/js/infolinks_main.js
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app?state=%7B%22ids%22:%5B%221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%22%5D,%22action%22:%22open%22,%22resourceKeys%22:%7B%7D%7D
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aff60969fbd47a49be574a38293199b1d62ff72585aef80c2c0a37a7abc0871a

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:37 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 18 Oct 2023 12:58:26 GMT
server: cloudflare
age: 11453
etag: W/"1057-607fd31f12e24"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=3600
cf-ray: 8188e9c90bdda252-YYZ
expires: Thu, 19 Oct 2023 09:58:44 GMT

GET
H2 200 client.js Show response
apis.google.com/js/ 18 KB
8 KB 119ms
46ms Script
text/javascript 142.250.31.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/client.js?onload=gapi_loaded

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.31.100 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d9139d893d8ce76cd9f7b387262a669ced0270373637ba947037c770faef910d

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 19 Oct 2023 12:09:37 GMT
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7116
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="gapi-team"
etag: "a00202bbb14b751a"
vary: Accept-Encoding
report-to: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 19 Oct 2023 12:09:37 GMT

GET
H2 200 client Show response
accounts.google.com/gsi/ 198 KB
78 KB 127ms
55ms Script
application/javascript 142.251.163.84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/gsi/client

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f84.1e100.net

Software

ESF /

Resource Hash

9e2f846373e176d51985706216dce7e367b6007e6e61f8b4a898e8c9cf87b4d5

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-KEL8mvFIbNXlm1BLM1r_YQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:38 GMT
content-security-policy: script-src 'report-sample' 'nonce-KEL8mvFIbNXlm1BLM1r_YQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
report-to: {"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]}
content-type: application/javascript; charset=utf-8
cache-control: private, max-age=1800
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1"
expires: Thu, 19 Oct 2023 12:09:38 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 108ms
35ms Script
text/javascript 142.251.16.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f138.1e100.net

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 19 Oct 2023 10:26:14 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 6204
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Thu, 19 Oct 2023 12:26:14 GMT

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310160101/ 421 KB
132 KB 110ms
36ms Script
text/javascript 142.251.16.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310160101/pubads_impl.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0e2f8c21cbfea3e52e2b6b9f3783656232fb21e92f5c665e882887f0b547639c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Thu, 19 Oct 2023 11:26:21 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2597
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 135102
x-xss-protection: 0
server: cafe
etag: 524636607866283267
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Fri, 18 Oct 2024 11:26:21 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 15 B
227 B 43ms
42ms XHR
text/plain 142.251.16.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=661521544&t=pageview&_s=1&dl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%3D%257B%2522ids%2522%3A%255B%25221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%2522%255D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%257B%257D%257D&ul=en-us&de=UTF-8&dt=Anyfile%20Notepad&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAACAAI~&jid=1925081392&gjid=1338568500&cid=709084694.1697717379&tid=UA-69003440-1&_gid=1232533905.1697717379&_r=1&_slc=1&z=1783667819

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f138.1e100.net

Software

Golfe2 /

Resource Hash

a59d6fec09f986c957c8192fbd71a84cc53315793fb9cde7de010e6a0cfccaea

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:38 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://anyfile-notepad.semaan.ca
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 227 KB
81 KB 123ms
52ms Script
application/javascript 172.253.63.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-3VRGCWTSLB&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

87eeec60b9a40d580e36f032e076dd35f160d44cb7d4168a886333350368e085

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:39 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 83003
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 19 Oct 2023 12:09:39 GMT

POST
H2 200 / Show response
prebid.admedia.com/bidder/ 322 B
327 B 128ms
36ms XHR
application/json 173.198.200.125
TURNKEY-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.admedia.com/bidder/
Requested by: Host: storage.googleapis.com
URL: https://storage.googleapis.com/dbmtiqbxqoopp7t3s9lq/sdbmtiqbxqoopp7t3s9lq.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.198.200.125 Latham, United States, ASN40244 (TURNKEY-INTERNET, US),
Reverse DNS: 173-198-200-125.static.as40244.net
Software: nginx /
Resource Hash: a1e50719a968ea53edbc079f52b7c11dd246df4313372fd7a584d50bc04a568c

Request headers

Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:39 GMT
content-encoding: gzip
server: nginx
content-type: application/json; charset=utf-8
access-control-allow-origin: https://anyfile-notepad.semaan.ca
cache-control: no-cache, no-store, private
access-control-allow-credentials: true
expires: 0

POST
H/1.1 200
OK prebid Show response
lockerdome.com/ladbid/ 11 B
345 B 207ms
52ms XHR
application/json 104.154.142.214
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://lockerdome.com/ladbid/prebid
Requested by: Host: storage.googleapis.com
URL: https://storage.googleapis.com/dbmtiqbxqoopp7t3s9lq/sdbmtiqbxqoopp7t3s9lq.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.154.142.214 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 214.142.154.104.bc.googleusercontent.com
Software: /
Resource Hash: 846949c5a40e3ffbb702473e54dfac0646541aa624a844369b6e24e51ddaf96b

Request headers

Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://anyfile-notepad.semaan.ca
Date: Thu, 19 Oct 2023 12:09:39 GMT
Cache-Control: no-cache, max-age=0, must-revalidate, no-store
Access-Control-Allow-Credentials: true
Content-Encoding: gzip
Content-Length: 31
Content-Type: application/json; charset=utf-8

POST
H2 204 ortb Show response
bid.contextweb.com/header/ 0
203 B 91ms
31ms XHR
text/plain 198.148.27.131
PULSEPOINT

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.contextweb.com/header/ortb?src=prebid

Requested by

Host: storage.googleapis.com
URL: https://storage.googleapis.com/dbmtiqbxqoopp7t3s9lq/sdbmtiqbxqoopp7t3s9lq.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

198.148.27.131 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://anyfile-notepad.semaan.ca
access-control-expose-headers: Access-Control-Allow-Origin
strict-transport-security: max-age=15768000
access-control-allow-credentials: true
x-no-bid-reason: Passback by decision

GET
H2 200 ice.js Show response
resources.infolinks.com/js/1891.003-3.027/ 187 KB
57 KB 34ms
34ms Script
application/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/js/1891.003-3.027/ice.js
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app?state=%7B%22ids%22:%5B%221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%22%5D,%22action%22:%22open%22,%22resourceKeys%22:%7B%7D%7D
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d6a76baa0441e916618e699391d04b711145a4826c478ff40934a0de12235285

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:39 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 11 Oct 2023 08:21:11 GMT
server: cloudflare
age: 6606
etag: W/"2ede2-6076c818dea10"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 8188e9d34deaa252-YYZ
expires: Sat, 18 Nov 2023 10:19:33 GMT

POST
H2 200 stats Show response
api.anyfile-notepad.semaan.ca/ 2 B
235 B 229ms
19ms XHR
text/plain 159.89.121.194
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://api.anyfile-notepad.semaan.ca/stats
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/assets/application-8ac8a8e77829523edc80484f0aaae715f1532137.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 159.89.121.194 Toronto, Canada, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: srv.semaan.ca
Software: Caddy, Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 mod_wsgi/3.4 Python/2.7.5 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Accept: */*
Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 19 Oct 2023 12:09:39 GMT
server: Caddy, Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 mod_wsgi/3.4 Python/2.7.5
access-control-allow-headers: Content-Type, Authorization
content-length: 2
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/plain; charset=utf-8

GET
H2 200 Lato-Regular.ttf
anyfile-notepad.semaan.ca/fonts/ 593 KB
594 KB 266ms
266ms Font
font/ttf 172.105.61.58
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://anyfile-notepad.semaan.ca/fonts/Lato-Regular.ttf
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/assets/application-8ac8a8e77829523edc80484f0aaae715f1532137.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.105.61.58 Mumbai, India, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS: 172-105-61-58.ip.linodeusercontent.com
Software: Caddy /
Resource Hash: 089ab6d4a57e0e6c4dd3b681b6fd50a5184f1b902429d35e1227e52d6ccad1bd

Request headers

Referer: https://anyfile-notepad.semaan.ca/assets/application-8ac8a8e77829523edc80484f0aaae715f1532137.min.css
Origin: https://anyfile-notepad.semaan.ca
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:39 GMT
x-afn-server: afn-srv-v2-mum-1
x-afn-frontend-version: 2
last-modified: Sun, 30 Jul 2023 00:52:32 GMT
server: Caddy
content-type: font/ttf
access-control-allow-origin: *
accept-ranges: bytes
content-length: 607720

GET
H2 200 Material-Design-Icons.woff
anyfile-notepad.semaan.ca/fonts/ 100 KB
100 KB 275ms
275ms Font
font/woff 172.105.61.58
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://anyfile-notepad.semaan.ca/fonts/Material-Design-Icons.woff?3ocs8m
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/assets/application-8ac8a8e77829523edc80484f0aaae715f1532137.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.105.61.58 Mumbai, India, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS: 172-105-61-58.ip.linodeusercontent.com
Software: Caddy /
Resource Hash: be00e19b662046cb8f2eb6eb86e4689edeefb0c003f6a215df9c22f0e15e16ad

Request headers

Referer: https://anyfile-notepad.semaan.ca/assets/application-8ac8a8e77829523edc80484f0aaae715f1532137.min.css
Origin: https://anyfile-notepad.semaan.ca
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:39 GMT
x-afn-server: afn-srv-v2-mum-1
x-afn-frontend-version: 2
last-modified: Sun, 30 Jul 2023 00:52:32 GMT
server: Caddy
content-type: font/woff
access-control-allow-origin: *
accept-ranges: bytes
content-length: 101968

GET
H2 200 logo.png
anyfile-notepad.semaan.ca/ 6 KB
6 KB 268ms
268ms Image
image/png 172.105.61.58
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://anyfile-notepad.semaan.ca/logo.png
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app?state=%7B%22ids%22:%5B%221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%22%5D,%22action%22:%22open%22,%22resourceKeys%22:%7B%7D%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.105.61.58 Mumbai, India, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS: 172-105-61-58.ip.linodeusercontent.com
Software: Caddy /
Resource Hash: bfb6a8799c9f3a60f0a04e2cc9c1d9df6c591708ae4aaa3eda711fcde2d31df9

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/app?state=%7B%22ids%22:%5B%221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%22%5D,%22action%22:%22open%22,%22resourceKeys%22:%7B%7D%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:39 GMT
x-afn-server: afn-srv-v2-mum-1
x-afn-frontend-version: 2
last-modified: Sun, 30 Jul 2023 00:52:32 GMT
server: Caddy
content-type: image/png
access-control-allow-origin: *
accept-ranges: bytes
content-length: 6277

GET
H2 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.AOzoyjtjrhQ.O/m=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA/ 316 KB
108 KB 37ms
36ms Script
text/javascript 142.250.31.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.AOzoyjtjrhQ.O/m=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA/cb=gapi.loaded_0?le=scs

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/client.js?onload=gapi_loaded

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.31.100 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3253ebd8d1a3c41f020b8e18e84bf61b96b0c1bba646b047fa90d87e72438371

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Sat, 14 Oct 2023 11:10:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 435578
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 110396
x-xss-protection: 0
last-modified: Tue, 03 Oct 2023 15:22:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
vary: Accept-Encoding
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 13 Oct 2024 11:10:01 GMT

GET
H2 200 manage Show response
router.infolinks.com/usync/ Frame DDFC 11 KB
2 KB 57ms
51ms Document
text/html 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%3D%257B%2522ids%2522%3A%255B%25221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%2522%255D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%257B%257D%257D
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1891.003-3.027/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 599e14f08de5d26a2891127ee3bfa4c37db92590a3fdcd7da860dee4e4250d44

Request headers

Referer: https://anyfile-notepad.semaan.ca/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store
cf-cache-status: DYNAMIC
cf-ray: 8188e9d44eada252-YYZ
content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Thu, 19 Oct 2023 12:09:39 GMT
p3p: CP="NON DSP NID OUR COR"
server: cloudflare
via: 1.1 google

GET
H2 200 lcmanage Show response
router.infolinks.com/usync/ 282 B
303 B 55ms
54ms Script
application/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://router.infolinks.com/usync/lcmanage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%3D%257B%2522ids%2522%3A%255B%25221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%2522%255D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%257B%257D%257D
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1891.003-3.027/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fbcde12e694b62b7f7224d04b8b07fd0a4c8331b642e2119efa976ae6eacd74f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:39 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
content-type: application/javascript;charset=ISO-8859-1
p3p: CP="NON DSP NID OUR COR"
cache-control: no-store
cf-ray: 8188e9d44eafa252-YYZ

GET
H2 200 gsd Show response
router.infolinks.com/ 319 B
486 B 54ms
54ms Script
text/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://router.infolinks.com/gsd?evt=afterGSD&pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%3D%257B%2522ids%2522%3A%255B%25221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%2522%255D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%257B%257D%257D&jsv=1891.003-3.027&_cb=16977173792340
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1891.003-3.027/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8e2c3010105c04d9e1e23eadbfc1cd953ba96b1665a5537fcf54e17c5df83605

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:39 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
content-type: text/javascript;charset=UTF-8
p3p: CP="NON DSP NID OUR COR"
cache-control: max-age=0
cf-ray: 8188e9d44eb0a252-YYZ
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H3 204 collect
www.google-analytics.com/g/ 0
17 B 43ms
42ms Ping
text/plain 142.251.16.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-3VRGCWTSLB&gtm=45je3ai0&_p=661521544&ul=en-us&sr=1600x1200&cid=709084694.1697717379&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EBAI&_s=1&dl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%3D%257B%2522ids%2522%3A%255B%25221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%2522%255D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%257B%257D%257D&dt=Anyfile%20Notepad&sid=1697717379&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-3VRGCWTSLB&cx=c&_slc=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.16.138 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bl-in-f138.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:39 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://anyfile-notepad.semaan.ca
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 905 B
918 B 243ms
242ms Fetch
text/plain 142.251.16.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=503274487368582&correlator=4099483942163932&output=ldjh&gdfp_req=1&vrg=202310160101&ptt=17&impl=fif&iu_parts=61772569%2Cdbmtiqbxqoopp7t3s9lq_anyfilenotepadsemaanca_160x600_1&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=1&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1697717379288&lmt=1690703552&adxs=1440&adys=65&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&url=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%3D%257B%2522ids%2522%3A%255B%25221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%2522%255D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%257B%257D%257D&vis=1&psz=0x-1&msz=160x-1&fws=644&ohw=1600&ga_vid=709084694.1697717379&ga_sid=1697717379&ga_hid=661521544&ga_fc=true&dlt=1697717376896&idt=2133&adks=450036033&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310160101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f3f2c187f6d7ba52026a54d9641f8ab3055229562aec790d67a852fbd277e6a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:39 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 520
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://anyfile-notepad.semaan.ca
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
e9e1034672e29623cab2e72c8e5f2c3a.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame D1BC 6 KB
3 KB 118ms
40ms Document
text/html 172.253.62.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://e9e1034672e29623cab2e72c8e5f2c3a.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202310160101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f132.1e100.net

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://anyfile-notepad.semaan.ca/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 19 Oct 2023 12:09:39 GMT
expires: Fri, 18 Oct 2024 12:09:39 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 proxy.html Show response
content.googleapis.com/static/ Frame 849E 382 B
908 B 48ms
44ms Document
text/html 172.253.63.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://content.googleapis.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.AOzoyjtjrhQ.O%2Fd%3D1%2Frs%3DAHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA%2Fm%3D__features__

Requested by

Host: apis.google.com
URL: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.AOzoyjtjrhQ.O/m=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA/cb=gapi.loaded_0?le=scs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de56c469fb6e9940f128ce2f16d348b5807477e0456217dfa6451f6f849b03ef

Security Headers

Name	Value
Content-Security-Policy	script-src 'nonce-cf62Tl8qJUAM2dXpO9dvYw' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/apiserving; base-uri 'none' require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apiserving
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://anyfile-notepad.semaan.ca/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: gzip
content-length: 274
content-security-policy: script-src 'nonce-cf62Tl8qJUAM2dXpO9dvYw' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/apiserving; base-uri 'none' require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apiserving
content-type: text/html
cross-origin-embedder-policy: require-corp; report-to="apiserving"
cross-origin-opener-policy-report-only: same-origin; report-to="apiserving"
cross-origin-resource-policy: cross-origin
date: Thu, 19 Oct 2023 12:09:39 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
last-modified: Fri, 30 Jun 2023 18:58:00 GMT
pragma: no-cache
report-to: {"group":"apiserving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apiserving"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

/ Show response
hde.tynt.com/deb/ Frame 890B
Redirect Chain

https://de.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV
https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1

1 KB
2 KB

32ms
31ms

Document
text/html

67.202.105.34
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%3D%257B%2522ids%2522%3A%255B%25221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%2522%255D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%257B%257D%257D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.34 , United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip34.67-202-105.static.steadfastdns.net
Software: /
Resource Hash: 39407402c624739e6e830b12138391fcc5b9df425b37d673c07cdc1ecbb47d5b

Request headers

Referer: https://router.infolinks.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Model, Sec-CH-UA-Full-Version-List, Sec-CH-UA, Sec-CH-UA-Mobile
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
content-length: 1403
content-type: text/html
date: Thu, 19 Oct 2023 12:09:39 GMT
expires: Sat, 26 Jul 1997 05:00:00 GMT
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
referrer-policy: unsafe-url

Redirect headers

accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Model, Sec-CH-UA-Full-Version-List, Sec-CH-UA, Sec-CH-UA-Mobile
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
content-length: 0
date: Thu, 19 Oct 2023 12:09:39 GMT
expires: Sat, 26 Jul 1997 05:00:00 GMT
location: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
referrer-policy: unsafe-url

GET
H2

200

usermatch Show response
ssum-sec.casalemedia.com/ Frame FFDB
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1

2 KB
958 B

48ms
47ms

Document
text/html

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%3D%257B%2522ids%2522%3A%255B%25221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%2522%255D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%257B%257D%257D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5027dd1aa8f32a38827ca8c595aa9f3ca58350c1bbeb9751f476da0345d37aa5

Request headers

Referer: https://router.infolinks.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 8188e9d5d815a1e4-YYZ
content-encoding: br
content-type: text/html
date: Thu, 19 Oct 2023 12:09:39 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Bbr1Up18LQpNnlzJWhgI8XJb9lj0OvOCpBHvioA6Bn9nlpOli7Mn2n9%2BoBJ97s2lEbf47q%2FZYbpD3A3lgYS9Cu1S%2FISgqsyeHyYWllPodcOQqaQuOKMFDcZN5xrgG4hyZ5EvLCqJ8ZDBAg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 8188e9d58fa6a1e4-YYZ
content-length: 0
date: Thu, 19 Oct 2023 12:09:39 GMT
expires: 0
location: /usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T01My96mgFK1go2kcs7u6Yet91r7foMRm6hwxYHhIi%2BqhshEo7per8eJjeHBtVYGRmpllbs%2BnfMwriuyJh0ELZyVCTqDeNe3wOfyWngD84aLYAa1EQ6npszy0qnVjLiqBF9MYNwwPCqr5w%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame 488B 4 KB
2 KB 123ms
35ms Document
text/html 51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Requested by

Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%3D%257B%2522ids%2522%3A%255B%25221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%2522%255D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%257B%257D%257D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

1029869c89ec7bc8f7cb987dc602f1d0a40150b80a13e71792a110daf33bdad2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://router.infolinks.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 1408
content-type: text/html
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
strict-transport-security: max-age=15552000

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame DDFC
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=156872&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156872%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infoli...
https://image8.pubmatic.com/AdServer/ImgSync?p=156872&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156872%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infoli...
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=Q0ZGQUVEQTYtN0YxMi00RDM2LTlDQzUtQUY0NDE2MzlEMjI5&gdpr=-1&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=Q0ZGQUVEQTYtN0YxMi00RDM2LTlDQzUtQUY0NDE2MzlEMjI5&gdpr=-1&gdpr_consent=&google_tc=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=-1&gdpr_consent=
https://image8.pubmatic.com/AdServer/ImgSync?sec=1&gdpr=0&gdpr_consent=&us_privacy=${US_PRIVACY}
https://image4.pubmatic.com/AdServer/SPug?gdpr=0&p=156872&pmc=1&pr=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fpbm-usync%3Fuid%3DCFFAEDA6-7F12-4D36-9CC5-AF441639D229&us_privacy=%24%7BUS_PRIVACY%7D
https://router.infolinks.com/dyn/pbm-usync?uid=CFFAEDA6-7F12-4D36-9CC5-AF441639D229
https://pixel.tapad.com/idsync/ex/receive?partner_id=3356&partner_device_id=CFFAEDA6-7F12-4D36-9CC5-AF441639D229
https://secure.adnxs.com/getuid?https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DAPPNEXUS%26partner_device_id%3D%24UID%26pt%3Df581ea5d-a018-40b0-b6a3-b8c6fd92e17f%252C%252C
https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=7428532414938068229&pt=f581ea5d-a018-40b0-b6a3-b8c6fd92e17f%2C%2C

95 B
124 B

54ms
54ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=7428532414938068229&pt=f581ea5d-a018-40b0-b6a3-b8c6fd92e17f%2C%2C

Requested by

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:42 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:42 GMT
an-x-request-uuid: 336af922-61ac-4d43-ab8e-0cf200ab51c7
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://pixel.tapad.com/idsync/ex/receive?partner_id=APPNEXUS&partner_device_id=7428532414938068229&pt=f581ea5d-a018-40b0-b6a3-b8c6fd92e17f%2C%2C
x-proxy-origin: 37.19.212.193; 37.19.212.193; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

apn-usync
router.infolinks.com/dyn/ Frame DDFC
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fapn-usync%3Fuser_id%3D%24UID
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Frouter.infolinks.com%252Fdyn%252Fapn-usync%253Fuser_id%253D%2524UID
https://router.infolinks.com/dyn/apn-usync?user_id=7428532414938068229

35 B
209 B

52ms
51ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/apn-usync?user_id=7428532414938068229
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%3D%257B%2522ids%2522%3A%255B%25221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%2522%255D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%257B%257D%257D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:39 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 8188e9d64888a252-YYZ
content-length: 35
expires: Wed, 19 Oct 2022 12:09:39 GMT

Redirect headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:39 GMT
an-x-request-uuid: 1ce612fc-bfb5-44e0-aff7-6e958bb7e0cf
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://router.infolinks.com/dyn/apn-usync?user_id=7428532414938068229
x-proxy-origin: 37.19.212.193; 37.19.212.193; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

iqm-us
router.infolinks.com/dyn/ Frame DDFC
Redirect Chain

https://pxl.iqm.com/i/ck/infolink?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fiqm-us%3Fuid%3D%7BIQM_COOKIE%7D%20
https://router.infolinks.com/dyn/iqm-us?uid=f1632635-05e4-4361-be2a-9d97296c765d

35 B
193 B

55ms
55ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/iqm-us?uid=f1632635-05e4-4361-be2a-9d97296c765d
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%3D%257B%2522ids%2522%3A%255B%25221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%2522%255D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%257B%257D%257D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:39 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 8188e9d6084aa252-YYZ
content-length: 35
expires: Wed, 19 Oct 2022 12:09:39 GMT

Redirect headers

date: Thu, 19 Oct 2023 12:09:39 GMT
server: nginx
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/avif;charset=UTF-8
location: https://router.infolinks.com/dyn/iqm-us?uid=f1632635-05e4-4361-be2a-9d97296c765d
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 81

GET
H2

200

eqv-us
router.infolinks.com/dyn/ Frame DDFC
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=112&gdpr=0&gdpr_consent=
https://router.infolinks.com/dyn/eqv-us?user_id=6754517263874570649&gdpr=0&gdpr_consent=

35 B
187 B

50ms
48ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/eqv-us?user_id=6754517263874570649&gdpr=0&gdpr_consent=
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%3D%257B%2522ids%2522%3A%255B%25221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%2522%255D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%257B%257D%257D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:39 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 8188e9d60846a252-YYZ
content-length: 35
expires: Wed, 19 Oct 2022 12:09:39 GMT

Redirect headers

location: https://router.infolinks.com/dyn/eqv-us?user_id=6754517263874570649&gdpr=0&gdpr_consent=
date: Thu, 19 Oct 2023 12:09:39 GMT
content-length: 0

GET
H2

200

ox-usync
router.infolinks.com/dyn/ Frame DDFC
Redirect Chain

https://u.openx.net/w/1.0/cm?id=9b5994f2-035d-46de-8c12-bc0e9a4e66c2&r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fox-usync%3Fuid%3D
https://u.openx.net/w/1.0/cm?cc=1&id=9b5994f2-035d-46de-8c12-bc0e9a4e66c2&r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fox-usync%3Fuid%3D
https://router.infolinks.com/dyn/ox-usync?uid=fe8009b7-77f2-4fba-a3a1-d8c9e3dd65dc

35 B
207 B

53ms
51ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/ox-usync?uid=fe8009b7-77f2-4fba-a3a1-d8c9e3dd65dc
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%3D%257B%2522ids%2522%3A%255B%25221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%2522%255D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%257B%257D%257D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:39 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 8188e9d64884a252-YYZ
content-length: 35
expires: Wed, 19 Oct 2022 12:09:39 GMT

Redirect headers

date: Thu, 19 Oct 2023 12:09:39 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://router.infolinks.com/dyn/ox-usync?uid=fe8009b7-77f2-4fba-a3a1-d8c9e3dd65dc
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame DDFC
Redirect Chain

https://ups.analytics.yahoo.com/ups/58786/sync?redir=true
https://ups.analytics.yahoo.com/ups/58786/sync?redir=true&verify=true
https://router.infolinks.com/dyn/VR-usync?uid=y-sbU1rSNE2uJ9pxNOV9zATFO5si6qykdL~A
https://pixel.tapad.com/idsync/ex/receive?partner_id=3399&partner_device_id=y-sbU1rSNE2uJ9pxNOV9zATFO5si6qykdL~A
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3399&partner_device_id=y-sbU1rSNE2uJ9pxNOV9zATFO5si6qykdL~A
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=0fcbe503-4fc9-4082-9691-eef2afb3484b%252C%252C&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=9279c2c7-0a3c-4984-9085-399d8dc48589&ttd_puid=0fcbe503-4fc9-4082-9691-eef2afb3484b%2C%2C

95 B
124 B

54ms
54ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=9279c2c7-0a3c-4984-9085-399d8dc48589&ttd_puid=0fcbe503-4fc9-4082-9691-eef2afb3484b%2C%2C

Requested by

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:39 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

location: https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=9279c2c7-0a3c-4984-9085-399d8dc48589&ttd_puid=0fcbe503-4fc9-4082-9691-eef2afb3484b%2C%2C
date: Thu, 19 Oct 2023 12:09:39 GMT
server: Kestrel
content-length: 359

GET
H2

200

ur-usync
router.infolinks.com/dyn/ Frame DDFC
Redirect Chain

https://sync.1rx.io/usersync2/infolinks
https://sync.1rx.io/usersync2/infolinks?zcc=1&cb=1697717379495
https://ad.turn.com/r/cs?pid=45&rndcb=50743587
https://sync.1rx.io/usersync/turn/7435067569187583797?dspret=1&gdpr=&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-90874fed-f4f7-4b12-98dd-9e7fadb77b42-005?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fur-usync%3Fuid%3DRX-90874fed-f4f7-4b12-98dd-9e7fadb77b42-005
https://router.infolinks.com/dyn/ur-usync?uid=RX-90874fed-f4f7-4b12-98dd-9e7fadb77b42-005

35 B
92 B

49ms
49ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/ur-usync?uid=RX-90874fed-f4f7-4b12-98dd-9e7fadb77b42-005
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%3D%257B%2522ids%2522%3A%255B%25221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%2522%255D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%257B%257D%257D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:43 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 8188e9eeee09a252-YYZ
content-length: 35
expires: Wed, 19 Oct 2022 12:09:43 GMT

Redirect headers

Date: Thu, 19 Oct 2023 12:09:43 GMT
Server: Tengine
ETag: RX90874fedf4f74b1298dd9e7fadb77b42005
Transfer-Encoding: chunked
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location: https://router.infolinks.com/dyn/ur-usync?uid=RX-90874fed-f4f7-4b12-98dd-9e7fadb77b42-005
Content-Type: text/html
Connection: keep-alive

GET
H2

200

zmn-usync
router.infolinks.com/dyn/ Frame DDFC
Redirect Chain

https://b1sync.zemanta.com/usersync/infolinks/?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fzmn-usync%3Fuid%3D__ZUID__
https://b1sync.zemanta.com/usersync/infolinks/?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fzmn-usync%3Fuid%3D__ZUID__&s=2
https://router.infolinks.com/dyn/zmn-usync?uid=iM3sLYoKzkdGqBcqRC-P

35 B
230 B

57ms
57ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/zmn-usync?uid=iM3sLYoKzkdGqBcqRC-P
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%3D%257B%2522ids%2522%3A%255B%25221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%2522%255D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%257B%257D%257D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:39 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 8188e9d6589aa252-YYZ
content-length: 35
expires: Wed, 19 Oct 2022 12:09:39 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 19 Oct 2023 12:09:39 GMT
Content-Type: text/html; charset=utf-8
Location: https://router.infolinks.com/dyn/zmn-usync?uid=iM3sLYoKzkdGqBcqRC-P
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 90
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2

200

tplift
router.infolinks.com/dyn/ Frame DDFC
Redirect Chain

https://eb2.3lift.com/getuid?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Ftplift%3Fuid%3D%24UID
https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Ftplift%3Fuid%3D%24UID
https://router.infolinks.com/dyn/tplift?uid=1107753425527544185478

35 B
189 B

49ms
48ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/tplift?uid=1107753425527544185478
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%3D%257B%2522ids%2522%3A%255B%25221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%2522%255D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%257B%257D%257D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:39 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 8188e9d63876a252-YYZ
content-length: 35
expires: Wed, 19 Oct 2022 12:09:39 GMT

Redirect headers

location: https://router.infolinks.com/dyn/tplift?uid=1107753425527544185478
date: Thu, 19 Oct 2023 12:09:39 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

sonobi-usync
router.infolinks.com/dyn/ Frame DDFC
Redirect Chain

https://sync.go.sonobi.com/us?loc=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsonobi-usync%3Fuid%3D%5BUID%5D
https://router.infolinks.com/dyn/sonobi-usync?uid=137827e5-7fc6-4753-83a6-9934c50200aa

35 B
257 B

49ms
48ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/sonobi-usync?uid=137827e5-7fc6-4753-83a6-9934c50200aa
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%3D%257B%2522ids%2522%3A%255B%25221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%2522%255D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%257B%257D%257D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:39 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 8188e9d5f83da252-YYZ
content-length: 35
expires: Wed, 19 Oct 2022 12:09:39 GMT

Redirect headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:39 GMT
server: sonobi-go
vary: negotiate,Accept-Encoding
x-go-server: go-iad-2-6-72
content-type: text/plain; charset=utf8
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://router.infolinks.com/dyn/sonobi-usync?uid=137827e5-7fc6-4753-83a6-9934c50200aa
cache-control: no-cache, no-store, private
tcn: Choice
content-length: 0
x-xss-protection: 0
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

imd-usync
router.infolinks.com/dyn/ Frame DDFC
Redirect Chain

https://ad.360yield.com/server_match?r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fimd-usync%3Fuser_id%3D%7BPUB_USER_ID%7D%26partner_id%3D1531
https://ad.360yield.com/ul_cb/server_match?r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fimd-usync%3Fuser_id%3D%7BPUB_USER_ID%7D%26partner_id%3D1531
https://router.infolinks.com/dyn/imd-usync?user_id=94ed2471-7840-4ca7-bea4-19436155b50d&partner_id=1531

35 B
239 B

52ms
52ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/imd-usync?user_id=94ed2471-7840-4ca7-bea4-19436155b50d&partner_id=1531
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%3D%257B%2522ids%2522%3A%255B%25221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%2522%255D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%257B%257D%257D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:40 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 8188e9dd9ecda252-YYZ
content-length: 35
expires: Wed, 19 Oct 2022 12:09:40 GMT

Redirect headers

location: https://router.infolinks.com/dyn/imd-usync?user_id=94ed2471-7840-4ca7-bea4-19436155b50d&partner_id=1531
access-control-allow-origin: *
date: Thu, 19 Oct 2023 12:09:40 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2

200

outh-usync
router.infolinks.com/dyn/ Frame DDFC
Redirect Chain

https://pixel.advertising.com/ups/58237/sync?&gdpr=&gdpr_consent=&redir=true
https://ups.analytics.yahoo.com/ups/58237/sync?&gdpr=&gdpr_consent=&redir=true
https://router.infolinks.com/dyn/outh-usync?uid=y-IsZXJldE2uHjwgDta5DJpdCRay.nso8S~A

35 B
204 B

51ms
50ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/outh-usync?uid=y-IsZXJldE2uHjwgDta5DJpdCRay.nso8S~A
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%3D%257B%2522ids%2522%3A%255B%25221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%2522%255D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%257B%257D%257D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:39 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 8188e9d6d8eba252-YYZ
content-length: 35
expires: Wed, 19 Oct 2022 12:09:39 GMT

Redirect headers

location: https://router.infolinks.com/dyn/outh-usync?uid=y-IsZXJldE2uHjwgDta5DJpdCRay.nso8S~A
date: Thu, 19 Oct 2023 12:09:39 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.87
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

sovrn-usync
router.infolinks.com/dyn/ Frame DDFC
Redirect Chain

https://ap.lijit.com/pixel?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsovrn-usync%3Fuid%3D%24UID
https://ap.lijit.com/pixel?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsovrn-usync%3Fuid%3D%24UID&sovrn_retry=true
https://router.infolinks.com/dyn/sovrn-usync?uid=Hgw5ZLZHXQO-mdfKQ4qJKc71

35 B
203 B

51ms
50ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/sovrn-usync?uid=Hgw5ZLZHXQO-mdfKQ4qJKc71
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%3D%257B%2522ids%2522%3A%255B%25221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%2522%255D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%257B%257D%257D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:40 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 8188e9dd9eb8a252-YYZ
content-length: 35
expires: Wed, 19 Oct 2022 12:09:40 GMT

Redirect headers

Date: Thu, 19 Oct 2023 12:09:40 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://router.infolinks.com/dyn/sovrn-usync?uid=Hgw5ZLZHXQO-mdfKQ4qJKc71
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap1ewr1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H2

200

usersync
router.infolinks.com/dyn/ Frame DDFC
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=60809&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D60809%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infolink...
https://image4.pubmatic.com/AdServer/SPug?p=60809&pmc=1&pr=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fusersync%3Fpmuservalue%3DCFFAEDA6-7F12-4D36-9CC5-AF441639D229
https://router.infolinks.com/dyn/usersync?pmuservalue=CFFAEDA6-7F12-4D36-9CC5-AF441639D229

0
156 B

52ms
51ms

Image
text/plain

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/usersync?pmuservalue=CFFAEDA6-7F12-4D36-9CC5-AF441639D229
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%3D%257B%2522ids%2522%3A%255B%25221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%2522%255D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%257B%257D%257D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:42 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
cache-control: no-store
cf-ray: 8188e9e55e09a252-YYZ
content-length: 0

Redirect headers

location: https://router.infolinks.com/dyn/usersync?pmuservalue=CFFAEDA6-7F12-4D36-9CC5-AF441639D229
date: Thu, 19 Oct 2023 04:59:49 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

200

mnet-usync
router.infolinks.com/dyn/ Frame DDFC
Redirect Chain

https://cs.media.net/cksync?cs=41&ovsid=setstatuscode&type=inf&redirect=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fmnet-usync%3Fuid%3D%3Cvsid%3E
https://router.infolinks.com/dyn/mnet-usync?uid=3407189825664174000V10

35 B
190 B

54ms
53ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/mnet-usync?uid=3407189825664174000V10
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%3D%257B%2522ids%2522%3A%255B%25221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%2522%255D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%257B%257D%257D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:42 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 8188e9eaaa8ca252-YYZ
content-length: 35
expires: Wed, 19 Oct 2022 12:09:42 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 19 Oct 2023 12:09:42 GMT
Server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Location: https://router.infolinks.com/dyn/mnet-usync?uid=3407189825664174000V10
Content-Type: text/html
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 154
x-mnet-hl2: E
Expires: Thu, 19 Oct 2023 12:09:42 GMT

