Submitted URL: http://notepad.pw/
Effective URL: https://notepad.pw/ybtg765
Submission: On August 14 via manual from US

Summary

This website contacted 9 IPs in 4 countries across 8 domains to perform 28 HTTP transactions. The main IP is 151.139.128.10, located in Dallas, United States and belongs to HIGHWINDS3 - Highwinds Network Group, Inc., US. The main domain is notepad.pw.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on June 25th 2019. Valid for: 3 months.
This is the only time notepad.pw was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 9 151.139.128.10 20446 (HIGHWINDS3)
1 2a00:1450:400... 15169 (GOOGLE)
9 2606:4700::68... 13335 (CLOUDFLAR...)
1 23.111.10.140 33438 (HIGHWINDS2)
2 2a00:1450:400... 15169 (GOOGLE)
1 206.189.98.175 14061 (DIGITALOC...)
4 2606:4700:30:... 13335 (CLOUDFLAR...)
1 94.31.29.32 33438 (HIGHWINDS2)
1 2 216.58.208.38 15169 (GOOGLE)
28 9
Domain Requested by
9 cdnjs.cloudflare.com notepad.pw
9 notepad.pw 1 redirects notepad.pw
4 live.notepad.pw notepad.pw
2 ad.doubleclick.net 1 redirects notepad.pw
2 fonts.gstatic.com notepad.pw
cdnjs.cloudflare.com
1 cdn4.buysellads.net notepad.pw
1 srv.carbonads.net cdn.carbonads.com
1 cdn.carbonads.com notepad.pw
1 fonts.googleapis.com notepad.pw
28 9
Subject Issuer Validity Valid
notepad.pw
Sectigo RSA Domain Validation Secure Server CA
2019-06-25 -
2019-09-23
3 months crt.sh
*.googleapis.com
Google Internet Authority G3
2019-07-29 -
2019-10-21
3 months crt.sh
ssl412106.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2
2019-08-10 -
2020-02-16
6 months crt.sh
*.carbonads.com
COMODO RSA Domain Validation Secure Server CA
2018-03-12 -
2020-04-08
2 years crt.sh
*.google.com
Google Internet Authority G3
2019-07-29 -
2019-10-21
3 months crt.sh
*.carbonads.net
COMODO RSA Domain Validation Secure Server CA
2018-10-13 -
2019-10-13
a year crt.sh
cdn4.buysellads.net
COMODO RSA Domain Validation Secure Server CA
2018-08-27 -
2019-08-30
a year crt.sh
*.doubleclick.net
Google Internet Authority G3
2019-07-29 -
2019-10-21
3 months crt.sh

This page contains 2 frames:

Primary Page: https://notepad.pw/ybtg765
Frame ID: F889BC139BA57050AAB5E3F31E384B52
Requests: 25 HTTP requests in this frame

Frame: https://notepad.pw/sbbi/?sbbpg=sbbShell&gprid=jB
Frame ID: 4EEFF66BBE08BC9CBF3C0B660648775A
Requests: 3 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://notepad.pw/ HTTP 307
    https://notepad.pw/ybtg765 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /fbs/i

Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i

Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+ionicons(?:\.min)?\.css/i

Page Statistics

28
Requests

100 %
HTTPS

44 %
IPv6

8
Domains

9
Subdomains

9
IPs

4
Countries

402 kB
Transfer

738 kB
Size

9
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://notepad.pw/ HTTP 307
    https://notepad.pw/ybtg765 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 20
  • https://ad.doubleclick.net/ddm/trackimp/N32602.3091281BUYSELLADS/B21259774.231300620;dc_trk_aid=429112145;dc_trk_cid=107294693;ord=156581402;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua= HTTP 302
  • https://ad.doubleclick.net/ddm/trackimp/N32602.3091281BUYSELLADS/B21259774.231300620;dc_pre=COy-1OKXg-QCFZWsdwodK7YAOw;dc_trk_aid=429112145;dc_trk_cid=107294693;ord=156581402;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=

28 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request ybtg765
notepad.pw/
Redirect Chain
  • http://notepad.pw/
  • https://notepad.pw/ybtg765
32 KB
13 KB
Document
General
Full URL
https://notepad.pw/ybtg765
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
fbs /
Resource Hash
a4bd93ead54b442e72759c14597039053d9dbc4cb6791904ad6d679f1bc423c2

Request headers

:method
GET
:authority
notepad.pw
:scheme
https
:path
/ybtg765
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
none
accept-encoding
gzip, deflate, br
cookie
SPSI=50c0fc7d8dc0a552e081764bc8b39bf1; spcsrf=5b293009d984be70299abe419b87be2b; UTGv2=D-h4896d7e72cce00526f685acc47ec594bb20; pad_cookie=6ad94a3e9328da0fadd54f90aa9b1db89ac6841a; sp_lit=jtQSkNGlU9fLmxU53URaFQ==
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status
200
date
Wed, 14 Aug 2019 20:20:17 GMT
cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-type
text/html; charset=UTF-8
set-cookie
spcsrf=1cddfc743a0efe6c90743b21c2be2fc9; Expires=Wed, 14-Aug-19 22:20:17 GMT; Path=/; HttpOnly; SameSite=Strict UTGv2=D-h45548ef72234ded819d893d3faa91aaa260; Expires=Thu, 13-Aug-20 20:20:17 GMT; Path=/ sp_lit=jtQSkNGlU9fLmxU53URaFQ==; Expires=Wed, 14-Aug-19 20:25:17 GMT; Path=/; HttpOnly; SameSite=Strict
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
fbs
access-control-allow-origin
*
x-hw
1565814017.cds077.lo4.hn,1565814017.cds093.lo4.sc,1565814017.cdn2-wafbe03-lhr1.stackpath.systems.-.wx,1565814017.cds093.lo4.p