GET
H2

200

mgid-us
router.infolinks.com/dyn/ Frame DDFC
Redirect Chain

https://cm-x.mgid.com/5abf3d2eff2f70c0a0669cd9f0f84ba0.gif?puid=[UID]&redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fmgid-us%3Fuser_id%3D%5BUID%5D
https://router.infolinks.com/dyn/mgid-us?user_id=1e36fc8e-236c-4c05-a519-fefddb3446b0

35 B
200 B

51ms
50ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/mgid-us?user_id=1e36fc8e-236c-4c05-a519-fefddb3446b0
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%3D%257B%2522ids%2522%3A%255B%25221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%2522%255D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%257B%257D%257D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:40 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 8188e9ddef36a252-YYZ
content-length: 35
expires: Wed, 19 Oct 2022 12:09:40 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 19 Oct 2023 12:09:40 GMT
Transfer-Encoding: chunked
Location: https://router.infolinks.com/dyn/mgid-us?user_id=1e36fc8e-236c-4c05-a519-fefddb3446b0
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Keep-Alive: timeout=5
Expires: 0

GET
H2

200

ur-usync
router.infolinks.com/dyn/ Frame DDFC
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=infolinks
https://ad.turn.com/r/cs?pid=45&rndcb=7742077994
https://sync.1rx.io/usersync/turn/7218894787073799989?dspret=1&gdpr=&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-90874fed-f4f7-4b12-98dd-9e7fadb77b42-005?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fur-usync%3Fuid%3DRX-90874fed-f4f7-4b12-98dd-9e7fadb77b42-005
https://router.infolinks.com/dyn/ur-usync?uid=RX-90874fed-f4f7-4b12-98dd-9e7fadb77b42-005

35 B
259 B

55ms
54ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/ur-usync?uid=RX-90874fed-f4f7-4b12-98dd-9e7fadb77b42-005
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%3D%257B%2522ids%2522%3A%255B%25221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%2522%255D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%257B%257D%257D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:43 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 8188e9eebdd9a252-YYZ
content-length: 35
expires: Wed, 19 Oct 2022 12:09:43 GMT

Redirect headers

Date: Thu, 19 Oct 2023 12:09:43 GMT
Server: Tengine
ETag: RX90874fedf4f74b1298dd9e7fadb77b42005
Transfer-Encoding: chunked
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location: https://router.infolinks.com/dyn/ur-usync?uid=RX-90874fed-f4f7-4b12-98dd-9e7fadb77b42-005
Content-Type: text/html
Connection: keep-alive

GET
H2

200

qc-usync
router.infolinks.com/dyn/ Frame DDFC
Redirect Chain

https://cms.quantserve.com/pixel/p-u1vdacBMXAcfT.gif?idmatch=0
https://router.infolinks.com/dyn/qc-usync?gdpr=0&uid=xrTxoMHi-qfd46SllrjvoJK39PLdtPGjk7glT0QV

35 B
260 B

54ms
53ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/qc-usync?gdpr=0&uid=xrTxoMHi-qfd46SllrjvoJK39PLdtPGjk7glT0QV
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%3D%257B%2522ids%2522%3A%255B%25221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%2522%255D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%257B%257D%257D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:42 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 8188e9ea9a77a252-YYZ
content-length: 35
expires: Wed, 19 Oct 2022 12:09:42 GMT

Redirect headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:42 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://router.infolinks.com/dyn/qc-usync?gdpr=0&uid=xrTxoMHi-qfd46SllrjvoJK39PLdtPGjk7glT0QV
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

zeta-usync
router.infolinks.com/dyn/ Frame DDFC
Redirect Chain

https://p.rfihub.com/cm?pub=43153&in=1
https://router.infolinks.com/dyn/zeta-usync?uid=2810316566524960240

35 B
241 B

51ms
51ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/zeta-usync?uid=2810316566524960240
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%3D%257B%2522ids%2522%3A%255B%25221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%2522%255D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%257B%257D%257D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:39 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 8188e9d7a98ea252-YYZ
content-length: 35
expires: Wed, 19 Oct 2022 12:09:39 GMT

Redirect headers

Location: https://router.infolinks.com/dyn/zeta-usync?uid=2810316566524960240
Date: Thu, 19 Oct 2023 12:09:39 GMT
Server: Jetty(9.4.51.v20230217)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

disus
router.infolinks.com/dyn/ Frame DDFC
Redirect Chain

https://ssp.disqus.com/redirectuser?r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fdisus%3Fuid%3D%24UID&partner=infolinks
https://ib.adnxs.com/getuid?https://ssp.disqus.com/match?bidder=14&buyeruid=$UID&r=Cid1YS02NDBiZDJiYy04ZWIxLTM3NjEtOTQ3YS02MjhiOGIxNjhlNTEQ____________ASpSaHR0cHM6Ly9yb3V0ZXIuaW5mb2xpbmtzLmNvbS9keW...
https://ssp.disqus.com/match?bidder=14&buyeruid=7428532414938068229&r=Cid1YS02NDBiZDJiYy04ZWIxLTM3NjEtOTQ3YS02MjhiOGIxNjhlNTEQ____________ASpSaHR0cHM6Ly9yb3V0ZXIuaW5mb2xpbmtzLmNvbS9keW4vZGlzdXM_dWl...
https://ce.lijit.com/merge?pid=279534&3pid=ua-640bd2bc-8eb1-3761-947a-628b8b168e51&gdpr=&gdpr_consent=&us_privacy=&location=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D12%26buyeruid%3D%5BSOVRNI...
https://ce.lijit.com/merge?pid=279534&3pid=ua-640bd2bc-8eb1-3761-947a-628b8b168e51&gdpr=&gdpr_consent=&us_privacy=&location=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D12%26buyeruid%3D%5BSOVRNI...
https://ssp.disqus.com/match?bidder=12&buyeruid=Hgw5aRZHm2YnTrf_TF6MwyYR&r=Cid1YS02NDBiZDJiYy04ZWIxLTM3NjEtOTQ3YS02MjhiOGIxNjhlNTEQ____________ASpSaHR0cHM6Ly9yb3V0ZXIuaW5mb2xpbmtzLmNvbS9keW4vZGlzdX...
https://router.infolinks.com/dyn/disus?uid=ua-640bd2bc-8eb1-3761-947a-628b8b168e51

35 B
225 B

97ms
97ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/disus?uid=ua-640bd2bc-8eb1-3761-947a-628b8b168e51
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%3D%257B%2522ids%2522%3A%255B%25221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%2522%255D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%257B%257D%257D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:40 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 8188e9dbdd12a252-YYZ
content-length: 35
expires: Wed, 19 Oct 2022 12:09:40 GMT

Redirect headers

location: https://router.infolinks.com/dyn/disus?uid=ua-640bd2bc-8eb1-3761-947a-628b8b168e51
pragma: no-cache
date: Thu, 19 Oct 2023 12:09:40 GMT
cache-control: no-store
content-length: 0
expires: 0

GET
H2

200

33a-usync
router.infolinks.com/dyn/ Frame DDFC
Redirect Chain

https://ssc-cms.33across.com/ps/?ri=0010b00002CpYhEAAV&ru=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2F33a-usync%3Fuid%3D33XUSERID33X
https://router.infolinks.com/dyn/33a-usync?uid=212313561892033

35 B
184 B

52ms
52ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/33a-usync?uid=212313561892033
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%3D%257B%2522ids%2522%3A%255B%25221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%2522%255D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%257B%257D%257D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:39 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 8188e9d839f1a252-YYZ
content-length: 35
expires: Wed, 19 Oct 2022 12:09:39 GMT

Redirect headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:38 GMT
referrer-policy: unsafe-url
server: 33XP010
x-33x-status: 100000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://router.infolinks.com/dyn/33a-usync?uid=212313561892033
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

503

ProfilesEngineServlet
sync.intentiq.com/profiles_engine/ Frame DDFC
Redirect Chain

https://router.infolinks.com/dyn/iq-usync
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=1509139146&pcid=ffd41085-77f2-4d26-9987-042230561fb1&3rddpi=2023874098&3rdpcid=ZTEcgzJJDOr9MP44hO2bQAAA%263798&3rddpi...

0
0

36ms
35ms

Image
text/html

3.162.125.120
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=1509139146&pcid=ffd41085-77f2-4d26-9987-042230561fb1&3rddpi=2023874098&3rdpcid=ZTEcgzJJDOr9MP44hO2bQAAA%263798&3rddpi=1639354730&3rdpcid=y-IsZXJldE2uHjwgDta5DJpdCRay.nso8S%7EA&3rddpi=445262707&3rdpcid=BqS_njDJ2GmmdDG78iKAPuI5E9jH6CduiuiVHFe8K9s&3rddpi=1634346717&3rdpcid=iM3sLYoKzkdGqBcqRC-P&3rddpi=1177082855&3rdpcid=2810316566524960240&3rddpi=1213503647&3rdpcid=y-sbU1rSNE2uJ9pxNOV9zATFO5si6qykdL%7EA&3rddpi=1239766150&3rdpcid=fe8009b7-77f2-4fba-a3a1-d8c9e3dd65dc
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%3D%257B%2522ids%2522%3A%255B%25221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%2522%255D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%257B%257D%257D
Protocol: H2
Server: 3.162.125.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-162-125-120.iad61.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

Redirect headers

date: Thu, 19 Oct 2023 12:09:39 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
location: https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=1509139146&pcid=ffd41085-77f2-4d26-9987-042230561fb1&3rddpi=2023874098&3rdpcid=ZTEcgzJJDOr9MP44hO2bQAAA%263798&3rddpi=1639354730&3rdpcid=y-IsZXJldE2uHjwgDta5DJpdCRay.nso8S%7EA&3rddpi=445262707&3rdpcid=BqS_njDJ2GmmdDG78iKAPuI5E9jH6CduiuiVHFe8K9s&3rddpi=1634346717&3rdpcid=iM3sLYoKzkdGqBcqRC-P&3rddpi=1177082855&3rdpcid=2810316566524960240&3rddpi=1213503647&3rdpcid=y-sbU1rSNE2uJ9pxNOV9zATFO5si6qykdL%7EA&3rddpi=1239766150&3rdpcid=fe8009b7-77f2-4fba-a3a1-d8c9e3dd65dc
cache-control: no-store
cf-ray: 8188e9d839f0a252-YYZ
content-length: 0

GET
H2 200 iqusync-1.25.min.js Show response
resources.infolinks.com/static/usync/ 2 KB
1 KB 31ms
29ms Script
application/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/static/usync/iqusync-1.25.min.js
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/lcmanage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%3D%257B%2522ids%2522%3A%255B%25221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%2522%255D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%257B%257D%257D
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7e035885f253b73836d41088415cc8c467e43385ca3452b111431e6ab76f990b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:39 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 22 May 2023 09:55:02 GMT
server: cloudflare
age: 14294
etag: W/"8e7-5fc4543bc811d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 8188e9d54fb6a252-YYZ
expires: Sat, 18 Nov 2023 08:11:25 GMT

POST
H2 204 apiserving
csp.withgoogle.com/csp/ Frame 849E 0
0 133ms
59ms Other
text/html 142.251.16.141
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csp.withgoogle.com/csp/apiserving
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app?state=%7B%22ids%22:%5B%221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%22%5D,%22action%22:%22open%22,%22resourceKeys%22:%7B%7D%7D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.251.16.141 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bl-in-f141.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://content.googleapis.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
Content-Type: application/csp-report

Response headers

GET
H3 200 googleapis.proxy.js Show response
apis.google.com/js/ Frame 849E 18 KB
7 KB 45ms
44ms Script
text/javascript 142.250.31.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/googleapis.proxy.js?onload=startup

Requested by

Host: content.googleapis.com
URL: https://content.googleapis.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.AOzoyjtjrhQ.O%2Fd%3D1%2Frs%3DAHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA%2Fm%3D__features__

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.100 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f92e7baf6054ada951110842b4751571b3b16b43e826ff46eb36520f0294f59d

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://content.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 19 Oct 2023 12:09:39 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7117
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="gapi-team"
etag: "5f95998ecb7c0577"
vary: Accept-Encoding
report-to: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 19 Oct 2023 12:09:39 GMT

POST
H2 200 doq.htm Show response
rt3010.infolinks.com/action/ 2 KB
2 KB 176ms
128ms XHR
text/html 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rt3010.infolinks.com/action/doq.htm?pcode=utf-8&r=16977173794221
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1891.003-3.027/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 388fc5f9540abc2f4515a6299353470904fab9f7cc183a6dbe40d560398f22a1

Request headers

Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:39 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: text/html;charset=UTF-8
access-control-allow-origin: https://anyfile-notepad.semaan.ca
p3p: CP="NON DSP NID OUR COR"
cache-control: no-cache,no-store
access-control-allow-credentials: true
content-language: en-CA
cf-ray: 8188e9d5c93736b2-YYZ
x-application-context: application:prod
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 iquid.js Show response
resources.infolinks.com/static/ 54 KB
13 KB 30ms
29ms Script
application/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/static/iquid.js
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/usync/iqusync-1.25.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4c35a725ae1976af59c99556ad69e993dd9cf474033a75bb9406d59819d573d4

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:39 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 20 Mar 2023 11:30:07 GMT
server: cloudflare
age: 500
etag: W/"d8c3-5f7533fc75a6e"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 8188e9d59feba252-YYZ
expires: Sat, 18 Nov 2023 12:01:19 GMT

GET
H2 200 ima.js Show response
cdn-ima.33across.com/ 13 KB
4 KB 77ms
29ms Script
application/javascript 104.18.35.167
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-ima.33across.com/ima.js
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/usync/iqusync-1.25.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.35.167 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 71d6b578dd1b6ebb774c06c84953d0cbe8e1287eb2f8cfea0b63a56d538df956

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:39 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 18 Sep 2023 17:20:43 GMT
server: cloudflare
age: 238501
etag: W/"650886eb-3387"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 8188e9d5db8836c0-YYZ
expires: Sun, 22 Oct 2023 12:09:39 GMT

GET
H2 200 id5.js Show response
resources.infolinks.com/static/ 58 KB
17 KB 32ms
31ms Script
application/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/static/id5.js
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/usync/iqusync-1.25.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 05e77dab19940dd457e00282837faecc886434cc8cc5f631575a5e6c386de774

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:39 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Sun, 26 Mar 2023 15:25:02 GMT
server: cloudflare
age: 12315
etag: W/"e65f-5f7cf3aed6f0f"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 8188e9d59feda252-YYZ
expires: Sat, 18 Nov 2023 08:44:24 GMT

GET
H3 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.AOzoyjtjrhQ.O/m=googleapis_proxy/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA/ Frame 849E 77 KB
27 KB 39ms
37ms Script
text/javascript 142.250.31.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.AOzoyjtjrhQ.O/m=googleapis_proxy/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA/cb=gapi.loaded_0?le=scs

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/googleapis.proxy.js?onload=startup

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.100 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns31533571.ip-162-19-138.eu

Software

sffe /

Resource Hash

84b4d9bd7d1de7f01972743862afa12b6899d2015e89eebfb7cac12232611e5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://content.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Wed, 18 Oct 2023 00:32:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 128233
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27742
x-xss-protection: 0
last-modified: Tue, 03 Oct 2023 15:22:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
vary: Accept-Encoding
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 17 Oct 2024 00:32:26 GMT

GET
H2 200 ProfilesEngineServlet Show response
api.intentiq.com/profiles_engine/ 92 B
932 B 132ms
43ms XHR
text/html 108.138.64.123
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=39&mi=10&dpi=328512134&pt=17&dpn=1&jsver=5.36&iiqidtype=2&iiqpcid=61989954-917c-443c-aab0-c81b0b6d5d29&iiqpciddate=1697717379491&iiqcallcount=0&iiqfailcount=0&iiqnodata=false&iiqlocalstorageenabled=true&tsrnd=267_1697717379491&fbp=622056641&cttl=43200000&rrtt=0&dud=0&abtg=A&iiqppcc=0
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/iquid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.64.123 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-64-123.iad12.r.cloudfront.net
Software: Apache-Coyote/1.1 /
Resource Hash: 290e0b2a0facf520e51e57ad7f3a6f2f577206473aaa35ce9bd302d6a143fc4b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:39 GMT
via: 1.1 d125bf8405e840aa51a88ae3d8d91fb2.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD12-P1
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
patent: https://www.almondnet.com/ip
alt-svc: h3=":443"; ma=86400
pragma: no-cache
server: Apache-Coyote/1.1
vary: Origin
access-control-allow-methods: POST, GET
content-type: text/html
access-control-allow-origin: https://anyfile-notepad.semaan.ca
access-control-max-age: 3600
access-control-allow-credentials: true
cache-control: no-cache, no-store, must-revalidate
access-control-allow-headers: Content-Type, Accept, X-Requested-With, remember-me
x-amz-cf-id: nIUFHSYGeChNgQyFIyHg3ydnjrCQHCWGKsVObpZ-esfMJRkO-yNaVg==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

ProfilesEngineServlet
sync1.intentiq.com/profiles_engine/
Redirect Chain

https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&secure=1&dpi=328512134&rnd=355328&iiqidtype=2&iiqpcid=61989954-917c-443c-aab0-c81b0b6d5d29&iiqpciddate=1697717379491&tsrn...
https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&secure=1&dpi=328512134&rnd=355328&iiqidtype=2&iiqpcid=61989954-917c-443c-aab0-c81b0b6d5d29&iiqpciddate=1697717379491&tsr...

43 B
956 B

52ms
46ms

Image
image/gif

3.162.125.120
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&secure=1&dpi=328512134&rnd=355328&iiqidtype=2&iiqpcid=61989954-917c-443c-aab0-c81b0b6d5d29&iiqpciddate=1697717379491&tsrnd=667_1697717379492&fbp=622056641&jsver=5.36&abtp=100&abtg=A&ckls=true&ci=51XXytlHbB&nc=false&trid=-175836287
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app?state=%7B%22ids%22:%5B%221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%22%5D,%22action%22:%22open%22,%22resourceKeys%22:%7B%7D%7D
Protocol: H2
Server: 3.162.125.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-162-125-120.iad61.r.cloudfront.net
Software: Apache-Coyote/1.1 /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:39 GMT
via: 1.1 cfbbd45bc29ebb0e8475ffa26dff7618.cloudfront.net (CloudFront)
server: Apache-Coyote/1.1
x-amz-cf-pop: IAD61-P3
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=86400
content-length: 43
x-amz-cf-id: TXoolPW39-pUKgsorVN05vI2xSfiyz6pjiI4yD-TXmoRw6OvbRTMuQ==
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:39 GMT
via: 1.1 cfbbd45bc29ebb0e8475ffa26dff7618.cloudfront.net (CloudFront)
server: Apache-Coyote/1.1
x-amz-cf-pop: IAD61-P3
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
location: https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&secure=1&dpi=328512134&rnd=355328&iiqidtype=2&iiqpcid=61989954-917c-443c-aab0-c81b0b6d5d29&iiqpciddate=1697717379491&tsrnd=667_1697717379492&fbp=622056641&jsver=5.36&abtp=100&abtg=A&ckls=true&ci=51XXytlHbB&nc=false&trid=-175836287
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
patent: https://www.almondnet.com/ip
alt-svc: h3=":443"; ma=86400
content-length: 43
x-amz-cf-id: kyi0XP_39DeyCIqInZklPbZrNOao3r0lTvmqr94Fw32OuIyLl1xndA==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 33 B
285 B 342ms
114ms XHR
application/json 162.19.138.120
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/id5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.120 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

5e24dfe0480121d45519d8a07a067b428c2c522dcced8099b74b90086781d023

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://anyfile-notepad.semaan.ca
date: Thu, 19 Oct 2023 12:09:39 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H2

200

/
onetag-sys.com/match/ Frame 488B
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=75&redir=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D1%26uid%3D%5BMM_UUID%5D%26gdpr%3D1%26gdpr_consent%3D
https://onetag-sys.com/match/?int_id=1&uid=45486531-1c83-4000-92c5-c4a36eaecdf0&gdpr=1&gdpr_consent=

0
291 B

35ms
35ms

Image
text/plain

51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=1&uid=45486531-1c83-4000-92c5-c4a36eaecdf0&gdpr=1&gdpr_consent=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Protocol

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Date: Thu, 19 Oct 2023 12:09:39 GMT
Server: MT3 1075 283b7e3 master ord ord-pixel-x11 config_version:"1969"
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://onetag-sys.com/match/?int_id=1&uid=45486531-1c83-4000-92c5-c4a36eaecdf0&gdpr=1&gdpr_consent=
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Thu, 19 Oct 2023 12:09:38 GMT

GET
H/1.1 204
No Content sync.php
pixel-eu.rubiconproject.com/exchange/ Frame 488B 0
239 B 3503ms
105ms Image
image/gif 213.19.162.90
LEVEL3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-eu.rubiconproject.com/exchange/sync.php?p=onetag&gdpr=1&gdpr_consent=
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 213.19.162.90 , United Kingdom, ASN3356 (LEVEL3, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: 2eb7d209ab67664d6226c75331547ba1
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

/
onetag-sys.com/match/ Frame 488B
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D98%26gdpr%3D1%26gdpr_consent%3D%26uid%3D$UID
https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=7428532414938068229

0
291 B

36ms
34ms

Image
text/plain

51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=7428532414938068229

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Protocol

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:39 GMT
an-x-request-uuid: 6258347e-d9f6-4ff0-a6d4-7dbabc30adc6
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=7428532414938068229
x-proxy-origin: 37.19.212.193; 37.19.212.193; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

/
onetag-sys.com/match/ Frame 488B
Redirect Chain

https://ads.stickyadstv.com/user-matching?id=3679&gdpr=1&gdpr_consent=
https://onetag-sys.com/match/?int_id=3&uid=58dd88acabece610497c72bd89909bc&gdpr_consent=&gdpr=1

0
291 B

35ms
34ms

Image
text/plain

51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=3&uid=58dd88acabece610497c72bd89909bc&gdpr_consent=&gdpr=1

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Protocol

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Pragma: no-cache
Date: Thu, 19 Oct 2023 12:09:40 GMT
Server: nginx
Access-Control-Allow-Origin: *
Location: https://onetag-sys.com/match/?int_id=3&uid=58dd88acabece610497c72bd89909bc&gdpr_consent=&gdpr=1
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
x-sticky-vk: 1697717380153099-59

GET
H/1.1 200
OK tap.php
pixel.rubiconproject.com/ Frame 488B 42 B
775 B 152ms
38ms Image
image/gif 8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=223352&nid=4584&put=BqS_njDJ2GmmdDG78iKAPuI5E9jH6CduiuiVHFe8K9s
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: b08401febecfa1b1a0c0270265f29df4
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 488B
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&ot_initiated=1
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABi0fXYdv_KZkjCLisklP_e3k5exWIN0w1Pg

170 B
243 B

86ms
50ms

Image
image/png

172.253.122.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABi0fXYdv_KZkjCLisklP_e3k5exWIN0w1Pg

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Protocol

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f156.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:39 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABi0fXYdv_KZkjCLisklP_e3k5exWIN0w1Pg
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H2 200 sync
ssbsync-global.smartadserver.com/api/ Frame 488B 0
44 B 48ms
35ms Image
text/plain 23.105.12.158
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=1&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D107%26uid%3D[ssb_sync_pid]
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.105.12.158 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:39 GMT
content-length: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 488B
Redirect Chain

https://onetag-sys.com/match/?int_id=113&gdpr=1&gdpr_consent=&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Donetag.com%26id%3D%24%7BUSER_TOKEN%7D&ot_initiated=1
https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=BqS_njDJ2GmmdDG78iKAPuI5E9jH6CduiuiVHFe8K9s

43 B
479 B

442ms
51ms

Image
image/gif

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=BqS_njDJ2GmmdDG78iKAPuI5E9jH6CduiuiVHFe8K9s

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Protocol

HTTP/1.1

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 19 Oct 2023 12:09:39 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: R90H9GK596ME5E1K93P2
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location: https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=BqS_njDJ2GmmdDG78iKAPuI5E9jH6CduiuiVHFe8K9s
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H2 200 ImgSync
image8.pubmatic.com/AdServer/ Frame 488B 0
39 B 34ms
32ms Image
text/plain 8.28.7.82
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?p=159706&gdpr=1&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D${GDPR}%26gdpr_consent%3D${GDPR_STRING}%26uid%3D%23PMUID
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.82 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:38 GMT
content-length: 0

GET
H2

200

/
onetag-sys.com/match/ Frame 488B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=onetag_eb&google_cm
https://cm.g.doubleclick.net/pixel?google_nid=onetag_eb&google_cm=&google_tc=
https://onetag-sys.com/match/?int_id=106&google_gid=CAESELWMI3Jtoh-7aWFXwqUChOY&google_cver=1

0
291 B

35ms
35ms

Image
text/plain

51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=106&google_gid=CAESELWMI3Jtoh-7aWFXwqUChOY&google_cver=1

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Protocol

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

ec2-34-200-65-202.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:39 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/match/?int_id=106&google_gid=CAESELWMI3Jtoh-7aWFXwqUChOY&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 298
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 occ
ups.analytics.yahoo.com/ups/58488/ Frame 488B 0
15 B 39ms
37ms Image
text/plain 34.200.65.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58488/occ?&gdpr=1&gdpr_consent=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

34.200.65.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS/9.1.10.87 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:39 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.87
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

/
onetag-sys.com/match/ Frame 488B
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=vw6iyrn&ttd_tpi=1&gpdr=1&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=vw6iyrn&ttd_tpi=1&gpdr=1&gdpr_consent=
https://onetag-sys.com/match/?int_id=29&uid=9279c2c7-0a3c-4984-9085-399d8dc48589&gdpr=0&gdpr_consent=

0
291 B

35ms
35ms

Image
text/plain

51.222.39.187
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=29&uid=9279c2c7-0a3c-4984-9085-399d8dc48589&gdpr=0&gdpr_consent=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Protocol

Server

51.222.39.187 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location: https://onetag-sys.com/match/?int_id=29&uid=9279c2c7-0a3c-4984-9085-399d8dc48589&gdpr=0&gdpr_consent=
date: Thu, 19 Oct 2023 12:09:39 GMT
server: Kestrel
content-length: 233

GET
H/1.1 200
OK sync
x.bidswitch.net/ Frame 488B 43 B
235 B 142ms
46ms Image
image/gif 35.211.178.172
GOOGLE-2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=onetag&gdpr=1&gdpr_consent=
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.211.178.172 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 172.178.211.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

Date: Thu, 19 Oct 2023 12:09:39 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2 200 onetag-usync
router.infolinks.com/dyn/ Frame 488B 35 B
207 B 53ms
51ms Image
image/gif 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/onetag-usync?uid=BqS_njDJ2GmmdDG78iKAPuI5E9jH6CduiuiVHFe8K9s
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:39 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 8188e9d61859a252-YYZ
content-length: 35
expires: Wed, 19 Oct 2022 12:09:39 GMT

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame BBB2
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=33across&endpoint=us-east&us_privacy=
https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=

281 B
554 B

3144ms
33ms

Document
text/html

23.55.205.215
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.55.205.215 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-55-205-215.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Thu, 19 Oct 2023 12:09:42 GMT
ETag: "4014f-119-6051b805b8000"
Last-Modified: Mon, 11 Sep 2023 20:52:16 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Thu, 19 Oct 2023 12:09:39 GMT
location: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
server: AkamaiGHost

GET
H2

200

user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame ABBA
Redirect Chain

https://ssc-cms.33across.com/ps/?us_privacy=&ts=1697717379502.6&ri=25&ru=https%3A%2F%2Fads.pubmatic.com%2FAdServer%2Fjs%2Fuser_sync.html%3F%26p%3D156423%26us_privacy%3D%24%7BUS_PRIVACY%7D%26predire...
https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D

15 KB
6 KB

3180ms
59ms

Document
text/html

23.47.64.205
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.47.64.205 Atlanta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-47-64-205.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 94061a925c5d84bf776554ac894020c407a9a4c89b979d538de3cf45591fe423

Request headers

Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=29450
content-encoding: gzip
content-length: 5606
content-type: text/html
date: Thu, 19 Oct 2023 12:09:42 GMT
expires: Thu, 19 Oct 2023 20:20:32 GMT
last-modified: Fri, 01 Sep 2023 11:18:33 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

Redirect headers

cache-control: no-store, no-cache, must-revalidate
content-length: 0
date: Thu, 19 Oct 2023 12:09:39 GMT
expires: Thu, 01-Jan-70 00:00:01 GMT
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
pragma: no-cache
referrer-policy: unsafe-url
server: 33XP001
x-33x-status: 40000000008200000C

GET
H2

200

match
events-ssc.33across.com/ Frame 890B
Redirect Chain

https://x.bidswitch.net/sync?ssp=the33across&us_privacy=
https://x.bidswitch.net/ul_cb/sync?ssp=the33across&us_privacy=
https://cm.g.doubleclick.net/pixel?google_nid=bidswitch_dbm&google_cm&google_sc&ssp=the33across&bsw_param=62f3bea8-85b8-457d-80ee-09e2934320be&google_hm=NjJmM2JlYTgtODViOC00NTdkLTgwZWUtMDllMjkzNDMy...
https://x.bidswitch.net/sync?dsp_id=16&user_id=CAESEL6xUawgadFXSVCGI4_2W60&google_cver=1&ssp=the33across&bsw_param=62f3bea8-85b8-457d-80ee-09e2934320be
https://ssc-cms.33across.com/ps/?xi=10&us_privacy=&xu=62f3bea8-85b8-457d-80ee-09e2934320be
https://events-ssc.33across.com/match?bidder_id=10&external_user_id=62f3bea8-85b8-457d-80ee-09e2934320be&ts=1697717379&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
126 B

116ms
41ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=10&external_user_id=62f3bea8-85b8-457d-80ee-09e2934320be&ts=1697717379&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:39 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:39 GMT
referrer-policy: unsafe-url
server: 33XP003
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=10&external_user_id=62f3bea8-85b8-457d-80ee-09e2934320be&ts=1697717379&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

match
events-ssc.33across.com/ Frame 890B
Redirect Chain

https://ups.analytics.yahoo.com/ups/58350/sync?redir=true
https://ssc-cms.33across.com/ps/?xi=99&us_privacy=&xu=y-DYy_EmtE2uEicJW_zFA5YyO6Wit6Kv9r~A
https://events-ssc.33across.com/match?bidder_id=99&external_user_id=y-DYy_EmtE2uEicJW_zFA5YyO6Wit6Kv9r%7EA&ts=1697717379&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
225 B

327ms
39ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=99&external_user_id=y-DYy_EmtE2uEicJW_zFA5YyO6Wit6Kv9r%7EA&ts=1697717379&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:39 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:38 GMT
referrer-policy: unsafe-url
server: 33XP004
x-33x-status: 8000000008200000C
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=99&external_user_id=y-DYy_EmtE2uEicJW_zFA5YyO6Wit6Kv9r%7EA&ts=1697717379&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

match
events-ssc.33across.com/ Frame 890B
Redirect Chain

https://33across-match.dotomi.com/match/bounce/current?networkId=78390&version=1&us_privacy=
https://33across-match.dotomi.com/match/bounce/current?DotomiTest=3aa032b471c807a6&is_secure=true&networkId=78390&version=1&us_privacy=
https://ssc-cms.33across.com/ps?xi=64&xu=AAACQ9Ql53OM9gMTtx7GAAAAAAA&expiration=1697803782&is_secure=true&us_privacy=
https://events-ssc.33across.com/match?bidder_id=64&external_user_id=AAACQ9Ql53OM9gMTtx7GAAAAAAA&ts=1697717382&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
126 B

40ms
39ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=64&external_user_id=AAACQ9Ql53OM9gMTtx7GAAAAAAA&ts=1697717382&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:42 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:41 GMT
referrer-policy: unsafe-url
server: 33XP015
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=64&external_user_id=AAACQ9Ql53OM9gMTtx7GAAAAAAA&ts=1697717382&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

match
events-ssc.33across.com/ Frame 890B
Redirect Chain

https://eb2.3lift.com/getuid?gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fssc-cms.33across.com%2Fps%2F%3Fus_privacy%3D%26xi%3D33%26xu%3D%24UID
https://ssc-cms.33across.com/ps/?us_privacy=&xi=33&xu=1107753425527544185478
https://events-ssc.33across.com/match?bidder_id=33&external_user_id=1107753425527544185478&ts=1697717379&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
126 B

328ms
40ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=33&external_user_id=1107753425527544185478&ts=1697717379&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:39 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:38 GMT
referrer-policy: unsafe-url
server: 33XP002
x-33x-status: 8000000008200000C
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=33&external_user_id=1107753425527544185478&ts=1697717379&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

envelope Show response
lexicon.33across.com/v1/
Redirect Chain

https://lexicon.33across.com/v1/envelope?pid=0015a0000344WLkAAM&src=ima&ver=1.1.0
https://lexicon.33across.com/v1/envelope?pid=0015a0000344WLkAAM&src=ima&ver=1.1.0&b=1&g=YCftBRH80%2BgTFqJ%2BZszV9ZMrYW%2BetUp5hN8MwfyITCE%3D

42 B
138 B

51ms
51ms

XHR
application/json

35.244.193.51
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0015a0000344WLkAAM&src=ima&ver=1.1.0&b=1&g=YCftBRH80%2BgTFqJ%2BZszV9ZMrYW%2BetUp5hN8MwfyITCE%3D
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app?state=%7B%22ids%22:%5B%221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%22%5D,%22action%22:%22open%22,%22resourceKeys%22:%7B%7D%7D
Protocol: H2
Server: 35.244.193.51 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 435b1ece4a55f4f8d06866b32c1aee3cc4661eb905265894795f15a57bf1b33d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:39 GMT
via: 1.1 google
vary: origin
content-type: application/json
access-control-allow-origin: https://anyfile-notepad.semaan.ca
cache-control: private, must-revalidate, max-age=28800
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

date: Thu, 19 Oct 2023 12:09:39 GMT
via: 1.1 google
referrer-policy: unsafe-url
vary: origin
access-control-allow-origin: https://anyfile-notepad.semaan.ca
location: https://lexicon.33across.com/v1/envelope?pid=0015a0000344WLkAAM&src=ima&ver=1.1.0&b=1&g=YCftBRH80%2BgTFqJ%2BZszV9ZMrYW%2BetUp5hN8MwfyITCE%3D
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H3

200

usermatchredir
ssum-sec.casalemedia.com/ Frame FFDB
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZTEcgzJJDOr9MP44hO2bQAAADtYAAAAB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEFH2MNQn3jIdCH-FgthUbE4&google_cver=1

43 B
768 B

78ms
77ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEFH2MNQn3jIdCH-FgthUbE4&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:39 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iKJsfjBpd0YUDBXuttRFSDOIS2CXr5BonaCHpPh9hiJf84nEsy%2FEd0UT8rd4s02QjJO1yUuzKvZr7ddOdNvk0bIzV5UE2fjP38jQVlH9ymEX3Ozk%2B7m2%2FOow1uXNpldMCXTtQVynOF33TQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8188e9d6ea8cc454-EWR
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:39 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEFH2MNQn3jIdCH-FgthUbE4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 364
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame FFDB
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZTEcgzJJDOr9MP44hO2bQAAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEIdfO21pBPFmDdlpoiVXi0M&google_cver=1

43 B
734 B

80ms
79ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEIdfO21pBPFmDdlpoiVXi0M&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:39 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BcVgQSCEopiVgWsJ%2BUbLCHgYvbSe3BfFypzmZ73RLLvea3th8iNPF8etWl1av%2Fpw9YYPoHYlZSmTYW3qlTjXO3L00r1l48AKC5fn7h5b0Aifz9%2Bz%2F1PHI7KTstL6IrvQD9yKN9pcObqFEQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8188e9d6ea8ac454-EWR
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:39 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEIdfO21pBPFmDdlpoiVXi0M&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame FFDB
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZTEcgzJJDOr9MP44hO2bQAAADtYAAAAB&gpp=&gpp_sid=
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZTEcgzJJDOr9MP44hO2bQAAADtYAAAAB&gpp=&gpp_sid=&dcc=t