Redirect headers

Date
Wed, 14 Aug 2019 20:20:17 GMT
Cache-Control
no-store, no-cache, must-revalidate
Content-Encoding
gzip
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Set-Cookie
SPSI=50c0fc7d8dc0a552e081764bc8b39bf1; Path=/ spcsrf=5b293009d984be70299abe419b87be2b; Expires=Wed, 14-Aug-19 22:20:17 GMT; Path=/; HttpOnly; SameSite=Strict adOtr=obsvl; Expires=Thu, 2 Aug 2001 20:47:11 UTC; Path=/ UTGv2=D-h4896d7e72cce00526f685acc47ec594bb20; Expires=Thu, 13-Aug-20 20:20:17 GMT; Path=/ pad_cookie=6ad94a3e9328da0fadd54f90aa9b1db89ac6841a; expires=Wed, 14-Aug-2019 22:23:35 GMT; Max-Age=7200; path=/; HttpOnly sp_lit=jtQSkNGlU9fLmxU53URaFQ==; Expires=Wed, 14-Aug-19 20:25:17 GMT; Path=/; HttpOnly; SameSite=Strict
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Pragma
no-cache
Location
https://notepad.pw/ybtg765
Server
fbs
Access-Control-Allow-Origin
*
X-HW
1565814017.cds041.lo4.h2,1565814017.cds037.lo4.sc,1565814017.cdn2-wafbe03-lhr1.stackpath.systems.-.wx,1565814017.cds037.lo4.p
Connection
keep-alive
css
fonts.googleapis.com/
5 KB
963 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Noto+Sans:400,700
Requested by
Host: notepad.pw
URL: https://notepad.pw/ybtg765
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:818::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
ESF /
Resource Hash
43bb0a64804a24261d91350f72b92265af1f1dae881f1b6021f219caf83f46f3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://notepad.pw/ybtg765
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
br
last-modified
Wed, 14 Aug 2019 20:20:17 GMT
server
ESF
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
status
200
date
Wed, 14 Aug 2019 20:20:17 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
x-xss-protection
0
expires
Wed, 14 Aug 2019 20:20:17 GMT
global.css
notepad.pw/content/css/
6 KB
2 KB
Stylesheet
General
Full URL
https://notepad.pw/content/css/global.css?229
Requested by
Host: notepad.pw
URL: https://notepad.pw/ybtg765
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
fbs /
Resource Hash
2b60310189012686567c541c72a40acf74adb416bdc524008822d6c7c73ccd97

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://notepad.pw/ybtg765
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 14 Aug 2019 20:20:17 GMT
content-encoding
gzip
last-modified
Mon, 02 Oct 2017 03:48:05 GMT
server
fbs
etag
"59d1b6f5-1821"
status
200
x-hw
1565814017.cds077.lo4.hn,1565814017.cds044.lo4.sc,1565814017.cdn2-wafbe02-lhr1.stackpath.systems.-.wx,1565814017.cds044.lo4.p
content-type
text/css
access-control-allow-origin
*
accept-ranges
bytes
normalize.min.css
cdnjs.cloudflare.com/ajax/libs/normalize/6.0.0/
2 KB
1 KB
Stylesheet
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/normalize/6.0.0/normalize.min.css
Requested by
Host: notepad.pw
URL: https://notepad.pw/ybtg765
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:c397 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
55b731aa03064189b7abca9931deb7b844c75d7664aacecc1356c4bc0635c4af
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://notepad.pw/ybtg765
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 14 Aug 2019 20:20:17 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
10447954
status
200
served-in-seconds
0.100
timing-allow-origin
*
last-modified
Thu, 17 May 2018 09:24:31 GMT
server
cloudflare
etag
W/"5afd4a4f-8a8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000; includeSubDomains
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=30672000
cf-ray
5065a0ea5c39bef6-FRA
expires
Mon, 03 Aug 2020 20:20:17 GMT
ionicons.min.css
cdnjs.cloudflare.com/ajax/libs/ionicons/2.0.1/css/
50 KB
7 KB
Stylesheet
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/ionicons/2.0.1/css/ionicons.min.css
Requested by
Host: notepad.pw
URL: https://notepad.pw/ybtg765
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:c397 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
de2bbd8e0b32f53a53c1729bedb350cea59e9115fba4f2bed8e2e3dd1f76d9fa
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://notepad.pw/ybtg765
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 14 Aug 2019 20:20:17 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
10447954
status
200
served-in-seconds
0.011
timing-allow-origin
*
last-modified
Thu, 17 May 2018 09:20:05 GMT
server
cloudflare
etag
W/"5afd4945-c854"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000; includeSubDomains
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=30672000
cf-ray
5065a0ea5c3bbef6-FRA
expires
Mon, 03 Aug 2020 20:20:17 GMT
logo-dark.png
notepad.pw/content/images/
22 KB
22 KB
Image
General
Full URL
https://notepad.pw/content/images/logo-dark.png
Requested by
Host: notepad.pw
URL: https://notepad.pw/ybtg765
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
fbs /
Resource Hash
560ee8213cda78828e88fbcbe2fbe6d3337d563384ea57d344ce3e3559da1dda

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://notepad.pw/ybtg765
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 14 Aug 2019 20:20:17 GMT
last-modified
Thu, 30 Aug 2018 21:59:20 GMT
server
fbs
etag
"5b8868b8-57f4"
status
200
x-hw
1565814017.cds077.lo4.hn,1565814017.cds042.lo4.sc,1565814017.cdn2-wafbe01-lhr1.stackpath.systems.-.wx,1565814017.cds042.lo4.p
content-type
image/png
access-control-allow-origin
*
accept-ranges
bytes
content-length
22516
carbon.js
cdn.carbonads.com/
37 KB
13 KB
Script
General
Full URL
https://cdn.carbonads.com/carbon.js?serve=CK7IT277&placement=notepadpw
Requested by
Host: notepad.pw
URL: https://notepad.pw/ybtg765
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.111.10.140 Phoenix, United States, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
NetDNA-cache/2.2 /
Resource Hash
2b465cb38a82c39337f1b5e8fe543929f58a26e127f0825575f89979c0e37fea

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://notepad.pw/ybtg765
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 14 Aug 2019 20:20:17 GMT
Content-Encoding
gzip
Last-Modified
Mon, 10 Jun 2019 17:33:21 GMT
Server
NetDNA-cache/2.2
ETag
W/"9554-58afb9398c5a2"
Vary
Accept-Encoding
X-Cache
HIT
Content-Type
application/javascript
Transfer-Encoding
chunked
Connection
keep-alive
jquery.min.js
cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/
82 KB
28 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js
Requested by
Host: notepad.pw
URL: https://notepad.pw/ybtg765
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:c397 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://notepad.pw/ybtg765
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 14 Aug 2019 20:20:17 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
10447958
status
200
served-in-seconds
0.027
timing-allow-origin
*
last-modified
Thu, 17 May 2018 09:21:00 GMT
server
cloudflare
etag
W/"5afd497c-1499c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000; includeSubDomains
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
cf-ray
5065a0ea5c3dbef6-FRA
expires
Mon, 03 Aug 2020 20:20:17 GMT
angular.min.js
cdnjs.cloudflare.com/ajax/libs/angular.js/1.5.8/
156 KB
53 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.5.8/angular.min.js
Requested by
Host: notepad.pw
URL: https://notepad.pw/ybtg765
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:c397 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e92af41ea36051ffe9f3c83abec97cec2ac09cdaa2396863958e8b4bc8de5870
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://notepad.pw/ybtg765
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 14 Aug 2019 20:20:17 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
10447940
status
200
served-in-seconds
0.009
timing-allow-origin
*
last-modified
Thu, 17 May 2018 09:15:35 GMT
server
cloudflare
etag
W/"5afd4837-27130"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000; includeSubDomains
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
cf-ray
5065a0ea5c3fbef6-FRA
expires
Mon, 03 Aug 2020 20:20:17 GMT
angular-cookies.min.js
cdnjs.cloudflare.com/ajax/libs/angular.js/1.5.8/
1 KB
871 B
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.5.8/angular-cookies.min.js
Requested by
Host: notepad.pw
URL: https://notepad.pw/ybtg765
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:c397 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f79dfaabb417f7b777458a24663c5075dd1e56026e20578a0d74568b3c762375
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://notepad.pw/ybtg765
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 14 Aug 2019 20:20:17 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
10447940
status
200
served-in-seconds
0.006
timing-allow-origin
*
last-modified
Thu, 17 May 2018 09:15:35 GMT
server
cloudflare
etag
W/"5afd4837-5a7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000; includeSubDomains
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
cf-ray
5065a0ea5c3ebef6-FRA
expires
Mon, 03 Aug 2020 20:20:17 GMT
socket.io.min.js
cdnjs.cloudflare.com/ajax/libs/socket.io/1.4.8/
68 KB
21 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/socket.io/1.4.8/socket.io.min.js
Requested by
Host: notepad.pw
URL: https://notepad.pw/ybtg765
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:c397 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
888b41bb493f82bc787b507deee35df8a9dca32d9f59e5e4434334bb04aa1e17
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://notepad.pw/ybtg765
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 14 Aug 2019 20:20:17 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
302220
status
200
served-in-seconds
0.003
timing-allow-origin
*
last-modified
Thu, 17 May 2018 09:26:47 GMT
server
cloudflare
etag
W/"5afd4ad7-10ec3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000; includeSubDomains
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
cf-ray
5065a0ea5c3cbef6-FRA
expires
Mon, 03 Aug 2020 20:20:17 GMT
app.min.js
notepad.pw/content/js/
8 KB
3 KB
Script
General
Full URL
https://notepad.pw/content/js/app.min.js?366
Requested by
Host: notepad.pw
URL: https://notepad.pw/ybtg765
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
fbs /
Resource Hash
c9c41579990e491b31185c662e701facbcd6dab9ec0b06edef8feec2f981812e