43 B
855 B

107ms
55ms

Image
image/gif

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZTEcgzJJDOr9MP44hO2bQAAADtYAAAAB&gpp=&gpp_sid=&dcc=t

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1

Protocol

HTTP/1.1

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 19 Oct 2023 12:09:40 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: N0V8JFYBCGX0X7V4DZ10
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 19 Oct 2023 12:09:39 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 5EJ776Z8TFQXM59FYVJY
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZTEcgzJJDOr9MP44hO2bQAAADtYAAAAB&gpp=&gpp_sid=&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame FFDB
Redirect Chain

https://match.adsrvr.org/track/cmf/casale
https://match.adsrvr.org/track/cmb/casale?
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=9279c2c7-0a3c-4984-9085-399d8dc48589&expiration=1700309379&gdpr=0&gdpr_consent=

43 B
730 B

77ms
77ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=9279c2c7-0a3c-4984-9085-399d8dc48589&expiration=1700309379&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:39 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7%2ByD5SmTbtMd6a7mfdVOMrxAOF5aShBSuEBApfPE0VQid4hUsgK241SqjTVT8Ihj5FmMMvHAWH2yzzZUqd1Jh0VGO3XmxOfQRBEUtsH1IlNzb05%2F1P8r6t4QOMJfELrVrsr0rQOXwuxdRw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8188e9d71adbc454-EWR
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=9279c2c7-0a3c-4984-9085-399d8dc48589&expiration=1700309379&gdpr=0&gdpr_consent=
date: Thu, 19 Oct 2023 12:09:39 GMT
server: Kestrel
content-length: 323

GET
H2

200

crum
dsum-sec.casalemedia.com/ Frame FFDB
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=82&gdpr=$%7bGDPR%7d&gdpr_consent=$%7bGDPR_CONSENT%7d
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=6754517263874570649&gdpr=0&gdpr_consent=

43 B
343 B

46ms
46ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=6754517263874570649&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol: H2
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:39 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BNX79vO%2BbCTnUHM0AMz50aLzJm8GWqHcN%2FxXZAYpAk6g8tDVSU6fAljbeTIuVpw%2BrraC3SrLnQBujcK%2Bh9YGOS2hpUiKUzaFEQM8juARsMiB9%2FuWC8d066dLU7AJOja30sO%2BX1fnYDw7bQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8188e9d678d9a1e4-YYZ
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=196&external_user_id=6754517263874570649&gdpr=0&gdpr_consent=
date: Thu, 19 Oct 2023 12:09:38 GMT
content-length: 0

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame FFDB
Redirect Chain

https://match.prod.bidr.io/cookie-sync/ie
https://match.prod.bidr.io/cookie-sync/ie?_bee_ppp=1
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AAE4ZE7KYjkAABkEUBHfyg&expiration=1698926979

43 B
732 B

73ms
73ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AAE4ZE7KYjkAABkEUBHfyg&expiration=1698926979
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:40 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8jjxelrro%2F6KLczCIkFtdCW%2B1MJMkNbngte1vrO7591J30ZtolBPqmtBH1ajO4WBaEZOKAuaQhwIl8nY%2Fb3YrTwlTdFK8kLnHmceeQ0BEkXw3lzyCZlzI5bkvEmTupU6ZQdu8N7LWkBFjw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8188e9d92cf5c454-EWR
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=130&external_user_id=AAE4ZE7KYjkAABkEUBHfyg&expiration=1698926979
Date: Thu, 19 Oct 2023 12:09:39 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame FFDB
Redirect Chain

https://um.simpli.fi/pm_match?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=$UID
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=6BD46589BE3C45D58663717B78E42E07

43 B
733 B

75ms
75ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=6BD46589BE3C45D58663717B78E42E07
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:39 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jGuK3Qbg3AHP4QHml8HzsTfGXnHYpQbv9Jbd6HTRBIzpka81CUJJjbv0SrV8D6j%2FF7ZriwNZI11bF6lR%2B0hH2ERt57XyBdnnRK48UMJMkaI5kXWS8FOFptQLgIkI1G8O%2BIAbk0wQMhSdlA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8188e9d6fab3c454-EWR
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

date: Thu, 19 Oct 2023 12:09:39 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=6BD46589BE3C45D58663717B78E42E07
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Wed, 18 Oct 2023 12:09:39 GMT

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame FFDB
Redirect Chain

https://a.tribalfusion.com/i.match?p=b20&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com/crum%3Fcm_dsp_id%3D131%26external_user_id%3D%24TF_USER_ID_ENC%24&cm_callback_url=https%3A%2F%2Fdsum-sec.casa...
https://s.tribalfusion.com/z/i.match?p=b20&redirect=https%3A%2F%2Fdsum-sec.casalemedia.com/crum%3Fcm_dsp_id%3D131%26external_user_id%3D%24TF_USER_ID_ENC%24&cm_callback_url=https%3A%2F%2Fdsum-sec.ca...
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662081262867714

43 B
733 B

74ms
72ms

Image
image/gif

104.18.26.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662081262867714
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol: H3
Server: 104.18.26.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:42 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3oi4WwfwqGAcwOV9l03u1dv7GsFDXEdUkqWr9uztbi%2FFeBY0l7tJf3k5r080PoWQZ3a2ihEeTQ0KNnEq0SdzbWygTklIu8ixSW95nPDgok%2FjA%2BxHcqAJO7%2FISpYSv9bAoANY%2BrL416yXjQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8188e9eae835c454-EWR
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:42 GMT
cf-cache-status: DYNAMIC
x-function: 209
server: cloudflare
x-reuse-index: 1757
content-type: text/html
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=131&external_user_id=18072662081262867714
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 8188e9ea5ed139f6-YYZ
alt-svc: h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 ix-usync
router.infolinks.com/dyn/ Frame FFDB 35 B
205 B 50ms
49ms Image
image/gif 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/ix-usync?uid=ZTEcgzJJDOr9MP44hO2bQAAA%263798
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:39 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 8188e9d64878a252-YYZ
content-length: 35
expires: Wed, 19 Oct 2022 12:09:39 GMT

GET
H2 200 rest Show response
content.googleapis.com/discovery/v1/apis/oauth2/v2/ Frame 849E 6 KB
2 KB 40ms
35ms XHR
application/json 172.253.63.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://content.googleapis.com/discovery/v1/apis/oauth2/v2/rest?fields=kind%2Cname%2Cversion%2CrootUrl%2CservicePath%2Cresources%2Cparameters%2Cmethods%2CbatchPath%2Cid&pp=0

Requested by

Host: apis.google.com
URL: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.AOzoyjtjrhQ.O/m=googleapis_proxy/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA/cb=gapi.loaded_0?le=scs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4a1d6b68a866302b8ea5ab414b02d7a847b9d9336c4a7485d395041c5e916e16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

X-Goog-Encode-Response-If-Executable: base64
X-Origin: https://anyfile-notepad.semaan.ca
X-ClientDetails: appVersion=5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F118.0.5993.88%20Safari%2F537.36&platform=Win32&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F118.0.5993.88%20Safari%2F537.36
accept-language: en-CA,en;q=0.9
Authorization: Bearer undefined
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
Referer: https://content.googleapis.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.AOzoyjtjrhQ.O%2Fd%3D1%2Frs%3DAHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA%2Fm%3D__features__
X-Requested-With: XMLHttpRequest
X-JavaScript-User-Agent: google-api-javascript-client/1.1.0
X-Referer: https://anyfile-notepad.semaan.ca

Response headers

date: Thu, 19 Oct 2023 12:07:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 154
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/federated-signon-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1394
x-xss-protection: 0
last-modified: Tue, 27 Jun 2023 17:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="federated-signon-mpm-access"
vary: Accept-Encoding
report-to: {"group":"federated-signon-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/federated-signon-mpm-access"}]}
content-type: application/json; charset=UTF-8
cache-control: public, max-age=3000
accept-ranges: bytes
expires: Thu, 19 Oct 2023 12:57:05 GMT

GET
H2 200 rest Show response
content.googleapis.com/discovery/v1/apis/drive/v2/ Frame 849E 96 KB
11 KB 53ms
52ms XHR
application/json 172.253.63.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://content.googleapis.com/discovery/v1/apis/drive/v2/rest?fields=kind%2Cname%2Cversion%2CrootUrl%2CservicePath%2Cresources%2Cparameters%2Cmethods%2CbatchPath%2Cid&pp=0

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

45721490c11c3b09064644f0783f65068093e1991765b2c68b4c54fcca95ef69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

X-Goog-Encode-Response-If-Executable: base64
X-Origin: https://anyfile-notepad.semaan.ca
X-ClientDetails: appVersion=5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F118.0.5993.88%20Safari%2F537.36&platform=Win32&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F118.0.5993.88%20Safari%2F537.36
accept-language: en-CA,en;q=0.9
Authorization: Bearer undefined
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
Referer: https://content.googleapis.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.AOzoyjtjrhQ.O%2Fd%3D1%2Frs%3DAHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA%2Fm%3D__features__
X-Requested-With: XMLHttpRequest
X-JavaScript-User-Agent: google-api-javascript-client/1.1.0
X-Referer: https://anyfile-notepad.semaan.ca

Response headers

date: Thu, 19 Oct 2023 12:09:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10962
x-xss-protection: 0

GET
H2 200 in_search.js Show response
resources.infolinks.com/js/1891.003-3.027/ 225 KB
89 KB 29ms
29ms Script
application/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/js/1891.003-3.027/in_search.js
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1891.003-3.027/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4d1b618b508d6e2c3ab4c4d98feeddfdb66e6d87d9dcfd88097f1d85480c3af0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:39 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 11 Oct 2023 08:21:11 GMT
server: cloudflare
age: 6179
etag: W/"38471-6076c818dea10"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 8188e9d698c3a252-YYZ
expires: Sat, 18 Nov 2023 10:26:40 GMT

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 361 KB
124 KB 3152ms
53ms Script
text/javascript 142.251.16.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1891.003-3.027/ice.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f95.1e100.net

Software

sffe /

Resource Hash

8cbb913d075f48fea47711f393c162c69066118acb543879dc77cf69d6345682

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 126236
x-xss-protection: 0
expires: Thu, 19 Oct 2023 12:09:42 GMT

GET
H2 200 container-3.0.html Show response
resources.infolinks.com/static/ Frame A941 1 KB
673 B 38ms
38ms Document
text/html 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/static/container-3.0.html
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1891.003-3.027/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 616d665127071eff762adcab2e4790764ab42d57290a9a25bbd7593d25429114

Request headers

Referer: https://anyfile-notepad.semaan.ca/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 3960
cache-control: max-age=2592000
cf-cache-status: HIT
cf-ray: 8188e9d6a8d2a252-YYZ
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Thu, 19 Oct 2023 12:09:39 GMT
expires: Sat, 18 Nov 2023 11:03:39 GMT
last-modified: Thu, 20 Jul 2023 12:30:02 GMT
server: cloudflare
vary: Accept-Encoding
via: 1.1 google

GET
H2 200 getads.htm Show response
rt3010.infolinks.com/action/ 8 KB
6 KB 585ms
584ms Script
text/html 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rt3010.infolinks.com/action/getads.htm?hks=%5B%7B%22lid%22%3A%22d_IL_INSEARCH%22%2C%22bdc%22%3A1%2C%22prod_t%22%3A%22d%22%2C%22garc%22%3A0%2C%22sdata%22%3A%22article%22%2C%22scs%22%3A%229fIBKySYMR%22%7D%5D&rid=400203ce-ac79-4411-bd8d-adb4c1eb0eb0&jsv=1891.003-3.027&sr=1600X1200&rts=1697717379673&cfv=-1&cb=getAdsResponse&os=Windows&ov=10&br=Chrome&bv=118.0.5993.88&dv=p&ce=t&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%3D%257B%2522ids%2522%3A%255B%25221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%2522%255D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%257B%257D%257D&tzo=-0700&c=c&strg=true&pitc=46~1upSnuCIWl_lKlE1EtBHVomf_o5I9G0I&sua=%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%2C%22uaFullVersion%22%3A%22%22%7D&rsd=R6bNYdBPXX9lpO4OAmBc44vMT9JjvBcmtqpaegOnN0Obq5dPh2JHUKZSlRLj8I_Yw6w1HIL5ywtIoNbYC5_-b006amIvUOEGkidd7v6NuQ4cG7PNUpOxvosev9k-gIxJ-t_Bcl7G9OPCZ5jsH3fGgndWU9knkgct&rsk=39&rcs=Z46WvKRoWebRuBbtSnvDJA&cuid=ffd41085-77f2-4d26-9987-042230561fb1&_pubcid=d7993053-2e1c-4f7c-bdd1-36ff409c4d3e&ique=&hbnr=false
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1891.003-3.027/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d318131e406216083091a949a5df746473fb802db07098a36ee02620a26028fd

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:40 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-language: en-CA
content-type: text/html;charset=UTF-8
cache-control: no-cache,no-store
cf-ray: 8188e9d6f910a252-YYZ
x-application-context: application:prod
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 cb=gapi.loaded_1 Show response
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.AOzoyjtjrhQ.O/m=picker/exm=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA/ 86 KB
27 KB 36ms
36ms Script
text/javascript 142.250.31.100
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.AOzoyjtjrhQ.O/m=picker/exm=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA/cb=gapi.loaded_1?le=scs

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/client.js?onload=gapi_loaded

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.31.100 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns31533568.ip-162-19-138.eu

Software

sffe /

Resource Hash

d8937d279ce40e09299ddc9023db7c815b220a3eb280844314b3e9eb46fa0bf2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Wed, 18 Oct 2023 15:42:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 73649
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27759
x-xss-protection: 0
last-modified: Tue, 03 Oct 2023 15:22:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
vary: Accept-Encoding
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 17 Oct 2024 15:42:10 GMT

GET
H2

200

amd-us
router.infolinks.com/dyn/ Frame A941
Redirect Chain

https://tracker.exchange.amitydigital.io/sync?id=11&uid=ffd41085-77f2-4d26-9987-042230561fb1
https://router.infolinks.com/dyn/amd-us?user_id=819942ca-d324-e09c-6d67-4214fb0c8b88

35 B
207 B

57ms
56ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/amd-us?user_id=819942ca-d324-e09c-6d67-4214fb0c8b88
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app?state=%7B%22ids%22:%5B%221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%22%5D,%22action%22:%22open%22,%22resourceKeys%22:%7B%7D%7D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://resources.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:42 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 8188e9eb4afda252-YYZ
content-length: 35
expires: Wed, 19 Oct 2022 12:09:42 GMT

Redirect headers

date: Thu, 19 Oct 2023 12:09:42 GMT
server: nginx/1.20.1
access-control-allow-methods: GET, POST, OPTIONS, DELETE, PUT
content-type: text/plain; charset=utf-8
location: https://router.infolinks.com/dyn/amd-us?user_id=819942ca-d324-e09c-6d67-4214fb0c8b88
access-control-allow-credentials: true
access-control-allow-headers: User-Agent,Keep-Alive,Content-Type
content-length: 100

GET
H2

200

ta-usync
router.infolinks.com/dyn/ Frame A941
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_device_id=ffd41085-77f2-4d26-9987-042230561fb1=&partner_id=3337&partner_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fta-usync%3Fuid%3D%24%7BTA_DE...
https://pixel.tapad.com/idsync/ex/receive/check?partner_device_id=ffd41085-77f2-4d26-9987-042230561fb1=&partner_id=3337&partner_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fta-usync%3Fuid%3D%24%7...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=f581ea5d-a018-40b0-b6a3-b8c6fd92e17f%252Chttps%25253A%25252F%25252Frouter.infolinks.com%25252Fdyn%25252Fta-usync%25253Fui...
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=9279c2c7-0a3c-4984-9085-399d8dc48589&ttd_puid=f581ea5d-a018-40b0-b6a3-b8c6fd92e17f%2Chttps%253A%252F%252Frouter.infolinks...
https://router.infolinks.com/dyn/ta-usync?uid=f581ea5d-a018-40b0-b6a3-b8c6fd92e17f

35 B
206 B

50ms
50ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/ta-usync?uid=f581ea5d-a018-40b0-b6a3-b8c6fd92e17f
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app?state=%7B%22ids%22:%5B%221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%22%5D,%22action%22:%22open%22,%22resourceKeys%22:%7B%7D%7D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://resources.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:39 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 8188e9d85a10a252-YYZ
content-length: 35
expires: Wed, 19 Oct 2022 12:09:39 GMT

Redirect headers

date: Thu, 19 Oct 2023 12:09:39 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin: *
location: https://router.infolinks.com/dyn/ta-usync?uid=f581ea5d-a018-40b0-b6a3-b8c6fd92e17f
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

152mus
router.infolinks.com/dyn/ Frame A941
Redirect Chain

https://sync.adkernel.com/user-sync?zone=202694&t=image&r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2F152mus%3Fuid%3D%7BUID%7D
https://ib.adnxs.com/getuid?%2F%2Fsync.adkernel.com%2Fuser-sync%3Fzone%3D202694%26dsp%3D639242%26t%3Dimage%26uid%3D%24UID
https://sync.adkernel.com/user-sync?zone=202694&dsp=639242&t=image&uid=7428532414938068229
https://router.infolinks.com/dyn/152mus?uid=A4977136814560799111

35 B
234 B

51ms
51ms

Image
image/gif

172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/152mus?uid=A4977136814560799111
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app?state=%7B%22ids%22:%5B%221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%22%5D,%22action%22:%22open%22,%22resourceKeys%22:%7B%7D%7D
Protocol: H2
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://resources.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:44 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 8188e9f2087ea252-YYZ
content-length: 35
expires: Wed, 19 Oct 2022 12:09:44 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 19 Oct 2023 12:09:43 GMT
Server: nginx
Age: 0
Location: https://router.infolinks.com/dyn/152mus?uid=A4977136814560799111
Cache-Control: no-store
Connection: close
Content-Length: 0

GET
H3 401 userinfo Show response
content.googleapis.com/oauth2/v2/ Frame 849E 304 B
251 B 62ms
62ms XHR
application/json 142.251.163.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://content.googleapis.com/oauth2/v2/userinfo

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f95.1e100.net

Software

ESF /

Resource Hash

a9ec945a24875fc594683ac8c3e176f2c199ed1011c8e1eec897d66c392d17b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

X-Goog-Encode-Response-If-Executable: base64
X-Origin: https://anyfile-notepad.semaan.ca
X-ClientDetails: appVersion=5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F118.0.5993.88%20Safari%2F537.36&platform=Win32&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F118.0.5993.88%20Safari%2F537.36
accept-language: en-CA,en;q=0.9
Authorization: Bearer undefined
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
Referer: https://content.googleapis.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.AOzoyjtjrhQ.O%2Fd%3D1%2Frs%3DAHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA%2Fm%3D__features__
X-Requested-With: XMLHttpRequest
X-JavaScript-User-Agent: google-api-javascript-client/1.1.0
X-Referer: https://anyfile-notepad.semaan.ca

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 228
x-xss-protection: 0
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 200 535.json Show response
id5-sync.com/g/v2/ 635 B
1 KB 1617ms
122ms XHR
application/json 162.19.138.117
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/535.json

Requested by

Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/id5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

a067ac9c06af4ea8b48de14a956060c85d5944b42b5f8fdf16be136a0ff856cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://anyfile-notepad.semaan.ca
date: Thu, 19 Oct 2023 12:09:40 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
p3p: CP="CAO PSA OUR"
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H2 200 adview.htm Show response
rt3010.infolinks.com/action/ 0
166 B 100ms
100ms XHR
text/html 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rt3010.infolinks.com/action/adview.htm?rid=400203ce-ac79-4411-bd8d-adb4c1eb0eb0&bdc=1&midx=0&emd=NzE1fjM5NDFfNzcyMjE3OTN-NzcyMjE3OTM&rts=1697717380328&prod_t=d&jsv=1891.003-3.027&skin=sidebar&theme=nologo&sdata=article&scs=9fIBKySYMR&rsd=R6bNYdBPXX9lpO4OAmBc44vMT9JjvBcmtqpaegOnN0Obq5dPh2JHUKZSlRLj8I_Yw6w1HIL5ywtIoNbYC5_-b006amIvUOEGkidd7v6NuQ4cG7PNUpOxvosev9k-gIxJ-t_Bcl7G9OPCZ5jsH3fGgndWU9knkgct&rsk=39&rcs=Z46WvKRoWebRuBbtSnvDJA
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1891.003-3.027/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:40 GMT
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: text/html;charset=UTF-8
access-control-allow-origin: https://anyfile-notepad.semaan.ca
p3p: CP="NON DSP NID OUR COR"
cache-control: no-cache,no-store
access-control-allow-credentials: true
cf-ray: 8188e9db1d1836b2-YYZ
content-length: 0
x-application-context: application:prod
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 ab Show response
lax1-ib.adnxs.com/ Frame 6C25 21 KB
9 KB 265ms
90ms Script
application/javascript 104.254.151.36
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://lax1-ib.adnxs.com/ab?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QL_NvBMfxsAAAMA1gAFAQiDucSpBhDAu7LEpNnnhjcYherulvnb3ItnKjYJXio25nXE-z8RagquAzGa9z8ZAAAAQApXQUAhagquAzGa9z8pXioJJAQxAAUBsAhAMLGtxgg4sxlA5R5IZVChn-kkWLrgfGAAaMmwRHijgAaAAQGKAQNVU0SSAQEG9IICmAGsAqAB-gGoAQGwAQC4AQLAAQXIAQLQAQnYAQDgAQDwAQCyAiRmZmQ0MTA4NS03N2YyLTRkMjYtOTk4Ny0wNDIyMzA1NjFmYjHYAqRD4ALq-SXqAhlhbnlmaWxlLW5vdGVwYWQuc2VtYWFuLmNh8gINCgZIRUlHSFQSAzI1MPICDAoFV0lEVEgSAzMwMPICIQoGTE9BREVSEhdyZW5kZXJfcG9zdF9hZHNfdjEuaHRtbPICFwoKSUZSQU1FX0tFWRIJODQ0Mzc4ODUy8gLIFQoLUFJFX1NDUklQVFMSuBU8c2NyaXB0PihmdW5jdGlvbigpey8qCgogQ29weXJpZ2h0IFRoZSBDbG9zdXJlIExpYnJhcnkgQXV0aG9ycy4KIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wCiovCnZhciBrPXRoaXN8fHNlbGY7dmFyIGw9QXJyYXkucHJvdG90eXBlLmluZGV4T2Y_ZnVuY3Rpb24oYSxjKXtyZXR1cm4gQXJyYXkucHJvdG90eXBlLmluZGV4T2YuY2FsbChhLGMsdm9pZCAwKX06ZnVuY3Rpb24oYSxjKXtpZigic3RyaW5nIj09PXR5cGVvZiBhKXJldHVybiJzdHJpbmciIT09dHlwZW9mIGN8fDEhPWMubGVuZ3RoPy0xOmEuaW5kZXhPZihjLDApO2Zvcih2YXIgZT0wO2U8YS5sZW5ndGg7ZSsrKWlmKGUgaW4gYSYmYVtlXT09PWMpcmV0dXJuIGU7cmV0dXJuLTF9O2Z1bmN0aW9uIG0oYSl7bVsiICJdKGEpO3JldHVybiBhfW1bIiAiXT1mdW5jdCmVCH07Zg3VeCBuKGEpe2E9dm9pZCAwPT09YT9kb2N1bWVudDphO3INQyQuY3JlYXRlRWxlARkYKCJpbWciKR1FBHAoITIwZSl7dmFyIGI9ITE7YhlSgGI_ITE6YjthLmdvb2dsZV9pbWFnZV9yZXF1ZXN0c3x8KFoaABA9W10pOwFRFGQ9bihhLhGXECk7aWYoDWsEZj0RyAgoKXsZFwRnPVpTADwsaD1sKGcsZCk7MDw9aCYmPjICJHNwbGljZS5jYWwBJ2xoLDEpfWQucmVtb3ZlRXZlbnRMaXN0ZW5lciYmUhcANCgibG9hZCIsZiwhMSk7UiMAYjoAEGVycm9yDTsYfTtkLmFkZEJzAD4UAD5wAD4gAAFtPhQAACg2agBYYiYmKGQuYXR0cmlidXRpb25TcmM9IiIBvhBzcmM9Y163ASQucHVzaChkKX0KWUsEcShJAQRhPTGsNC5jdXJyZW50U2NyaXB0TU8AKDJuAjBudWxsOmEpJiYiNzciQYAQLmdldEENkDhlKCJkYXRhLWpjIik_YToVVzxxdWVyeVNlbGVjdG9yKCdbDSUAPQFEDF0nKX1FN_BScj1SZWdFeHAoIl5odHRwcz86Ly8oXFx3fC0pK1xcLmNkblxcLmFtcHByb2plY3RcXC4obmV0fG9yZykoXFw_fC98JCkiKTsKZnVuY3Rpb24gdCgR4ABrBWEMYz1bXQUJBGU9AcYMO2Rve0GvGGI9YTt0cnkFDABkQa0YZD0hIWImJgEkHCE9Yi5sb2NhIWogLmhyZWYpYjp7AS2QbShiLmZvbyk7ZD0hMDticmVhayBifWNhdGNoKGgpe31kPSExfQFeCGY9ZBkXAGYBFgxpZihmCZkAZz5eAAw7ZT1idTkEJiYZDCgucmVmZXJyZXJ8fAGXJH1lbHNlIGc9ZSwNywBjKeAwbmV3IHUoZ3x8IiIpKQXVFGE9Yi5wYSHUGYYAYQX_UH19d2hpbGUoYSYmYiE9YSk7Yj0wO4HeEGE9Yy5shdZ0LTE7Yjw9YTsrK2IpY1tiXS5kZXB0aD1hLWI7Yj1rISs5HgGuNSo4YW5jZXN0b3JPcmlnaW5zbhwADWsAPR11ACkJhgwxO2E8EYpMOysrYSlnPWNbYV0sZy51cmx8fCgFCC5CATp2ABRbYS0KMV0hDBgsZy5oPSEwAeMpIgBrGash1WX_AGclFiUCBGU9MgQBIDA8PWU7LS1lKSG6RD1jW2VdLCFnJiZyLnRlc3QoZgGPICkmJihnPWYpLAUOLCYmIWYuaCl7Yj1mO0UbAH0NXQBlFeYEJiYBzAE7BDswQWUlWggmJmUFSAEbCCk7YwWtFHYoYixnKW2LGCBjLmc_Yy4F-gw6Yy5pAUAAfbFTBCB2odYcKXt0aGlzLmlB1QEJCGc9YxkiAHUdIgh1cmwRJBRoPSEhYzsFLwWIJQrdLwB3lSkcdCgpLGM9YS7tfkAoIj8iKTtzZXRUaW1lb3V0KBGMDTEAZdlWGGU_LjAxOmVBNUQhKE1hdGgucmFuZG9tKCk-ZSlpDwxiPXEoIaQAImX_NDovLyIrKGImJiJ0cnVlgWsAYlZrBDgtcmNkIik_InBhZ2VhZDLNtxBzeW5kaWm5IC1jbi5jb20iOmYjAAUgDCkrIi8JRXgvZ2VuXzIwND9pZD1qY2EmamM9NzcmdmVyc2lvbj0ihUUMZD0oZAGxACmhtlIEBQAtDTEwIil8fCJ1bmtub3duImHjXCtkKyImc2FtcGxlPSIrZTtiPXdpbmRvdwVYAGY5NABm4YoAZiEzNGQ9Yi5uYXZpZ2F0b3IpMg4AUC51c2VyQWdlbnQsZD0vQ2hyb21lL0mbIGQpJiYhL0VkZxkRHD8hMDohMTtkYZMVUTAuc2VuZEJlYWNvbj8KHWkdGCQoZSk6cChiLGUsInoICZ4QKX19LDBVoCgwPD1jP2Euc3VicxJaCRwoMCxjKTphfQngDC5yZmwuAggarwhoZW5jb2RlVVJJQ29tcG9uZW50KHcoKSl9O30p6dtBmhQpOwo8L3PFmGw-8gLJAgoKRVhUUkFfVEFHUxK6AjxkaXYgc3R5IVIMcG9zaaGxZDogYWJzb2x1dGU7IGxlZnQ6IDBweDsgdG9wDQpkdmlzaWJpbGl0eTogaGlkZGVuOyI-PGltZyDhTFWHSRRKWQJBNg0eLjICFGF3YmlkJgUG8HlfYj1BS0FtZi1BbnJZa0p6T0JsVHNCQkIyV0trajNGSk9LMnVfQ2oyNTRZZGZwdllQNmliSlY3UWhOUUswbW12RVdubEo5MU0zcXg1Rm0tb0hSNDItbHh0RG0tTGxYUVp1VzBpUSIgYm9yZGVyPTAgd2lkdGg9MSBoZQ6-CyA9MSBhbHQ9IiIxGoBkaXNwbGF5Om5vbmUiPjwvZGl2PvICmQEKDFBPU1RfU0MWGgwIiAE8KWo2CAEWEApQYWRzLmcuZG91YmxlY2xpY2submV0MQY8eGJmZV9iYWNrZmlsbC5qcwFlCUsAPg1TAD6dJBwge3IzcHgoJyKlDBwnKTt9KSgpOz3qEJMWChBIAZ00UE9SVF9QQVJBTVMS_hWRI4qUAPB9YWRmZXRjaD9hZGs9MTk0Njg5Mjg3OCZhZHNhZmU9bWVkaXVtJmNsaWVudD1jYS1wdWItMzA3Njg5MDAxMjc0MTQ2NyZmb3JtYXQ9MzAweDI1MF9hcyZpcD0zNy4xOS4yMTIuMTkzJm91dHB1dD1odG1sJnVudmlld2VkX3BvSYsgX3N0YXJ0PTEmpXYEbnlWAQ4QJnN1Yl8NigBiQZDw7XItNDcxMDEyNCZobD1lbiZhY2VpZD1NQ0VZdEFDc0dyUUF3QnEwQUQ0ZHRBQkRIYlFBeFlNMEFaS0hOQUhzanpRQmRKRTBBYU9TTkFIYWtqUUJTWk0wQVg2VE5BR1JrelFCdFpNMEFlR1ROQUh0a3pRQkVwUTBBUzZVTkFFdmxEUUJOWlEwQVRlVU5BRkJsRFFCU0pRMEFWR1VOQUZTbERRQlZaUTBBVi1VTkFGb2xEUUJmWlEwQVlLVU5BR2xsRFFCcUpRMEFhdVVOQUcxbERRQnQ1UTBBYmlVTkFHNWxEUUJ1cFEwQWJ1VU5BRzkBcCx4NVEwQWRDVU5BSFQBEAAyAUAEZC0BEABqARD0VQNTM05CQVUxelFRR3p2b29CX19jZUFwTWZYQUtCSUZ3Q3BpQmNBaWo1aUFLN19vZ0N2XzZJQWlkQ3FnSW9RcW9DS1VLcUF2VlRxZ0tVYXFvQ19uaXFBb0NicWdLQm02b0NncHVxQXFLb3FnTGxyS29DMXJ5cUFvYk5xZ0pDLUtvQ1FmdXFBc01NcXdKYUlhc0NoQ2VyQWxRb3F3TDdLNnNDMURhckFqdzRxd0w5T2FzQ0pUcXJBaWs2cXdJdE9xc0N0VHlyQXIwLXF3SkNRYXNDSEVhckFteEtxd0tjUzZzQ1lFNnJBcmxPcXdJZ1VLc0M5RkNyQWdKUnF3SUtVYXNDSUZ5ckFvUmRxd0psWHFzQ1JHQ3JBbVZncXdKaVk2c0MzR1NyQWc5cXF3STlhcXNDRzNHckFsVnhxd0x4Y2FzQ2dIT3JBb1Z6cXdMTWRLc0NDWGFyQWtsMnF3SnhkcXNDR0hlckFoMTNxd0lpZDZzQ0ozZXJBaXgzcXdJS2Vhc0NhbnFyQXFwNnF3SWhmYXNDVTRDckFwdUJxd0pUaXFzQ29JcXJBdmFMcXdKMWpLc0N0WXlyQXJlTXF3S2JqNnNDQTVDckFrYVFxd0s4azZzQ0haYXJBZ3FacXdKWm1xc0NvNXVyQXJpZHF3THpuYXNDUnA2ckFsbWVxd0lDb0tzQ09LQ3JBc0NncXdMRm9Lc0N5YUNyQXV5Z3F3STFvcXNDOWFLckFnT2pxd0lXcEtzQ19hU3JBbXFscXdKaHBxc0NtYWFyQW55bnF3SkFxS3NDQUttckFqS3Bxd0pPcWFzQ1hLbXJBb21wcXdLaXFhc0N0S3FyQXNPcXF3TG5xcXNDOHFxckFtZXJxd0o0cktzQ29xMnJBbUN2cXdJS3Nhc0N3V3drQkM1ZDl3UjRYZmNFdWwzM0JBMkU5d1JVc3NVRjBJWWpDZ1Bubnd1U2xQc1NDYWo3RWdPdC14Slh5dnNTdHRiN0VvbjEteElzRHZ3U2JSRDhFbEVSX0JLbkV2d1NJQlA4RWo0Vl9CTHFGZndTNVJiOEVxMFhfQko1R1B3U0pocjhFclViX0JLWHVWRVRudXlQRV9oV2F4cGM5bGQ0JmV4az04NDQzNzg4NTImYXdiaWRfY9Wl8LBhNEFGd0FhNEdOOEZsLXlQZkdiNVJmX1hRd1BiajJyRzNIbXhfX3lwcXRRZjRHd3RMSlc4UU9MQW5ISDgzMFdVSE5LamRFYVN1akdZMEZhb2FFZWFRM0RaRFdXV0NpS3dhc1o0TXlOWFhFMktLUHRDRkVkckstVzc1S19Ea3YwcWdiX0JSZlQweWFQbTVrc3FsRC1uZjhTLW5XZERneUkwczJpTHBEVWtpdzNsRFJFJmHhawRfZA3A9AIFQ0RGdGRWWjluZ3pxVDdJUmlUNDhmZm1fQk5VN2kwM05UNUNQOWVSZk5XZE1qOVM1RENmNTM0YXlUQ1ZEdG9BWDQxU0hrNnpyYlZOWDhOSDJNNjltelAyX1BKRXZydi1uRzUyaVp4NE1TSmt3d0xUZWlsc2g3encwWEFwRHdIcGc2bFNjb1hmdjE3aGtuMmZ6YktPV1hvbTRaeU9UblpvZlFFbEFsMkNIR0NWTlUtQnJrNTRvMG0ybmJhdkc0S2tlTXdBVDFwd29BMVBSX2Q2UEZTT2VSVGhEYjJwbkxaRHZnRUxZeElhMnM4LUh1RjhmdXZ6Y2JHT0tGWWFmQVc5TGtmSHplZG9mcVJ4Zm1vMGdtWUhlUmNMbDdJTWFuNDV4U216b1NzM0J3blNROGx6NXBYd2p3TDhYQUViWjVqdXVQdC1oaXBfS3prRGxhcVlpQkxUTk9PeWdKY01mS0JQUGFWN1F0b0tKcnJLRzRQVm9jM2RZQXA3bGNsVUFVNFBEN2FJYWlZTGE5OHI0alhoc0dLcUFCOWxsRlhRRG4tcWtYdk1YWUZWQjN2clY2bjg5Z3hfanBjdDNKQURTYmVNX1NfVkhzQTRGQ3RIckp0NEt1bmxnQjl6UXY2NEtVRFVlWFU3QXFENEstSl95TGhsWUZkX1NVc3pwalBUZURWeTV3WFA2Z2gwbnl1VkpSNXFvclk4dnN5dzJ0LTF5NFBGVU9td3UyMEgxNEFab2d0ODNLekRadWMycEN6UHNhMFFrVWFXWEo1ZUtwQ2s2M29vTlVMdnlMYWtycl9iLThpRWdPdk5DcjN4bkt3NUxxd3NzZ3JBeEYtaE9yVUM3LXkwX0g5UEV1ZEsyaGN1MGk3NVRCNVpzUHMwWExZU1NQOGdQSDBwenc4YzM5UmR4Umh6MTZhVmpJU1ZYSjVSVVhvS2tETHJMMmF2VGNIZ2hVUEp0a2VkVVpWbHlXMHFPX2xyaTdJWEFQa3VMM0o0WUZYT1pyMno0ZE1vMElpUzd1S3JzVU1SUHpwR0xlSk9JUHp1WmVOVXVOcEh6eEhXZGxGZHE3VEh1MWhjVHpMTzRLclZDSXBVZDZxX1h3cXZWZHkxaTFLcGFTaXJOMm9aUkRXcXZ4akVmMjhOTURaOF9uMzA2a01LLVNwUXVxZ1VjV2ZYWjJHRk1xYmpUc2lKN0I3UnltVVVKTGdZeXR2SGpITVlqallHX1o5b3BtU1p2c1RkS3Roc09nZk9qVmhsNV9kcVJ5NWtUWF8tUjNjNy1rYTlBZE4xeXVUZnVSUTQ5d3FDdG04M1o1RUNpYlNvWVM3VnhTdEUwVUhLYnhrbjFwMVlxNU1oRkdLcF9TTDBmbXV3RWZqSmpiUDZZZllOT2pkY3ZLVDhJRnhpTkx4clVHYUFLUW5GajM5QXZnM3Z6UXkzLTJMQzl4dzB2bUxOTHlEUWZ4YVNWTWdwREZ2Mm9iWVZCT0VzTzVrM21senVGQmdSXzd2X2lKRklsbkNXWTVBaThuSFpia2RNZ3RwSlZ2b0lYd0c4ZTJjREl6Y1dBdGxXeGVZSXpEZUFkRFBxNmZMdFVmTVJISTlVdGZhQUZPemhOSSZjaWQ9Q0FRU0d3RElDYWFOTzdyS1ZEeGg3UXNXek1IdlNkYVlqT0h0QVhWbHJCZ0ImYV9jaWQ9gAMAiAMBkAMAmAMUoAMBqgPnAQq_AWh0dHAONw_-sAwOsAzwwkM4QjE0U1pBY1Jwd0ItNnRkUXlvU1ZRNjdiSXVVM0dfY2RWT1NkRUxpX0pkQ2luMGZzcXpJNXU3dlZJMWZoeEx1WFl4TE12WWdFS21SX2M1WWFDWi1La0RVY2x3JnByPTEwOiR7QVVDVElPTl9QUklDRX0aEzM5NjcwMDE0Mzg0MjEwMzIzODQiCDc3MjIxNzkzKgQzOTQxwAPYBMgDANgDAOADAOgDAPgDA4AEAJIECS9vcGVucnRiMpgEAKIEDTM3LiacC5CoBACyBAwIABAAGAAgADAAOAC4BADABADIBADaBAIIAeAEAPAEDg4a8EOIBQGYBQCgBbOby_WVje69PaoFKjQwMDIwM2NlLWFjNzktNDQxMS1iZDhkLWFkYjRjMWViMGViMH43MTV-McAFAMkFABJrGhTwP9IFCQkFC0AAAADYBQHgBQHwBYzGAvoFBAGIKJAGAJgGALgGAMEGASE0AADwP9AG7o8B2gYWChAJEhkBAbeg4AYB8gYCCACABwGIBwCgBwGqBwwxMzA2MTk0OTc4MDjIB6OABtIHDQkRNwE1CNoHBgFtsBgA4AcA6gcCCADwB-exCYoIAhAAlQgAAIA_mAgBwAikQ9IICQjz__8_EAAYAA..&s=03ef793b916c28023490dc36c69d92a45ac2a363&pp=1.475144