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://notepad.pw/ybtg765
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 14 Aug 2019 20:20:17 GMT
content-encoding
gzip
last-modified
Thu, 30 Aug 2018 22:33:49 GMT
server
fbs
etag
"5b8870cd-2089"
status
200
x-hw
1565814017.cds077.lo4.hn,1565814017.cds071.lo4.sc,1565814017.cdn2-wafbe04-lhr1.stackpath.systems.-.wx,1565814017.cds071.lo4.p
content-type
application/javascript
access-control-allow-origin
*
accept-ranges
bytes
store.min.js
cdnjs.cloudflare.com/ajax/libs/store.js/1.3.20/
3 KB
1 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/store.js/1.3.20/store.min.js
Requested by
Host: notepad.pw
URL: https://notepad.pw/ybtg765
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:c397 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d23807344428eec21271b708fcf73919827e568b0a335989f9f2348ae4356bd1
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://notepad.pw/ybtg765
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 14 Aug 2019 20:20:17 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
10447914
status
200
served-in-seconds
0.001
timing-allow-origin
*
last-modified
Thu, 17 May 2018 09:25:41 GMT
server
cloudflare
etag
W/"5afd4a95-a35"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000; includeSubDomains
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
cf-ray
5065a0ea6c47bef6-FRA
expires
Mon, 03 Aug 2020 20:20:17 GMT
clipboard.min.js
cdnjs.cloudflare.com/ajax/libs/clipboard.js/1.7.1/
11 KB
3 KB
Script
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/clipboard.js/1.7.1/clipboard.min.js
Requested by
Host: notepad.pw
URL: https://notepad.pw/ybtg765
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:c397 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0da7fc1ae23678b2872653962d147fcd1cbd0a5a9c8f84d44ae99bc581fd9062
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://notepad.pw/ybtg765
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 14 Aug 2019 20:20:17 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
2568170
status
200
served-in-seconds
0.001
timing-allow-origin
*
last-modified
Thu, 17 May 2018 09:18:33 GMT
server
cloudflare
etag
W/"5afd48e9-2aa5"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000; includeSubDomains
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=30672000
cf-ray
5065a0ea6c48bef6-FRA
expires
Mon, 03 Aug 2020 20:20:17 GMT
/
notepad.pw/sbbi/ Frame 4EEF
35 KB
15 KB
Document
General
Full URL
https://notepad.pw/sbbi/?sbbpg=sbbShell&gprid=jB&sbbgs=h45548ef72234ded819d893d3faa91aaa260&ddl=1
Requested by
Host: notepad.pw
URL: https://notepad.pw/ybtg765
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
fbs /
Resource Hash
35331af440f3044b8b0cac1995806357a44704336fd898623d5b70b0e6dbb34f

Request headers

:method
GET
:authority
notepad.pw
:scheme
https
:path
/sbbi/?sbbpg=sbbShell&gprid=jB&sbbgs=h45548ef72234ded819d893d3faa91aaa260&ddl=1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
same-origin
referer
https://notepad.pw/ybtg765
accept-encoding
gzip, deflate, br
cookie
SPSI=50c0fc7d8dc0a552e081764bc8b39bf1; pad_cookie=6ad94a3e9328da0fadd54f90aa9b1db89ac6841a; sp_lit=jtQSkNGlU9fLmxU53URaFQ==; spcsrf=1cddfc743a0efe6c90743b21c2be2fc9; PRLST=jB; UTGv2=h45548ef72234ded819d893d3faa91aaa260
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://notepad.pw/ybtg765