Requested by

Host: blank
URL: about:blank

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.151.36 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

3de18de6515ebb123717b0086d1f7e9c1e8ff857a2adb39f3f15e8cba5028901

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:40 GMT
content-encoding: gzip
x-creative-id: 77221793
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
x-proxy-origin: 37.19.212.193; 37.19.212.193; 897.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
x-xss-protection: 0
pragma: no-cache
an-x-request-uuid: 94793d35-8946-40e5-a864-23f3e61335fe
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 if Show response
lax1-ib.adnxs.com/ Frame 44B8 9 KB
6 KB 113ms
112ms Document
text/html 104.254.151.36
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://lax1-ib.adnxs.com/if?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QL_NvRTCX8bAAADANYABQEIg7nEqQYQwLuyxKTZ54Y3GIXq7pb529yLZyo2CZWW42d1xPs_Ef8_Tpgwmvc_GQAAAEAKV0FAIWoKrgMxmvc_KV4qNuZ1xPs_MQAAAAAAAAhAMLGtxgg4sxlA5R5IZVChn-kkWLrgfGAAaMmwRHijgAaAAQGKAQNVU0SSAQNVU0SYAawCoAH6AagBAbABALgBAsABBcgBAtABCdgBAOABAPABALICJGZmZDQxMDg1LTc3ZjItNGQyNi05OTg3LTA0MjIzMDU2MWZiMdgCpEPgAur5JeoCGWFueWZpbGUtbm90ZXBhZC5zZW1hYW4uY2HyAg0KBkhFSUdIVBIDMjUw8gIMCgVXSURUSBIDMzAw8gIhCgZMT0FERVISF3JlbmRlcl9wb3N0X2Fkc192MS5odG1s8gIXCgpJRlJBTUVfS0VZEgk4NDQzNzg4NTLyAsgVCgtQUkVfU0NSSVBUUxK4FTxzY3JpcHQ-KGZ1bmN0aW9uKCl7LyoKCiBDb3B5cmlnaHQgVGhlIENsb3N1cmUgTGlicmFyeSBBdXRob3JzLgogU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjAKKi8KdmFyIGs9dGhpc3x8c2VsZjt2YXIgbD1BcnJheS5wcm90b3R5cGUuaW5kZXhPZj9mdW5jdGlvbihhLGMpe3JldHVybiBBcnJheS5wcm90b3R5cGUuaW5kZXhPZi5jYWxsKGEsYyx2b2lkIDApfTpmdW5jdGlvbihhLGMpe2lmKCJzdHJpbmciPT09dHlwZW9mIGEpcmV0dXJuInN0cmluZyIhPT10eXBlb2YgY3x8MSE9Yy5sZW5ndGg_LTE6YS5pbmRleE9mKGMsMCk7Zm9yKHZhciBlPTA7ZTxhLmxlbmd0aDtlKyspaWYoZSBpbiBhJiZhW2VdPT09YylyZXR1cm4gZTtyZXR1cm4tMX07ZnVuY3Rpb24gbShhKXttWyIgIl0oYSk7cmV0dXJuIGF9bVsiICJdPWZ1bmN0aW9uKCl7fTtmdW5jdGlvbiBuKGEpe2E9dm9pZCAwPT09YT9kb2N1bWVudDphO3JldHVybiBhLmNyZWF0ZUVsZW1lbnQoImltZyIpfTtmdW5jdGlvbiBwKGEsYyxlKXt2YXIgYj0hMTtiPXZvaWQgMD09PWI_ITE6YjthLmdvb2dsZV9pbWFnZV9yZXF1ZXN0c3x8KGEuZ29vZ2xlX2ltYWdlX3JlcXVlc3RzPVtdKTt2YXIgZD1uKGEuZG9jdW1lbnQpO2lmKGUpe3ZhciBmPWZ1bmN0aW9uKCl7aWYoZSl7dmFyIGc9YS5nb29nbGVfaW1hZ2VfcmVxdWVzdHMsaD1sKGcsZCk7MDw9aCYmQXJyYXkucHJvdG90eXBlLnNwbGljZS5jYWxsKGcsaCwxKX1kLnJlbW92ZUV2ZW50TGlzdGVuZXImJmQucmVtb3ZlRXZlbnRMaXN0ZW5lcigibG9hZCIsZiwhMSk7ZC5yZW1vdmVFdmVudExpc3RlbmVyJiZkLnJlbW92ZUV2ZW50TGlzdGVuZXIoImVycm9yIixmLCExKX07ZC5hZGRFdmVudExpc3RlbmVyJiZkLmFkZEV2ZW50TGlzdGVuZXIoImxvYWQiLGYsITEpO2QuYWRkRXZlbnRMaXN0ZW5lciYmZC5hZGRFdmVudExpc3RlbmVyKCJlcnJvciIsZiwhMSl9YiYmKGQuYXR0cmlidXRpb25TcmM9IiIpO2Quc3JjPWM7YS5nb29nbGVfaW1hZ2VfcmVxdWVzdHMucHVzaChkKX0KO2Z1bmN0aW9uIHEoKXt2YXIgYT1kb2N1bWVudC5jdXJyZW50U2NyaXB0O3JldHVybihhPXZvaWQgMD09PWE_bnVsbDphKSYmIjc3Ij09PWEuZ2V0QXR0cmlidXRlKCJkYXRhLWpjIik_YTpkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCdbZGF0YS1qYz0iNzciXScpfTt2YXIgcj1SZWdFeHAoIl5odHRwcz86Ly8oXFx3fC0pK1xcLmNkblxcLmFtcHByb2plY3RcXC4obmV0fG9yZykoXFw_fC98JCkiKTsKZnVuY3Rpb24gdCgpe3ZhciBhPWs7dmFyIGM9W107dmFyIGU9bnVsbDtkb3t2YXIgYj1hO3RyeXt2YXIgZDtpZihkPSEhYiYmbnVsbCE9Yi5sb2NhdGlvbi5ocmVmKWI6e3RyeXttKGIuZm9vKTtkPSEwO2JyZWFrIGJ9Y2F0Y2goaCl7fWQ9ITF9dmFyIGY9ZH1jYXRjaChoKXtmPSExfWlmKGYpe3ZhciBnPWIubG9jYXRpb24uaHJlZjtlPWIuZG9jdW1lbnQmJmIuZG9jdW1lbnQucmVmZXJyZXJ8fG51bGx9ZWxzZSBnPWUsZT1udWxsO2MucHVzaChuZXcgdShnfHwiIikpO3RyeXthPWIucGFyZW50fWNhdGNoKGgpe2E9bnVsbH19d2hpbGUoYSYmYiE9YSk7Yj0wO2ZvcihhPWMubGVuZ3RoLTE7Yjw9YTsrK2IpY1tiXS5kZXB0aD1hLWI7Yj1rO2lmKGIubG9jYXRpb24mJmIubG9jYXRpb24uYW5jZXN0b3JPcmlnaW5zJiZiLmxvY2F0aW9uLmFuY2VzdG9yT3JpZ2lucy5sZW5ndGg9PWMubGVuZ3RoLTEpZm9yKGE9MTthPGMubGVuZ3RoOysrYSlnPWNbYV0sZy51cmx8fChnLnVybD1iLmxvY2F0aW9uLmFuY2VzdG9yT3JpZ2luc1thLQoxXXx8IiIsZy5oPSEwKTtiPW5ldyB1KGsubG9jYXRpb24uaHJlZiwhMSk7Zz1udWxsO2ZvcihlPWE9Yy5sZW5ndGgtMTswPD1lOy0tZSlpZihmPWNbZV0sIWcmJnIudGVzdChmLnVybCkmJihnPWYpLGYudXJsJiYhZi5oKXtiPWY7YnJlYWt9Zz1udWxsO2U9Yy5sZW5ndGgmJmNbYV0udXJsOzAhPWIuZGVwdGgmJmUmJihnPWNbYV0pO2M9bmV3IHYoYixnKTtyZXR1cm4gYy5nP2MuZy51cmw6Yy5pLnVybH1mdW5jdGlvbiB2KGEsYyl7dGhpcy5pPWE7dGhpcy5nPWN9Zu1RBCB16RQodGhpcy51cmw9YTsFCxBoPSEhYwkLLGRlcHRoPW51bGx9O9GBqCB3KCl7dmFyIGE9dCgpLGM9YS5pbmRleE9mKCI_Iik7c2V0VGltZW91dCgRMw0xoGU9dm9pZCAwPT09ZT8uMDE6ZTtpZighKE1hdGgucmFuZG9tKCk-ZSkpBV_wYWI9cSgpO2I9Imh0dHBzOi8vIisoYiYmInRydWUiPT09Yi5nZXRBdHRyaWJ1dGUoImRhdGEtamMtcmNkIik_InBhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24tY24uY29tIjoiYiMAAC4BIAwpKyIvCSJ4L2dlbl8yMDQ_aWQ9amNhJmpjPTc3JnZlcnNpb249IhLACAxkPShkAbEMKSYmZFqZAA0xoCIpfHwidW5rbm93biI7ZT1iK2QrIiZzYW1wbGU9IitlO2I9d2luZG93BVgAZjk0FGY_ITE6ZiEzNGQ9Yi5uYXZpZ2F0b3IpMg4AkC51c2VyQWdlbnQsZD0vQ2hyb21lLy50ZXN0KGQpJiYhL0VkZ2UVESQ_ITA6ITE7ZCYmHVEwLnNlbmRCZWFjb24_ClYYACAoZSk6cChiLGUaaAkEPT0NnhgpfX0sMCk7GnoILDA8PWM_YS5zdWJzdA5aCRwoMCxjKTphfQngEC5yZmw9XSMNNYBlbmNvZGVVUklDb21wb25lbnQodygpKX07fSkuY2FsbChBpZgpOwo8L3NjcmlwdD7yAskCCgpFWFRSQV9UQUdTEroCPGRpdiBzdHkhUohwb3NpdGlvbjogYWJzb2x1dGU7IGxlZnQ6IDBweDsgdG9wOgkKcHZpc2liaWxpdHk6IGhpZGRlbjsiPjxpbWcgc3JjWYdJFAQyLkJZAkE2DR4uMgIUYXdiaWQmBQbwhl9iPUFLQW1mLUFucllrSnpPQmxUc0JCQjJXS2tqM0ZKT0sydV9DajI1NFlkZnB2WVA2aWJKVjdRaE5RSzBtbXZFV25sSjkxTTNxeDVGbS1vSFI0Mi1seHREbS1MbFhRWnVXMGlRIiBib3JkZXI9MCB3aWR0aD0xIGhlaWdodD0xIGFsdD0iIjEaqGRpc3BsYXk6bm9uZSI-PC9kaXY-8gKZAQoMUE9TVF9TQ1JJUFRTEogBPHMlajYIASkAUGFkcy5nLmRvdWJsZWNsaWNrLm5ldDEGPHhiZmVfYmFja2ZpbGwuanMBZS21DVMEPihZAWAge3IzcHgoJzg0NDM3ODg1MicpO30pKCk7PeoQkxYKEEgBnTRQT1JUX1BBUkFNUxL-FZEjipQA8H1hZGZldGNoP2Fkaz0xOTQ2ODkyODc4JmFkc2FmZT1tZWRpdW0mY2xpZW50PWNhLXB1Yi0zMDc2ODkwMDEyNzQxNDY3JmZvcm1hdD0zMDB4MjUwX2FzJmlwPTM3LjE5LjIxMi4xOTMmb3V0cHV0PWh0bWwmdW52aWV3ZWRfcG9JiyBfc3RhcnQ9MSaldgxueWZpTgEOECZzdWJfDYoAYkGQ8O1yLTQ3MTAxMjQmaGw9ZW4mYWNlaWQ9TUNFWXRBQ3NHclFBd0JxMEFENGR0QUJESGJRQXhZTTBBWktITkFIc2p6UUJkSkUwQWFPU05BSGFralFCU1pNMEFYNlROQUdSa3pRQnRaTTBBZUdUTkFIdGt6UUJFcFEwQVM2VU5BRXZsRFFCTlpRMEFUZVVOQUZCbERRQlNKUTBBVkdVTkFGU2xEUUJWWlEwQVYtVU5BRm9sRFFCZlpRMEFZS1VOQUdsbERRQnFKUTBBYXVVTkFHMWxEUUJ0NVEwQWJpVU5BRzVsRFFCdXBRMEFidVVOQUc5AXAseDVRMEFkQ1VOQUhUARAAMgFABGQtARAAagEQ9FUDUzNOQkFVMXpRUUd6dm9vQl9fY2VBcE1mWEFLQklGd0NwaUJjQWlqNWlBSzdfb2dDdl82SUFpZENxZ0lvUXFvQ0tVS3FBdlZUcWdLVWFxb0NfbmlxQW9DYnFnS0JtNm9DZ3B1cUFxS29xZ0xscktvQzFyeXFBb2JOcWdKQy1Lb0NRZnVxQXNNTXF3SmFJYXNDaENlckFsUW9xd0w3SzZzQzFEYXJBanc0cXdMOU9hc0NKVHFyQWlrNnF3SXRPcXNDdFR5ckFyMC1xd0pDUWFzQ0hFYXJBbXhLcXdLY1M2c0NZRTZyQXJsT3F3SWdVS3NDOUZDckFnSlJxd0lLVWFzQ0lGeXJBb1JkcXdKbFhxc0NSR0NyQW1WZ3F3SmlZNnNDM0dTckFnOXFxd0k5YXFzQ0czR3JBbFZ4cXdMeGNhc0NnSE9yQW9WenF3TE1kS3NDQ1hhckFrbDJxd0p4ZHFzQ0dIZXJBaDEzcXdJaWQ2c0NKM2VyQWl4M3F3SUtlYXNDYW5xckFxcDZxd0loZmFzQ1U0Q3JBcHVCcXdKVGlxc0NvSXFyQXZhTHF3SjFqS3NDdFl5ckFyZU1xd0tiajZzQ0E1Q3JBa2FRcXdLOGs2c0NIWmFyQWdxWnF3SlptcXNDbzV1ckFyaWRxd0x6bmFzQ1JwNnJBbG1lcXdJQ29Lc0NPS0NyQXNDZ3F3TEZvS3NDeWFDckF1eWdxd0kxb3FzQzlhS3JBZ09qcXdJV3BLc0NfYVNyQW1xbHF3SmhwcXNDbWFhckFueW5xd0pBcUtzQ0FLbXJBaktwcXdKT3Fhc0NYS21yQW9tcHF3S2lxYXNDdEtxckFzT3Fxd0xucXFzQzhxcXJBbWVycXdKNHJLc0NvcTJyQW1DdnF3SUtzYXNDd1d3a0JDNWQ5d1I0WGZjRXVsMzNCQTJFOXdSVXNzVUYwSVlqQ2dQbm53dVNsUHNTQ2FqN0VnT3QteEpYeXZzU3R0YjdFb24xLXhJc0R2d1NiUkQ4RWxFUl9CS25FdndTSUJQOEVqNFZfQkxxRmZ3UzVSYjhFcTBYX0JKNUdQd1NKaHI4RXJVYl9CS1h1VkVUbnV5UEVfaFdheHBjOWxkNCZleGs9ODQ0Mzc4ODUyJmF3YmlkX2PVpfCwYTRBRndBYTRHTjhGbC15UGZHYjVSZl9YUXdQYmoyckczSG14X195cHF0UWY0R3d0TEpXOFFPTEFuSEg4MzBXVUhOS2pkRWFTdWpHWTBGYW9hRWVhUTNEWkRXV1dDaUt3YXNaNE15TlhYRTJLS1B0Q0ZFZHJLLVc3NUtfRGt2MHFnYl9CUmZUMHlhUG01a3NxbEQtbmY4Uy1uV2REZ3lJMHMyaUxwRFVraXczbERSRSZh4WsEX2QNwPQCBUNERnRkVlo5bmd6cVQ3SVJpVDQ4ZmZtX0JOVTdpMDNOVDVDUDllUmZOV2RNajlTNURDZjUzNGF5VENWRHRvQVg0MVNIazZ6cmJWTlg4TkgyTTY5bXpQMl9QSkV2cnYtbkc1MmlaeDRNU0prd3dMVGVpbHNoN3p3MFhBcER3SHBnNmxTY29YZnYxN2hrbjJmemJLT1dYb200WnlPVG5ab2ZRRWxBbDJDSEdDVk5VLUJyazU0bzBtMm5iYXZHNEtrZU13QVQxcHdvQTFQUl9kNlBGU09lUlRoRGIycG5MWkR2Z0VMWXhJYTJzOC1IdUY4ZnV2emNiR09LRllhZkFXOUxrZkh6ZWRvZnFSeGZtbzBnbVlIZVJjTGw3SU1hbjQ1eFNtem9TczNCd25TUThsejVwWHdqd0w4WEFFYlo1anV1UHQtaGlwX0t6a0RsYXFZaUJMVE5PT3lnSmNNZktCUFBhVjdRdG9LSnJyS0c0UFZvYzNkWUFwN2xjbFVBVTRQRDdhSWFpWUxhOThyNGpYaHNHS3FBQjlsbEZYUURuLXFrWHZNWFlGVkIzdnJWNm44OWd4X2pwY3QzSkFEU2JlTV9TX1ZIc0E0RkN0SHJKdDRLdW5sZ0I5elF2NjRLVURVZVhVN0FxRDRLLUpfeUxobFlGZF9TVXN6cGpQVGVEVnk1d1hQNmdoMG55dVZKUjVxb3JZOHZzeXcydC0xeTRQRlVPbXd1MjBIMTRBWm9ndDgzS3pEWnVjMnBDelBzYTBRa1VhV1hKNWVLcENrNjNvb05VTHZ5TGFrcnJfYi04aUVnT3ZOQ3IzeG5LdzVMcXdzc2dyQXhGLWhPclVDNy15MF9IOVBFdWRLMmhjdTBpNzVUQjVac1BzMFhMWVNTUDhnUEgwcHp3OGMzOVJkeFJoejE2YVZqSVNWWEo1UlVYb0trRExyTDJhdlRjSGdoVVBKdGtlZFVaVmx5VzBxT19scmk3SVhBUGt1TDNKNFlGWE9acjJ6NGRNbzBJaVM3dUtyc1VNUlB6cEdMZUpPSVB6dVplTlV1TnBIenhIV2RsRmRxN1RIdTFoY1R6TE80S3JWQ0lwVWQ2cV9Yd3F2VmR5MWkxS3BhU2lyTjJvWlJEV3F2eGpFZjI4Tk1EWjhfbjMwNmtNSy1TcFF1cWdVY1dmWFoyR0ZNcWJqVHNpSjdCN1J5bVVVSkxnWXl0dkhqSE1ZampZR19aOW9wbVNadnNUZEt0aHNPZ2ZPalZobDVfZHFSeTVrVFhfLVIzYzcta2E5QWROMXl1VGZ1UlE0OXdxQ3RtODNaNUVDaWJTb1lTN1Z4U3RFMFVIS2J4a24xcDFZcTVNaEZHS3BfU0wwZm11d0VmakpqYlA2WWZZTk9qZGN2S1Q4SUZ4aU5MeHJVR2FBS1FuRmozOUF2ZzN2elF5My0yTEM5eHcwdm1MTkx5RFFmeGFTVk1ncERGdjJvYllWQk9Fc081azNtbHp1RkJnUl83dl9pSkZJbG5DV1k1QWk4bkhaYmtkTWd0cEpWdm9JWHdHOGUyY0RJemNXQXRsV3hlWUl6RGVBZERQcTZmTHRVZk1SSEk5VXRmYUFGT3poTkkmY2lkPUNBUVNHd0RJQ2FhTk83cktWRHhoN1FzV3pNSHZTZGFZak9IdEFYVmxyQmdCJmFfY2lkPYADAIgDAZADAJgDFKADAaoD5wEKvwFodHRwDjcP_rAMDrAM8MJDOEIxNFNaQWNScHdCLTZ0ZFF5b1NWUTY3Ykl1VTNHX2NkVk9TZEVMaV9KZENpbjBmc3F6STV1N3ZWSTFmaHhMdVhZeExNdllnRUttUl9jNVlhQ1otS2tEVWNsdyZwcj0xMDoke0FVQ1RJT05fUFJJQ0V9GhMzOTY3MDAxNDM4NDIxMDMyMzg0Igg3NzIyMTc5MyoEMzk0McAD2ATIAwDYAwDgAwDoAwD4AwOABACSBAkvb3BlbnJ0YjKYBACiBA0zNy4mnAuQqAQAsgQMCAAQABgAIAAwADgCuAQAwAQAyAQA2gQCCAHgBADwBA4OGvBDiAUBmAUAoAWzm8v1lY3uvT2qBSo0MDAyMDNjZS1hYzc5LTQ0MTEtYmQ4ZC1hZGI0YzFlYjBlYjB-NzE1fjHABQDJBQAOahoYAPA_0gUJCQULQAAAANgFAeAFAfAFjMYC-gUEAYgokAYAmAYAuAYAwQYBIQExJNAG7o8B2gYWChAJEhkBAbeg4AYB8gYCCACABwGIBwCgBwGqBwwxMzA2MTk0OTc4MDjIB6OABtIHDQkRNwE1CNoHBgFtsBgA4AcA6gcCCADwB-exCYoIAhAAlQgAAIA_mAgBwAikQ9IICQjz__8_EAAYAA..&s=9be3c993fac4b5955046d55d686ae7430afa724e

Requested by

Host: lax1-ib.adnxs.com
URL: https://lax1-ib.adnxs.com/ab?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QL_NvBMfxsAAAMA1gAFAQiDucSpBhDAu7LEpNnnhjcYherulvnb3ItnKjYJXio25nXE-z8RagquAzGa9z8ZAAAAQApXQUAhagquAzGa9z8pXioJJAQxAAUBsAhAMLGtxgg4sxlA5R5IZVChn-kkWLrgfGAAaMmwRHijgAaAAQGKAQNVU0SSAQEG9IICmAGsAqAB-gGoAQGwAQC4AQLAAQXIAQLQAQnYAQDgAQDwAQCyAiRmZmQ0MTA4NS03N2YyLTRkMjYtOTk4Ny0wNDIyMzA1NjFmYjHYAqRD4ALq-SXqAhlhbnlmaWxlLW5vdGVwYWQuc2VtYWFuLmNh8gINCgZIRUlHSFQSAzI1MPICDAoFV0lEVEgSAzMwMPICIQoGTE9BREVSEhdyZW5kZXJfcG9zdF9hZHNfdjEuaHRtbPICFwoKSUZSQU1FX0tFWRIJODQ0Mzc4ODUy8gLIFQoLUFJFX1NDUklQVFMSuBU8c2NyaXB0PihmdW5jdGlvbigpey8qCgogQ29weXJpZ2h0IFRoZSBDbG9zdXJlIExpYnJhcnkgQXV0aG9ycy4KIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wCiovCnZhciBrPXRoaXN8fHNlbGY7dmFyIGw9QXJyYXkucHJvdG90eXBlLmluZGV4T2Y_ZnVuY3Rpb24oYSxjKXtyZXR1cm4gQXJyYXkucHJvdG90eXBlLmluZGV4T2YuY2FsbChhLGMsdm9pZCAwKX06ZnVuY3Rpb24oYSxjKXtpZigic3RyaW5nIj09PXR5cGVvZiBhKXJldHVybiJzdHJpbmciIT09dHlwZW9mIGN8fDEhPWMubGVuZ3RoPy0xOmEuaW5kZXhPZihjLDApO2Zvcih2YXIgZT0wO2U8YS5sZW5ndGg7ZSsrKWlmKGUgaW4gYSYmYVtlXT09PWMpcmV0dXJuIGU7cmV0dXJuLTF9O2Z1bmN0aW9uIG0oYSl7bVsiICJdKGEpO3JldHVybiBhfW1bIiAiXT1mdW5jdCmVCH07Zg3VeCBuKGEpe2E9dm9pZCAwPT09YT9kb2N1bWVudDphO3INQyQuY3JlYXRlRWxlARkYKCJpbWciKR1FBHAoITIwZSl7dmFyIGI9ITE7YhlSgGI_ITE6YjthLmdvb2dsZV9pbWFnZV9yZXF1ZXN0c3x8KFoaABA9W10pOwFRFGQ9bihhLhGXECk7aWYoDWsEZj0RyAgoKXsZFwRnPVpTADwsaD1sKGcsZCk7MDw9aCYmPjICJHNwbGljZS5jYWwBJ2xoLDEpfWQucmVtb3ZlRXZlbnRMaXN0ZW5lciYmUhcANCgibG9hZCIsZiwhMSk7UiMAYjoAEGVycm9yDTsYfTtkLmFkZEJzAD4UAD5wAD4gAAFtPhQAACg2agBYYiYmKGQuYXR0cmlidXRpb25TcmM9IiIBvhBzcmM9Y163ASQucHVzaChkKX0KWUsEcShJAQRhPTGsNC5jdXJyZW50U2NyaXB0TU8AKDJuAjBudWxsOmEpJiYiNzciQYAQLmdldEENkDhlKCJkYXRhLWpjIik_YToVVzxxdWVyeVNlbGVjdG9yKCdbDSUAPQFEDF0nKX1FN_BScj1SZWdFeHAoIl5odHRwcz86Ly8oXFx3fC0pK1xcLmNkblxcLmFtcHByb2plY3RcXC4obmV0fG9yZykoXFw_fC98JCkiKTsKZnVuY3Rpb24gdCgR4ABrBWEMYz1bXQUJBGU9AcYMO2Rve0GvGGI9YTt0cnkFDABkQa0YZD0hIWImJgEkHCE9Yi5sb2NhIWogLmhyZWYpYjp7AS2QbShiLmZvbyk7ZD0hMDticmVhayBifWNhdGNoKGgpe31kPSExfQFeCGY9ZBkXAGYBFgxpZihmCZkAZz5eAAw7ZT1idTkEJiYZDCgucmVmZXJyZXJ8fAGXJH1lbHNlIGc9ZSwNywBjKeAwbmV3IHUoZ3x8IiIpKQXVFGE9Yi5wYSHUGYYAYQX_UH19d2hpbGUoYSYmYiE9YSk7Yj0wO4HeEGE9Yy5shdZ0LTE7Yjw9YTsrK2IpY1tiXS5kZXB0aD1hLWI7Yj1rISs5HgGuNSo4YW5jZXN0b3JPcmlnaW5zbhwADWsAPR11ACkJhgwxO2E8EYpMOysrYSlnPWNbYV0sZy51cmx8fCgFCC5CATp2ABRbYS0KMV0hDBgsZy5oPSEwAeMpIgBrGash1WX_AGclFiUCBGU9MgQBIDA8PWU7LS1lKSG6RD1jW2VdLCFnJiZyLnRlc3QoZgGPICkmJihnPWYpLAUOLCYmIWYuaCl7Yj1mO0UbAH0NXQBlFeYEJiYBzAE7BDswQWUlWggmJmUFSAEbCCk7YwWtFHYoYixnKW2LGCBjLmc_Yy4F-gw6Yy5pAUAAfbFTBCB2odYcKXt0aGlzLmlB1QEJCGc9YxkiAHUdIgh1cmwRJBRoPSEhYzsFLwWIJQrdLwB3lSkcdCgpLGM9YS7tfkAoIj8iKTtzZXRUaW1lb3V0KBGMDTEAZdlWGGU_LjAxOmVBNUQhKE1hdGgucmFuZG9tKCk-ZSlpDwxiPXEoIaQAImX_NDovLyIrKGImJiJ0cnVlgWsAYlZrBDgtcmNkIik_InBhZ2VhZDLNtxBzeW5kaWm5IC1jbi5jb20iOmYjAAUgDCkrIi8JRXgvZ2VuXzIwND9pZD1qY2EmamM9NzcmdmVyc2lvbj0ihUUMZD0oZAGxACmhtlIEBQAtDTEwIil8fCJ1bmtub3duImHjXCtkKyImc2FtcGxlPSIrZTtiPXdpbmRvdwVYAGY5NABm4YoAZiEzNGQ9Yi5uYXZpZ2F0b3IpMg4AUC51c2VyQWdlbnQsZD0vQ2hyb21lL0mbIGQpJiYhL0VkZxkRHD8hMDohMTtkYZMVUTAuc2VuZEJlYWNvbj8KHWkdGCQoZSk6cChiLGUsInoICZ4QKX19LDBVoCgwPD1jP2Euc3VicxJaCRwoMCxjKTphfQngDC5yZmwuAggarwhoZW5jb2RlVVJJQ29tcG9uZW50KHcoKSl9O30p6dtBmhQpOwo8L3PFmGw-8gLJAgoKRVhUUkFfVEFHUxK6AjxkaXYgc3R5IVIMcG9zaaGxZDogYWJzb2x1dGU7IGxlZnQ6IDBweDsgdG9wDQpkdmlzaWJpbGl0eTogaGlkZGVuOyI-PGltZyDhTFWHSRRKWQJBNg0eLjICFGF3YmlkJgUG8HlfYj1BS0FtZi1BbnJZa0p6T0JsVHNCQkIyV0trajNGSk9LMnVfQ2oyNTRZZGZwdllQNmliSlY3UWhOUUswbW12RVdubEo5MU0zcXg1Rm0tb0hSNDItbHh0RG0tTGxYUVp1VzBpUSIgYm9yZGVyPTAgd2lkdGg9MSBoZQ6-CyA9MSBhbHQ9IiIxGoBkaXNwbGF5Om5vbmUiPjwvZGl2PvICmQEKDFBPU1RfU0MWGgwIiAE8KWo2CAEWEApQYWRzLmcuZG91YmxlY2xpY2submV0MQY8eGJmZV9iYWNrZmlsbC5qcwFlCUsAPg1TAD6dJBwge3IzcHgoJyKlDBwnKTt9KSgpOz3qEJMWChBIAZ00UE9SVF9QQVJBTVMS_hWRI4qUAPB9YWRmZXRjaD9hZGs9MTk0Njg5Mjg3OCZhZHNhZmU9bWVkaXVtJmNsaWVudD1jYS1wdWItMzA3Njg5MDAxMjc0MTQ2NyZmb3JtYXQ9MzAweDI1MF9hcyZpcD0zNy4xOS4yMTIuMTkzJm91dHB1dD1odG1sJnVudmlld2VkX3BvSYsgX3N0YXJ0PTEmpXYEbnlWAQ4QJnN1Yl8NigBiQZDw7XItNDcxMDEyNCZobD1lbiZhY2VpZD1NQ0VZdEFDc0dyUUF3QnEwQUQ0ZHRBQkRIYlFBeFlNMEFaS0hOQUhzanpRQmRKRTBBYU9TTkFIYWtqUUJTWk0wQVg2VE5BR1JrelFCdFpNMEFlR1ROQUh0a3pRQkVwUTBBUzZVTkFFdmxEUUJOWlEwQVRlVU5BRkJsRFFCU0pRMEFWR1VOQUZTbERRQlZaUTBBVi1VTkFGb2xEUUJmWlEwQVlLVU5BR2xsRFFCcUpRMEFhdVVOQUcxbERRQnQ1UTBBYmlVTkFHNWxEUUJ1cFEwQWJ1VU5BRzkBcCx4NVEwQWRDVU5BSFQBEAAyAUAEZC0BEABqARD0VQNTM05CQVUxelFRR3p2b29CX19jZUFwTWZYQUtCSUZ3Q3BpQmNBaWo1aUFLN19vZ0N2XzZJQWlkQ3FnSW9RcW9DS1VLcUF2VlRxZ0tVYXFvQ19uaXFBb0NicWdLQm02b0NncHVxQXFLb3FnTGxyS29DMXJ5cUFvYk5xZ0pDLUtvQ1FmdXFBc01NcXdKYUlhc0NoQ2VyQWxRb3F3TDdLNnNDMURhckFqdzRxd0w5T2FzQ0pUcXJBaWs2cXdJdE9xc0N0VHlyQXIwLXF3SkNRYXNDSEVhckFteEtxd0tjUzZzQ1lFNnJBcmxPcXdJZ1VLc0M5RkNyQWdKUnF3SUtVYXNDSUZ5ckFvUmRxd0psWHFzQ1JHQ3JBbVZncXdKaVk2c0MzR1NyQWc5cXF3STlhcXNDRzNHckFsVnhxd0x4Y2FzQ2dIT3JBb1Z6cXdMTWRLc0NDWGFyQWtsMnF3SnhkcXNDR0hlckFoMTNxd0lpZDZzQ0ozZXJBaXgzcXdJS2Vhc0NhbnFyQXFwNnF3SWhmYXNDVTRDckFwdUJxd0pUaXFzQ29JcXJBdmFMcXdKMWpLc0N0WXlyQXJlTXF3S2JqNnNDQTVDckFrYVFxd0s4azZzQ0haYXJBZ3FacXdKWm1xc0NvNXVyQXJpZHF3THpuYXNDUnA2ckFsbWVxd0lDb0tzQ09LQ3JBc0NncXdMRm9Lc0N5YUNyQXV5Z3F3STFvcXNDOWFLckFnT2pxd0lXcEtzQ19hU3JBbXFscXdKaHBxc0NtYWFyQW55bnF3SkFxS3NDQUttckFqS3Bxd0pPcWFzQ1hLbXJBb21wcXdLaXFhc0N0S3FyQXNPcXF3TG5xcXNDOHFxckFtZXJxd0o0cktzQ29xMnJBbUN2cXdJS3Nhc0N3V3drQkM1ZDl3UjRYZmNFdWwzM0JBMkU5d1JVc3NVRjBJWWpDZ1Bubnd1U2xQc1NDYWo3RWdPdC14Slh5dnNTdHRiN0VvbjEteElzRHZ3U2JSRDhFbEVSX0JLbkV2d1NJQlA4RWo0Vl9CTHFGZndTNVJiOEVxMFhfQko1R1B3U0pocjhFclViX0JLWHVWRVRudXlQRV9oV2F4cGM5bGQ0JmV4az04NDQzNzg4NTImYXdiaWRfY9Wl8LBhNEFGd0FhNEdOOEZsLXlQZkdiNVJmX1hRd1BiajJyRzNIbXhfX3lwcXRRZjRHd3RMSlc4UU9MQW5ISDgzMFdVSE5LamRFYVN1akdZMEZhb2FFZWFRM0RaRFdXV0NpS3dhc1o0TXlOWFhFMktLUHRDRkVkckstVzc1S19Ea3YwcWdiX0JSZlQweWFQbTVrc3FsRC1uZjhTLW5XZERneUkwczJpTHBEVWtpdzNsRFJFJmHhawRfZA3A9AIFQ0RGdGRWWjluZ3pxVDdJUmlUNDhmZm1fQk5VN2kwM05UNUNQOWVSZk5XZE1qOVM1RENmNTM0YXlUQ1ZEdG9BWDQxU0hrNnpyYlZOWDhOSDJNNjltelAyX1BKRXZydi1uRzUyaVp4NE1TSmt3d0xUZWlsc2g3encwWEFwRHdIcGc2bFNjb1hmdjE3aGtuMmZ6YktPV1hvbTRaeU9UblpvZlFFbEFsMkNIR0NWTlUtQnJrNTRvMG0ybmJhdkc0S2tlTXdBVDFwd29BMVBSX2Q2UEZTT2VSVGhEYjJwbkxaRHZnRUxZeElhMnM4LUh1RjhmdXZ6Y2JHT0tGWWFmQVc5TGtmSHplZG9mcVJ4Zm1vMGdtWUhlUmNMbDdJTWFuNDV4U216b1NzM0J3blNROGx6NXBYd2p3TDhYQUViWjVqdXVQdC1oaXBfS3prRGxhcVlpQkxUTk9PeWdKY01mS0JQUGFWN1F0b0tKcnJLRzRQVm9jM2RZQXA3bGNsVUFVNFBEN2FJYWlZTGE5OHI0alhoc0dLcUFCOWxsRlhRRG4tcWtYdk1YWUZWQjN2clY2bjg5Z3hfanBjdDNKQURTYmVNX1NfVkhzQTRGQ3RIckp0NEt1bmxnQjl6UXY2NEtVRFVlWFU3QXFENEstSl95TGhsWUZkX1NVc3pwalBUZURWeTV3WFA2Z2gwbnl1VkpSNXFvclk4dnN5dzJ0LTF5NFBGVU9td3UyMEgxNEFab2d0ODNLekRadWMycEN6UHNhMFFrVWFXWEo1ZUtwQ2s2M29vTlVMdnlMYWtycl9iLThpRWdPdk5DcjN4bkt3NUxxd3NzZ3JBeEYtaE9yVUM3LXkwX0g5UEV1ZEsyaGN1MGk3NVRCNVpzUHMwWExZU1NQOGdQSDBwenc4YzM5UmR4Umh6MTZhVmpJU1ZYSjVSVVhvS2tETHJMMmF2VGNIZ2hVUEp0a2VkVVpWbHlXMHFPX2xyaTdJWEFQa3VMM0o0WUZYT1pyMno0ZE1vMElpUzd1S3JzVU1SUHpwR0xlSk9JUHp1WmVOVXVOcEh6eEhXZGxGZHE3VEh1MWhjVHpMTzRLclZDSXBVZDZxX1h3cXZWZHkxaTFLcGFTaXJOMm9aUkRXcXZ4akVmMjhOTURaOF9uMzA2a01LLVNwUXVxZ1VjV2ZYWjJHRk1xYmpUc2lKN0I3UnltVVVKTGdZeXR2SGpITVlqallHX1o5b3BtU1p2c1RkS3Roc09nZk9qVmhsNV9kcVJ5NWtUWF8tUjNjNy1rYTlBZE4xeXVUZnVSUTQ5d3FDdG04M1o1RUNpYlNvWVM3VnhTdEUwVUhLYnhrbjFwMVlxNU1oRkdLcF9TTDBmbXV3RWZqSmpiUDZZZllOT2pkY3ZLVDhJRnhpTkx4clVHYUFLUW5GajM5QXZnM3Z6UXkzLTJMQzl4dzB2bUxOTHlEUWZ4YVNWTWdwREZ2Mm9iWVZCT0VzTzVrM21senVGQmdSXzd2X2lKRklsbkNXWTVBaThuSFpia2RNZ3RwSlZ2b0lYd0c4ZTJjREl6Y1dBdGxXeGVZSXpEZUFkRFBxNmZMdFVmTVJISTlVdGZhQUZPemhOSSZjaWQ9Q0FRU0d3RElDYWFOTzdyS1ZEeGg3UXNXek1IdlNkYVlqT0h0QVhWbHJCZ0ImYV9jaWQ9gAMAiAMBkAMAmAMUoAMBqgPnAQq_AWh0dHAONw_-sAwOsAzwwkM4QjE0U1pBY1Jwd0ItNnRkUXlvU1ZRNjdiSXVVM0dfY2RWT1NkRUxpX0pkQ2luMGZzcXpJNXU3dlZJMWZoeEx1WFl4TE12WWdFS21SX2M1WWFDWi1La0RVY2x3JnByPTEwOiR7QVVDVElPTl9QUklDRX0aEzM5NjcwMDE0Mzg0MjEwMzIzODQiCDc3MjIxNzkzKgQzOTQxwAPYBMgDANgDAOADAOgDAPgDA4AEAJIECS9vcGVucnRiMpgEAKIEDTM3LiacC5CoBACyBAwIABAAGAAgADAAOAC4BADABADIBADaBAIIAeAEAPAEDg4a8EOIBQGYBQCgBbOby_WVje69PaoFKjQwMDIwM2NlLWFjNzktNDQxMS1iZDhkLWFkYjRjMWViMGViMH43MTV-McAFAMkFABJrGhTwP9IFCQkFC0AAAADYBQHgBQHwBYzGAvoFBAGIKJAGAJgGALgGAMEGASE0AADwP9AG7o8B2gYWChAJEhkBAbeg4AYB8gYCCACABwGIBwCgBwGqBwwxMzA2MTk0OTc4MDjIB6OABtIHDQkRNwE1CNoHBgFtsBgA4AcA6gcCCADwB-exCYoIAhAAlQgAAIA_mAgBwAikQ9IICQjz__8_EAAYAA..&s=03ef793b916c28023490dc36c69d92a45ac2a363&pp=1.475144