Response headers

status
200
date
Wed, 14 Aug 2019 20:20:17 GMT
cache-control
no-store, no-cache, max-age=0, must-revalidate, private, max-stale=0, post-check=0, pre-check=0
content-encoding
gzip
content-type
text/html; charset=UTF-8
server
fbs
x-accel-expires
0
access-control-allow-origin
*
x-hw
1565814017.cds077.lo4.hn,1565814017.cds053.lo4.sc,1565814017.cdn2-redis01-lhr1.stackpath.systems.-.i,1565814017.cds053.lo4.p
/
notepad.pw/sbbi/
43 B
167 B
Image
General
Full URL
https://notepad.pw/sbbi/?sbbpg=utMedia&vii=5h04c505f4c87edf87d2c203a45d5e2de801891d786943bdc38fba3a99b1fa1ahan2p6h0
Requested by
Host: notepad.pw
URL: https://notepad.pw/ybtg765
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
fbs /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://notepad.pw/ybtg765
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-accel-expires
0
date
Wed, 14 Aug 2019 20:20:17 GMT
server
fbs
status
200
x-hw
1565814017.cds077.lo4.hn,1565814017.cds075.lo4.sc,1565814017.cdn2-wafbe02-lhr1.stackpath.systems.-.i,1565814017.cds075.lo4.p
content-type
image/gif
access-control-allow-origin
*
cache-control
no-store, no-cache, max-age=0, must-revalidate, private, max-stale=0, post-check=0, pre-check=0
o-0IIpQlx3QUlC5A4PNr5TRASf6M7Q.woff2
fonts.gstatic.com/s/notosans/v9/
10 KB
10 KB
Font
General
Full URL
https://fonts.gstatic.com/s/notosans/v9/o-0IIpQlx3QUlC5A4PNr5TRASf6M7Q.woff2
Requested by
Host: notepad.pw
URL: https://notepad.pw/ybtg765
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
e56f53b3b976e9c05d86645a1e85cfc69e961601d201e957768455580fa30478
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=Noto+Sans:400,700
Origin
https://notepad.pw
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 22 Jul 2019 19:36:05 GMT
x-content-type-options
nosniff
last-modified
Mon, 22 Jul 2019 19:20:41 GMT
server
sffe
age
1989852
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
10292
x-xss-protection
0
expires
Tue, 21 Jul 2020 19:36:05 GMT
CK7IT277.json
srv.carbonads.net/ads/
1 KB
1 KB
Script
General
Full URL
https://srv.carbonads.net/ads/CK7IT277.json?segment=placement:notepadpw&callback=_carbonads_go
Requested by
Host: cdn.carbonads.com
URL: https://cdn.carbonads.com/carbon.js?serve=CK7IT277&placement=notepadpw
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
206.189.98.175 Amsterdam, Netherlands, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
srv-eu-nl-8.buysellads.com
Software
//srv.buysellads.com /
Resource Hash
07809eaf0d2272ffc4d885998a131d72da4e30e76b8375501f9081219535ad4b

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://notepad.pw/ybtg765
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Wed, 14 Aug 2019 20:20:17 GMT
Content-Encoding
gzip
Server
//srv.buysellads.com
Content-Length
972
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
ionicons.ttf
cdnjs.cloudflare.com/ajax/libs/ionicons/2.0.1/fonts/
184 KB
185 KB
Font
General
Full URL
https://cdnjs.cloudflare.com/ajax/libs/ionicons/2.0.1/fonts/ionicons.ttf?v=2.0.0
Requested by
Host: notepad.pw
URL: https://notepad.pw/ybtg765
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:c397 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2ba7f20b1d8990e17a47fe3d88e4c766628aaa2baf1dd30fca0a0db59836f5f9
Security Headers
Name Value
Strict-Transport-Security max-age=15780000; includeSubDomains

Request headers

Sec-Fetch-Mode
cors
Referer
https://cdnjs.cloudflare.com/ajax/libs/ionicons/2.0.1/css/ionicons.min.css
Origin
https://notepad.pw
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 14 Aug 2019 20:20:17 GMT
vary
Accept-Encoding
cf-cache-status
HIT
age
10447951
status
200
content-length
188508
served-in-seconds
0.018
timing-allow-origin
*
last-modified
Thu, 17 May 2018 09:20:52 GMT
server
cloudflare
etag
"5afd4974-2e05c"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000; includeSubDomains
content-type
application/octet-stream
access-control-allow-origin
*
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
5065a0ebafb663b3-FRA
expires
Mon, 03 Aug 2020 20:20:17 GMT
/
live.notepad.pw/socket.io/
101 B
451 B
XHR
General
Full URL
https://live.notepad.pw/socket.io/?EIO=3&transport=polling&t=MoHoSzl
Requested by
Host: notepad.pw
URL: https://notepad.pw/ybtg765
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681f:5f8d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e626cd322a146fb471ce04b32dfd3f81e37aa38627cb65dfe228599794c2f7b7

Request headers

Sec-Fetch-Mode
cors
Referer
https://notepad.pw/ybtg765
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 14 Aug 2019 20:20:18 GMT
via
1.1 vegur
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status
200
content-type
application/octet-stream
access-control-allow-origin
https://notepad.pw
access-control-allow-credentials
true
cf-ray
5065a0ec3d1464f1-FRA
content-length
101
1547651305-slack-carbon-white_2x.png
cdn4.buysellads.net/uu/1/41629/
7 KB
7 KB
Image
General
Full URL
https://cdn4.buysellads.net/uu/1/41629/1547651305-slack-carbon-white_2x.png
Requested by
Host: notepad.pw
URL: https://notepad.pw/ybtg765
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
94.31.29.32 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS
94.31.29.32.IPYX-077437-ZYO.above.net
Software
NetDNA-cache/2.2 /
Resource Hash
42b2639191e7216663c13d1034894fb43bd6769ff50681c12916f3aee7b68b86