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.151.36 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

6a9497816bafa6f0bac35ef6a59f3f854ee2cfc9de2f7f88a7aafddcf7b9f4dc

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
access-control-allow-origin: *
an-x-request-uuid: 3fc964b6-86b4-473f-b4ce-0453a396edcc
cache-control: no-store, no-cache, private
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 19 Oct 2023 12:09:40 GMT
expires: Sat, 15 Nov 2008 16:00:00 GMT
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma: no-cache
server: nginx/1.21.3
vary: Accept-Encoding
x-creative-id: 77221793
x-proxy-origin: 37.19.212.193; 37.19.212.193; 897.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
x-xss-protection: 0

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame EDFD 52 KB
17 KB 394ms
49ms Document
text/html 23.47.64.191
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=3251&pub_id=1623654
Requested by: Host: lax1-ib.adnxs.com
URL: https://lax1-ib.adnxs.com/ab?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QL_NvBMfxsAAAMA1gAFAQiDucSpBhDAu7LEpNnnhjcYherulvnb3ItnKjYJXio25nXE-z8RagquAzGa9z8ZAAAAQApXQUAhagquAzGa9z8pXioJJAQxAAUBsAhAMLGtxgg4sxlA5R5IZVChn-kkWLrgfGAAaMmwRHijgAaAAQGKAQNVU0SSAQEG9IICmAGsAqAB-gGoAQGwAQC4AQLAAQXIAQLQAQnYAQDgAQDwAQCyAiRmZmQ0MTA4NS03N2YyLTRkMjYtOTk4Ny0wNDIyMzA1NjFmYjHYAqRD4ALq-SXqAhlhbnlmaWxlLW5vdGVwYWQuc2VtYWFuLmNh8gINCgZIRUlHSFQSAzI1MPICDAoFV0lEVEgSAzMwMPICIQoGTE9BREVSEhdyZW5kZXJfcG9zdF9hZHNfdjEuaHRtbPICFwoKSUZSQU1FX0tFWRIJODQ0Mzc4ODUy8gLIFQoLUFJFX1NDUklQVFMSuBU8c2NyaXB0PihmdW5jdGlvbigpey8qCgogQ29weXJpZ2h0IFRoZSBDbG9zdXJlIExpYnJhcnkgQXV0aG9ycy4KIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wCiovCnZhciBrPXRoaXN8fHNlbGY7dmFyIGw9QXJyYXkucHJvdG90eXBlLmluZGV4T2Y_ZnVuY3Rpb24oYSxjKXtyZXR1cm4gQXJyYXkucHJvdG90eXBlLmluZGV4T2YuY2FsbChhLGMsdm9pZCAwKX06ZnVuY3Rpb24oYSxjKXtpZigic3RyaW5nIj09PXR5cGVvZiBhKXJldHVybiJzdHJpbmciIT09dHlwZW9mIGN8fDEhPWMubGVuZ3RoPy0xOmEuaW5kZXhPZihjLDApO2Zvcih2YXIgZT0wO2U8YS5sZW5ndGg7ZSsrKWlmKGUgaW4gYSYmYVtlXT09PWMpcmV0dXJuIGU7cmV0dXJuLTF9O2Z1bmN0aW9uIG0oYSl7bVsiICJdKGEpO3JldHVybiBhfW1bIiAiXT1mdW5jdCmVCH07Zg3VeCBuKGEpe2E9dm9pZCAwPT09YT9kb2N1bWVudDphO3INQyQuY3JlYXRlRWxlARkYKCJpbWciKR1FBHAoITIwZSl7dmFyIGI9ITE7YhlSgGI_ITE6YjthLmdvb2dsZV9pbWFnZV9yZXF1ZXN0c3x8KFoaABA9W10pOwFRFGQ9bihhLhGXECk7aWYoDWsEZj0RyAgoKXsZFwRnPVpTADwsaD1sKGcsZCk7MDw9aCYmPjICJHNwbGljZS5jYWwBJ2xoLDEpfWQucmVtb3ZlRXZlbnRMaXN0ZW5lciYmUhcANCgibG9hZCIsZiwhMSk7UiMAYjoAEGVycm9yDTsYfTtkLmFkZEJzAD4UAD5wAD4gAAFtPhQAACg2agBYYiYmKGQuYXR0cmlidXRpb25TcmM9IiIBvhBzcmM9Y163ASQucHVzaChkKX0KWUsEcShJAQRhPTGsNC5jdXJyZW50U2NyaXB0TU8AKDJuAjBudWxsOmEpJiYiNzciQYAQLmdldEENkDhlKCJkYXRhLWpjIik_YToVVzxxdWVyeVNlbGVjdG9yKCdbDSUAPQFEDF0nKX1FN_BScj1SZWdFeHAoIl5odHRwcz86Ly8oXFx3fC0pK1xcLmNkblxcLmFtcHByb2plY3RcXC4obmV0fG9yZykoXFw_fC98JCkiKTsKZnVuY3Rpb24gdCgR4ABrBWEMYz1bXQUJBGU9AcYMO2Rve0GvGGI9YTt0cnkFDABkQa0YZD0hIWImJgEkHCE9Yi5sb2NhIWogLmhyZWYpYjp7AS2QbShiLmZvbyk7ZD0hMDticmVhayBifWNhdGNoKGgpe31kPSExfQFeCGY9ZBkXAGYBFgxpZihmCZkAZz5eAAw7ZT1idTkEJiYZDCgucmVmZXJyZXJ8fAGXJH1lbHNlIGc9ZSwNywBjKeAwbmV3IHUoZ3x8IiIpKQXVFGE9Yi5wYSHUGYYAYQX_UH19d2hpbGUoYSYmYiE9YSk7Yj0wO4HeEGE9Yy5shdZ0LTE7Yjw9YTsrK2IpY1tiXS5kZXB0aD1hLWI7Yj1rISs5HgGuNSo4YW5jZXN0b3JPcmlnaW5zbhwADWsAPR11ACkJhgwxO2E8EYpMOysrYSlnPWNbYV0sZy51cmx8fCgFCC5CATp2ABRbYS0KMV0hDBgsZy5oPSEwAeMpIgBrGash1WX_AGclFiUCBGU9MgQBIDA8PWU7LS1lKSG6RD1jW2VdLCFnJiZyLnRlc3QoZgGPICkmJihnPWYpLAUOLCYmIWYuaCl7Yj1mO0UbAH0NXQBlFeYEJiYBzAE7BDswQWUlWggmJmUFSAEbCCk7YwWtFHYoYixnKW2LGCBjLmc_Yy4F-gw6Yy5pAUAAfbFTBCB2odYcKXt0aGlzLmlB1QEJCGc9YxkiAHUdIgh1cmwRJBRoPSEhYzsFLwWIJQrdLwB3lSkcdCgpLGM9YS7tfkAoIj8iKTtzZXRUaW1lb3V0KBGMDTEAZdlWGGU_LjAxOmVBNUQhKE1hdGgucmFuZG9tKCk-ZSlpDwxiPXEoIaQAImX_NDovLyIrKGImJiJ0cnVlgWsAYlZrBDgtcmNkIik_InBhZ2VhZDLNtxBzeW5kaWm5IC1jbi5jb20iOmYjAAUgDCkrIi8JRXgvZ2VuXzIwND9pZD1qY2EmamM9NzcmdmVyc2lvbj0ihUUMZD0oZAGxACmhtlIEBQAtDTEwIil8fCJ1bmtub3duImHjXCtkKyImc2FtcGxlPSIrZTtiPXdpbmRvdwVYAGY5NABm4YoAZiEzNGQ9Yi5uYXZpZ2F0b3IpMg4AUC51c2VyQWdlbnQsZD0vQ2hyb21lL0mbIGQpJiYhL0VkZxkRHD8hMDohMTtkYZMVUTAuc2VuZEJlYWNvbj8KHWkdGCQoZSk6cChiLGUsInoICZ4QKX19LDBVoCgwPD1jP2Euc3VicxJaCRwoMCxjKTphfQngDC5yZmwuAggarwhoZW5jb2RlVVJJQ29tcG9uZW50KHcoKSl9O30p6dtBmhQpOwo8L3PFmGw-8gLJAgoKRVhUUkFfVEFHUxK6AjxkaXYgc3R5IVIMcG9zaaGxZDogYWJzb2x1dGU7IGxlZnQ6IDBweDsgdG9wDQpkdmlzaWJpbGl0eTogaGlkZGVuOyI-PGltZyDhTFWHSRRKWQJBNg0eLjICFGF3YmlkJgUG8HlfYj1BS0FtZi1BbnJZa0p6T0JsVHNCQkIyV0trajNGSk9LMnVfQ2oyNTRZZGZwdllQNmliSlY3UWhOUUswbW12RVdubEo5MU0zcXg1Rm0tb0hSNDItbHh0RG0tTGxYUVp1VzBpUSIgYm9yZGVyPTAgd2lkdGg9MSBoZQ6-CyA9MSBhbHQ9IiIxGoBkaXNwbGF5Om5vbmUiPjwvZGl2PvICmQEKDFBPU1RfU0MWGgwIiAE8KWo2CAEWEApQYWRzLmcuZG91YmxlY2xpY2submV0MQY8eGJmZV9iYWNrZmlsbC5qcwFlCUsAPg1TAD6dJBwge3IzcHgoJyKlDBwnKTt9KSgpOz3qEJMWChBIAZ00UE9SVF9QQVJBTVMS_hWRI4qUAPB9YWRmZXRjaD9hZGs9MTk0Njg5Mjg3OCZhZHNhZmU9bWVkaXVtJmNsaWVudD1jYS1wdWItMzA3Njg5MDAxMjc0MTQ2NyZmb3JtYXQ9MzAweDI1MF9hcyZpcD0zNy4xOS4yMTIuMTkzJm91dHB1dD1odG1sJnVudmlld2VkX3BvSYsgX3N0YXJ0PTEmpXYEbnlWAQ4QJnN1Yl8NigBiQZDw7XItNDcxMDEyNCZobD1lbiZhY2VpZD1NQ0VZdEFDc0dyUUF3QnEwQUQ0ZHRBQkRIYlFBeFlNMEFaS0hOQUhzanpRQmRKRTBBYU9TTkFIYWtqUUJTWk0wQVg2VE5BR1JrelFCdFpNMEFlR1ROQUh0a3pRQkVwUTBBUzZVTkFFdmxEUUJOWlEwQVRlVU5BRkJsRFFCU0pRMEFWR1VOQUZTbERRQlZaUTBBVi1VTkFGb2xEUUJmWlEwQVlLVU5BR2xsRFFCcUpRMEFhdVVOQUcxbERRQnQ1UTBBYmlVTkFHNWxEUUJ1cFEwQWJ1VU5BRzkBcCx4NVEwQWRDVU5BSFQBEAAyAUAEZC0BEABqARD0VQNTM05CQVUxelFRR3p2b29CX19jZUFwTWZYQUtCSUZ3Q3BpQmNBaWo1aUFLN19vZ0N2XzZJQWlkQ3FnSW9RcW9DS1VLcUF2VlRxZ0tVYXFvQ19uaXFBb0NicWdLQm02b0NncHVxQXFLb3FnTGxyS29DMXJ5cUFvYk5xZ0pDLUtvQ1FmdXFBc01NcXdKYUlhc0NoQ2VyQWxRb3F3TDdLNnNDMURhckFqdzRxd0w5T2FzQ0pUcXJBaWs2cXdJdE9xc0N0VHlyQXIwLXF3SkNRYXNDSEVhckFteEtxd0tjUzZzQ1lFNnJBcmxPcXdJZ1VLc0M5RkNyQWdKUnF3SUtVYXNDSUZ5ckFvUmRxd0psWHFzQ1JHQ3JBbVZncXdKaVk2c0MzR1NyQWc5cXF3STlhcXNDRzNHckFsVnhxd0x4Y2FzQ2dIT3JBb1Z6cXdMTWRLc0NDWGFyQWtsMnF3SnhkcXNDR0hlckFoMTNxd0lpZDZzQ0ozZXJBaXgzcXdJS2Vhc0NhbnFyQXFwNnF3SWhmYXNDVTRDckFwdUJxd0pUaXFzQ29JcXJBdmFMcXdKMWpLc0N0WXlyQXJlTXF3S2JqNnNDQTVDckFrYVFxd0s4azZzQ0haYXJBZ3FacXdKWm1xc0NvNXVyQXJpZHF3THpuYXNDUnA2ckFsbWVxd0lDb0tzQ09LQ3JBc0NncXdMRm9Lc0N5YUNyQXV5Z3F3STFvcXNDOWFLckFnT2pxd0lXcEtzQ19hU3JBbXFscXdKaHBxc0NtYWFyQW55bnF3SkFxS3NDQUttckFqS3Bxd0pPcWFzQ1hLbXJBb21wcXdLaXFhc0N0S3FyQXNPcXF3TG5xcXNDOHFxckFtZXJxd0o0cktzQ29xMnJBbUN2cXdJS3Nhc0N3V3drQkM1ZDl3UjRYZmNFdWwzM0JBMkU5d1JVc3NVRjBJWWpDZ1Bubnd1U2xQc1NDYWo3RWdPdC14Slh5dnNTdHRiN0VvbjEteElzRHZ3U2JSRDhFbEVSX0JLbkV2d1NJQlA4RWo0Vl9CTHFGZndTNVJiOEVxMFhfQko1R1B3U0pocjhFclViX0JLWHVWRVRudXlQRV9oV2F4cGM5bGQ0JmV4az04NDQzNzg4NTImYXdiaWRfY9Wl8LBhNEFGd0FhNEdOOEZsLXlQZkdiNVJmX1hRd1BiajJyRzNIbXhfX3lwcXRRZjRHd3RMSlc4UU9MQW5ISDgzMFdVSE5LamRFYVN1akdZMEZhb2FFZWFRM0RaRFdXV0NpS3dhc1o0TXlOWFhFMktLUHRDRkVkckstVzc1S19Ea3YwcWdiX0JSZlQweWFQbTVrc3FsRC1uZjhTLW5XZERneUkwczJpTHBEVWtpdzNsRFJFJmHhawRfZA3A9AIFQ0RGdGRWWjluZ3pxVDdJUmlUNDhmZm1fQk5VN2kwM05UNUNQOWVSZk5XZE1qOVM1RENmNTM0YXlUQ1ZEdG9BWDQxU0hrNnpyYlZOWDhOSDJNNjltelAyX1BKRXZydi1uRzUyaVp4NE1TSmt3d0xUZWlsc2g3encwWEFwRHdIcGc2bFNjb1hmdjE3aGtuMmZ6YktPV1hvbTRaeU9UblpvZlFFbEFsMkNIR0NWTlUtQnJrNTRvMG0ybmJhdkc0S2tlTXdBVDFwd29BMVBSX2Q2UEZTT2VSVGhEYjJwbkxaRHZnRUxZeElhMnM4LUh1RjhmdXZ6Y2JHT0tGWWFmQVc5TGtmSHplZG9mcVJ4Zm1vMGdtWUhlUmNMbDdJTWFuNDV4U216b1NzM0J3blNROGx6NXBYd2p3TDhYQUViWjVqdXVQdC1oaXBfS3prRGxhcVlpQkxUTk9PeWdKY01mS0JQUGFWN1F0b0tKcnJLRzRQVm9jM2RZQXA3bGNsVUFVNFBEN2FJYWlZTGE5OHI0alhoc0dLcUFCOWxsRlhRRG4tcWtYdk1YWUZWQjN2clY2bjg5Z3hfanBjdDNKQURTYmVNX1NfVkhzQTRGQ3RIckp0NEt1bmxnQjl6UXY2NEtVRFVlWFU3QXFENEstSl95TGhsWUZkX1NVc3pwalBUZURWeTV3WFA2Z2gwbnl1VkpSNXFvclk4dnN5dzJ0LTF5NFBGVU9td3UyMEgxNEFab2d0ODNLekRadWMycEN6UHNhMFFrVWFXWEo1ZUtwQ2s2M29vTlVMdnlMYWtycl9iLThpRWdPdk5DcjN4bkt3NUxxd3NzZ3JBeEYtaE9yVUM3LXkwX0g5UEV1ZEsyaGN1MGk3NVRCNVpzUHMwWExZU1NQOGdQSDBwenc4YzM5UmR4Umh6MTZhVmpJU1ZYSjVSVVhvS2tETHJMMmF2VGNIZ2hVUEp0a2VkVVpWbHlXMHFPX2xyaTdJWEFQa3VMM0o0WUZYT1pyMno0ZE1vMElpUzd1S3JzVU1SUHpwR0xlSk9JUHp1WmVOVXVOcEh6eEhXZGxGZHE3VEh1MWhjVHpMTzRLclZDSXBVZDZxX1h3cXZWZHkxaTFLcGFTaXJOMm9aUkRXcXZ4akVmMjhOTURaOF9uMzA2a01LLVNwUXVxZ1VjV2ZYWjJHRk1xYmpUc2lKN0I3UnltVVVKTGdZeXR2SGpITVlqallHX1o5b3BtU1p2c1RkS3Roc09nZk9qVmhsNV9kcVJ5NWtUWF8tUjNjNy1rYTlBZE4xeXVUZnVSUTQ5d3FDdG04M1o1RUNpYlNvWVM3VnhTdEUwVUhLYnhrbjFwMVlxNU1oRkdLcF9TTDBmbXV3RWZqSmpiUDZZZllOT2pkY3ZLVDhJRnhpTkx4clVHYUFLUW5GajM5QXZnM3Z6UXkzLTJMQzl4dzB2bUxOTHlEUWZ4YVNWTWdwREZ2Mm9iWVZCT0VzTzVrM21senVGQmdSXzd2X2lKRklsbkNXWTVBaThuSFpia2RNZ3RwSlZ2b0lYd0c4ZTJjREl6Y1dBdGxXeGVZSXpEZUFkRFBxNmZMdFVmTVJISTlVdGZhQUZPemhOSSZjaWQ9Q0FRU0d3RElDYWFOTzdyS1ZEeGg3UXNXek1IdlNkYVlqT0h0QVhWbHJCZ0ImYV9jaWQ9gAMAiAMBkAMAmAMUoAMBqgPnAQq_AWh0dHAONw_-sAwOsAzwwkM4QjE0U1pBY1Jwd0ItNnRkUXlvU1ZRNjdiSXVVM0dfY2RWT1NkRUxpX0pkQ2luMGZzcXpJNXU3dlZJMWZoeEx1WFl4TE12WWdFS21SX2M1WWFDWi1La0RVY2x3JnByPTEwOiR7QVVDVElPTl9QUklDRX0aEzM5NjcwMDE0Mzg0MjEwMzIzODQiCDc3MjIxNzkzKgQzOTQxwAPYBMgDANgDAOADAOgDAPgDA4AEAJIECS9vcGVucnRiMpgEAKIEDTM3LiacC5CoBACyBAwIABAAGAAgADAAOAC4BADABADIBADaBAIIAeAEAPAEDg4a8EOIBQGYBQCgBbOby_WVje69PaoFKjQwMDIwM2NlLWFjNzktNDQxMS1iZDhkLWFkYjRjMWViMGViMH43MTV-McAFAMkFABJrGhTwP9IFCQkFC0AAAADYBQHgBQHwBYzGAvoFBAGIKJAGAJgGALgGAMEGASE0AADwP9AG7o8B2gYWChAJEhkBAbeg4AYB8gYCCACABwGIBwCgBwGqBwwxMzA2MTk0OTc4MDjIB6OABtIHDQkRNwE1CNoHBgFtsBgA4AcA6gcCCADwB-exCYoIAhAAlQgAAIA_mAgBwAikQ9IICQjz__8_EAAYAA..&s=03ef793b916c28023490dc36c69d92a45ac2a363&pp=1.475144
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.47.64.191 Atlanta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-47-64-191.deploy.static.akamaitechnologies.com
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Access-Control-Allow-Origin: *
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Thu, 19 Oct 2023 12:09:41 GMT
ETag: "623de86a-cf34"
Expires: Fri, 20 Oct 2023 12:09:43 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
X-Akamai-EW-Subworker: 8096267

GET
H2 200 rd_log Show response
lax1-ib.adnxs.com/ Frame 6C25 0
646 B 106ms
105ms Script
text/html 104.254.151.36
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://lax1-ib.adnxs.com/rd_log?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QKXNfRTCZcaAAADANYABQEIg7nEqQYQwLuyxKTZ54Y3GIXq7pb529yLZyo2CZWW42d1xPs_Ef8_Tpgwmvc_GQAAAEAKV0FAIWoKrgMxmvc_KV4qNuZ1xPs_MQAAAAAAAAhAMLGtxgg4sxlA5R5IZVChn-kkWLrgfGAAaMmwRHijgAaAAQGKAQNVU0SSAQNVU0SYAawCoAH6AagBAbABALgBAsABBcgBAtABCdgBAOABAPABALICJGZmZDQxMDg1LTc3ZjItNGQyNi05OTg3LTA0MjIzMDU2MWZiMdgCpEPgAur5JeoCGWFueWZpbGUtbm90ZXBhZC5zZW1hYW4uY2HyAg0KBkhFSUdIVBIDMjUw8gIMCgVXSURUSBIDMzAw8gIhCgZMT0FERVISF3JlbmRlcl9wb3N0X2Fkc192MS5odG1s8gIXCgpJRlJBTUVfS0VZEgk4NDQzNzg4NTLyAsgVCgtQUkVfU0NSSVBUUxK4FTxzY3JpcHQ-KGZ1bmN0aW9uKCl7LyoKCiBDb3B5cmlnaHQgVGhlIENsb3N1cmUgTGlicmFyeSBBdXRob3JzLgogU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjAKKi8KdmFyIGs9dGhpc3x8c2VsZjt2YXIgbD1BcnJheS5wcm90b3R5cGUuaW5kZXhPZj9mdW5jdGlvbihhLGMpe3JldHVybiBBcnJheS5wcm90b3R5cGUuaW5kZXhPZi5jYWxsKGEsYyx2b2lkIDApfTpmdW5jdGlvbihhLGMpe2lmKCJzdHJpbmciPT09dHlwZW9mIGEpcmV0dXJuInN0cmluZyIhPT10eXBlb2YgY3x8MSE9Yy5sZW5ndGg_LTE6YS5pbmRleE9mKGMsMCk7Zm9yKHZhciBlPTA7ZTxhLmxlbmd0aDtlKyspaWYoZSBpbiBhJiZhW2VdPT09YylyZXR1cm4gZTtyZXR1cm4tMX07ZnVuY3Rpb24gbShhKXttWyIgIl0oYSk7cmV0dXJuIGF9bVsiICJdPWZ1bmN0aW9uKCl7fTtmdW5jdGlvbiBuKGEpe2E9dm9pZCAwPT09YT9kb2N1bWVudDphO3JldHVybiBhLmNyZWF0ZUVsZW1lbnQoImltZyIpfTtmdW5jdGlvbiBwKGEsYyxlKXt2YXIgYj0hMTtiPXZvaWQgMD09PWI_ITE6YjthLmdvb2dsZV9pbWFnZV9yZXF1ZXN0c3x8KGEuZ29vZ2xlX2ltYWdlX3JlcXVlc3RzPVtdKTt2YXIgZD1uKGEuZG9jdW1lbnQpO2lmKGUpe3ZhciBmPWZ1bmN0aW9uKCl7aWYoZSl7dmFyIGc9YS5nb29nbGVfaW1hZ2VfcmVxdWVzdHMsaD1sKGcsZCk7MDw9aCYmQXJyYXkucHJvdG90eXBlLnNwbGljZS5jYWxsKGcsaCwxKX1kLnJlbW92ZUV2ZW50TGlzdGVuZXImJmQucmVtb3ZlRXZlbnRMaXN0ZW5lcigibG9hZCIsZiwhMSk7ZC5yZW1vdmVFdmVudExpc3RlbmVyJiZkLnJlbW92ZUV2ZW50TGlzdGVuZXIoImVycm9yIixmLCExKX07ZC5hZGRFdmVudExpc3RlbmVyJiZkLmFkZEV2ZW50TGlzdGVuZXIoImxvYWQiLGYsITEpO2QuYWRkRXZlbnRMaXN0ZW5lciYmZC5hZGRFdmVudExpc3RlbmVyKCJlcnJvciIsZiwhMSl9YiYmKGQuYXR0cmlidXRpb25TcmM9IiIpO2Quc3JjPWM7YS5nb29nbGVfaW1hZ2VfcmVxdWVzdHMucHVzaChkKX0KO2Z1bmN0aW9uIHEoKXt2YXIgYT1kb2N1bWVudC5jdXJyZW50U2NyaXB0O3JldHVybihhPXZvaWQgMD09PWE_bnVsbDphKSYmIjc3Ij09PWEuZ2V0QXR0cmlidXRlKCJkYXRhLWpjIik_YTpkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCdbZGF0YS1qYz0iNzciXScpfTt2YXIgcj1SZWdFeHAoIl5odHRwcz86Ly8oXFx3fC0pK1xcLmNkblxcLmFtcHByb2plY3RcXC4obmV0fG9yZykoXFw_fC98JCkiKTsKZnVuY3Rpb24gdCgpe3ZhciBhPWs7dmFyIGM9W107dmFyIGU9bnVsbDtkb3t2YXIgYj1hO3RyeXt2YXIgZDtpZihkPSEhYiYmbnVsbCE9Yi5sb2NhdGlvbi5ocmVmKWI6e3RyeXttKGIuZm9vKTtkPSEwO2JyZWFrIGJ9Y2F0Y2goaCl7fWQ9ITF9dmFyIGY9ZH1jYXRjaChoKXtmPSExfWlmKGYpe3ZhciBnPWIubG9jYXRpb24uaHJlZjtlPWIuZG9jdW1lbnQmJmIuZG9jdW1lbnQucmVmZXJyZXJ8fG51bGx9ZWxzZSBnPWUsZT1udWxsO2MucHVzaChuZXcgdShnfHwiIikpO3RyeXthPWIucGFyZW50fWNhdGNoKGgpe2E9bnVsbH19d2hpbGUoYSYmYiE9YSk7Yj0wO2ZvcihhPWMubGVuZ3RoLTE7Yjw9YTsrK2IpY1tiXS5kZXB0aD1hLWI7Yj1rO2lmKGIubG9jYXRpb24mJmIubG9jYXRpb24uYW5jZXN0b3JPcmlnaW5zJiZiLmxvY2F0aW9uLmFuY2VzdG9yT3JpZ2lucy5sZW5ndGg9PWMubGVuZ3RoLTEpZm9yKGE9MTthPGMubGVuZ3RoOysrYSlnPWNbYV0sZy51cmx8fChnLnVybD1iLmxvY2F0aW9uLmFuY2VzdG9yT3JpZ2luc1thLQoxXXx8IiIsZy5oPSEwKTtiPW5ldyB1KGsubG9jYXRpb24uaHJlZiwhMSk7Zz1udWxsO2ZvcihlPWE9Yy5sZW5ndGgtMTswPD1lOy0tZSlpZihmPWNbZV0sIWcmJnIudGVzdChmLnVybCkmJihnPWYpLGYudXJsJiYhZi5oKXtiPWY7YnJlYWt9Zz1udWxsO2U9Yy5sZW5ndGgmJmNbYV0udXJsOzAhPWIuZGVwdGgmJmUmJihnPWNbYV0pO2M9bmV3IHYoYixnKTtyZXR1cm4gYy5nP2MuZy51cmw6Yy5pLnVybH1mdW5jdGlvbiB2KGEsYyl7dGhpcy5pPWE7dGhpcy5nPWN9Zu1RBCB16RQodGhpcy51cmw9YTsFCxBoPSEhYwkLLGRlcHRoPW51bGx9O9GBqCB3KCl7dmFyIGE9dCgpLGM9YS5pbmRleE9mKCI_Iik7c2V0VGltZW91dCgRMw0xoGU9dm9pZCAwPT09ZT8uMDE6ZTtpZighKE1hdGgucmFuZG9tKCk-ZSkpBV_wYWI9cSgpO2I9Imh0dHBzOi8vIisoYiYmInRydWUiPT09Yi5nZXRBdHRyaWJ1dGUoImRhdGEtamMtcmNkIik_InBhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24tY24uY29tIjoiYiMAAC4BIAwpKyIvCSJ4L2dlbl8yMDQ_aWQ9amNhJmpjPTc3JnZlcnNpb249IhLACAxkPShkAbEMKSYmZFqZAA0xoCIpfHwidW5rbm93biI7ZT1iK2QrIiZzYW1wbGU9IitlO2I9d2luZG93BVgAZjk0FGY_ITE6ZiEzNGQ9Yi5uYXZpZ2F0b3IpMg4AkC51c2VyQWdlbnQsZD0vQ2hyb21lLy50ZXN0KGQpJiYhL0VkZ2UVESQ_ITA6ITE7ZCYmHVEwLnNlbmRCZWFjb24_ClYYACAoZSk6cChiLGUaaAkEPT0NnhgpfX0sMCk7GnoILDA8PWM_YS5zdWJzdA5aCRwoMCxjKTphfQngEC5yZmw9XSMNNYBlbmNvZGVVUklDb21wb25lbnQodygpKX07fSkuY2FsbChBpZgpOwo8L3NjcmlwdD7yAskCCgpFWFRSQV9UQUdTEroCPGRpdiBzdHkhUohwb3NpdGlvbjogYWJzb2x1dGU7IGxlZnQ6IDBweDsgdG9wOgkKcHZpc2liaWxpdHk6IGhpZGRlbjsiPjxpbWcgc3JjWYdJFAQyLkJZAkE2DR4uMgIUYXdiaWQmBQbwhl9iPUFLQW1mLUFucllrSnpPQmxUc0JCQjJXS2tqM0ZKT0sydV9DajI1NFlkZnB2WVA2aWJKVjdRaE5RSzBtbXZFV25sSjkxTTNxeDVGbS1vSFI0Mi1seHREbS1MbFhRWnVXMGlRIiBib3JkZXI9MCB3aWR0aD0xIGhlaWdodD0xIGFsdD0iIjEaqGRpc3BsYXk6bm9uZSI-PC9kaXY-8gKZAQoMUE9TVF9TQ1JJUFRTEogBPHMlajYIASkAUGFkcy5nLmRvdWJsZWNsaWNrLm5ldDEGPHhiZmVfYmFja2ZpbGwuanMBZS21DVMEPihZAWAge3IzcHgoJzg0NDM3ODg1MicpO30pKCk7PeoQkxYKEEgBnTRQT1JUX1BBUkFNUxL-FZEjipQA8H1hZGZldGNoP2Fkaz0xOTQ2ODkyODc4JmFkc2FmZT1tZWRpdW0mY2xpZW50PWNhLXB1Yi0zMDc2ODkwMDEyNzQxNDY3JmZvcm1hdD0zMDB4MjUwX2FzJmlwPTM3LjE5LjIxMi4xOTMmb3V0cHV0PWh0bWwmdW52aWV3ZWRfcG9JiyBfc3RhcnQ9MSaldgxueWZpTgEOECZzdWJfDYoAYkGQ8O1yLTQ3MTAxMjQmaGw9ZW4mYWNlaWQ9TUNFWXRBQ3NHclFBd0JxMEFENGR0QUJESGJRQXhZTTBBWktITkFIc2p6UUJkSkUwQWFPU05BSGFralFCU1pNMEFYNlROQUdSa3pRQnRaTTBBZUdUTkFIdGt6UUJFcFEwQVM2VU5BRXZsRFFCTlpRMEFUZVVOQUZCbERRQlNKUTBBVkdVTkFGU2xEUUJWWlEwQVYtVU5BRm9sRFFCZlpRMEFZS1VOQUdsbERRQnFKUTBBYXVVTkFHMWxEUUJ0NVEwQWJpVU5BRzVsRFFCdXBRMEFidVVOQUc5AXAseDVRMEFkQ1VOQUhUARAAMgFABGQtARAAagEQ9FUDUzNOQkFVMXpRUUd6dm9vQl9fY2VBcE1mWEFLQklGd0NwaUJjQWlqNWlBSzdfb2dDdl82SUFpZENxZ0lvUXFvQ0tVS3FBdlZUcWdLVWFxb0NfbmlxQW9DYnFnS0JtNm9DZ3B1cUFxS29xZ0xscktvQzFyeXFBb2JOcWdKQy1Lb0NRZnVxQXNNTXF3SmFJYXNDaENlckFsUW9xd0w3SzZzQzFEYXJBanc0cXdMOU9hc0NKVHFyQWlrNnF3SXRPcXNDdFR5ckFyMC1xd0pDUWFzQ0hFYXJBbXhLcXdLY1M2c0NZRTZyQXJsT3F3SWdVS3NDOUZDckFnSlJxd0lLVWFzQ0lGeXJBb1JkcXdKbFhxc0NSR0NyQW1WZ3F3SmlZNnNDM0dTckFnOXFxd0k5YXFzQ0czR3JBbFZ4cXdMeGNhc0NnSE9yQW9WenF3TE1kS3NDQ1hhckFrbDJxd0p4ZHFzQ0dIZXJBaDEzcXdJaWQ2c0NKM2VyQWl4M3F3SUtlYXNDYW5xckFxcDZxd0loZmFzQ1U0Q3JBcHVCcXdKVGlxc0NvSXFyQXZhTHF3SjFqS3NDdFl5ckFyZU1xd0tiajZzQ0E1Q3JBa2FRcXdLOGs2c0NIWmFyQWdxWnF3SlptcXNDbzV1ckFyaWRxd0x6bmFzQ1JwNnJBbG1lcXdJQ29Lc0NPS0NyQXNDZ3F3TEZvS3NDeWFDckF1eWdxd0kxb3FzQzlhS3JBZ09qcXdJV3BLc0NfYVNyQW1xbHF3SmhwcXNDbWFhckFueW5xd0pBcUtzQ0FLbXJBaktwcXdKT3Fhc0NYS21yQW9tcHF3S2lxYXNDdEtxckFzT3Fxd0xucXFzQzhxcXJBbWVycXdKNHJLc0NvcTJyQW1DdnF3SUtzYXNDd1d3a0JDNWQ5d1I0WGZjRXVsMzNCQTJFOXdSVXNzVUYwSVlqQ2dQbm53dVNsUHNTQ2FqN0VnT3QteEpYeXZzU3R0YjdFb24xLXhJc0R2d1NiUkQ4RWxFUl9CS25FdndTSUJQOEVqNFZfQkxxRmZ3UzVSYjhFcTBYX0JKNUdQd1NKaHI4RXJVYl9CS1h1VkVUbnV5UEVfaFdheHBjOWxkNCZleGs9ODQ0Mzc4ODUyJmF3YmlkX2PVpfCwYTRBRndBYTRHTjhGbC15UGZHYjVSZl9YUXdQYmoyckczSG14X195cHF0UWY0R3d0TEpXOFFPTEFuSEg4MzBXVUhOS2pkRWFTdWpHWTBGYW9hRWVhUTNEWkRXV1dDaUt3YXNaNE15TlhYRTJLS1B0Q0ZFZHJLLVc3NUtfRGt2MHFnYl9CUmZUMHlhUG01a3NxbEQtbmY4Uy1uV2REZ3lJMHMyaUxwRFVraXczbERSRSZh4WsEX2QNwPQrBUNERnRkVlo5bmd6cVQ3SVJpVDQ4ZmZtX0JOVTdpMDNOVDVDUDllUmZOV2RNajlTNURDZjUzNGF5VENWRHRvQVg0MVNIazZ6cmJWTlg4TkgyTTY5bXpQMl9QSkV2cnYtbkc1MmlaeDRNU0prd3dMVGVpbHNoN3p3MFhBcER3SHBnNmxTY29YZnYxN2hrbjJmemJLT1dYb200WnlPVG5ab2ZRRWxBbDJDSEdDVk5VLUJyazU0bzBtMm5iYXZHNEtrZU13QVQxcHdvQTFQUl9kNlBGU09lUlRoRGIycG5MWkR2Z0VMWXhJYTJzOC1IdUY4ZnV2emNiR09LRllhZkFXOUxrZkh6ZWRvZnFSeGZtbzBnbVlIZVJjTGw3SU1hbjQ1eFNtem9TczNCd25TUThsejVwWHdqd0w4WEFFYlo1anV1UHQtaGlwX0t6a0RsYXFZaUJMVE5PT3lnSmNNZktCUFBhVjdRdG9LSnJyS0c0UFZvYzNkWUFwN2xjbFVBVTRQRDdhSWFpWUxhOThyNGpYaHNHS3FBQjlsbEZYUURuLXFrWHZNWFlGVkIzdnJWNm44OWd4X2pwY3QzSkFEU2JlTV9TX1ZIc0E0RkN0SHJKdDRLdW5sZ0I5elF2NjRLVURVZVhVN0FxRDRLLUpfeUxobFlGZF9TVXN6cGpQVGVEVnk1d1hQNmdoMG55dVZKUjVxb3JZOHZzeXcydC0xeTRQRlVPbXd1MjBIMTRBWm9ndDgzS3pEWnVjMnBDelBzYTBRa1VhV1hKNWVLcENrNjNvb05VTHZ5TGFrcnJfYi04aUVnT3ZOQ3IzeG5LdzVMcXdzc2dyQXhGLWhPclVDNy15MF9IOVBFdWRLMmhjdTBpNzVUQjVac1BzMFhMWVNTUDhnUEgwcHp3OGMzOVJkeFJoejE2YVZqSVNWWEo1UlVYb0trRExyTDJhdlRjSGdoVVBKdGtlZFVaVmx5VzBxT19scmk3SVhBUGt1TDNKNFlGWE9acjJ6NGRNbzBJaVM3dUtyc1VNUlB6cEdMZUpPSVB6dVplTlV1TnBIenhIV2RsRmRxN1RIdTFoY1R6TE80S3JWQ0lwVWQ2cV9Yd3F2VmR5MWkxS3BhU2lyTjJvWlJEV3F2eGpFZjI4Tk1EWjhfbjMwNmtNSy1TcFF1cWdVY1dmWFoyR0ZNcWJqVHNpSjdCN1J5bVVVSkxnWXl0dkhqSE1ZampZR19aOW9wbVNadnNUZEt0aHNPZ2ZPalZobDVfZHFSeTVrVFhfLVIzYzcta2E5QWROMXl1VGZ1UlE0OXdxQ3RtODNaNUVDaWJTb1lTN1Z4U3RFMFVIS2J4a24xcDFZcTVNaEZHS3BfU0wwZm11d0VmakpqYlA2WWZZTk9qZGN2S1Q4SUZ4aU5MeHJVR2FBS1FuRmozOUF2ZzN2elF5My0yTEM5eHcwdm1MTkx5RFFmeGFTVk1ncERGdjJvYllWQk9Fc081azNtbHp1RkJnUl83dl9pSkZJbG5DV1k1QWk4bkhaYmtkTWd0cEpWdm9JWHdHOGUyY0RJemNXQXRsV3hlWUl6RGVBZERQcTZmTHRVZk1SSEk5VXRmYUFGT3poTkkmY2lkPUNBUVNHd0RJQ2FhTk83cktWRHhoN1FzV3pNSHZTZGFZak9IdEFYVmxyQmdCJmFfY2lkPYADAIgDAZADAJgDFKADAaoDAMAD2ATIAwDYAwDgAwDoAwD4AwOABACSBAkvb3BlbnJ0YjKYBACiBA0zNy4xOS4yMTIOtAqQqAQAsgQMCAAQABgAIAAwADgCuAQAwAQAyAQA2gQCCAHgBADwBA4mGfBDiAUBmAUAoAWzm8v1lY3uvT2qBSo0MDAyMDNjZS1hYzc5LTQ0MTEtYmQ4ZC1hZGI0YzFlYjBlYjB-NzE1fjHABQDJBQAOghkYAPA_0gUJCQULQAAAANgFAeAFAfAFjMYC-gUEAYgokAYAmAYAuAYAwQYBIQExJNAG7o8B2gYWChAJEhkBAbeg4AYB8gYCCACABwGIBwCgBwGqBwwxMzA2MTk0OTc4MDjIB6OABtIHDQkRNwE1CNoHBgFtsBgA4AcA6gcCCADwB-exCYoIAhAAlQgAAIA_mAgBwAikQ9IICQjz__8_EAAYAA..&s=8630adbc4027eeb0a33e7b438ea3651e54235e0b&bdref=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%3D%257B%2522ids%2522%3A%255B%25221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%2522%255D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%257B%257D%257D&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp%3Fstate%3D%257B%2522ids%2522%3A%255B%25221lquvpkJq2nJQ4SCcsONbXV-COQ7wD6Jo%2522%255D%2C%2522action%2522%3A%2522open%2522%2C%2522resourceKeys%2522%3A%257B%257D%257D,about%3Ablank&

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.151.36 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:40 GMT
an-x-request-uuid: 89da2f39-a50f-4b0b-afdc-32fe2a49479c
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 37.19.212.193; 37.19.212.193; 897.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 44B8 0
340 B 167ms
93ms Image
image/gif 172.253.62.154
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=awbid&awbid_b=AKAmf-AnrYkJzOBlTsBBB2WKkj3FJOK2u_Cj254YdfpvYP6ibJV7QhNQK0mmvEWnlJ91M3qx5Fm-oHR42-lxtDm-LlXQZuW0iQ

Requested by

Host: lax1-ib.adnxs.com
URL: https://lax1-ib.adnxs.com/if?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QL_NvRTCX8bAAADANYABQEIg7nEqQYQwLuyxKTZ54Y3GIXq7pb529yLZyo2CZWW42d1xPs_Ef8_Tpgwmvc_GQAAAEAKV0FAIWoKrgMxmvc_KV4qNuZ1xPs_MQAAAAAAAAhAMLGtxgg4sxlA5R5IZVChn-kkWLrgfGAAaMmwRHijgAaAAQGKAQNVU0SSAQNVU0SYAawCoAH6AagBAbABALgBAsABBcgBAtABCdgBAOABAPABALICJGZmZDQxMDg1LTc3ZjItNGQyNi05OTg3LTA0MjIzMDU2MWZiMdgCpEPgAur5JeoCGWFueWZpbGUtbm90ZXBhZC5zZW1hYW4uY2HyAg0KBkhFSUdIVBIDMjUw8gIMCgVXSURUSBIDMzAw8gIhCgZMT0FERVISF3JlbmRlcl9wb3N0X2Fkc192MS5odG1s8gIXCgpJRlJBTUVfS0VZEgk4NDQzNzg4NTLyAsgVCgtQUkVfU0NSSVBUUxK4FTxzY3JpcHQ-KGZ1bmN0aW9uKCl7LyoKCiBDb3B5cmlnaHQgVGhlIENsb3N1cmUgTGlicmFyeSBBdXRob3JzLgogU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjAKKi8KdmFyIGs9dGhpc3x8c2VsZjt2YXIgbD1BcnJheS5wcm90b3R5cGUuaW5kZXhPZj9mdW5jdGlvbihhLGMpe3JldHVybiBBcnJheS5wcm90b3R5cGUuaW5kZXhPZi5jYWxsKGEsYyx2b2lkIDApfTpmdW5jdGlvbihhLGMpe2lmKCJzdHJpbmciPT09dHlwZW9mIGEpcmV0dXJuInN0cmluZyIhPT10eXBlb2YgY3x8MSE9Yy5sZW5ndGg_LTE6YS5pbmRleE9mKGMsMCk7Zm9yKHZhciBlPTA7ZTxhLmxlbmd0aDtlKyspaWYoZSBpbiBhJiZhW2VdPT09YylyZXR1cm4gZTtyZXR1cm4tMX07ZnVuY3Rpb24gbShhKXttWyIgIl0oYSk7cmV0dXJuIGF9bVsiICJdPWZ1bmN0aW9uKCl7fTtmdW5jdGlvbiBuKGEpe2E9dm9pZCAwPT09YT9kb2N1bWVudDphO3JldHVybiBhLmNyZWF0ZUVsZW1lbnQoImltZyIpfTtmdW5jdGlvbiBwKGEsYyxlKXt2YXIgYj0hMTtiPXZvaWQgMD09PWI_ITE6YjthLmdvb2dsZV9pbWFnZV9yZXF1ZXN0c3x8KGEuZ29vZ2xlX2ltYWdlX3JlcXVlc3RzPVtdKTt2YXIgZD1uKGEuZG9jdW1lbnQpO2lmKGUpe3ZhciBmPWZ1bmN0aW9uKCl7aWYoZSl7dmFyIGc9YS5nb29nbGVfaW1hZ2VfcmVxdWVzdHMsaD1sKGcsZCk7MDw9aCYmQXJyYXkucHJvdG90eXBlLnNwbGljZS5jYWxsKGcsaCwxKX1kLnJlbW92ZUV2ZW50TGlzdGVuZXImJmQucmVtb3ZlRXZlbnRMaXN0ZW5lcigibG9hZCIsZiwhMSk7ZC5yZW1vdmVFdmVudExpc3RlbmVyJiZkLnJlbW92ZUV2ZW50TGlzdGVuZXIoImVycm9yIixmLCExKX07ZC5hZGRFdmVudExpc3RlbmVyJiZkLmFkZEV2ZW50TGlzdGVuZXIoImxvYWQiLGYsITEpO2QuYWRkRXZlbnRMaXN0ZW5lciYmZC5hZGRFdmVudExpc3RlbmVyKCJlcnJvciIsZiwhMSl9YiYmKGQuYXR0cmlidXRpb25TcmM9IiIpO2Quc3JjPWM7YS5nb29nbGVfaW1hZ2VfcmVxdWVzdHMucHVzaChkKX0KO2Z1bmN0aW9uIHEoKXt2YXIgYT1kb2N1bWVudC5jdXJyZW50U2NyaXB0O3JldHVybihhPXZvaWQgMD09PWE_bnVsbDphKSYmIjc3Ij09PWEuZ2V0QXR0cmlidXRlKCJkYXRhLWpjIik_YTpkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCdbZGF0YS1qYz0iNzciXScpfTt2YXIgcj1SZWdFeHAoIl5odHRwcz86Ly8oXFx3fC0pK1xcLmNkblxcLmFtcHByb2plY3RcXC4obmV0fG9yZykoXFw_fC98JCkiKTsKZnVuY3Rpb24gdCgpe3ZhciBhPWs7dmFyIGM9W107dmFyIGU9bnVsbDtkb3t2YXIgYj1hO3RyeXt2YXIgZDtpZihkPSEhYiYmbnVsbCE9Yi5sb2NhdGlvbi5ocmVmKWI6e3RyeXttKGIuZm9vKTtkPSEwO2JyZWFrIGJ9Y2F0Y2goaCl7fWQ9ITF9dmFyIGY9ZH1jYXRjaChoKXtmPSExfWlmKGYpe3ZhciBnPWIubG9jYXRpb24uaHJlZjtlPWIuZG9jdW1lbnQmJmIuZG9jdW1lbnQucmVmZXJyZXJ8fG51bGx9ZWxzZSBnPWUsZT1udWxsO2MucHVzaChuZXcgdShnfHwiIikpO3RyeXthPWIucGFyZW50fWNhdGNoKGgpe2E9bnVsbH19d2hpbGUoYSYmYiE9YSk7Yj0wO2ZvcihhPWMubGVuZ3RoLTE7Yjw9YTsrK2IpY1tiXS5kZXB0aD1hLWI7Yj1rO2lmKGIubG9jYXRpb24mJmIubG9jYXRpb24uYW5jZXN0b3JPcmlnaW5zJiZiLmxvY2F0aW9uLmFuY2VzdG9yT3JpZ2lucy5sZW5ndGg9PWMubGVuZ3RoLTEpZm9yKGE9MTthPGMubGVuZ3RoOysrYSlnPWNbYV0sZy51cmx8fChnLnVybD1iLmxvY2F0aW9uLmFuY2VzdG9yT3JpZ2luc1thLQoxXXx8IiIsZy5oPSEwKTtiPW5ldyB1KGsubG9jYXRpb24uaHJlZiwhMSk7Zz1udWxsO2ZvcihlPWE9Yy5sZW5ndGgtMTswPD1lOy0tZSlpZihmPWNbZV0sIWcmJnIudGVzdChmLnVybCkmJihnPWYpLGYudXJsJiYhZi5oKXtiPWY7YnJlYWt9Zz1udWxsO2U9Yy5sZW5ndGgmJmNbYV0udXJsOzAhPWIuZGVwdGgmJmUmJihnPWNbYV0pO2M9bmV3IHYoYixnKTtyZXR1cm4gYy5nP2MuZy51cmw6Yy5pLnVybH1mdW5jdGlvbiB2KGEsYyl7dGhpcy5pPWE7dGhpcy5nPWN9Zu1RBCB16RQodGhpcy51cmw9YTsFCxBoPSEhYwkLLGRlcHRoPW51bGx9O9GBqCB3KCl7dmFyIGE9dCgpLGM9YS5pbmRleE9mKCI_Iik7c2V0VGltZW91dCgRMw0xoGU9dm9pZCAwPT09ZT8uMDE6ZTtpZighKE1hdGgucmFuZG9tKCk-ZSkpBV_wYWI9cSgpO2I9Imh0dHBzOi8vIisoYiYmInRydWUiPT09Yi5nZXRBdHRyaWJ1dGUoImRhdGEtamMtcmNkIik_InBhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24tY24uY29tIjoiYiMAAC4BIAwpKyIvCSJ4L2dlbl8yMDQ_aWQ9amNhJmpjPTc3JnZlcnNpb249IhLACAxkPShkAbEMKSYmZFqZAA0xoCIpfHwidW5rbm93biI7ZT1iK2QrIiZzYW1wbGU9IitlO2I9d2luZG93BVgAZjk0FGY_ITE6ZiEzNGQ9Yi5uYXZpZ2F0b3IpMg4AkC51c2VyQWdlbnQsZD0vQ2hyb21lLy50ZXN0KGQpJiYhL0VkZ2UVESQ_ITA6ITE7ZCYmHVEwLnNlbmRCZWFjb24_ClYYACAoZSk6cChiLGUaaAkEPT0NnhgpfX0sMCk7GnoILDA8PWM_YS5zdWJzdA5aCRwoMCxjKTphfQngEC5yZmw9XSMNNYBlbmNvZGVVUklDb21wb25lbnQodygpKX07fSkuY2FsbChBpZgpOwo8L3NjcmlwdD7yAskCCgpFWFRSQV9UQUdTEroCPGRpdiBzdHkhUohwb3NpdGlvbjogYWJzb2x1dGU7IGxlZnQ6IDBweDsgdG9wOgkKcHZpc2liaWxpdHk6IGhpZGRlbjsiPjxpbWcgc3JjWYdJFAQyLkJZAkE2DR4uMgIUYXdiaWQmBQbwhl9iPUFLQW1mLUFucllrSnpPQmxUc0JCQjJXS2tqM0ZKT0sydV9DajI1NFlkZnB2WVA2aWJKVjdRaE5RSzBtbXZFV25sSjkxTTNxeDVGbS1vSFI0Mi1seHREbS1MbFhRWnVXMGlRIiBib3JkZXI9MCB3aWR0aD0xIGhlaWdodD0xIGFsdD0iIjEaqGRpc3BsYXk6bm9uZSI-PC9kaXY-8gKZAQoMUE9TVF9TQ1JJUFRTEogBPHMlajYIASkAUGFkcy5nLmRvdWJsZWNsaWNrLm5ldDEGPHhiZmVfYmFja2ZpbGwuanMBZS21DVMEPihZAWAge3IzcHgoJzg0NDM3ODg1MicpO30pKCk7PeoQkxYKEEgBnTRQT1JUX1BBUkFNUxL-FZEjipQA8H1hZGZldGNoP2Fkaz0xOTQ2ODkyODc4JmFkc2FmZT1tZWRpdW0mY2xpZW50PWNhLXB1Yi0zMDc2ODkwMDEyNzQxNDY3JmZvcm1hdD0zMDB4MjUwX2FzJmlwPTM3LjE5LjIxMi4xOTMmb3V0cHV0PWh0bWwmdW52aWV3ZWRfcG9JiyBfc3RhcnQ9MSaldgxueWZpTgEOECZzdWJfDYoAYkGQ8O1yLTQ3MTAxMjQmaGw9ZW4mYWNlaWQ9TUNFWXRBQ3NHclFBd0JxMEFENGR0QUJESGJRQXhZTTBBWktITkFIc2p6UUJkSkUwQWFPU05BSGFralFCU1pNMEFYNlROQUdSa3pRQnRaTTBBZUdUTkFIdGt6UUJFcFEwQVM2VU5BRXZsRFFCTlpRMEFUZVVOQUZCbERRQlNKUTBBVkdVTkFGU2xEUUJWWlEwQVYtVU5BRm9sRFFCZlpRMEFZS1VOQUdsbERRQnFKUTBBYXVVTkFHMWxEUUJ0NVEwQWJpVU5BRzVsRFFCdXBRMEFidVVOQUc5AXAseDVRMEFkQ1VOQUhUARAAMgFABGQtARAAagEQ9FUDUzNOQkFVMXpRUUd6dm9vQl9fY2VBcE1mWEFLQklGd0NwaUJjQWlqNWlBSzdfb2dDdl82SUFpZENxZ0lvUXFvQ0tVS3FBdlZUcWdLVWFxb0NfbmlxQW9DYnFnS0JtNm9DZ3B1cUFxS29xZ0xscktvQzFyeXFBb2JOcWdKQy1Lb0NRZnVxQXNNTXF3SmFJYXNDaENlckFsUW9xd0w3SzZzQzFEYXJBanc0cXdMOU9hc0NKVHFyQWlrNnF3SXRPcXNDdFR5ckFyMC1xd0pDUWFzQ0hFYXJBbXhLcXdLY1M2c0NZRTZyQXJsT3F3SWdVS3NDOUZDckFnSlJxd0lLVWFzQ0lGeXJBb1JkcXdKbFhxc0NSR0NyQW1WZ3F3SmlZNnNDM0dTckFnOXFxd0k5YXFzQ0czR3JBbFZ4cXdMeGNhc0NnSE9yQW9WenF3TE1kS3NDQ1hhckFrbDJxd0p4ZHFzQ0dIZXJBaDEzcXdJaWQ2c0NKM2VyQWl4M3F3SUtlYXNDYW5xckFxcDZxd0loZmFzQ1U0Q3JBcHVCcXdKVGlxc0NvSXFyQXZhTHF3SjFqS3NDdFl5ckFyZU1xd0tiajZzQ0E1Q3JBa2FRcXdLOGs2c0NIWmFyQWdxWnF3SlptcXNDbzV1ckFyaWRxd0x6bmFzQ1JwNnJBbG1lcXdJQ29Lc0NPS0NyQXNDZ3F3TEZvS3NDeWFDckF1eWdxd0kxb3FzQzlhS3JBZ09qcXdJV3BLc0NfYVNyQW1xbHF3SmhwcXNDbWFhckFueW5xd0pBcUtzQ0FLbXJBaktwcXdKT3Fhc0NYS21yQW9tcHF3S2lxYXNDdEtxckFzT3Fxd0xucXFzQzhxcXJBbWVycXdKNHJLc0NvcTJyQW1DdnF3SUtzYXNDd1d3a0JDNWQ5d1I0WGZjRXVsMzNCQTJFOXdSVXNzVUYwSVlqQ2dQbm53dVNsUHNTQ2FqN0VnT3QteEpYeXZzU3R0YjdFb24xLXhJc0R2d1NiUkQ4RWxFUl9CS25FdndTSUJQOEVqNFZfQkxxRmZ3UzVSYjhFcTBYX0JKNUdQd1NKaHI4RXJVYl9CS1h1VkVUbnV5UEVfaFdheHBjOWxkNCZleGs9ODQ0Mzc4ODUyJmF3YmlkX2PVpfCwYTRBRndBYTRHTjhGbC15UGZHYjVSZl9YUXdQYmoyckczSG14X195cHF0UWY0R3d0TEpXOFFPTEFuSEg4MzBXVUhOS2pkRWFTdWpHWTBGYW9hRWVhUTNEWkRXV1dDaUt3YXNaNE15TlhYRTJLS1B0Q0ZFZHJLLVc3NUtfRGt2MHFnYl9CUmZUMHlhUG01a3NxbEQtbmY4Uy1uV2REZ3lJMHMyaUxwRFVraXczbERSRSZh4WsEX2QNwPQCBUNERnRkVlo5bmd6cVQ3SVJpVDQ4ZmZtX0JOVTdpMDNOVDVDUDllUmZOV2RNajlTNURDZjUzNGF5VENWRHRvQVg0MVNIazZ6cmJWTlg4TkgyTTY5bXpQMl9QSkV2cnYtbkc1MmlaeDRNU0prd3dMVGVpbHNoN3p3MFhBcER3SHBnNmxTY29YZnYxN2hrbjJmemJLT1dYb200WnlPVG5ab2ZRRWxBbDJDSEdDVk5VLUJyazU0bzBtMm5iYXZHNEtrZU13QVQxcHdvQTFQUl9kNlBGU09lUlRoRGIycG5MWkR2Z0VMWXhJYTJzOC1IdUY4ZnV2emNiR09LRllhZkFXOUxrZkh6ZWRvZnFSeGZtbzBnbVlIZVJjTGw3SU1hbjQ1eFNtem9TczNCd25TUThsejVwWHdqd0w4WEFFYlo1anV1UHQtaGlwX0t6a0RsYXFZaUJMVE5PT3lnSmNNZktCUFBhVjdRdG9LSnJyS0c0UFZvYzNkWUFwN2xjbFVBVTRQRDdhSWFpWUxhOThyNGpYaHNHS3FBQjlsbEZYUURuLXFrWHZNWFlGVkIzdnJWNm44OWd4X2pwY3QzSkFEU2JlTV9TX1ZIc0E0RkN0SHJKdDRLdW5sZ0I5elF2NjRLVURVZVhVN0FxRDRLLUpfeUxobFlGZF9TVXN6cGpQVGVEVnk1d1hQNmdoMG55dVZKUjVxb3JZOHZzeXcydC0xeTRQRlVPbXd1MjBIMTRBWm9ndDgzS3pEWnVjMnBDelBzYTBRa1VhV1hKNWVLcENrNjNvb05VTHZ5TGFrcnJfYi04aUVnT3ZOQ3IzeG5LdzVMcXdzc2dyQXhGLWhPclVDNy15MF9IOVBFdWRLMmhjdTBpNzVUQjVac1BzMFhMWVNTUDhnUEgwcHp3OGMzOVJkeFJoejE2YVZqSVNWWEo1UlVYb0trRExyTDJhdlRjSGdoVVBKdGtlZFVaVmx5VzBxT19scmk3SVhBUGt1TDNKNFlGWE9acjJ6NGRNbzBJaVM3dUtyc1VNUlB6cEdMZUpPSVB6dVplTlV1TnBIenhIV2RsRmRxN1RIdTFoY1R6TE80S3JWQ0lwVWQ2cV9Yd3F2VmR5MWkxS3BhU2lyTjJvWlJEV3F2eGpFZjI4Tk1EWjhfbjMwNmtNSy1TcFF1cWdVY1dmWFoyR0ZNcWJqVHNpSjdCN1J5bVVVSkxnWXl0dkhqSE1ZampZR19aOW9wbVNadnNUZEt0aHNPZ2ZPalZobDVfZHFSeTVrVFhfLVIzYzcta2E5QWROMXl1VGZ1UlE0OXdxQ3RtODNaNUVDaWJTb1lTN1Z4U3RFMFVIS2J4a24xcDFZcTVNaEZHS3BfU0wwZm11d0VmakpqYlA2WWZZTk9qZGN2S1Q4SUZ4aU5MeHJVR2FBS1FuRmozOUF2ZzN2elF5My0yTEM5eHcwdm1MTkx5RFFmeGFTVk1ncERGdjJvYllWQk9Fc081azNtbHp1RkJnUl83dl9pSkZJbG5DV1k1QWk4bkhaYmtkTWd0cEpWdm9JWHdHOGUyY0RJemNXQXRsV3hlWUl6RGVBZERQcTZmTHRVZk1SSEk5VXRmYUFGT3poTkkmY2lkPUNBUVNHd0RJQ2FhTk83cktWRHhoN1FzV3pNSHZTZGFZak9IdEFYVmxyQmdCJmFfY2lkPYADAIgDAZADAJgDFKADAaoD5wEKvwFodHRwDjcP_rAMDrAM8MJDOEIxNFNaQWNScHdCLTZ0ZFF5b1NWUTY3Ykl1VTNHX2NkVk9TZEVMaV9KZENpbjBmc3F6STV1N3ZWSTFmaHhMdVhZeExNdllnRUttUl9jNVlhQ1otS2tEVWNsdyZwcj0xMDoke0FVQ1RJT05fUFJJQ0V9GhMzOTY3MDAxNDM4NDIxMDMyMzg0Igg3NzIyMTc5MyoEMzk0McAD2ATIAwDYAwDgAwDoAwD4AwOABACSBAkvb3BlbnJ0YjKYBACiBA0zNy4mnAuQqAQAsgQMCAAQABgAIAAwADgCuAQAwAQAyAQA2gQCCAHgBADwBA4OGvBDiAUBmAUAoAWzm8v1lY3uvT2qBSo0MDAyMDNjZS1hYzc5LTQ0MTEtYmQ4ZC1hZGI0YzFlYjBlYjB-NzE1fjHABQDJBQAOahoYAPA_0gUJCQULQAAAANgFAeAFAfAFjMYC-gUEAYgokAYAmAYAuAYAwQYBIQExJNAG7o8B2gYWChAJEhkBAbeg4AYB8gYCCACABwGIBwCgBwGqBwwxMzA2MTk0OTc4MDjIB6OABtIHDQkRNwE1CNoHBgFtsBgA4AcA6gcCCADwB-exCYoIAhAAlQgAAIA_mAgBwAikQ9IICQjz__8_EAAYAA..&s=9be3c993fac4b5955046d55d686ae7430afa724e

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://lax1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:40 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 xbfe_backfill.js Show response
googleads.g.doubleclick.net/pagead/ Frame 44B8 7 KB
3 KB 37ms
36ms Script
text/javascript 142.251.16.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/xbfe_backfill.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6cf4189247ceccbc67687e6bbc383d0ca3d9739c8b8429296c03909b1933777a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://lax1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 11:37:21 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1939
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3343
x-xss-protection: 0
server: cafe
etag: 3680861016058904691
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Thu, 19 Oct 2023 12:37:21 GMT

GET
H2 200 it
lax1-ib.adnxs.com/ Frame 44B8 0
646 B 179ms
179ms Image
text/html 104.254.151.36
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lax1-ib.adnxs.com/it?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QLVBvTZAlUDAAADANYABQEIg7nEqQYQwLuyxKTZ54Y3GIXq7pb529yLZyo2CZWW42d1xPs_Ef8_Tpgwmvc_GQAAAEAKV0FAIWoKrgMxmvc_KV4qNuZ1xPs_MQAAAAAAAAhAMLGtxgg4sxlA5R5IZVChn-kkWLrgfGAAaMmwRHijgAaAAQGKAQNVU0SSAQNVU0SYAawCoAH6AagBA7ABALgBAcABBcgBAtABCdgBAOABAPABALICJGZmZDQxMDg1LTc3ZjItNGQyNi05OTg3LTA0MjIzMDU2MWZiMdgCpEPgAur5JeoCGWFueWZpbGUtbm90ZXBhZC5zZW1hYW4uY2GAAwCIAwGQAwCYAxSgAwGqA-cBCr8BaHR0cHM6Ly9wYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvZ2VuXzIwND9pZD1hd2JpZCZhd2JpZF9iPUFLQW1mLUM4QjE0U1pBY1Jwd0ItNnRkUXlvU1ZRNjdiSXVVM0dfY2RWT1NkRUxpX0pkQ2luMGZzcXpJNXU3dlZJMWZoeEx1WFl4TE12WWdFS21SX2M1WWFDWi1La0RVY2x3JnByPTEwOiR7QVVDVElPTl9QUklDRX0aEzM5NjcwMDE0Mzg0MjEwMzIzODQiCDc3MjIxNzkzKgQzOTQxwAPYBMgDANgDAOADAOgDAPgDA4AEAJIECS9vcGVucnRiMpgEAKIEDTM3LjE5LjIxMi4xOTOoBACyBAwIABAAGAAgADAAOAK4BADABADIBADaBAIIAeAEAPAEoZ_pJIgFAZgFAKAFs5vL9ZWN7r09qgUqNDAwMjAzY2UtYWM3OS00NDExLWJkOGQtYWRiNGMxZWIwZWIwfjcxNX4xwAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFjMYC-gUECAAQAJAGAJgGALgGAMEGAAAAAAAA8D_QBu6PAdoGFgoQAABBhBkBsBAAGADgBgHyBgIIAIAHAYgHAKAHAaoHDDEzMDYxOTQ5NzgwOMgHo4AG0gcNCRE3ATUM2gcGCAUJqOAHAOoHAggA8AfnsQmKCAIQAJUIAACAP5gIAcAIpEPSCAkI8___PxAAGAA.&s=136fc109abbdeaa56fe9cad86d74d69eb35a47cc