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://notepad.pw/ybtg765
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 14 Aug 2019 20:20:18 GMT
last-modified
Wed, 16 Jan 2019 15:08:26 GMT
server
NetDNA-cache/2.2
x-amz-request-id
59424B54740D9D5B
etag
"58c6f82f17dd71f58c48f13eaab3b671"
x-cache
HIT
content-type
image/png
status
200
cache-control
max-age=31104000
accept-ranges
bytes
content-length
7302
x-amz-id-2
NHo8i6q2BNIzsQFKMwlGIN0j5f5jKoANESC0e14WX+MxC9V1cD+pbNblV3b8d5CqK9L7l3bvIqw=
expires
Sat, 08 Aug 2020 20:20:18 GMT
B21259774.231300620;dc_pre=COy-1OKXg-QCFZWsdwodK7YAOw;dc_trk_aid=429112145;dc_trk_cid=107294693;ord=156581402;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=
ad.doubleclick.net/ddm/trackimp/N32602.3091281BUYSELLADS/
Redirect Chain
  • https://ad.doubleclick.net/ddm/trackimp/N32602.3091281BUYSELLADS/B21259774.231300620;dc_trk_aid=429112145;dc_trk_cid=107294693;ord=156581402;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?
  • https://ad.doubleclick.net/ddm/trackimp/N32602.3091281BUYSELLADS/B21259774.231300620;dc_pre=COy-1OKXg-QCFZWsdwodK7YAOw;dc_trk_aid=429112145;dc_trk_cid=107294693;ord=156581402;dc_lat=;dc_rdid=;tag_f...
42 B
317 B
Image
General
Full URL
https://ad.doubleclick.net/ddm/trackimp/N32602.3091281BUYSELLADS/B21259774.231300620;dc_pre=COy-1OKXg-QCFZWsdwodK7YAOw;dc_trk_aid=429112145;dc_trk_cid=107294693;ord=156581402;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?
Requested by
Host: notepad.pw
URL: https://notepad.pw/ybtg765
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.58.208.38 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
fra15s12-in-f6.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://notepad.pw/ybtg765
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 14 Aug 2019 20:20:18 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 14 Aug 2019 20:20:18 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
302
content-type
text/html; charset=UTF-8
location
https://ad.doubleclick.net/ddm/trackimp/N32602.3091281BUYSELLADS/B21259774.231300620;dc_pre=COy-1OKXg-QCFZWsdwodK7YAOw;dc_trk_aid=429112145;dc_trk_cid=107294693;ord=156581402;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?
cache-control
no-cache, must-revalidate
follow-only-when-prerender-shown
1
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
notepad.pw/sbbi/ Frame 4EEF
516 B
483 B
Document
General
Full URL
https://notepad.pw/sbbi/?sbbpg=sbbShell&gprid=jB&sbbgs=h45548ef72234ded819d893d3faa91aaa260&ddl=1
Requested by
Host: notepad.pw
URL: https://notepad.pw/sbbi/?sbbpg=sbbShell&gprid=jB&sbbgs=h45548ef72234ded819d893d3faa91aaa260&ddl=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
fbs /
Resource Hash
d155160aea288964eebe06a362795ab879ed657ca75f7ca60d5a1c8e9fe05d7b

Request headers

:method
POST
:authority
notepad.pw
:scheme
https
:path
/sbbi/?sbbpg=sbbShell&gprid=jB&sbbgs=h45548ef72234ded819d893d3faa91aaa260&ddl=1
content-length
491
pragma
no-cache
cache-control
no-cache
origin
https://notepad.pw
upgrade-insecure-requests
1
content-type
application/x-www-form-urlencoded
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
same-origin
referer
https://notepad.pw/sbbi/?sbbpg=sbbShell&gprid=jB&sbbgs=h45548ef72234ded819d893d3faa91aaa260&ddl=1
accept-encoding
gzip, deflate, br
cookie
SPSI=50c0fc7d8dc0a552e081764bc8b39bf1; pad_cookie=6ad94a3e9328da0fadd54f90aa9b1db89ac6841a; sp_lit=jtQSkNGlU9fLmxU53URaFQ==; spcsrf=1cddfc743a0efe6c90743b21c2be2fc9; PRLST=jB; UTGv2=h45548ef72234ded819d893d3faa91aaa260; typography=%7B%22sp_class%22%3A%22not-active%22%7D; adOtr=f00c5dc87cd
Origin
https://notepad.pw
Upgrade-Insecure-Requests
1
Content-Type
application/x-www-form-urlencoded
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://notepad.pw/sbbi/?sbbpg=sbbShell&gprid=jB&sbbgs=h45548ef72234ded819d893d3faa91aaa260&ddl=1

Response headers

status
200
date
Wed, 14 Aug 2019 20:20:18 GMT
cache-control
no-store, no-cache, max-age=0, must-revalidate, private, max-stale=0, post-check=0, pre-check=0
content-encoding
gzip
content-type
text/html; charset=UTF-8
server
fbs
x-accel-expires
0
access-control-allow-origin
*
x-hw
1565814018.cds077.lo4.hn,1565814018.cds089.lo4.sc,1565814018.cdn2-redis02-lhr1.stackpath.systems.-.i,1565814018.cds089.lo4.p
/
notepad.pw/sbbi/ Frame 4EEF
7 KB
3 KB
Document
General
Full URL
https://notepad.pw/sbbi/?sbbpg=sbbShell&gprid=jB
Requested by
Host: notepad.pw
URL: https://notepad.pw/sbbi/?sbbpg=sbbShell&gprid=jB&sbbgs=h45548ef72234ded819d893d3faa91aaa260&ddl=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software
fbs /
Resource Hash
75065a08f652ed62f1893b25e90261c17be047651338e41e0f707a6c7d31904a