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.151.36 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://lax1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:40 GMT
an-x-request-uuid: 762cda32-f758-4c15-8c0a-617534c8d9cd
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 37.19.212.193; 37.19.212.193; 897.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK trk.js Show response
cdn.adnxs.com/v/s/239/ Frame 44B8 80 KB
27 KB 1156ms
54ms Script
application/x-javascript 23.47.64.191
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adnxs.com/v/s/239/trk.js
Requested by: Host: lax1-ib.adnxs.com
URL: https://lax1-ib.adnxs.com/if?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QL_NvRTCX8bAAADANYABQEIg7nEqQYQwLuyxKTZ54Y3GIXq7pb529yLZyo2CZWW42d1xPs_Ef8_Tpgwmvc_GQAAAEAKV0FAIWoKrgMxmvc_KV4qNuZ1xPs_MQAAAAAAAAhAMLGtxgg4sxlA5R5IZVChn-kkWLrgfGAAaMmwRHijgAaAAQGKAQNVU0SSAQNVU0SYAawCoAH6AagBAbABALgBAsABBcgBAtABCdgBAOABAPABALICJGZmZDQxMDg1LTc3ZjItNGQyNi05OTg3LTA0MjIzMDU2MWZiMdgCpEPgAur5JeoCGWFueWZpbGUtbm90ZXBhZC5zZW1hYW4uY2HyAg0KBkhFSUdIVBIDMjUw8gIMCgVXSURUSBIDMzAw8gIhCgZMT0FERVISF3JlbmRlcl9wb3N0X2Fkc192MS5odG1s8gIXCgpJRlJBTUVfS0VZEgk4NDQzNzg4NTLyAsgVCgtQUkVfU0NSSVBUUxK4FTxzY3JpcHQ-KGZ1bmN0aW9uKCl7LyoKCiBDb3B5cmlnaHQgVGhlIENsb3N1cmUgTGlicmFyeSBBdXRob3JzLgogU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjAKKi8KdmFyIGs9dGhpc3x8c2VsZjt2YXIgbD1BcnJheS5wcm90b3R5cGUuaW5kZXhPZj9mdW5jdGlvbihhLGMpe3JldHVybiBBcnJheS5wcm90b3R5cGUuaW5kZXhPZi5jYWxsKGEsYyx2b2lkIDApfTpmdW5jdGlvbihhLGMpe2lmKCJzdHJpbmciPT09dHlwZW9mIGEpcmV0dXJuInN0cmluZyIhPT10eXBlb2YgY3x8MSE9Yy5sZW5ndGg_LTE6YS5pbmRleE9mKGMsMCk7Zm9yKHZhciBlPTA7ZTxhLmxlbmd0aDtlKyspaWYoZSBpbiBhJiZhW2VdPT09YylyZXR1cm4gZTtyZXR1cm4tMX07ZnVuY3Rpb24gbShhKXttWyIgIl0oYSk7cmV0dXJuIGF9bVsiICJdPWZ1bmN0aW9uKCl7fTtmdW5jdGlvbiBuKGEpe2E9dm9pZCAwPT09YT9kb2N1bWVudDphO3JldHVybiBhLmNyZWF0ZUVsZW1lbnQoImltZyIpfTtmdW5jdGlvbiBwKGEsYyxlKXt2YXIgYj0hMTtiPXZvaWQgMD09PWI_ITE6YjthLmdvb2dsZV9pbWFnZV9yZXF1ZXN0c3x8KGEuZ29vZ2xlX2ltYWdlX3JlcXVlc3RzPVtdKTt2YXIgZD1uKGEuZG9jdW1lbnQpO2lmKGUpe3ZhciBmPWZ1bmN0aW9uKCl7aWYoZSl7dmFyIGc9YS5nb29nbGVfaW1hZ2VfcmVxdWVzdHMsaD1sKGcsZCk7MDw9aCYmQXJyYXkucHJvdG90eXBlLnNwbGljZS5jYWxsKGcsaCwxKX1kLnJlbW92ZUV2ZW50TGlzdGVuZXImJmQucmVtb3ZlRXZlbnRMaXN0ZW5lcigibG9hZCIsZiwhMSk7ZC5yZW1vdmVFdmVudExpc3RlbmVyJiZkLnJlbW92ZUV2ZW50TGlzdGVuZXIoImVycm9yIixmLCExKX07ZC5hZGRFdmVudExpc3RlbmVyJiZkLmFkZEV2ZW50TGlzdGVuZXIoImxvYWQiLGYsITEpO2QuYWRkRXZlbnRMaXN0ZW5lciYmZC5hZGRFdmVudExpc3RlbmVyKCJlcnJvciIsZiwhMSl9YiYmKGQuYXR0cmlidXRpb25TcmM9IiIpO2Quc3JjPWM7YS5nb29nbGVfaW1hZ2VfcmVxdWVzdHMucHVzaChkKX0KO2Z1bmN0aW9uIHEoKXt2YXIgYT1kb2N1bWVudC5jdXJyZW50U2NyaXB0O3JldHVybihhPXZvaWQgMD09PWE_bnVsbDphKSYmIjc3Ij09PWEuZ2V0QXR0cmlidXRlKCJkYXRhLWpjIik_YTpkb2N1bWVudC5xdWVyeVNlbGVjdG9yKCdbZGF0YS1qYz0iNzciXScpfTt2YXIgcj1SZWdFeHAoIl5odHRwcz86Ly8oXFx3fC0pK1xcLmNkblxcLmFtcHByb2plY3RcXC4obmV0fG9yZykoXFw_fC98JCkiKTsKZnVuY3Rpb24gdCgpe3ZhciBhPWs7dmFyIGM9W107dmFyIGU9bnVsbDtkb3t2YXIgYj1hO3RyeXt2YXIgZDtpZihkPSEhYiYmbnVsbCE9Yi5sb2NhdGlvbi5ocmVmKWI6e3RyeXttKGIuZm9vKTtkPSEwO2JyZWFrIGJ9Y2F0Y2goaCl7fWQ9ITF9dmFyIGY9ZH1jYXRjaChoKXtmPSExfWlmKGYpe3ZhciBnPWIubG9jYXRpb24uaHJlZjtlPWIuZG9jdW1lbnQmJmIuZG9jdW1lbnQucmVmZXJyZXJ8fG51bGx9ZWxzZSBnPWUsZT1udWxsO2MucHVzaChuZXcgdShnfHwiIikpO3RyeXthPWIucGFyZW50fWNhdGNoKGgpe2E9bnVsbH19d2hpbGUoYSYmYiE9YSk7Yj0wO2ZvcihhPWMubGVuZ3RoLTE7Yjw9YTsrK2IpY1tiXS5kZXB0aD1hLWI7Yj1rO2lmKGIubG9jYXRpb24mJmIubG9jYXRpb24uYW5jZXN0b3JPcmlnaW5zJiZiLmxvY2F0aW9uLmFuY2VzdG9yT3JpZ2lucy5sZW5ndGg9PWMubGVuZ3RoLTEpZm9yKGE9MTthPGMubGVuZ3RoOysrYSlnPWNbYV0sZy51cmx8fChnLnVybD1iLmxvY2F0aW9uLmFuY2VzdG9yT3JpZ2luc1thLQoxXXx8IiIsZy5oPSEwKTtiPW5ldyB1KGsubG9jYXRpb24uaHJlZiwhMSk7Zz1udWxsO2ZvcihlPWE9Yy5sZW5ndGgtMTswPD1lOy0tZSlpZihmPWNbZV0sIWcmJnIudGVzdChmLnVybCkmJihnPWYpLGYudXJsJiYhZi5oKXtiPWY7YnJlYWt9Zz1udWxsO2U9Yy5sZW5ndGgmJmNbYV0udXJsOzAhPWIuZGVwdGgmJmUmJihnPWNbYV0pO2M9bmV3IHYoYixnKTtyZXR1cm4gYy5nP2MuZy51cmw6Yy5pLnVybH1mdW5jdGlvbiB2KGEsYyl7dGhpcy5pPWE7dGhpcy5nPWN9Zu1RBCB16RQodGhpcy51cmw9YTsFCxBoPSEhYwkLLGRlcHRoPW51bGx9O9GBqCB3KCl7dmFyIGE9dCgpLGM9YS5pbmRleE9mKCI_Iik7c2V0VGltZW91dCgRMw0xoGU9dm9pZCAwPT09ZT8uMDE6ZTtpZighKE1hdGgucmFuZG9tKCk-ZSkpBV_wYWI9cSgpO2I9Imh0dHBzOi8vIisoYiYmInRydWUiPT09Yi5nZXRBdHRyaWJ1dGUoImRhdGEtamMtcmNkIik_InBhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24tY24uY29tIjoiYiMAAC4BIAwpKyIvCSJ4L2dlbl8yMDQ_aWQ9amNhJmpjPTc3JnZlcnNpb249IhLACAxkPShkAbEMKSYmZFqZAA0xoCIpfHwidW5rbm93biI7ZT1iK2QrIiZzYW1wbGU9IitlO2I9d2luZG93BVgAZjk0FGY_ITE6ZiEzNGQ9Yi5uYXZpZ2F0b3IpMg4AkC51c2VyQWdlbnQsZD0vQ2hyb21lLy50ZXN0KGQpJiYhL0VkZ2UVESQ_ITA6ITE7ZCYmHVEwLnNlbmRCZWFjb24_ClYYACAoZSk6cChiLGUaaAkEPT0NnhgpfX0sMCk7GnoILDA8PWM_YS5zdWJzdA5aCRwoMCxjKTphfQngEC5yZmw9XSMNNYBlbmNvZGVVUklDb21wb25lbnQodygpKX07fSkuY2FsbChBpZgpOwo8L3NjcmlwdD7yAskCCgpFWFRSQV9UQUdTEroCPGRpdiBzdHkhUohwb3NpdGlvbjogYWJzb2x1dGU7IGxlZnQ6IDBweDsgdG9wOgkKcHZpc2liaWxpdHk6IGhpZGRlbjsiPjxpbWcgc3JjWYdJFAQyLkJZAkE2DR4uMgIUYXdiaWQmBQbwhl9iPUFLQW1mLUFucllrSnpPQmxUc0JCQjJXS2tqM0ZKT0sydV9DajI1NFlkZnB2WVA2aWJKVjdRaE5RSzBtbXZFV25sSjkxTTNxeDVGbS1vSFI0Mi1seHREbS1MbFhRWnVXMGlRIiBib3JkZXI9MCB3aWR0aD0xIGhlaWdodD0xIGFsdD0iIjEaqGRpc3BsYXk6bm9uZSI-PC9kaXY-8gKZAQoMUE9TVF9TQ1JJUFRTEogBPHMlajYIASkAUGFkcy5nLmRvdWJsZWNsaWNrLm5ldDEGPHhiZmVfYmFja2ZpbGwuanMBZS21DVMEPihZAWAge3IzcHgoJzg0NDM3ODg1MicpO30pKCk7PeoQkxYKEEgBnTRQT1JUX1BBUkFNUxL-FZEjipQA8H1hZGZldGNoP2Fkaz0xOTQ2ODkyODc4JmFkc2FmZT1tZWRpdW0mY2xpZW50PWNhLXB1Yi0zMDc2ODkwMDEyNzQxNDY3JmZvcm1hdD0zMDB4MjUwX2FzJmlwPTM3LjE5LjIxMi4xOTMmb3V0cHV0PWh0bWwmdW52aWV3ZWRfcG9JiyBfc3RhcnQ9MSaldgxueWZpTgEOECZzdWJfDYoAYkGQ8O1yLTQ3MTAxMjQmaGw9ZW4mYWNlaWQ9TUNFWXRBQ3NHclFBd0JxMEFENGR0QUJESGJRQXhZTTBBWktITkFIc2p6UUJkSkUwQWFPU05BSGFralFCU1pNMEFYNlROQUdSa3pRQnRaTTBBZUdUTkFIdGt6UUJFcFEwQVM2VU5BRXZsRFFCTlpRMEFUZVVOQUZCbERRQlNKUTBBVkdVTkFGU2xEUUJWWlEwQVYtVU5BRm9sRFFCZlpRMEFZS1VOQUdsbERRQnFKUTBBYXVVTkFHMWxEUUJ0NVEwQWJpVU5BRzVsRFFCdXBRMEFidVVOQUc5AXAseDVRMEFkQ1VOQUhUARAAMgFABGQtARAAagEQ9FUDUzNOQkFVMXpRUUd6dm9vQl9fY2VBcE1mWEFLQklGd0NwaUJjQWlqNWlBSzdfb2dDdl82SUFpZENxZ0lvUXFvQ0tVS3FBdlZUcWdLVWFxb0NfbmlxQW9DYnFnS0JtNm9DZ3B1cUFxS29xZ0xscktvQzFyeXFBb2JOcWdKQy1Lb0NRZnVxQXNNTXF3SmFJYXNDaENlckFsUW9xd0w3SzZzQzFEYXJBanc0cXdMOU9hc0NKVHFyQWlrNnF3SXRPcXNDdFR5ckFyMC1xd0pDUWFzQ0hFYXJBbXhLcXdLY1M2c0NZRTZyQXJsT3F3SWdVS3NDOUZDckFnSlJxd0lLVWFzQ0lGeXJBb1JkcXdKbFhxc0NSR0NyQW1WZ3F3SmlZNnNDM0dTckFnOXFxd0k5YXFzQ0czR3JBbFZ4cXdMeGNhc0NnSE9yQW9WenF3TE1kS3NDQ1hhckFrbDJxd0p4ZHFzQ0dIZXJBaDEzcXdJaWQ2c0NKM2VyQWl4M3F3SUtlYXNDYW5xckFxcDZxd0loZmFzQ1U0Q3JBcHVCcXdKVGlxc0NvSXFyQXZhTHF3SjFqS3NDdFl5ckFyZU1xd0tiajZzQ0E1Q3JBa2FRcXdLOGs2c0NIWmFyQWdxWnF3SlptcXNDbzV1ckFyaWRxd0x6bmFzQ1JwNnJBbG1lcXdJQ29Lc0NPS0NyQXNDZ3F3TEZvS3NDeWFDckF1eWdxd0kxb3FzQzlhS3JBZ09qcXdJV3BLc0NfYVNyQW1xbHF3SmhwcXNDbWFhckFueW5xd0pBcUtzQ0FLbXJBaktwcXdKT3Fhc0NYS21yQW9tcHF3S2lxYXNDdEtxckFzT3Fxd0xucXFzQzhxcXJBbWVycXdKNHJLc0NvcTJyQW1DdnF3SUtzYXNDd1d3a0JDNWQ5d1I0WGZjRXVsMzNCQTJFOXdSVXNzVUYwSVlqQ2dQbm53dVNsUHNTQ2FqN0VnT3QteEpYeXZzU3R0YjdFb24xLXhJc0R2d1NiUkQ4RWxFUl9CS25FdndTSUJQOEVqNFZfQkxxRmZ3UzVSYjhFcTBYX0JKNUdQd1NKaHI4RXJVYl9CS1h1VkVUbnV5UEVfaFdheHBjOWxkNCZleGs9ODQ0Mzc4ODUyJmF3YmlkX2PVpfCwYTRBRndBYTRHTjhGbC15UGZHYjVSZl9YUXdQYmoyckczSG14X195cHF0UWY0R3d0TEpXOFFPTEFuSEg4MzBXVUhOS2pkRWFTdWpHWTBGYW9hRWVhUTNEWkRXV1dDaUt3YXNaNE15TlhYRTJLS1B0Q0ZFZHJLLVc3NUtfRGt2MHFnYl9CUmZUMHlhUG01a3NxbEQtbmY4Uy1uV2REZ3lJMHMyaUxwRFVraXczbERSRSZh4WsEX2QNwPQCBUNERnRkVlo5bmd6cVQ3SVJpVDQ4ZmZtX0JOVTdpMDNOVDVDUDllUmZOV2RNajlTNURDZjUzNGF5VENWRHRvQVg0MVNIazZ6cmJWTlg4TkgyTTY5bXpQMl9QSkV2cnYtbkc1MmlaeDRNU0prd3dMVGVpbHNoN3p3MFhBcER3SHBnNmxTY29YZnYxN2hrbjJmemJLT1dYb200WnlPVG5ab2ZRRWxBbDJDSEdDVk5VLUJyazU0bzBtMm5iYXZHNEtrZU13QVQxcHdvQTFQUl9kNlBGU09lUlRoRGIycG5MWkR2Z0VMWXhJYTJzOC1IdUY4ZnV2emNiR09LRllhZkFXOUxrZkh6ZWRvZnFSeGZtbzBnbVlIZVJjTGw3SU1hbjQ1eFNtem9TczNCd25TUThsejVwWHdqd0w4WEFFYlo1anV1UHQtaGlwX0t6a0RsYXFZaUJMVE5PT3lnSmNNZktCUFBhVjdRdG9LSnJyS0c0UFZvYzNkWUFwN2xjbFVBVTRQRDdhSWFpWUxhOThyNGpYaHNHS3FBQjlsbEZYUURuLXFrWHZNWFlGVkIzdnJWNm44OWd4X2pwY3QzSkFEU2JlTV9TX1ZIc0E0RkN0SHJKdDRLdW5sZ0I5elF2NjRLVURVZVhVN0FxRDRLLUpfeUxobFlGZF9TVXN6cGpQVGVEVnk1d1hQNmdoMG55dVZKUjVxb3JZOHZzeXcydC0xeTRQRlVPbXd1MjBIMTRBWm9ndDgzS3pEWnVjMnBDelBzYTBRa1VhV1hKNWVLcENrNjNvb05VTHZ5TGFrcnJfYi04aUVnT3ZOQ3IzeG5LdzVMcXdzc2dyQXhGLWhPclVDNy15MF9IOVBFdWRLMmhjdTBpNzVUQjVac1BzMFhMWVNTUDhnUEgwcHp3OGMzOVJkeFJoejE2YVZqSVNWWEo1UlVYb0trRExyTDJhdlRjSGdoVVBKdGtlZFVaVmx5VzBxT19scmk3SVhBUGt1TDNKNFlGWE9acjJ6NGRNbzBJaVM3dUtyc1VNUlB6cEdMZUpPSVB6dVplTlV1TnBIenhIV2RsRmRxN1RIdTFoY1R6TE80S3JWQ0lwVWQ2cV9Yd3F2VmR5MWkxS3BhU2lyTjJvWlJEV3F2eGpFZjI4Tk1EWjhfbjMwNmtNSy1TcFF1cWdVY1dmWFoyR0ZNcWJqVHNpSjdCN1J5bVVVSkxnWXl0dkhqSE1ZampZR19aOW9wbVNadnNUZEt0aHNPZ2ZPalZobDVfZHFSeTVrVFhfLVIzYzcta2E5QWROMXl1VGZ1UlE0OXdxQ3RtODNaNUVDaWJTb1lTN1Z4U3RFMFVIS2J4a24xcDFZcTVNaEZHS3BfU0wwZm11d0VmakpqYlA2WWZZTk9qZGN2S1Q4SUZ4aU5MeHJVR2FBS1FuRmozOUF2ZzN2elF5My0yTEM5eHcwdm1MTkx5RFFmeGFTVk1ncERGdjJvYllWQk9Fc081azNtbHp1RkJnUl83dl9pSkZJbG5DV1k1QWk4bkhaYmtkTWd0cEpWdm9JWHdHOGUyY0RJemNXQXRsV3hlWUl6RGVBZERQcTZmTHRVZk1SSEk5VXRmYUFGT3poTkkmY2lkPUNBUVNHd0RJQ2FhTk83cktWRHhoN1FzV3pNSHZTZGFZak9IdEFYVmxyQmdCJmFfY2lkPYADAIgDAZADAJgDFKADAaoD5wEKvwFodHRwDjcP_rAMDrAM8MJDOEIxNFNaQWNScHdCLTZ0ZFF5b1NWUTY3Ykl1VTNHX2NkVk9TZEVMaV9KZENpbjBmc3F6STV1N3ZWSTFmaHhMdVhZeExNdllnRUttUl9jNVlhQ1otS2tEVWNsdyZwcj0xMDoke0FVQ1RJT05fUFJJQ0V9GhMzOTY3MDAxNDM4NDIxMDMyMzg0Igg3NzIyMTc5MyoEMzk0McAD2ATIAwDYAwDgAwDoAwD4AwOABACSBAkvb3BlbnJ0YjKYBACiBA0zNy4mnAuQqAQAsgQMCAAQABgAIAAwADgCuAQAwAQAyAQA2gQCCAHgBADwBA4OGvBDiAUBmAUAoAWzm8v1lY3uvT2qBSo0MDAyMDNjZS1hYzc5LTQ0MTEtYmQ4ZC1hZGI0YzFlYjBlYjB-NzE1fjHABQDJBQAOahoYAPA_0gUJCQULQAAAANgFAeAFAfAFjMYC-gUEAYgokAYAmAYAuAYAwQYBIQExJNAG7o8B2gYWChAJEhkBAbeg4AYB8gYCCACABwGIBwCgBwGqBwwxMzA2MTk0OTc4MDjIB6OABtIHDQkRNwE1CNoHBgFtsBgA4AcA6gcCCADwB-exCYoIAhAAlQgAAIA_mAgBwAikQ9IICQjz__8_EAAYAA..&s=9be3c993fac4b5955046d55d686ae7430afa724e
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.47.64.191 Atlanta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-47-64-191.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: a9c49f9f526c232731b2ff9aa3e31b686b8b339bdd246bbf74f804c802f9755d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://lax1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

Date: Thu, 19 Oct 2023 12:09:41 GMT
Content-Encoding: gzip
Last-Modified: Tue, 11 Jul 2023 11:56:12 GMT
Server: AkamaiNetStorage
ETag: "615fd4ad24a409f4de5416b603f042c1:1689076572.555276"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 27646
Expires: Fri, 18 Oct 2024 12:09:41 GMT

GET
H2 200 render_post_ads_v1.html Show response
googleads.g.doubleclick.net/pagead/ Frame 9F55 13 KB
5 KB 36ms
36ms Document
text/html 142.251.16.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

04f5d63c75f9fabede423b3d013e6efd9a448190898a34499a4010a59014a8d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://lax1-ib.adnxs.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 80888
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 4767
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 18 Oct 2023 13:41:32 GMT
etag: 12223946614886178233
expires: Thu, 19 Oct 2023 13:41:32 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 200 adfetch Show response
googleads.g.doubleclick.net/pagead/ Frame 9F55 135 KB
43 KB 123ms
123ms XHR
text/html 142.251.16.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adfetch

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a23cac518784200be1964a852f302cd5b9852e8105d210e36faaa1cd67b94c97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Thu, 19 Oct 2023 12:09:40 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44147
x-xss-protection: 0

GET
H2 200 82ca28dbaca5b785d9b85a9054d15208.js Show response
www.gstatic.com/mysidia/ Frame 9F55 15 KB
7 KB 113ms
37ms Script
text/javascript 172.253.115.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/82ca28dbaca5b785d9b85a9054d15208.js?tag=client_fast_engine

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f94.1e100.net

Software

sffe /

Resource Hash

e595db7b40bedf014568d722e6637c971897c54f2106096f930bf1c6c6298121

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Fri, 13 Oct 2023 13:57:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 511940
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6271
x-xss-protection: 0
last-modified: Thu, 12 Oct 2023 21:09:27 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 11 Jan 2024 13:57:21 GMT

GET
H2 200 c48d59f47e0fef168dfe1f44b7a039fd.js Show response
www.gstatic.com/mysidia/ Frame 9F55 14 KB
6 KB 133ms
57ms Script
text/javascript 172.253.115.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/c48d59f47e0fef168dfe1f44b7a039fd.js?tag=text/vanilla_highlight

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f94.1e100.net

Software

sffe /

Resource Hash

6803803fc88310f2e98747cc8624f2e96a173382784ac9c83765ad0b3c4a0199

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Fri, 13 Oct 2023 14:07:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 511331
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6025
x-xss-protection: 0
last-modified: Thu, 12 Oct 2023 21:09:27 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 11 Jan 2024 14:07:30 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 9F55 14 KB
1 KB 48ms
46ms Stylesheet
text/css 172.253.63.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 19 Oct 2023 12:09:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 19 Oct 2023 11:07:33 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 19 Oct 2023 12:09:40 GMT

GET
H2 200 load_preloaded_resource.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/ Frame 9F55 3 KB
1 KB 385ms
56ms Script
text/javascript 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/load_preloaded_resource.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e0b374d64219f25c480983127d46b1dad0d87e14292b621df9205a2c3c5ce98a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:07:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 145
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1247
x-xss-protection: 0
server: cafe
etag: 9347959128929567288
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 02 Nov 2023 12:07:16 GMT

GET
H2 200 abg_lite.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/ Frame 9F55 30 KB
11 KB 381ms
51ms Script
text/javascript 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c75166534a7cf375f7963558a6a55858688f6c289c9d200706ce1592669ffe3b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 09:25:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9869
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11596
x-xss-protection: 0
server: cafe
etag: 6499730840814102677
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 02 Nov 2023 09:25:12 GMT

GET
H2 200 window_focus.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/ Frame 9F55 3 KB
1 KB 387ms
58ms Script
text/javascript 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/window_focus.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

88a577b7767cbe34315ff67366be5530949df573931dd9c762c2c2e0434c5b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 11:20:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2947
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1307
x-xss-protection: 0
server: cafe
etag: 18393213423120915576
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 02 Nov 2023 11:20:34 GMT

GET
H2 200 qs_click_protection.js Show response
tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/ Frame 9F55 29 KB
12 KB 365ms
36ms Script
text/javascript 142.250.31.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231011/r20110914/client/qs_click_protection.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.31.132 Oxford, United States, ASN15169 (GOOGLE, US),

Reverse DNS

678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

cafe /

Resource Hash

be78b72189b3c20bdceb388596d3f56cd14391953c7acbc0c1397696ee159b12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Wed, 18 Oct 2023 23:58:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 43874
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11410
x-xss-protection: 0
server: cafe
etag: 9599288504522070368
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 01 Nov 2023 23:58:27 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 9F55 0
0 310ms
48ms Image
text/html 172.253.115.104
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSRjga87XiPMaRZfR_-TUN-0aBZTxdSJobM2in8AGO6qZCT-TtSCrQOOcLcUjnzDhg2qmau5iDsOVmNFFpt9cYXnkuiow
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.253.115.104 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bg-in-f104.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9F55 187 KB
59 KB 39ms
38ms Script
text/javascript 142.251.167.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ww-in-f154.1e100.net

Software

sffe /

Resource Hash

100e1bd433b0fbe35e8d609395d4f9a1cbafbeddb64a30b6ac6fcc7888f9310a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60178
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1697628223465749"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 19 Oct 2023 12:09:40 GMT

GET
H2 200 c62cdbe74aa44fa5687213016a2a0988.js Show response
www.gstatic.com/mysidia/ Frame 9F55 51 KB
19 KB 111ms
39ms Script
text/javascript 172.253.115.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/c62cdbe74aa44fa5687213016a2a0988.js?tag=mysidia_one_click_handler_one_afma

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f94.1e100.net

Software

sffe /

Resource Hash

c6f3705baa0b29577010fcae82a5815b87dc50705f0c72e79f41ca052abfeb9e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Fri, 13 Oct 2023 13:48:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 512477
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19622
x-xss-protection: 0
last-modified: Thu, 12 Oct 2023 21:09:27 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 11 Jan 2024 13:48:24 GMT

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame EDFD 0
595 B 35ms
35ms Script
text/html 68.67.160.76
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=3251&pub_id=1623654&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=3251&pub_id=1623654

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.76 Fairfield, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:41 GMT
an-x-request-uuid: 624473aa-5ccf-43d5-888a-b3957920219d
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
cache-control: no-store, no-cache, private
x-proxy-origin: 37.19.212.193; 37.19.212.193; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 9F55
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=C1WxrgxwxZfrHM5jD998Ps_q-yATu25jHc-OhmrWgDr7-iMiqHBABIOaX1iVg_aCZgegDoAGN7OTZAsgBAakCFqOCICNtqD6oAwHIA8sEqgToAU_QcUyC2odWSVPzYpESzV__hIulRKAeUwQ...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x9c83a60c7a50ce6a0000000000000000%22,%222%22:%220xf216c68e0f95340c0000000000000000%22,%223%22:%220x5a000b...

0
0

165ms
91ms

Fetch
text/css

172.253.62.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x9c83a60c7a50ce6a0000000000000000%22,%222%22:%220xf216c68e0f95340c0000000000000000%22,%223%22:%220x5a000b53f53a2d620000000000000000%22,%224%22:%220xe39a663abb1d17750000000000000000%22,%225%22:%220x556e6aaf46d29d820000000000000000%22},%22debug_key%22:%2216977603273491719871%22,%22debug_reporting%22:true,%22destination%22:%22https://pchelpsoft.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22725169677%22],%224%22:[%2210-19%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%22783252032617967217%22}&andc=true

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:41 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"1":"0x9c83a60c7a50ce6a0000000000000000","2":"0xf216c68e0f95340c0000000000000000","3":"0x5a000b53f53a2d620000000000000000","4":"0xe39a663abb1d17750000000000000000","5":"0x556e6aaf46d29d820000000000000000"},"debug_key":"16977603273491719871","debug_reporting":true,"destination":"https://pchelpsoft.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["725169677"],"4":["10-19"],"6":["true"]},"priority":"500","source_event_id":"783252032617967217"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 19 Oct 2023 12:09:41 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 19 Oct 2023 12:09:41 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"aggregation_keys":{"1":"0x9c83a60c7a50ce6a0000000000000000","2":"0xf216c68e0f95340c0000000000000000","3":"0x5a000b53f53a2d620000000000000000","4":"0xe39a663abb1d17750000000000000000","5":"0x556e6aaf46d29d820000000000000000"},"debug_key":"16977603273491719871","debug_reporting":true,"destination":"https://pchelpsoft.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["725169677"],"4":["10-19"],"6":["true"]},"priority":"500","source_event_id":"783252032617967217"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame DB4C 143 B
166 B 36ms
36ms Document
text/html 142.251.16.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 3302
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 19 Oct 2023 11:14:39 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame DB4C
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

44ms
44ms

Document
text/html

142.251.16.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 19 Oct 2023 12:09:41 GMT
expires: Thu, 19 Oct 2023 12:09:41 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 19 Oct 2023 12:09:41 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 164ms
90ms Preflight
text/html 172.253.62.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 19 Oct 2023 12:09:41 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 9F55 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 639e5d3d1d0f0a5882201c89bcb7263832bb13ea3e2b7de99c23fcdae97543bd

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 dcl.htm Show response
rt3010.infolinks.com/action/ 0
62 B 102ms
101ms Script
text/html 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rt3010.infolinks.com/action/dcl.htm?rid=400203ce-ac79-4411-bd8d-adb4c1eb0eb0&prod_t=d&sdata=article&bdc=1&midx=0&capara=%7B%22ve%22%3A%22mrc50%22%7D
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1891.003-3.027/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:41 GMT
cf-cache-status: DYNAMIC
server: cloudflare
content-type: text/html;charset=UTF-8
cache-control: no-cache,no-store
cf-ray: 8188e9e1caa9a252-YYZ
content-length: 0
x-application-context: application:prod
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v58/ Frame 9F55 33 KB
34 KB 108ms
36ms Font
font/woff2 142.251.16.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bl-in-f94.1e100.net

Software

sffe /

Resource Hash

65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Fri, 13 Oct 2023 13:52:39 GMT
x-content-type-options: nosniff
age: 512222
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34108
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 12 Oct 2024 13:52:39 GMT

GET
H2 200 e-zfyE2pbDTyYQrCQWWBVQC0FJ7OV3Fqk4CSA41GVMg.js Show response
pagead2.googlesyndication.com/bg/ Frame A5E4 37 KB
15 KB 38ms
36ms Script
text/javascript 172.253.62.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/e-zfyE2pbDTyYQrCQWWBVQC0FJ7OV3Fqk4CSA41GVMg.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7becdfc84da96c34f2610ac24165815500b4149ece57716a938092038d4654c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 12 Oct 2023 18:34:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 581735
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14689
x-xss-protection: 0
last-modified: Tue, 10 Oct 2023 07:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 11 Oct 2024 18:34:06 GMT

GET
H2

200

us.gif
sync.go.sonobi.com/
Redirect Chain

https://id5-sync.com/i/535/8.gif?id5id=ID5*u0MbeLvFFW023MPEzIj6smVMHLp2mKvGtm9nnDc66XVokZ-qR-s8-XhsvgPy4bAcaJIOIlfVkoGUax0RZ_VaoA&o=api&gdpr_consent=undefined&gdpr=false
https://pixel.tapad.com/idsync/ex/push?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F535%2F108%2F7%2F2.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_con...
https://id5-sync.com/c/535/108/7/2.gif?puid=f581ea5d-a018-40b0-b6a3-b8c6fd92e17f&gdpr=0&gdpr_consent=
https://ib.adnxs.com/getuid?https://id5-sync.com/c/535/2/6/3.gif?puid=$UID&gdpr=0&gdpr_consent=
https://id5-sync.com/c/535/2/6/3.gif?puid=7428532414938068229&gdpr=0&gdpr_consent=
https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fid5-sync.com%2Fc%2F535%2F429%2F5%2F4.gif%3Fpuid%3D%23PM_USER_ID%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0
https://id5-sync.com/c/535/429/5/4.gif?puid=CFFAEDA6-7F12-4D36-9CC5-AF441639D229&gdpr=0&gdpr_consent=
https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fid5-sync.com%2Fc%2F535%2F434%2F4%2F5.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&consent=
https://id5-sync.com/c/535/434/4/5.gif?puid=137827e5-7fc6-4753-83a6-9934c50200aa&gdpr=0&gdpr_consent=
https://rtb.gumgum.com/getuid/id5?r=https%3A%2F%2Fid5-sync.com%2Fc%2F535%2F441%2F3%2F6.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=
https://id5-sync.com/c/535/441/3/6.gif?puid=u_a212c7ca-b4e6-4403-8ca6-ab0abe7d3e64&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=
https://id5-sync.com/k/264.gif?puid=9279c2c7-0a3c-4984-9085-399d8dc48589&ttl=%%TTL%%
https://uipglob.semasio.net/id5/1/get?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F535%2F112%2F1%2F8.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D
https://uipglob.semasio.net/id5/1/get2?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F535%2F112%2F1%2F8.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D
https://id5-sync.com/c/535/112/1/8.gif?puid=350639C94BC6748D&gdpr=0&gdpr_consent=
https://sync.go.sonobi.com/us.gif?nw=i5td&nuid=9279c2c7-0a3c-4984-9085-399d8dc48589&gdpr=0&consent=&id5id=ID5-8fb1OOBsJLX5uo1PrYP75mll8_W90o81Sh7VtB-QPA