Request headers

:method
GET
:authority
notepad.pw
:scheme
https
:path
/sbbi/?sbbpg=sbbShell&gprid=jB
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode
nested-navigate
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site
same-origin
referer
https://notepad.pw/sbbi/?sbbpg=sbbShell&gprid=jB&sbbgs=h45548ef72234ded819d893d3faa91aaa260&ddl=1
accept-encoding
gzip, deflate, br
cookie
SPSI=50c0fc7d8dc0a552e081764bc8b39bf1; pad_cookie=6ad94a3e9328da0fadd54f90aa9b1db89ac6841a; sp_lit=jtQSkNGlU9fLmxU53URaFQ==; spcsrf=1cddfc743a0efe6c90743b21c2be2fc9; PRLST=jB; UTGv2=h45548ef72234ded819d893d3faa91aaa260; typography=%7B%22sp_class%22%3A%22not-active%22%7D; adOtr=f00c5dc87cd
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://notepad.pw/sbbi/?sbbpg=sbbShell&gprid=jB&sbbgs=h45548ef72234ded819d893d3faa91aaa260&ddl=1

Response headers

status
200
date
Wed, 14 Aug 2019 20:20:18 GMT
cache-control
no-store, no-cache, max-age=0, must-revalidate, private, max-stale=0, post-check=0, pre-check=0
content-encoding
gzip
content-type
text/html; charset=UTF-8
server
fbs
x-accel-expires
0
access-control-allow-origin
*
x-hw
1565814018.cds077.lo4.hn,1565814018.cds031.lo4.sc,1565814018.cdn2-redis01-lhr1.stackpath.systems.-.i,1565814018.cds031.lo4.p
/
live.notepad.pw/socket.io/
5 B
62 B
XHR
General
Full URL
https://live.notepad.pw/socket.io/?EIO=3&transport=polling&t=MoHoT21&sid=nJkU7E8IjfmFPgjKAX0m
Requested by
Host: notepad.pw
URL: https://notepad.pw/ybtg765
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681f:5f8d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
25d989b3ed89abc5bb5a814c257dc57619d7f45908013cd08aa508c22e4f6a0a

Request headers

Sec-Fetch-Mode
cors
Referer
https://notepad.pw/ybtg765
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 14 Aug 2019 20:20:18 GMT
via
1.1 vegur
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status
200
content-type
application/octet-stream
access-control-allow-origin
https://notepad.pw
access-control-allow-credentials
true
cf-ray
5065a0edae3964f1-FRA
content-length
5
o-0NIpQlx3QUlC5A4PNjXhFVZNyBx2pqPA.woff2
fonts.gstatic.com/s/notosans/v9/
10 KB
10 KB
Font
General
Full URL
https://fonts.gstatic.com/s/notosans/v9/o-0NIpQlx3QUlC5A4PNjXhFVZNyBx2pqPA.woff2
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:821::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
sffe /
Resource Hash
6195b1bce0085db8c9b1b936150dfd7b070aa9be52d44580b1b6f16752dece34
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Sec-Fetch-Mode
cors
Referer
https://fonts.googleapis.com/css?family=Noto+Sans:400,700
Origin
https://notepad.pw
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Mon, 22 Jul 2019 19:36:37 GMT
x-content-type-options
nosniff
last-modified
Mon, 22 Jul 2019 19:20:44 GMT
server
sffe
age
1989821
status
200
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43,39"
content-length
10116
x-xss-protection
0
expires
Tue, 21 Jul 2020 19:36:37 GMT
/
live.notepad.pw/socket.io/
2 B
72 B
XHR
General
Full URL
https://live.notepad.pw/socket.io/?EIO=3&transport=polling&t=MoHoT5x&sid=nJkU7E8IjfmFPgjKAX0m
Requested by
Host: notepad.pw
URL: https://notepad.pw/ybtg765
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681f:5f8d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Sec-Fetch-Mode
cors
Referer
https://notepad.pw/ybtg765
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type
text/plain;charset=UTF-8

Response headers

cf-ray
5065a0ef3fa164f1-FRA
date
Wed, 14 Aug 2019 20:20:18 GMT
via
1.1 vegur
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status
200
content-type
text/html
access-control-allow-origin
https://notepad.pw
access-control-allow-credentials
true
content-encoding
br
/
live.notepad.pw/socket.io/
4 B
61 B
XHR
General
Full URL
https://live.notepad.pw/socket.io/?EIO=3&transport=polling&t=MoHoT5y&sid=nJkU7E8IjfmFPgjKAX0m
Requested by
Host: notepad.pw
URL: https://notepad.pw/ybtg765
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:30::681f:5f8d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a9a2f1dd042cb6f1eded53dc0a1c66ed8694fc093dc3520cdac1a541d615d474

Request headers

Sec-Fetch-Mode
cors
Referer
https://notepad.pw/ybtg765
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date
Wed, 14 Aug 2019 20:20:18 GMT
via
1.1 vegur
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status
200
content-type
application/octet-stream
access-control-allow-origin
https://notepad.pw
access-control-allow-credentials
true
cf-ray
5065a0ef3fa864f1-FRA
content-length
4

Verdicts & Comments Add Verdict or Comment

63 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask string| sbbvscc string| sbbgscc function| genPid function| nsbbfetch function| sbbgc function| addmg function| addprid function| sbbeccf function| m2vr function| sbbls string| y string| x string| gprid object| sbbeccfi string| sbbgs object| _carbonads function| _carbonads_go object| _carbon_where string| ignoretargeting function| _bsap_serving_callback function| $ function| jQuery object| angular function| io boolean| note_created boolean| password_set number| caret string| pad_key string| url_key number| version function| checkEnter function| swapsheets object| app object| store function| initiate_localStorage function| update_localStorage string| input_value string| zSAEYNMkMfis string| VTjEXVFsgQ number| tDcJIhXBZv number| VhnCGFSoUJ number| VFJyhpcwZL number| dDFxArlPjV function| lMtRvsgVod object| LZCBGEpKIH number| c2 number| c1 object| ui5R64z4VbXZ function| xIGzspHpRG number| lX number| lY string| csr object| otr object| cnv string| lk__ function| setUGEvals number| tt number| sbbtstflgsbbhbka boolean| sbbhbka boolean| sbrmp

9 Cookies

Domain/Path Name / Value
.notepad.pw/ Name: __cfduid
Value: dd383c51797f8a8e8df1c755c210fb4ce1565814017
notepad.pw/ Name: adOtr
Value: f00c5dc87cd
notepad.pw/ Name: typography
Value: %7B%22sp_class%22%3A%22not-active%22%7D
notepad.pw/ Name: UTGv2
Value: h45548ef72234ded819d893d3faa91aaa260
notepad.pw/ Name: PRLST
Value: jB
notepad.pw/ Name: pad_cookie
Value: 6ad94a3e9328da0fadd54f90aa9b1db89ac6841a
notepad.pw/ Name: spcsrf
Value: 1cddfc743a0efe6c90743b21c2be2fc9
notepad.pw/ Name: sp_lit
Value: jtQSkNGlU9fLmxU53URaFQ==
notepad.pw/ Name: SPSI
Value: 50c0fc7d8dc0a552e081764bc8b39bf1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ad.doubleclick.net
cdn.carbonads.com
cdn4.buysellads.net
cdnjs.cloudflare.com
fonts.googleapis.com
fonts.gstatic.com
live.notepad.pw
notepad.pw
srv.carbonads.net
151.139.128.10
206.189.98.175
216.58.208.38
23.111.10.140
2606:4700:30::681f:5f8d
2606:4700::6813:c397
2a00:1450:4001:818::200a
2a00:1450:4001:821::2003
94.31.29.32
07809eaf0d2272ffc4d885998a131d72da4e30e76b8375501f9081219535ad4b
0da7fc1ae23678b2872653962d147fcd1cbd0a5a9c8f84d44ae99bc581fd9062
22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5
25d989b3ed89abc5bb5a814c257dc57619d7f45908013cd08aa508c22e4f6a0a
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
2b465cb38a82c39337f1b5e8fe543929f58a26e127f0825575f89979c0e37fea
2b60310189012686567c541c72a40acf74adb416bdc524008822d6c7c73ccd97
2ba7f20b1d8990e17a47fe3d88e4c766628aaa2baf1dd30fca0a0db59836f5f9
35331af440f3044b8b0cac1995806357a44704336fd898623d5b70b0e6dbb34f
42b2639191e7216663c13d1034894fb43bd6769ff50681c12916f3aee7b68b86
43bb0a64804a24261d91350f72b92265af1f1dae881f1b6021f219caf83f46f3
55b731aa03064189b7abca9931deb7b844c75d7664aacecc1356c4bc0635c4af
560ee8213cda78828e88fbcbe2fbe6d3337d563384ea57d344ce3e3559da1dda
6195b1bce0085db8c9b1b936150dfd7b070aa9be52d44580b1b6f16752dece34
75065a08f652ed62f1893b25e90261c17be047651338e41e0f707a6c7d31904a
888b41bb493f82bc787b507deee35df8a9dca32d9f59e5e4434334bb04aa1e17
a4bd93ead54b442e72759c14597039053d9dbc4cb6791904ad6d679f1bc423c2
a9a2f1dd042cb6f1eded53dc0a1c66ed8694fc093dc3520cdac1a541d615d474
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
c9c41579990e491b31185c662e701facbcd6dab9ec0b06edef8feec2f981812e
d155160aea288964eebe06a362795ab879ed657ca75f7ca60d5a1c8e9fe05d7b
d23807344428eec21271b708fcf73919827e568b0a335989f9f2348ae4356bd1
de2bbd8e0b32f53a53c1729bedb350cea59e9115fba4f2bed8e2e3dd1f76d9fa
e56f53b3b976e9c05d86645a1e85cfc69e961601d201e957768455580fa30478
e626cd322a146fb471ce04b32dfd3f81e37aa38627cb65dfe228599794c2f7b7
e92af41ea36051ffe9f3c83abec97cec2ac09cdaa2396863958e8b4bc8de5870
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f79dfaabb417f7b777458a24663c5075dd1e56026e20578a0d74568b3c762375