49 B
773 B

350ms
33ms

Image
image/gif

69.166.1.66
AS-XFERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us.gif?nw=i5td&nuid=9279c2c7-0a3c-4984-9085-399d8dc48589&gdpr=0&consent=&id5id=ID5-8fb1OOBsJLX5uo1PrYP75mll8_W90o81Sh7VtB-QPA

Requested by

Protocol

Server

69.166.1.66 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

8f69e10876805b747a3ad08a818d46ac7e731b1af417ea6e259d9b6b7deb65c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:44 GMT
server: sonobi-go
vary: negotiate,Accept-Encoding
x-go-server: go-iad-2-6-72
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store, private
tcn: Choice
content-length: 49
x-xss-protection: 0
expires: Sat, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://sync.go.sonobi.com/us.gif?nw=i5td&nuid=9279c2c7-0a3c-4984-9085-399d8dc48589&gdpr=0&consent=&id5id=ID5-8fb1OOBsJLX5uo1PrYP75mll8_W90o81Sh7VtB-QPA
date: Thu, 19 Oct 2023 12:09:43 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
p3p: CP="CAO PSA OUR"

POST
H2 200 vevent
lax1-ib.adnxs.com/ Frame 44B8 0
663 B 158ms
158ms Ping
text/html 104.254.151.36
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://lax1-ib.adnxs.com/vevent?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QLVBvTZAlUDAAADANYABQEIg7nEqQYQwLuyxKTZ54Y3GIXq7pb529yLZyo2CZWW42d1xPs_Ef8_Tpgwmvc_GQAAAEAKV0FAIWoKrgMxmvc_KV4qNuZ1xPs_MQAAAAAAAAhAMLGtxgg4sxlA5R5IZVChn-kkWLrgfGAAaMmwRHijgAaAAQGKAQNVU0SSAQNVU0SYAawCoAH6AagBA7ABALgBAcABBcgBAtABCdgBAOABAPABALICJGZmZDQxMDg1LTc3ZjItNGQyNi05OTg3LTA0MjIzMDU2MWZiMdgCpEPgAur5JeoCGWFueWZpbGUtbm90ZXBhZC5zZW1hYW4uY2GAAwCIAwGQAwCYAxSgAwGqA-cBCr8BaHR0cHM6Ly9wYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvZ2VuXzIwND9pZD1hd2JpZCZhd2JpZF9iPUFLQW1mLUM4QjE0U1pBY1Jwd0ItNnRkUXlvU1ZRNjdiSXVVM0dfY2RWT1NkRUxpX0pkQ2luMGZzcXpJNXU3dlZJMWZoeEx1WFl4TE12WWdFS21SX2M1WWFDWi1La0RVY2x3JnByPTEwOiR7QVVDVElPTl9QUklDRX0aEzM5NjcwMDE0Mzg0MjEwMzIzODQiCDc3MjIxNzkzKgQzOTQxwAPYBMgDANgDAOADAOgDAPgDA4AEAJIECS9vcGVucnRiMpgEAKIEDTM3LjE5LjIxMi4xOTOoBACyBAwIABAAGAAgADAAOAK4BADABADIBADaBAIIAeAEAPAEoZ_pJIgFAZgFAKAFs5vL9ZWN7r09qgUqNDAwMjAzY2UtYWM3OS00NDExLWJkOGQtYWRiNGMxZWIwZWIwfjcxNX4xwAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFjMYC-gUECAAQAJAGAJgGALgGAMEGAAAAAAAA8D_QBu6PAdoGFgoQAABBhBkBsBAAGADgBgHyBgIIAIAHAYgHAKAHAaoHDDEzMDYxOTQ5NzgwOMgHo4AG0gcNCRE3ATUM2gcGCAUJqOAHAOoHAggA8AfnsQmKCAIQAJUIAACAP5gIAcAIpEPSCAkI8___PxAAGAA.&s=136fc109abbdeaa56fe9cad86d74d69eb35a47cc&type=nv&nvt=5&jm=1003&px=0&py=0&bw=300&bh=250&sid=1659830871166894475&vd=ct~0|rr~0&sv=239&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=17929905&sw=1600&sh=1200&pw=300&ph=250&ww=300&wh=250&ft=3

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/239/trk.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.151.36 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://lax1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:42 GMT
an-x-request-uuid: fcc88773-c333-4e8d-b26a-47beca7eddec
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: https://lax1-ib.adnxs.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 37.19.212.193; 37.19.212.193; 897.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame EDFD 0
594 B 35ms
35ms Script
text/html 68.67.160.76
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=3251&pub_id=1623654&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=3251&pub_id=1623654

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.160.76 Fairfield, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:42 GMT
an-x-request-uuid: 04b1a70f-c80e-44a5-ba08-49c54023acf1
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
cache-control: no-store, no-cache, private
x-proxy-origin: 37.19.212.193; 37.19.212.193; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

rtset
bh.contextweb.com/bh/
Redirect Chain

https://bh.contextweb.com/visitormatch/prebid
https://cm.g.doubleclick.net/pixel?google_nid=contextweb&google_cm&google_sc&google_hm=%%ENCRYPTED_VGUID_B64%%&gdpr=%%GDPR_IN_EFFECT%%&gdpr_consent=%%GDPR_CONSENT%%
https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=%%GDPR_IN_EFFECT%%&gdpr_consent=%%GDPR_CONSENT%%&google_hm=2&ev=CAESEGqHU5z-7lhwUsoSNPhvMl8&google_cver=1

49 B
787 B

29ms
28ms

Image
image/gif

198.148.27.131
PULSEPOINT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=%%GDPR_IN_EFFECT%%&gdpr_consent=%%GDPR_CONSENT%%&google_hm=2&ev=CAESEGqHU5z-7lhwUsoSNPhvMl8&google_cver=1

Requested by

Protocol

Server

198.148.27.131 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Jetty(10.0.14) /

Resource Hash

d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-CA
content-type: image/gif;charset=iso-8859-1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-cdf9fc9cc-tk9jc
expires: -1

Redirect headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:42 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=%%GDPR_IN_EFFECT%%&gdpr_consent=%%GDPR_CONSENT%%&google_hm=2&ev=CAESEGqHU5z-7lhwUsoSNPhvMl8&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 384
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 9F55 42 B
64 B 177ms
104ms Fetch
image/gif 172.253.62.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssntyi2QQvLkoi0--vhCta-dF4JvY6YNKrWKYoSr8xFdOrcdzwAHBqZsNLcu1ay4TIT3HWO2CoPZjXjC8X2yPw-oNjXHemZBOOKLyhtX7I_FR2DP5HcOnZWCnL_eNz-A-CJsn4F1ST2Eg&sai=AMfl-YSnPa3PtV-2WbqqvKluVDGdcU4Z_lWGZ9FUJb786qLh84NM5h6C-QUElsN1_QcRflUg4GXjqhUXhpnmJV3c3o6OONefm5Ozgtc&sig=Cg0ArKJSzIkalKCsiWayEAE&cid=CAQSKQDICaaN3d_n-h_ZXdGx5QBCFIXw8_9mfn7H3gzBlEBT01_8hxurb9QkGAE&id=lidar2&mcvt=1000&p=0,0,250,300&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231018&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=1946892878&rs=5&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1697717380764&rpt=648&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:42 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame BBB2 41 KB
11 KB 41ms
40ms Script
text/html 23.55.205.215
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.55.205.215 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-55-205-215.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: dc4506fa2f39c30ca17faf927bb8f26e6fc78344c6867e69637afd5c17afa75c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

Date: Thu, 19 Oct 2023 12:09:42 GMT
Content-Encoding: gzip
Last-Modified: Thu, 19 Oct 2023 11:36:16 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=84380
Connection: keep-alive
Content-Length: 11097
Expires: Fri, 20 Oct 2023 11:36:02 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame ABBA 5 KB
6 KB 33ms
31ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=83393469&p=156423&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e1f1952256105685dcf70d5dba356d270cfb81ccc34e2cf090bb83698b2efc3d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
date: Thu, 19 Oct 2023 12:09:42 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 vidice.js Show response
resources.infolinks.com/js/vidice/2.0/ 333 KB
86 KB 34ms
33ms Script
application/javascript 172.66.42.247
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/js/vidice/2.0/vidice.js
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1891.003-3.027/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.42.247 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b2bdac211f43fbee9eeb4d50f8755206599f76296cd15316a97c9d2cb2050d2f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:42 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 20 Mar 2023 11:31:12 GMT
server: cloudflare
age: 10490
etag: W/"5344d-5f75343a1bcf7"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 8188e9eaeabea252-YYZ
expires: Sat, 18 Nov 2023 09:14:52 GMT

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame BBB2 7 B
862 B 1153ms
35ms XHR
application/json 8.43.72.97

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 8.43.72.97 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: 6734403d2cb3625dc1fef1bbd4a17cf3
Expires: 0

GET
H/1.1 200
OK dcm Show response
s.amazon-adsystem.com/ Frame 3BA1 43 B
855 B 40ms
40ms Document
image/gif 52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.amazon-adsystem.com/dcm?pid=3b882453-6770-4785-baf8-a598533c054a&id=CFFAEDA6-7F12-4D36-9CC5-AF441639D229&redir=true&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif
Date: Thu, 19 Oct 2023 12:09:42 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server: Server
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
x-amz-rid: H663PWG2C2FX2EM5WQPW

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 5A4B
Redirect Chain

https://match.prod.bidr.io/cookie-sync/pm?gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFFNFpFN0tZamtBQUJrRVVCSGZ5Zw&gdpr=0&gdpr_consent=&bee_sync_partners=pp%2Csas%2Csyn%2Cpm&bee_sync_current_partner=adx&b...
https://match.prod.bidr.io/cookie-sync/adx?gdpr=0&gdpr_consent=&bee_sync_partners=pp%2Csas%2Csyn%2Cpm&bee_sync_current_partner=adx&bee_sync_initiator=pm&bee_sync_hop_count=1
https://bh.contextweb.com/bh/rtset?ev=AAE4ZE7KYjkAABkEUBHfyg&do=add&pid=558502&rurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26bee_sync_partners%3Dsas%252Csyn%252Cpm%26bee_sync_cur...
https://match.prod.bidr.io/cookie-sync?gdpr=0&bee_sync_partners=sas%2Csyn%2Cpm&bee_sync_current_partner=pp&bee_sync_initiator=adx&bee_sync_hop_count=2&ev=AAE4ZE7KYjkAABkEUBHfyg&pid=558502&do=add&gd...
https://rtb-csync.smartadserver.com/redir?partneruserid=AAE4ZE7KYjkAABkEUBHfyg&partnerid=127&redirurl=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr%3D0%26bee_sync_partners%3Dsyn%...
https://match.prod.bidr.io/cookie-sync?gdpr=0&gdpr=0&bee_sync_partners=syn%2Cpm&bee_sync_current_partner=sas&bee_sync_initiator=adx&bee_sync_hop_count=3&userid=6754517263874570649&gdpr=0&gdpr_consent=
https://sync.technoratimedia.com/services?uid=AAE4ZE7KYjkAABkEUBHfyg&srv=cs&pid=73&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr%3D0%26userid%3D6754517263874570649%26gdpr%3D0%...
https://ssum-sec.casalemedia.com/usermatchredir?s=191740&cb=https%3A%2F%2Fsync.technoratimedia.com%2Fservices%3Fsrv%3Dcs%26nuid%3D326F4B1229B64C6DAF94E8C5E1A9AF37%26att%3D1%26pid%3D82%26cb%3Dhttps%...
https://sync.technoratimedia.com/services?srv=cs&nuid=326F4B1229B64C6DAF94E8C5E1A9AF37&att=1&pid=82&cb=https%3A%2F%2Fmatch.prod.bidr.io%2Fcookie-sync%3Fgdpr%3D0%26gdpr%3D0%26userid%3D67545172638745...
https://match.prod.bidr.io/cookie-sync?gdpr=0&gdpr=0&userid=6754517263874570649&gdpr=0&gdpr_consent=&bee_sync_partners=pm&bee_sync_current_partner=syn&bee_sync_initiator=adx&bee_sync_hop_count=4
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAE4ZE7KYjkAABkEUBHfyg&gdpr=0&gdpr_consent=

42 B
279 B

34ms
34ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAE4ZE7KYjkAABkEUBHfyg&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 19 Oct 2023 12:09:43 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Connection: keep-alive
Content-Length: 0
Date: Thu, 19 Oct 2023 12:09:43 GMT
Server: gunicorn
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAE4ZE7KYjkAABkEUBHfyg&gdpr=0&gdpr_consent=
strict-transport-security: max-age=2592000; includeSubDomains

GET

Pug
simage2.pubmatic.com/AdServer/ Frame EE5F
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=7428532414938068229&gdpr=0&gdpr_consent=

0
0

GET
H2 200 141 Show response
match.deepintent.com/usersync/ Frame 277A 0
338 B 115ms
35ms Document
image/gif 38.91.45.7
DEEPINTENT

General

Check archive.org

Show headers Download Go to

Full URL: https://match.deepintent.com/usersync/141?gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 38.91.45.7 Ashburn, United States, ASN398989 (DEEPINTENT, US),
Reverse DNS
Software: c /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

content-length: 0
content-type: image/gif
date: Thu, 19 Oct 2023 12:09:42 GMT
p3p: policyref='http://cdn.deepintent.com/p3p.xml', CP='NON CUR DEV TAI'
server: c

GET
H2

200

b9pj45k4 Show response
sync-tm.everesttech.net/ct/upi/pid/ Frame DC40
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_con...
https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_...

85 B
259 B

37ms
37ms

Document
image/png

151.101.2.49
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_consent=&_test=ZTEchwAY7pMCRAA_
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.2.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: no-cache
content-length: 85
content-type: image/png
date: Thu, 19 Oct 2023 12:09:44 GMT
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-served-by: cache-yyz4573-YYZ
x-timer: S1697717384.997187,VS0,VE21

Redirect headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: no-cache
content-length: 0
date: Thu, 19 Oct 2023 12:09:43 GMT
location: https://sync-tm.everesttech.net/ct/upi/pid/b9pj45k4?redir=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=${TM_USER_ID}&gdpr=1&gdpr_consent=&_test=ZTEchwAY7pMCRAA_
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
pragma: no-cache
server: Jetty(9.4.35.v20201120)
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-served-by: cache-yyz4573-YYZ
x-timer: S1697717384.958878,VS0,VE21

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 6ADE
Redirect Chain

https://cms.quantserve.com/pixel/p-5aWVS_roA1dVM.gif?idmatch=0&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=M3q3bDQsvGsoLeJpY3apbGd5sj4oerdvZnbTqrHG

42 B
415 B

33ms
33ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=M3q3bDQsvGsoLeJpY3apbGd5sj4oerdvZnbTqrHG
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 19 Oct 2023 12:09:42 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
date: Thu, 19 Oct 2023 12:09:42 GMT
expires: Fri, 04 Aug 1978 12:00:00 GMT
location: https://image2.pubmatic.com/AdServer/Pug?gdpr=0&vcode=bz0yJnR5cGU9MSZjb2RlPTExMTMmdGw9NDMyMDA=&piggybackCookie=M3q3bDQsvGsoLeJpY3apbGd5sj4oerdvZnbTqrHG
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
pragma: no-cache
strict-transport-security: max-age=86400

GET

Pug
simage2.pubmatic.com/AdServer/ Frame F93D
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=11&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MzEmdGw9MTI5NjAw&piggybackCookie=WHEoEKATVk1pnC7jdv7KYiUT1ME&gdpr=0&gdpr_consent=

0
0

GET

Pug
simage2.pubmatic.com/AdServer/ Frame 4D52
Redirect Chain

https://cm.adgrx.com/bridge?AG_PID=pubmatic&AG_SETCOOKIE&gdpr=0&gdpr_consent=
https://cm.adgrx.com/bridge.gif?AG_PID=pubmatic&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzMDEmdGw9MTI5NjAw&piggybackCookie=63123ee8-6e78-11ee-b050-ca39a395c296

0
0

GET

sync
odr.mookie1.com/t/v2/ Frame 9C0F
Redirect Chain

https://x.bidswitch.net/sync?ssp=pubmatic&gdpr=0&gdpr_consent=&us_privacy=
https://odr.mookie1.com/t/v2/sync?tagid=V2_790378&src.visitorId=62f3bea8-85b8-457d-80ee-09e2934320be&ssp=pubmatic&gdpr=0&gdpr_consent=

0
0

GET usersync.aspx
dis.criteo.com/dis/ Frame 923F 0
0

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 4AA7
Redirect Chain

https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=2810316566524960240

42 B
291 B

33ms
32ms

Document
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=2810316566524960240
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Thu, 19 Oct 2023 12:09:41 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Content-Length: 0
Date: Thu, 19 Oct 2023 12:09:42 GMT
Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=2810316566524960240
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET pubmatic
ad.mrtnsvr.com/sync/ Frame FE49 0
0

GET ping_match.gif
pm.w55c.net/ Frame C054 0
0

GET pbmtc.gif
beacon.lynx.cognitivlabs.com/ Frame 7F30 0
0

GET

Pug
simage2.pubmatic.com/AdServer/ Frame E5A3
Redirect Chain

https://b1sync.zemanta.com/usersync/pubmatic/?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDMmdGw9MTI5NjAw&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMzNDMmdGw9MTI5NjAw&piggybackCookie=uid:iM3sLYoKzkdGqBcqRC-P&gdpr=0&gdpr_consent=&gdpr=0

0
0

GET
H2 200 i.match Show response
a.tribalfusion.com/ Frame 5FD8 43 B
462 B 90ms
85ms Document
image/gif 104.18.25.173
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.tribalfusion.com/i.match?p=b11&redirect=https%3A//simage2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTMzMjYmdGw9MTI5NjAw%26piggybackCookie%3D%24TF_USER_ID_ENC%24&u=${PUBMATIC_UID}
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.25.173 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f49e616d278a16d9cd55a6d5fe19c99ebd37d7d3848d14422190618b67011e0

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache private
cf-cache-status: DYNAMIC
cf-ray: 8188e9eb3fc339f6-YYZ
content-length: 43
content-type: image/gif; charset=utf-8
date: Thu, 19 Oct 2023 12:09:42 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
p3p: CP="NOI DEVo TAIa OUR BUS"
pragma: no-cache
server: cloudflare
x-function: 302

GET sync
t.adx.opera.com/pub/ Frame 4CB3 0
0

GET

Pug
simage2.pubmatic.com/AdServer/ Frame AC60
Redirect Chain

https://ums.acuityplatform.com/tum?umid=6
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI5NDcmdGw9MTI5NjAw&piggybackCookie=842316258356

0
0

GET
H3 200 match Show response
events-ssc.33across.com/ Frame 445D 68 B
82 B 44ms
43ms Document
image/png 34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://events-ssc.33across.com/match?liv=h&us_privacy=&bidder_id=25&external_user_id=CFFAEDA6-7F12-4D36-9CC5-AF441639D229
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 68
content-type: image/png
date: Thu, 19 Oct 2023 12:09:42 GMT
via: 1.1 google

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame ABBA
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=z_rtpn8STTacxa9EFjnSKQ%3D%3D&gdpr=0&gdpr_consent=
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=

15 KB
15 KB

44ms
43ms

Image
text/html

23.47.64.205
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Server: 23.47.64.205 Atlanta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-47-64-205.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:42 GMT
content-encoding: gzip
last-modified: Fri, 01 Sep 2023 11:18:33 GMT
server: Apache
vary: Accept-Encoding
content-type: text/html
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=29450
accept-ranges: bytes
content-length: 5606
expires: Thu, 19 Oct 2023 20:20:32 GMT

Redirect headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:42 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame ABBA
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_id=3371&partner_device_id=CFFAEDA6-7F12-4D36-9CC5-AF441639D229
https://dpm.demdex.net/ibs:dpid=540&dpuuid=f581ea5d-a018-40b0-b6a3-b8c6fd92e17f&redir=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DADB%26partner_device_id%3D%24%7BDD_UUID%7D...
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=540&dpuuid=f581ea5d-a018-40b0-b6a3-b8c6fd92e17f&redir=https%3A%2F%2Fpixel.tapad.com%2Fidsync%2Fex%2Freceive%3Fpartner_id%3DADB%26partner_device...
https://pixel.tapad.com/idsync/ex/receive?partner_id=ADB&partner_device_id=13720998680669905300730029506964403108&pt=f581ea5d-a018-40b0-b6a3-b8c6fd92e17f%2C%2C

95 B
124 B

54ms
54ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=ADB&partner_device_id=13720998680669905300730029506964403108&pt=f581ea5d-a018-40b0-b6a3-b8c6fd92e17f%2C%2C

Requested by

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:43 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

DCS: dcs-prod-va6-1-v051-0ac61509b.edge-va6.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: p+V3UVt4Rjo=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://pixel.tapad.com/idsync/ex/receive?partner_id=ADB&partner_device_id=13720998680669905300730029506964403108&pt=f581ea5d-a018-40b0-b6a3-b8c6fd92e17f%2C%2C
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET FZt5psomz79DGe~O1V5PkX7S8-NVJIdw0INR-k~Duu9c36GyIDyElf4y8fa2~-9InNSq4BCadyu-8tQSiIkaVleT~Yh8GI4ocNSeo4~API4DJEsYNIMg2sPMMXvjcckTUFy53ZYw3gzv35jSAchydRkSr2XFgqe-kzzlKTlv1VT7-TlAc0PcX7nFzbKlHypwbpU3A...
us01.z.antigena.com/l/ Frame ABBA 0
0

GET
H2 200 xuid
eb2.3lift.com/ Frame ABBA 37 B
354 B 45ms
39ms Image
image/gif 52.223.22.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eb2.3lift.com/xuid?mid=7976&xuid=CFFAEDA6-7F12-4D36-9CC5-AF441639D229&dongle=u6nf&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.223.22.214 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: afb83dd09526a6517.awsglobalaccelerator.com
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

content-type: image/gif
date: Thu, 19 Oct 2023 12:09:42 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 37
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame ABBA
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEIkXgDycIwO-8rdlYGFlLVI&google_cver=1

42 B
270 B

34ms
33ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEIkXgDycIwO-8rdlYGFlLVI&google_cver=1
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Thu, 19 Oct 2023 12:09:42 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:42 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEIkXgDycIwO-8rdlYGFlLVI&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 379
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame ABBA
Redirect Chain

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:6BD46589BE3C45D58663717B78E42E07

42 B
366 B

33ms
32ms

Image
image/gif

8.28.7.83
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:6BD46589BE3C45D58663717B78E42E07
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Server: 8.28.7.83 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Thu, 19 Oct 2023 04:38:45 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

date: Thu, 19 Oct 2023 12:09:42 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTgwNiZ0bD01MTg0MDA=&piggybackCookie=uid:6BD46589BE3C45D58663717B78E42E07
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Wed, 18 Oct 2023 12:09:42 GMT

GET

Pug
simage2.pubmatic.com/AdServer/ Frame ABBA
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&piggybackCookie=9279c2c7-0a3c-4984-9085-399d8dc48589&gdpr=0&gdpr_consent=

0
0

GET
H2 200 CFFAEDA6-7F12-4D36-9CC5-AF441639D229
pr-bh.ybp.yahoo.com/sync/pubmatic/ Frame ABBA 43 B
602 B 1408ms
40ms Image
image/gif 54.88.44.129

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/pubmatic/CFFAEDA6-7F12-4D36-9CC5-AF441639D229?gdpr=0&gdpr_consent=

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.88.44.129 -, , ASN (),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:44 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
content-length: 43

GET
H2

200

SPug
image4.pubmatic.com/AdServer/ Frame ABBA
Redirect Chain

https://ups.analytics.yahoo.com/ups/58292/sync?_origin=1&uid=CFFAEDA6-7F12-4D36-9CC5-AF441639D229&redir=true&gdpr=0&gdpr_consent=
https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-PU5ZWMRE2uXsVn4ShEk1Gqavoc3n73M-~A&gdpr=0

0
128 B

33ms
33ms

Image
text/plain

8.28.7.84
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-PU5ZWMRE2uXsVn4ShEk1Gqavoc3n73M-~A&gdpr=0
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Server: 8.28.7.84 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:42 GMT
cache-control: no-store, no-cache, private
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

location: https://image4.pubmatic.com/AdServer/SPug?partnerID=156078&xid=y-PU5ZWMRE2uXsVn4ShEk1Gqavoc3n73M-~A&gdpr=0
date: Thu, 19 Oct 2023 12:09:42 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.87
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET generic
sync.ipredictive.com/d/sync/cookie/ Frame ABBA 0
0

GET

Pug
simage2.pubmatic.com/AdServer/ Frame ABBA
Redirect Chain

https://pubmatic-match.dotomi.com/match/bounce/current?networkId=17100&version=1&nuid=CFFAEDA6-7F12-4D36-9CC5-AF441639D229&gdpr=0&gdpr_consent=
https://pubmatic-match.dotomi.com/match/bounce/current?DotomiTest=4e839785496b0660&is_secure=true&networkId=17100&version=1&nuid=CFFAEDA6-7F12-4D36-9CC5-AF441639D229&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTQ2MSZ0bD0xMDA4MA==&piggybackCookie=AAABfIV-zQoitgMZE76GAAAAAAA&expiration=1697803782&nuid=CFFAEDA6-7F12-4D36-9CC5-AF441639D229&...

0
0

GET CookieSyncPubMatic&gdpr=0&gdpr_consent=
rtb.adentifi.com/ Frame ABBA 0
0

GET pixelSync
pixel-sync.sitescout.com/dmp/ Frame ABBA 0
0

GET sn.ashx
pmp.mxptint.net/ Frame ABBA 0
0

GET

Pug
simage2.pubmatic.com/AdServer/ Frame ABBA
Redirect Chain

https://ad.turn.com/r/cs?pid=1&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODImdGw9MTU3NjgwMCZkcF9pZD0yMg==&piggybackCookie=7435067569187583797&gdpr=0&gdpr_consent=&us_privacy=

0
0

GET match
c1.adform.net/serving/cookie/ Frame ABBA 0
0

POST
H2 200 vevent
lax1-ib.adnxs.com/ Frame 44B8 0
662 B 86ms
85ms Ping
text/html 104.254.151.36
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://lax1-ib.adnxs.com/vevent?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QLVBvTZAlUDAAADANYABQEIg7nEqQYQwLuyxKTZ54Y3GIXq7pb529yLZyo2CZWW42d1xPs_Ef8_Tpgwmvc_GQAAAEAKV0FAIWoKrgMxmvc_KV4qNuZ1xPs_MQAAAAAAAAhAMLGtxgg4sxlA5R5IZVChn-kkWLrgfGAAaMmwRHijgAaAAQGKAQNVU0SSAQNVU0SYAawCoAH6AagBA7ABALgBAcABBcgBAtABCdgBAOABAPABALICJGZmZDQxMDg1LTc3ZjItNGQyNi05OTg3LTA0MjIzMDU2MWZiMdgCpEPgAur5JeoCGWFueWZpbGUtbm90ZXBhZC5zZW1hYW4uY2GAAwCIAwGQAwCYAxSgAwGqA-cBCr8BaHR0cHM6Ly9wYWdlYWQyLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvZ2VuXzIwND9pZD1hd2JpZCZhd2JpZF9iPUFLQW1mLUM4QjE0U1pBY1Jwd0ItNnRkUXlvU1ZRNjdiSXVVM0dfY2RWT1NkRUxpX0pkQ2luMGZzcXpJNXU3dlZJMWZoeEx1WFl4TE12WWdFS21SX2M1WWFDWi1La0RVY2x3JnByPTEwOiR7QVVDVElPTl9QUklDRX0aEzM5NjcwMDE0Mzg0MjEwMzIzODQiCDc3MjIxNzkzKgQzOTQxwAPYBMgDANgDAOADAOgDAPgDA4AEAJIECS9vcGVucnRiMpgEAKIEDTM3LjE5LjIxMi4xOTOoBACyBAwIABAAGAAgADAAOAK4BADABADIBADaBAIIAeAEAPAEoZ_pJIgFAZgFAKAFs5vL9ZWN7r09qgUqNDAwMjAzY2UtYWM3OS00NDExLWJkOGQtYWRiNGMxZWIwZWIwfjcxNX4xwAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFjMYC-gUECAAQAJAGAJgGALgGAMEGAAAAAAAA8D_QBu6PAdoGFgoQAABBhBkBsBAAGADgBgHyBgIIAIAHAYgHAKAHAaoHDDEzMDYxOTQ5NzgwOMgHo4AG0gcNCRE3ATUM2gcGCAUJqOAHAOoHAggA8AfnsQmKCAIQAJUIAACAP5gIAcAIpEPSCAkI8___PxAAGAA.&s=136fc109abbdeaa56fe9cad86d74d69eb35a47cc&type=pv&jm=1003&px=0&py=0&bw=300&bh=250&sf=1&sid=1659830871166894475&vd=ct~0|rr~5&sv=239&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=17929905&ft=3

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/239/trk.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.151.36 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://lax1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:43 GMT
an-x-request-uuid: e5ef1f44-ea51-4cdc-82b5-7cb3c81eeec2
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: https://lax1-ib.adnxs.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 37.19.212.193; 37.19.212.193; 897.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

match
events-ssc.33across.com/ Frame BBB2
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=33across&us_privacy=&khaos=LNX53DXU-1A-CXKA
https://ssc-cms.33across.com/ps/?xi=1&xu=LNX53DXU-1A-CXKA
https://events-ssc.33across.com/match?bidder_id=30&external_user_id=LNX53DXU-1A-CXKA&ts=1697717384&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
82 B

39ms
39ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=30&external_user_id=LNX53DXU-1A-CXKA&ts=1697717384&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H3
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 12:09:44 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:43 GMT
referrer-policy: unsafe-url
server: 33XP017
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=30&external_user_id=LNX53DXU-1A-CXKA&ts=1697717384&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame BBB2
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=zGuc3pwJTTaUxPWto1OaAQ&rk=usync-na
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=zGuc3pwJTTaUxPWto1OaAQ

43 B
479 B

44ms
44ms

Image
image/gif

52.46.128.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=zGuc3pwJTTaUxPWto1OaAQ

Requested by

Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1

Protocol

HTTP/1.1

Server

52.46.128.147 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 19 Oct 2023 12:09:44 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: QZSB4ZNZVEYQ057T0SMF
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=zGuc3pwJTTaUxPWto1OaAQ
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: b08401febecfa1b1a0c0270265f29df4
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame BBB2
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/aJ4qrMhCVm21EkRPGCmzTcn5EUdSAgOZEtemQ7w0kco?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-YrgboBJE2oLLlZmplAGWeCSh1K7Y4v_U0LaTUw--~A

42 B
775 B

162ms
37ms

Image
image/gif

8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-YrgboBJE2oLLlZmplAGWeCSh1K7Y4v_U0LaTUw--~A
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: HTTP/1.1
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: b08401febecfa1b1a0c0270265f29df4
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date: Thu, 19 Oct 2023 12:09:44 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-YrgboBJE2oLLlZmplAGWeCSh1K7Y4v_U0LaTUw--~A
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BBB2
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YmYzNTI3MmRmYWI5NzM4ZTExZDkyOTE3YjQ4NTFmN2IzNThhMjA4Ng

170 B
188 B

47ms
46ms

Image
image/png

172.253.122.156
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YmYzNTI3MmRmYWI5NzM4ZTExZDkyOTE3YjQ4NTFmN2IzNThhMjA4Ng

Requested by

Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1

Protocol

Server

172.253.122.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f156.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:44 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=YmYzNTI3MmRmYWI5NzM4ZTExZDkyOTE3YjQ4NTFmN2IzNThhMjA4Ng
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 6734403d2cb3625dc1fef1bbd4a17cf3
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame BBB2
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEB4lp8sMdrXpQAn2St-PEOQ&google_cver=1

42 B
775 B

184ms
38ms

Image
image/gif

8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEB4lp8sMdrXpQAn2St-PEOQ&google_cver=1
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: HTTP/1.1
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: b08401febecfa1b1a0c0270265f29df4
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:44 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEB4lp8sMdrXpQAn2St-PEOQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET

setuid
px.ads.linkedin.com/ Frame BBB2
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LNX53DXU-1A-CXKA

0
0

GET

pixel
cm.g.doubleclick.net/ Frame BBB2
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TE5YNTNEWFUtMUEtQ1hLQQ==
https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESELsxAOQGcHyA-ssn6dhoe1g&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TE5YNTNEWFUtMUEtQ1hLQQ==&google_push=

0
0

GET dcm
aax-eu.amazon-adsystem.com/s/ Frame BBB2 0
0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame BBB2
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=9279c2c7-0a3c-4984-9085-399d8dc48589&gdpr=0&gdpr_consent=&expires=30

42 B
775 B

115ms
37ms

Image
image/gif

8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=9279c2c7-0a3c-4984-9085-399d8dc48589&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: HTTP/1.1
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: b08401febecfa1b1a0c0270265f29df4
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=9279c2c7-0a3c-4984-9085-399d8dc48589&gdpr=0&gdpr_consent=&expires=30
date: Thu, 19 Oct 2023 12:09:44 GMT
server: Kestrel
content-length: 289

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame BBB2
Redirect Chain

https://match.prod.bidr.io/cookie-sync/rp?bee_sync_partners=rp
https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAE4ZE7KYjkAABkEUBHfyg&expires=30

42 B
775 B

79ms
38ms

Image
image/gif

8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAE4ZE7KYjkAABkEUBHfyg&expires=30
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: HTTP/1.1
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: b08401febecfa1b1a0c0270265f29df4
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAE4ZE7KYjkAABkEUBHfyg&expires=30
Date: Thu, 19 Oct 2023 12:09:44 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET

pixel
capi.connatix.com/us/ Frame BBB2
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=19564
https://capi.connatix.com/us/pixel?puid=LNX53DXU-1A-CXKA&pId=11&gdpr=&gdpr_consent=&us_privacy=
https://capi.connatix.com/us/pixel?puid=LNX53DXU-1A-CXKA&pId=11&gdpr=&gdpr_consent=&us_privacy=&final=true

0
0

GET
H2

200

setuid
ib.adnxs.com/prebid/ Frame BBB2
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-apn
https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=LNX53DXU-1A-CXKA

43 B
1 KB

39ms
39ms

Image
image/gif

68.67.160.76
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=LNX53DXU-1A-CXKA

Requested by

Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1

Protocol

Server

68.67.160.76 Fairfield, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 19 Oct 2023 12:09:44 GMT
an-x-request-uuid: 212dd353-7b83-44fb-94b9-10e7834e5b3a
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 37.19.212.193; 37.19.212.193; 678.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://ib.adnxs.com/prebid/setuid?bidder=rubicon&uid=LNX53DXU-1A-CXKA
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: b08401febecfa1b1a0c0270265f29df4
Expires: 0

GET

magnite
prebid.a-mo.net/setuid/ Frame BBB2
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=pbs-adaptmx
https://prebid.a-mo.net/setuid/magnite?uid=LNX53DXU-1A-CXKA

0
0

GET generic
sync.ipredictive.com/d/sync/cookie/ Frame BBB2 0
0

GET
H/1.1

200
OK

merge
ce.lijit.com/ Frame BBB2
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=sovrn
https://ce.lijit.com/merge?pid=80&3pid=LNX53DXU-1A-CXKA

43 B
1011 B

33ms
32ms

Image
image/gif

23.92.190.68
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ce.lijit.com/merge?pid=80&3pid=LNX53DXU-1A-CXKA
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: HTTP/1.1
Server: 23.92.190.68 Houston, United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 19 Oct 2023 12:09:44 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Content-Type: image/gif
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap2ewr1
Content-Length: 43
Expires: Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://ce.lijit.com/merge?pid=80&3pid=LNX53DXU-1A-CXKA
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: b08401febecfa1b1a0c0270265f29df4
Expires: 0

GET sync.php
pixel.rubiconproject.com/exchange/ Frame BBB2 0
0

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame BBB2
Redirect Chain

https://token.rubiconproject.com/token?pid=37556&a=1
https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=LNX53DXU-1A-CXKA

95 B
124 B

52ms
52ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=3355&partner_device_id=LNX53DXU-1A-CXKA

Requested by

Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS