notepad.plus Open in urlscan Pro
64.227.102.109 Public Scan

Software

Apache /

Resource Hash

2795e04b55a5083cbbe44f47a119c24c3d5faee8e75889b48158f6360cb02bae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

x-mnt-h: 21-tp9r
strict-transport-security: max-age=31536000
content-encoding: gzip
date: Thu, 26 Oct 2023 13:08:00 GMT
server: Apache
etag: "8927471f38354260e9e6ad77dbef8403"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: max-age=300
x-mnt-w: 22-5h9m
timing-allow-origin: *
content-length: 38451
expires: Thu, 26 Oct 2023 13:13:00 GMT

GET
H2 200 release-20230927-130-adperformance.js Show response
warp.media.net/rtb/resources/ Frame 7CA9 72 KB
25 KB 367ms
67ms Script
application/javascript 23.216.84.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://warp.media.net/rtb/resources/release-20230927-130-adperformance.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.216.84.23 Atlanta, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

UploadServer /

Resource Hash

1dbd18c0aa6071222d773de0ac1cde277406e857cf0b9c88cbf2035480857bba

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

strict-transport-security: max-age=604800
content-encoding: gzip
date: Thu, 26 Oct 2023 13:08:01 GMT
x-guploader-uploadid: ADPycdutsYQZ0KFvpuLmOlAstnBeoe9cupo2dWkPHZLX6h2rWl8u-T-0XKgbiYzA6nRYYeE7WqbaGcrYZ-NSPqQAv9GUU1o0QwJi
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
content-length: 25148
server: UploadServer
etag: "1eb27acd7f471c38284a9857c37daa7f"
vary: Accept-Encoding
x-goog-hash: md5=HrJ6zX9HHDgoSphXw32qfw==, crc32c=3FtsVQ==
content-type: application/javascript
x-goog-generation: 1697195146284262
cache-control: max-age=3600
x-goog-stored-content-length: 73447
expires: Thu, 26 Oct 2023 14:08:01 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231024/r20110914/client/ Frame 7CA9 3 KB
1 KB 341ms
47ms Script
text/javascript 2607:f8b0:4004:c1b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231024/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 01:56:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40291
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Nov 2023 01:56:30 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231024/r20110914/client/ Frame 7CA9 20 KB
9 KB 343ms
43ms Script
text/javascript 2607:f8b0:4004:c1b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231024/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a198f092051a356c1e62c1296f628da5732045abafbd974eb7fff157e14ff042

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 01:56:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40276
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8426
x-xss-protection: 0
server: cafe
etag: 17696348727749479825
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Nov 2023 01:56:45 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7CA9 187 KB
59 KB 344ms
45ms Script
text/javascript 2607:f8b0:4004:c1d::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4e155284926ba010442d774fd493ff925a0256bd427f54596b1244791a3fa170

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60190
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1698233972131352"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 26 Oct 2023 13:08:01 GMT

GET
H/1.1 200
OK browserfp.min.js Show response
pxlclnmdecom-a.akamaihd.net/javascripts/ Frame 7CA9 123 KB
41 KB 201ms
81ms Script
text/javascript 23.222.5.141
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://pxlclnmdecom-a.akamaihd.net/javascripts/browserfp.min.js?templateId=3&customerId=8CU7Q771E&noCookies=true
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/nmedianet.js?cid=8CU7Q771E&ydspr=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.222.5.141 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-222-5-141.deploy.static.akamaitechnologies.com
Software: / Express
Resource Hash: 0befebf3d7cfe134b04e8adba4b9b8eed09e0b459cb4011b899329c07c8f90c7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Date: Thu, 26 Oct 2023 13:08:01 GMT
Content-Encoding: gzip
x-powered-by: Express
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: text/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=300
Access-Control-Max-Age: 1800
Connection: keep-alive, Transfer-Encoding
Transfer-Encoding: chunked
Expires: Thu, 26 Oct 2023 13:13:01 GMT

GET
H2 200 SAFEFRAME.html Show response
contextual.media.net/sr/2722522032/ Frame CA24 87 KB
32 KB 306ms
301ms Document
text/html 23.55.204.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/sr/2722522032/SAFEFRAME.html?ule=2955&&kkdd=H*%7Ch%7CnuA9H3*&88=Bc&ld=aJ1i5YgJiT7Y5TJY7Y5&xU*k=T&XF*v=T&8Ul=aT11&SF8r=~Y1i&8dU=imBWeWWa9&8*8U=e84xpuD_Rf9DIaRROkkf8K%3D%3D&8kdU=151iTWg7i&FdAr=1WTuYgT&F8=.h&8yCX=3hjs60o&*dU=i.6j7E-W0&S*dU=Lfg7Jc1&ySS*F=a&kkk=SAjOy~8GO~1GAuqU!k6id~)(JoDNml4B&CFr=g&GK=a&_xU=7&vUSa=imBB1fPi3&vUSY=agg1YaYg7&(UvSv=FUY%3DC_GGZd_kGRG%3DaTZpxrk*X%3DTw5ZUpXR(%3DTwJ1Z(vS%3DT%2CT%2CTZF8U%3DCIZkvr%3DT%2CTZUpXRG%3DYTZlGYkRFU%3DYTY5aTYJTgZd_kGR(%3DJ5Jwg1Z_kGRSn8%3DTZ_kGRkYvR(%3DTZFSU%3D5gTTJaiJa5ZkvS%3DTwTTT%2CTZd*%3Da13N6vzmGX~.Fx4Kl1-DYxZ)((%3DTZkdd*_v%3DT%2CTZk8%3DaZk*FRFU%3DYTY5aTYJT7ZkvUl%3DTwTTT%2CTZ_kGR(%3Daw5gZlGYkR_kGR(%3DTZ_kGRG%3DaTZFGl%3DYJw7YZx8vS%3DgTTg5aZ((%3Da1JZrk*X%3DTw5ZlGYkR_kGRn8%3DT9TZ*FdR8%3DYWWg%2CY%2CT%2CT%2CT%2CT%2CT%2CTZ(X%3DaZ*FdRU%3D5agiJZknr%3DT%2CTZv5*R(%3DWw51%2CJ1wi7ZFU%3DTZ_dU%3DYNv2C)AqI2Y48WbPaBZ8lGYkR(%3D1w7iZ(SU%3DYY51ia55JTWWTg1ggJJJg5YT7gTg1YY5TT7i5aW55YYa5555JT1a775771iigTgYJg5TgYi1Y1Y5YYgigig75J5J5Y51JYig7Tgai7TZ_dX%3DTZknS%3DTwTTT%2CTZpxUY*R(%3DTw1iZFF%3D0hZ88%3DBcZn(RUG%3DC%2FvZ_dK%3DOaZ8r%3DTZk8l%3D75wgWZmN%3D5T5iZn(R_8%3DaZCSF%3DaZn(R_G%3DrCZn(R88nF%3DaZ8S%3DCrK%20IpknZ(FFRtL-%3D0h%2C0hZ(vFdFY%3Da1JZ(vFdFa%3Da1JZn(RSS%3DYZU8%3DiZlGYkR(%3DWw51ZSS%3DY1g5a7Z_GXR*%3DTwaZlKRru8%3DTwW7ZldFRFU%3DJY1Z_kGRk*FR(%3DaawiJZU8Y%3DaZlRvFC%3DWTaZGvFS%3DZ8lpx%3D1w7iZldFR_kGR(%3DTwgJZlGYkRdRFU%3DYTY5aTYJTgZldFR_kGRG%3DTZrS%3DYTZlGYkRdR(%3DTwT5ZldFR(%3DgiYwgaZlGYkR_kGRld%3Da9OaJZ_kGRSld%3DTZll%3DTZ8lGYkRFU%3DJY1Zk)l%3D75wgWZGYkR(%3DaTTTZkvU*%3DTwTTT%2CTZFdU%3D151iTWg7iZ_kGRk*FRn8%3DTZn(RFk8%3Dn((ZlK_%3DTwW7ZUY*RG%3DaTZ8lGY%3D1w7iZ5*8)%3DaTTTwWWZUXXRFSkx%3DyvkXpCIZUY*R(%3DTw1iZk*FR(%3DJ1wi7Z_kGRFk*FR(%3DaawigZknK*%3DTwTTT%2CTZknKU%3DTwTTT%2CTZdFjr)%3DTZdFd)%3DTZ_kGRk*8R(%3DTZ(dU%3DTw5Zn(R*S%3D3pXr*vxrZ_kGRk*FRkl%3DTZ8(U*%3DTwaTiZdSI*rRdU%3DaWZFrGGrkRSvxRdU%3D5gTTJaiJa5ZF_**GIRSvxRdU%3DZUrSr8SrURSvxRdU%3DZldrKv(dGdSI%3DTwW7Z*pF%3DaZv8RSI*r%3DaZvU(Gn%3D5gTTJaiJa5ZvX*%3DaZpx(dU%3DTw5TTZ()Gk%3DTwTaTZF_dU%3DZUS8%3DrvFSRF8ZUXXRrk*X%3D)vGFrZUXX%3DyvkXpCIZ(U*8v*U%3DTZUvGx%3D_CdFpCYJZFxXS%3DypXr*vxrRSr8yCpGpxIR8pX*_SdCxZFp(*%3DZudU%3Dhq!O*_(OiW15Y5W51i571a5WZySXG%3DaZU8_S%3DJgZUpx(%3DTOaZr8*R_FrU%3D(rGpKR4YgZr8*R*Yg%3DiwJJYigTJWTg5TT7JZr8*R*gT%3DaiwJ1YTaYYaiT7YW1iZr8*R*JT%3DY5w711iWg75551iYiWZr8*R*WT%3D5TwTJWT75gY7a17iJgZr8*R*Wg%3D57wT1WaT1YJY1g5Y5Zr8*R*iT%3D51wgTgY5TiY7iTa7aZr8*R*ig%3D7WwiTiiTW7Tg1g7W5Zr8*R*1T%3DJYw5WgJ1i11a1T1YgZr8*R*1g%3D1awWaaa5i57YiYgWYZr8*R*11%3DYgWw1J5a1WJgJYgaiZd(8%3DaZCFA%3DaZSxF%3D1WTuYgTZ(F(%3DTZ(F*%3DTZSXu%3DY7a&CSl=T&XXX=_!pF0)Nq49n%3D&dK=1WT&dCN)k=a&(UkNU=7JT&X8)=JgYa5&IUF*k=a&(vr=D7v4%2Fx7xuv&nvS*kr=a&8vUpXvdC=SAjOy~8GO~O3cy07YO__)UCg6!yYdmT0J4U5YI7Nc8zE63zRnIzpAx%3D%3D&I*G*=a&dFdU=g&vUl=NClrFSpk%20Pp8_F&FFX8kRlrk=g&*xdU=*aWW5YJaaigSYTY5aTYJa5Ti&FFGU=%7B%22FFd*%22%3A%22YJTT%3ATiT5%3ATvii%3ATTTT%3ATTTT%3ATTTT%3ATTTT%3ATTTT%22%2C%22FF88%22%3A%22Bc%22%2C%22FFF8%22%3A%220o%22%2C%22FF8SI%22%3A%22CrK%20Ipkn%22%7D&ySXGFk8=a&ure=1

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/nmedianet.js?cid=8CU7Q771E&ydspr=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.55.204.22 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-196-180-24.deploy.static.akamaitechnologies.com

Software

Resource Hash

3a2e4fbd961784d841167ec2785de1a0f2f07f4d1131f0cd559adabbb2e1afdc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: max-age=0, no-cache, no-store
content-encoding: gzip
content-length: 32731
content-type: text/html
date: Thu, 26 Oct 2023 13:08:01 GMT
expires: Thu, 26 Oct 2023 13:08:01 GMT
pragma: no-cache
strict-transport-security: max-age=31536000
timing-allow-origin: *
vary: Accept-Encoding
x-sc-h: 22-ps57

GET
H/1.1 200
OK bping.php
lg3.media.net/ Frame 7CA9 35 B
338 B 170ms
73ms Image
image/gif 23.196.180.24
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bping.php?vgd_len=2726&&vgd_cdv=1099&vgd_cage=0&vgd_tsce=L298&vgd_mcf=65213&gdpr=0&mspa=0&prid=8PRVCXX19&cid=8CU7Q771E&crid=939807548&vi=1698325680423062423&ugd=4&lf=6&cc=US&sc=PA&lper=100&wsip=170785062&r=1698325681072&rrr=tzR-hLcl-L9lzxDdXrO8iLfb6YBICvqU&requrl=https%3A%2F%2Fnotepad.plus%2F&vgde_bdata=QOfvzxjj~8xLjMjvu9~myJLEYv9.A~OmYMGv9.Fi~G17v9%2C9%2C9~QNOvz5~L1Jv9%2C9~OmYMjvf9~ejfLMQOvf9fAu9fF9X~8xLjMGvFAF.Xi~xLjM7UNv9~xLjMLf1MGv9~Q7OvAX99FuWFuA~L17v9.999%2C9~8EvuiqVa1d%3DjYT0Qy%20BeipRfy~kGGv9~L88Ex1v9%2C9~LNvu~LEQMQOvf9fAu9fF9H~L1Oev9.999%2C9~xLjMGvu.AX~ejfLMxLjMGv9~xLjMjvu9~QjevfF.Hf~yN17vX99XAu~GGvuiF~JLEYv9.A~ejfLMxLjMUNv949~EQ8MNvfhhX%2Cf%2C9%2C9%2C9%2C9%2C9%2C9~GYvu~EQ8MOvAuXWF~LUJv9%2C9~1AEMGvh.Ai%2CFi.WH~QOv9~x8OvfV1Zzklr5Zf%20Nh2suP~NejfLMGvi.HW~G7OvffAiWuAAF9hh9XiXXFFFXAf9HX9XiffA99HWAuhAAffuAAAAF9iuHHAHHiWWX9XfFXA9XfWififAffXWXWXHAFAFAfAiFfWXH9XuWH9~x8Yv9~LU7v9.999%2C9~myOfEMGv9.iW~QQvIK~NNvPb~UGMOjvzS1~x8Bvou~NJv9~LNevHA.Xh~%3DVvA9AW~UGMxNvu~z7Qvu~UGMxjvJz~UGMNNUQvu~N7vzJBn5mLU~GQQMC_pvIK%2CIK~G1Q8QfvuiF~G1Q8QuvuiF~UGM77vf~ONvW~ejfLMGvh.Ai~77vfiXAuH~xjYMEv9.u~eBMJ-Nv9.hH~e8QMQOvFfi~xLjMLEQMGvuu.WF~ONfvu~eM1Qzvh9u~j1Q7v~Nemyvi.HW~e8QMxLjMGv9.XF~ejfLM8MQOvf9fAu9fF9X~e8QMxLjMjv9~J7vf9~ejfLM8MGv9.9A~e8QMGvXWf.Xu~ejfLMxLjMe8vu4ouF~xLjM7e8v9~eev9~NejfLMQOvFfi~LkevHA.Xh~jfLMGvu999~L1OEv9.999%2C9~Q8OviAiW9hXHW~xLjMLEQMUNv9~UGMQLNvUGG~eBxv9.hH~OfEMjvu9~Nejfvi.HW~AENkvu999.hh~OYYMQ7Lyvw1LYmz5~OfEMGv9.iW~LEQMGvFi.WH~xLjMQLEQMGvuu.WX~LUBEv9.999%2C9~LUBOv9.999%2C9~8QDJkv9~8Q8kv9~xLjMLENMGv9~G8Ov9.A~UGME7vqmYJE1yJ~xLjMLEQMLev9~NGOEv9.u9W~875EJM8Ovuh~QJjjJLM71yM8OvAX99FuWFuA~QxEEj5M71yM8Ov~OJ7JN7JOM71yM8Ov~e8JB1G8j875v9.hH~EmQvu~1NM75EJvu~1OGjUvAX99FuWFuA~1YEvu~myG8Ov9.A99~GkjLv9.9u9~Qx8Ov~O7NvJ1Q7MQN~OYYMJLEYvk1jQJ~OYYvw1LYmz5~GOEN1EOv9~O1jyvxz8QmzfF~QyY7vwmYJE1yJM7JNwzmjmy5MNmYEx78zy~QmGEv~-8OvKrtoExGoWhiAfAhAiWAHiuAh~w7Yjvu~ONx7vFX~OmyGv9ou~JNEMxQJOvGJjmBM%20fX~JNEMEfXvW.FFfWX9Fh9XA99HF~JNEMEX9vuW.Fif9uffuW9HfhiW~JNEMEF9vfA.HiiWhXHAAAiWfWh~JNEMEh9vA9.9Fh9HAXfHuiHWFX~JNEMEhXvAH.9ihu9ifFfiXAfA~JNEMEW9vAi.X9XfA9WfHW9uHu~JNEMEWXvHh.W9WW9hH9XiXHhA~JNEMEi9vFf.AhXFiWiiui9ifX~JNEMEiXviu.huuuAWAHfWfXhf~JNEMEiivfXh.iFAuihFXFfXuW~8GNvu~zQlvu~7yQvih9-fX9~GQGv9~GQEv9~7Y-vfHu&ssld=%7B%22QQ8E%22%3A%22fF99%3A9W9A%3A91WW%3A9999%3A9999%3A9999%3A9999%3A9999%22%2C%22QQNN%22%3A%22Pb%22%2C%22QQQN%22%3A%22I3%22%2C%22QQN75%22%3A%22zJBn5mLU%22%7D&vgd_ydspr=1&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=701&vgd_rakh=1698325680158127814&vgd_l1rhst=contextual.media.net&vgd_rpth=%2Fnmedianet.js&vgd_hb_audit_1=8CUU9JF8H&vgd_hb_audit_2=155921254&vgd_pgid=p1773261185t202310261308&vgd_pgids=1&vgd_uspa=0&vgda_l1btm=%5B%22SPAMPXL%22%5D&hvsid=00001698325681068034604566862499&gdpr=0&mspa=0&vgd_l2type=scs_newfl&vgd_end=2

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.196.180.24 Piscataway, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=21600
Date: Thu, 26 Oct 2023 13:08:01 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Thu, 26 Oct 2023 13:08:01 GMT

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame 0E5A 26 KB
10 KB 136ms
134ms Document
text/html 23.55.204.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?vsSync=1&cs=6&cv=31&https=1&cid=8CUU9JF8H&prvid=99%2C77%2C20000%2C294%2C262%2C460%2C461%2C462%2C4%2C313%2C10000%2C459%2C229%2C9%2C319&itype=ADX&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.55.204.22 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

b979c0836edf99edbc1ac66a8c5047178bec55396f6fa591e50b88d586d7616d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 9539
content-type: text/html; charset=UTF-8
date: Thu, 26 Oct 2023 13:08:01 GMT
expires: Sat, 28 Oct 2023 13:08:01 GMT
p3p: CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H2 200 clog
hblg.media.net/ Frame 7CA9 35 B
191 B 139ms
115ms Image
image/gif 23.216.84.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hblg.media.net/clog?pixel_len_bucket=6247&logid=awlog&lper=1&itypeid=17&itype=ADX&cc=US&cid=8CUU9JF8H&reqid=0yHOlJQFP5UWvCTtaBK8Iw&vid=0yHOlJQFP5UWvCTtaBK8Iw&dn=notepad.plus&rawDn=notepad.plus&requrl_dn=notepad.plus&pid=8PR113JGC&ugd=4&fleet=appnexus&requrl=https%3A%2F%2Fnotepad.plus&cliIPV6=2600%3A0803%3A0a88%3A0000%3A0000%3A0000%3A0000%3A0000&cliIPType=v6&coppa_enf=true&lmt_status=N&lmt_applied=N&lmt_enf=true&dnt_enf=false&geo_source=1&sc=NY&ct=new+york&zip=10004&pubid=pub-ADX-116310109131&tgtval=pub-ADX-116310109131&csip=rtb-appnexus-75dc8cbb94-b4zbg.SC&dtc=east_sc&zone=d&ptype=23&tmax=300&xtmax=290&gdpr=0&gpp_present=false&app=0&sat=1&device_id=4&asn=703&sckfl=0&sckfl2=0&smbrid=adx-1&cxtSgmt=homepage_technology_computing&usp_status=0&usp_enf=1&mspa_enforced=false&gqid=AD8Fdm6i8_ti_NWF78pSvVbauH8_azGRylHB876nYP9b25uLv-md91JRvdVT38BptenMgOBe&pexid=ADX-pub-8793237398349137&geoll=false&is_ortb=false&s_ip=172.217.36.134&s_city=atlanta&commit_id=796d3eb8&ocurr=USD&omul=1.0&currsrc=API&currsrc_date=2023-10-25+00%3A00%3A00&schain_cmpl=1&schain_nodes_count=1&dummy_vsid=false&amptype=1&second_call=false&supply_cc=US&ipcc=US&is_msnnative_src=false&rtttime=49&req_tid_present=false&pvid=460&prvAccId=939807548&prvApiId=8CU7Q771E&adj0=0.0&adj1=0.0&adj2=0.0&pst=0&crid=155921254&prspt=headerBid&prvReqId=2491500579080569_30929867_1559212544601&size=970x250&chnl=HARMONY&bdp=0.300&bid_uuid=33c3c2c288a0f7bc0609095ab078cd65&cbdp=0.108&og_cbdp=0.300&ogbdp=0.3&pv_adtype=0&res_mtype=0&mnet_ckfl=0&ckfl=0&be=0&advUrl=https%3A%2F%2Frelated.investorfocus.net&dfpBd=0.108&dsrc=-2&dp=0&dbf=1&epc=939807548&s=1&snm=SUCCESS&pcrid=8CU7Q771E-939807548-43-27&tpbTkn=false&exid=218&bidflr=0.010&pbidflr=0.010&opbidflr=0.010&spbf=0&viewability=74&sbdrid=196&exp=ssProfile%3D0%7Csfl%3Dfalse%7CssBucket%3D0%7Cbfl%3D-100%7Csch%3D1%7Cclt%3D3%7Ctpi%3D1%7Cfl_rl%3D1%7Cdbr%3D1%7Csfl%3Dfalse%7Cbfl%3D-100%7Ctpi%3D1&mnrf=0&ortbseat=BID_API&brsrclk=0&bidrestime=1698325679527&fpuReq=1&bfs=103&acsn=1&ybnca_erpm=0.3&dmm_erpm=true&dmm_ogerpm=false&bcrid=1700080807684000970025000059500&strg=HARMONY&pgcatiab=IAB19-36&pgcatiab2=615&pgcatsprig=737&vls=0&scrid=1700080807684000970025000059500&mang=1&pvdTmax=241&fpusp=false&ae=false&epcexp=false&moau=true&ucrid_ver=2&omid=0&mnet_static_share=0.0&dt=O&incentive_type=0&aogbdp=0.0&spIvt=3&spSource=0&spTo=3&spIsReq=3&spFst=0&spCst=0&mx_page_url=https%3A%2F%2Fnotepad.plus&mx_sbp=-10.0&mx_sua_cvg=1111111&mx_tid_sent=false&mx_epbc=8CU7Q771E&mx_SPRIG=1&mx_bsBucket=0&mx_ssProfile=0&mx_sua_os_n=Windows+NT&mx_lr=0&mx_TAS=1&mx_ep_sent%3C%3E=badv&mx_g_one_uid_sent=None&mx_uid_sent=0&mx_sua_os_v=10.0&mx_bsBucketRa=0&mx_sid=8CUU9JF8H&mx_SC=0&mx_lr_seg_deal=0&mx_aqcpl_crid=0&mx_nsz=1&mx_GCID=0&mx_maq_call=false&mx_aurt=0&mx_sua_model=x64&mx_bsBucketKtwRl=0&mx_tgs=970x250&mx_bsProfileRa=0&mx_IAB2=1&mx_bss_algos%3C%3E=0&mx_aurl_hc=0&mx_aabpc=0&mx_PC=1&mx_UCC=2&mx_isLossNtf=false&mx_bsProfileKtwRl=0&mx_bsProfile=0&mx_ssBucket=0&mx_TAF=3&mx_gpid_sent=false&mx_commit_id=b8aecf0826&mx_exp_tokens%3C%3E=launch-wrng-exp%3Atoken2%23%23launchexp%3Atoken1%23%23NedCkfl%3ADEFAULT%23%23BssTgtMig%3ADEFAULT&acid=69eea43db760710f5f981bb0209946b1&rtime=20.0&wsip=mowx-lite-7f49494d84-d4gl8&ltime=27.0&act=headerBid&abs=0%7C0%7Cxtmax%3D290%7Cbrr%3D1&adtypes=0&adblk=3500618613&impId=1&reftime=0&reftype=0&psrc=fail&mowxReqId=69eea43db760710f5f981bb0209946b1_1&policy_enf=2&pub_blk_enf=1&req_size=970x250&renderer=0&ifst=0&iframingState=0&ifdp=0&slotVisibility=1&adpos=1&media=0&native_asset=0&req_mtype%3C%3E=0&ctr=-1.0&rfc=-1&skadidfl=0&feedback_id=0yHOlJQFP5UWvCTtaBK8Iw&supplyTagId=3500618613&mnrfc=-1&viewability_vendor=EXCHANGE&vcmplrt=-1.0&imp_tid_present=false&mp_seg%3C%3E=60677%23%2360699%23%23100109%23%23100085%23%2360457%23%2360878%23%2360677%23%2360699%23%23100169%23%23100273%23%2360457%23%2317191%23%2360878&debug_ts=2023-10-26+13%3A07%3A59&__expireat=1698326279786&mview=1&lo_pvid=%5B460%5D&lo_dp=0&lo_bdp=0.300&lo_cbdp=0.108&actltime=28&rme=adm&bdata=sd2%3Dnull~iurl_l%3D10~ogerpm%3D0.3~dom_b%3D0.69~bat%3D0%2C0%2C0~scd%3Dny~rae%3D0%2C0~dom_l%3D20~vl2r_sd%3D2023102605~iurl_b%3D636.59~url_tkc%3D0~url_r2a_b%3D0~std%3D3500618613~rat%3D0.000%2C0~ip%3D19HIOajClmLPsgqwv9WB2g~fbb%3D0~riipua%3D0%2C0~rc%3D1~rps_sd%3D2023102604~radv%3D0.000%2C0~url_b%3D1.35~vl2r_url_b%3D0~url_l%3D10~slv%3D26.42~gcat%3D500531~bb%3D196~erpm%3D0.3~vl2r_url_kc%3D0E0~psi_c%3D2775%2C2%2C0%2C0%2C0%2C0%2C0%2C0~bm%3D1~psi_d%3D31586~rke%3D0%2C0~a3p_b%3D7.39%2C69.84~sd%3D0~uid%3D2IaGnfzDyG2qc7ZF1U~cvl2r_b%3D9.48~btd%3D2239813360770595566653204505922300483173322133336091443449885052653052892923225858543636323962854051840~uim%3D0~rkt%3D0.000%2C0~ogd2p_b%3D0.98~ss%3DNA~cc%3DUS~kb_dl%3Dn%2Fa~uiw%3D-1~ce%3D0~rcv%3D43.57~CI%3D3038~kb_uc%3D1~nts%3D1~kb_ul%3Den~kb_ccks%3D1~ct%3Dnew%20york~bss_KTW%3DNA%2CNA~basis2%3D196~basis1%3D196~kb_tt%3D2~dc%3D8~vl2r_b%3D7.39~tt%3D295314~ulm_p%3D0.1~vw_exc%3D0.74~vis_sd%3D629~url_rps_b%3D11.86~dc2%3D1~v_asn%3D701~last%3D~cvog%3D9.48~vis_url_b%3D0.56~vl2r_i_sd%3D2023102605~vis_url_l%3D0~et%3D20~vl2r_i_b%3D0.03~vis_b%3D582.51~vl2r_url_vi%3D1E-16~url_tvi%3D0~vv%3D0~cvl2r_sd%3D629~rfv%3D43.57~l2r_b%3D1000~radp%3D0.000%2C0~sid%3D939807548~url_rps_kc%3D0~kb_src%3Dkbb~vwu%3D0.74~d2p_l%3D10~cvl2%3D9.48~3pcf%3D1000.77~dmm_strg%3Dharmony~d2p_b%3D0.98~rps_b%3D69.84~url_srps_b%3D11.85~rkwp%3D0.000%2C0~rkwd%3D0.000%2C0~isRef%3D0~isif%3D0~url_rpc_b%3D0~bid%3D0.3~kb_pt%3DHomepage~url_rps_rv%3D0~cbdp%3D0.108%7Eitype_id%3D17%7Eseller_tag_id%3D3500618613%7Esupply_tag_id%3D%7Edetected_tag_id%3D%7Eviewability%3D0.74%7Epos%3D1%7Eac_type%3D1%7Eadblk%3D3500618613%7Eamp%3D1%7Eogbid%3D0.300%7Ebflr%3D0.010%7Esuid%3D%7Edtc%3Deast_sc%7Edmm_erpm%3Dfalse%7Edmm%3Dharmony%7Ebdpcapd%3D0%7Edalg%3Dunison26%7Esgmt%3Dhomepage_technology_computing%7Esobp%3D%7Exid%3DADX-pub-8793237398349137%7Ehtml%3D1%7Edcut%3D65%7Edogb%3D0-1%7Eecp_used%3Dbelow_q25%7Eecp_p25%3D8.662850670530046%7Eecp_p50%3D18.692012218042798%7Eecp_p60%3D23.499875433398287%7Eecp_p70%3D30.067043524194865%7Eecp_p75%3D34.09710926295323%7Eecp_p80%3D39.50523082480141%7Eecp_p85%3D47.80880740595473%7Eecp_p90%3D62.37569899190925%7Eecp_p95%3D91.71113834282572%7Eecp_p99%3D257.9631976562518~ibc%3D1~nsz%3D1~tgs%3D970x250~bsb%3D0~bsp%3D0~tmx%3D241&utime=1552&sf=0&cpr=0.9879024572991175

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.216.84.23 Atlanta, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:01 GMT
strict-transport-security: max-age=86400 ; includeSubDomains
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Thu, 26 Oct 2023 13:08:01 GMT

GET
DATA 200
OK truncated
/ Frame 7CA9 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: daaec4ff6ae8c4c75e318436c730aee91463a1dd871d48f583987e2934d74197

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 7CA9 0
23 B 59ms
58ms Image
text/html 2607:f8b0:4004:c1b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CvOQBr2Q6Za-fCcethQbqirGAA76VpK9s99rS06wMwI23ARABIABgyQaCARdjYS1wdWItODc5MzIzNzM5ODM0OTEzN8gBCagDAcgDAqoEuQFP0IFKpukdxHYmgDSawmWayfQl8yPIeWwkoiux785C09RgbplhpP99TQOMinL6frlxVmhQZTsjXmapI-G1nF50D7bTpP0vrg_NGCDWbaEi0MM48qGvY4td24wXGgfWEhyTS9kq8imghVniZYSjdzzeFRVgYlQSHncxq2lcBv-LovTV8EKLfJ4A-ZlrrPqhbSlLSIFXncwXt1y-4AIETtGxVBsxUl4lS1ZXm1r9R7wzipuhhRdk00bonYAGqoy67O33loLIAaAGIagHpr4bqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBIIgGEQATICigI6AoBASL39wTqACgH6CwIIAYAMAdAVAYAXAbIXGgoYEhRwdWItODc5MzIzNzM5ODM0OTEzNxgA&sigh=IU3710yM54k&uach_m=[UACH]&cid=CAQSTADICaaNeoveMoL9KVZCXz03-pVrN3FYNkbx-fLJ4wRLSLc61BaBbehNyL-d7EXrN369tmzt-3v-3_7i4UALzgrXBbshX6p6INHBK1QYAQ&cbvp=2&vis=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8793237398349137&output=html&h=250&slotname=3182151161&adk=3500618613&adf=428091284&pi=t.ma~as.3182151161&w=970&lmt=1698361679&channel=channel1&format=970x250&url=https%3A%2F%2Fnotepad.plus%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1698325678804&bpp=2&bdt=760&idt=299&shv=r20231024&mjsv=m202310260101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3972234055011&frm=20&pv=1&ga_vid=2061795391.1698325679&ga_sid=1698325679&ga_hid=1146444982&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=315&ady=94&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079078%2C44805932%2C44806737%2C31078297%2C31079206&oid=2&pvsid=464992494868551&tmod=122040629&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=mSr1pDm4Y5&p=https%3A//notepad.plus&dtd=305
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 26 Oct 2023 13:08:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 26 Oct 2023 13:08:01 GMT

GET
H2 200 log
hblg.media.net/ Frame 7CA9 35 B
191 B 74ms
73ms Image
image/gif 23.216.84.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hblg.media.net/log?logid=kfke&evtid=plutol1&__q=AYYEIwKELwQCAAABAAAAAgAAAABAAAEABgAAQIABAAgAMNAATjI0OTE1MDA1NzkwODA1NjlfMzA5Mjk4NjdfMTU1OTIxMjU0NDYwMUA2OWVlYTQzZGI3NjA3MTBmNWY5ODFiYjAyMDk5NDZiMZgHMzMzMzMz0z8oaHR0cHM6Ly9ub3RlcGFkLnBsdXMEVVMA6AFNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTE4LjAuNTk5My4xMTcgU2FmYXJpLzUzNy4zNhhub3RlcGFkLnBsdXMSOENVVTlKRjhICA45NzB4MjUwCjAuMTA4DmVhc3Rfc2MGQURYCAhudXJsAAAAAAAAgFJAzrbKwe1iAjEAAAAAAADwv0BydGItYXBwbmV4dXMtNzVkYzhjYmI5NC1iNHpiZy5TQz4xNzAwMDgwODA3Njg0MDAwOTcwMDI1MDAwMDU5NTAwAhA3OTZkM2ViOAJkAg&cbvp=2

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.216.84.23 Atlanta, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400 ; includeSubDomains

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:01 GMT
strict-transport-security: max-age=86400 ; includeSubDomains
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Thu, 26 Oct 2023 13:08:01 GMT

GET
H/1.1 200
OK log
qsearch-a.akamaihd.net/ Frame 7CA9 35 B
296 B 185ms
59ms Image
image/gif 23.205.106.147
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://qsearch-a.akamaihd.net/log?logid=kfk&evtid=dmmra&acid=69eea43db760710f5f981bb0209946b1&algo=unison26&bdp=0.3000&bidfp=0.0100&capd=0&cc=US&cid=8CUU9JF8H&crid=155921254&ct=new%20york&dc=east_sc&dfpbd=0.1080&dn=notepad.plus&iwb=1&ogcbdp=0.3000&other_bids=0.3&other_prv=460&pbshr=100.0000&prdp=0.1080&requrl=notepad.plus%2F&sat=1&sc=NY&sc_pvid=460&send_erpm=true&server=1&size=970x250&strg=harmony&totalTime=7233030&ugd=4&ver=9.6.3&cliIP=0&time_stamp=2023-10-26%2013%3A07%3A59&seat=BID_API&itype=adx&req_id=0yHOlJQFP5UWvCTtaBK8Iw&dfp_bucket=0.1&level_base=0&bdp_bucket=0.3&app_type=adx_test&br_id=265&o_id=101&ua=Mozilla%2F5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F118.0.5993.117%20Safari%2F537.36&br_ver=118.0.5993.117&o_ver=NT%2010.0&second_bid=0.0&second_bidder=%2A&seg=Computer_Software_and_Applications%2CComputing%2Chomepage_technology_computing%2Clong_tail_homepage_catchall%2COperating_Systems%2Csegment_broad_technology_computing%2CTechnology_and_Computing&f_seg=homepage_technology_computing&model_key=generic_adx_1-cid_0&ogerpm=0.3000&ogerpm_used=false&rawbid=0.3000&totalTimeBucket=7&as_cache=0&sub_bidder=196&current_day=4.0&current_hour=12&cut=64&floor_bucket=0.00&model_version=202310251107_generic_adx_1-cid_0&erpm_bucket=0.30&mul_ratio=0.0000&dmm_m4=0.0000&ogerpm_wd_bkt=0-1&visibility=1&viewability=0.7400&pvid_seat=460_BID_API&ckfl=0&mnckfl=0&sd=0&predicted_wr=56.1487&bdp_wider_bucket=1&adblk=3500618613&dim10=false&dmm_m9=0.0000&dmm_m10=3423134&log_less=false&cut_bkt=65&advurl=related.investorfocus.net%2F&dmm_d10=0.0000&bdmm_m5=0.0000&bdmm_m6=0.0000&bdmm_m7=0.0000&bdmm_m12=0.0000&dmm_l=0.0000&dmm_r=0.0000&e_rpm=0.0000&bdr_typ=1&clisp=rtb-appnexus-75dc8cbb94-b4zbg.SC&dmm_m1=2023-10-26%2013%3A07%3A59.529200385&bd_m1=0.0000&bd_m2=0.0000&bd_m3=0.0000&ss=NA&ss_d1=0&ss_d2=0&dmm_m22=0.3000&adtyp=0&gpid_sent=false&pst=EMS&bcrid=1700080807684000970025000059500&erpm_mult=1.000000&zone=d&rc=-1&ecp_p50=18.692012218042798&ecp_p75=34.09710926295323&ecp_avg=0.02&ecp_status=Success&ecp_used=below_q25&ecp_rtime=1567.0&sfm_key=mowx_8CUU9JF8H_460&content_context=-1&video_mindur=-1&video_maxdur=-1&vskip=-1&ctr=-1.0&vcmplrt=-1.0&vplcmtt=-1&itype_id=17&wsip=mowx-lite-7f49494d84-d4gl8&rel_cut_bkt=65&ecp_ver=multiquantile&djvm=9.5.8&ecp_p25=8.662850670530046&ecp_p60=23.499875433398287&ecp_p70=30.067043524194865&ecp_p80=39.50523082480141&ecp_p85=47.80880740595473&ecp_p90=62.37569899190925&ecp_p95=91.71113834282572&ecp_p99=257.9631976562518&cbvp=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8793237398349137&output=html&h=250&slotname=3182151161&adk=3500618613&adf=428091284&pi=t.ma~as.3182151161&w=970&lmt=1698361679&channel=channel1&format=970x250&url=https%3A%2F%2Fnotepad.plus%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1698325678804&bpp=2&bdt=760&idt=299&shv=r20231024&mjsv=m202310260101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=3972234055011&frm=20&pv=1&ga_vid=2061795391.1698325679&ga_sid=1698325679&ga_hid=1146444982&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=315&ady=94&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079078%2C44805932%2C44806737%2C31078297%2C31079206&oid=2&pvsid=464992494868551&tmod=122040629&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=mSr1pDm4Y5&p=https%3A//notepad.plus&dtd=305
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.106.147 Ashburn, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a23-205-106-147.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 26 Oct 2023 13:08:01 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 35
Expires: Thu, 26 Oct 2023 13:08:01 GMT

GET
H2

200

cksync
cs.media.net/ Frame 0E5A
Redirect Chain

https://cm.g.doubleclick.net/pixel?cs=6&google_nid=media&google_cm=1&google_hm=MzQxMzI3MjgxNTY2ODY4MzAwMFYxMA%3D%3D&google_sc=1
https://cs.media.net/cksync?type=g&cs=6&google_gid=CAESEG2k0QU0nygPSoNiAzZIPh8&google_cver=1

53 B
445 B

224ms
202ms

Image
image/gif

23.216.84.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.media.net/cksync?type=g&cs=6&google_gid=CAESEG2k0QU0nygPSoNiAzZIPh8&google_cver=1
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=6&cv=31&https=1&cid=8CUU9JF8H&prvid=99%2C77%2C20000%2C294%2C262%2C460%2C461%2C462%2C4%2C313%2C10000%2C459%2C229%2C9%2C319&itype=ADX&purpose1=1&gdprconsent=1&gdpr=0&usp_status=0&usp_consent=1
Protocol: H2
Server: 23.216.84.23 Atlanta, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-216-84-23.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 9d96b2fe2d8d4a398a846ebee84e5e70ec37e0fc613b3e2a5aaa81b1bf2d8470

Request headers

accept-language: en-US,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:01 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 53
x-mnet-hl2: E
expires: Thu, 26 Oct 2023 13:08:01 GMT

Redirect headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:01 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://cs.media.net/cksync?type=g&cs=6&google_gid=CAESEG2k0QU0nygPSoNiAzZIPh8&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310260101/ 160 KB
55 KB 66ms
66ms Script
text/javascript 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310260101/reactive_library_fy2021.js?bust=31079206

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310260101/show_ads_impl_fy2021.js?bust=31079206

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a79fee0734ed90ad887405817cc01beff77b87e48ff2176b42820505b6025754

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://notepad.plus/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:01 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 55793
x-xss-protection: 0
server: cafe
etag: 6348872147439274208
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 26 Oct 2023 13:08:01 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame DD15 37 KB
16 KB 507ms
506ms Document
text/html 2607:f8b0:4004:c1b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8793237398349137&output=html&h=280&adk=221352476&adf=2860179214&pi=t.aa~a.2227863559~rp.1&w=1030&fwrn=4&fwrnh=100&lmt=1698361681&rafmt=1&to=qs&pwprc=4354248216&format=1030x280&url=https%3A%2F%2Fnotepad.plus%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1698325681326&bpp=1&bdt=3282&idt=-M&shv=r20231024&mjsv=m202310260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db38f74f5bba9cd29%3AT%3D1698325679%3ART%3D1698325679%3AS%3DALNI_MbFOhtzjBTfbED67puskk9feSK6ZQ&gpic=UID%3D00000d9cb191db97%3AT%3D1698325679%3ART%3D1698325679%3AS%3DALNI_MZ6ZUkzpsMstOsdeFgOXcsuu-BAqw&prev_fmts=0x0%2C970x250&nras=2&correlator=3972234055011&frm=20&pv=1&ga_vid=2061795391.1698325679&ga_sid=1698325679&ga_hid=1146444982&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=285&ady=1669&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079078%2C44805932%2C44806737%2C31078297%2C31079206&oid=2&psts=AOrYGsnymZq8uzdJoDkwlNsvW-NaSna0XYpnXdP_mu2O8X1-JPfzYwozuJp1M-FBp8XkKpQeFinhy0ybRtjj&pvsid=464992494868551&tmod=122040629&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=VjUxJeEZsd&p=https%3A//notepad.plus&dtd=11

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310260101/show_ads_impl_fy2021.js?bust=31079206

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

27baaf1e478cc9863cf5a2edd07e76d6652425adc138fa885d46573af95f722c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://notepad.plus/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 16166
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 26 Oct 2023 13:08:01 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame AAA0 38 KB
16 KB 455ms
455ms Document
text/html 2607:f8b0:4004:c1b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8793237398349137&output=html&h=280&adk=965705852&adf=4284688756&pi=t.aa~a.4100179273~rp.4&w=1050&fwrn=4&fwrnh=100&lmt=1698361681&rafmt=1&to=qs&pwprc=4354248216&format=1050x280&url=https%3A%2F%2Fnotepad.plus%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1698325681326&bpp=1&bdt=3282&idt=-M&shv=r20231024&mjsv=m202310260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db38f74f5bba9cd29%3AT%3D1698325679%3ART%3D1698325679%3AS%3DALNI_MbFOhtzjBTfbED67puskk9feSK6ZQ&gpic=UID%3D00000d9cb191db97%3AT%3D1698325679%3ART%3D1698325679%3AS%3DALNI_MZ6ZUkzpsMstOsdeFgOXcsuu-BAqw&prev_fmts=0x0%2C970x250%2C1030x280&nras=3&correlator=3972234055011&frm=20&pv=1&ga_vid=2061795391.1698325679&ga_sid=1698325679&ga_hid=1146444982&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=275&ady=3092&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079078%2C44805932%2C44806737%2C31078297%2C31079206&oid=2&psts=AOrYGsnymZq8uzdJoDkwlNsvW-NaSna0XYpnXdP_mu2O8X1-JPfzYwozuJp1M-FBp8XkKpQeFinhy0ybRtjj&pvsid=464992494868551&tmod=122040629&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=i085cixuMS&p=https%3A//notepad.plus&dtd=17

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310260101/show_ads_impl_fy2021.js?bust=31079206

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c6a88cddee1420ef21589d86eda7423b987266333d6ba30e8c8932e41a7d81c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://notepad.plus/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 16178
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 26 Oct 2023 13:08:01 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 0D56 38 KB
16 KB 372ms
372ms Document
text/html 2607:f8b0:4004:c1b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8793237398349137&output=html&h=280&adk=3809598800&adf=854766408&pi=t.aa~a.3093707004~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1698361681&rafmt=1&to=qs&pwprc=4354248216&format=1200x280&url=https%3A%2F%2Fnotepad.plus%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1698325681326&bpp=1&bdt=3282&idt=0&shv=r20231024&mjsv=m202310260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db38f74f5bba9cd29%3AT%3D1698325679%3ART%3D1698325679%3AS%3DALNI_MbFOhtzjBTfbED67puskk9feSK6ZQ&gpic=UID%3D00000d9cb191db97%3AT%3D1698325679%3ART%3D1698325679%3AS%3DALNI_MZ6ZUkzpsMstOsdeFgOXcsuu-BAqw&prev_fmts=0x0%2C970x250%2C1030x280%2C1050x280&nras=4&correlator=3972234055011&frm=20&pv=1&ga_vid=2061795391.1698325679&ga_sid=1698325679&ga_hid=1146444982&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=3767&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079078%2C44805932%2C44806737%2C31078297%2C31079206&oid=2&psts=AOrYGsnymZq8uzdJoDkwlNsvW-NaSna0XYpnXdP_mu2O8X1-JPfzYwozuJp1M-FBp8XkKpQeFinhy0ybRtjj&pvsid=464992494868551&tmod=122040629&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=GhWwA9iBgf&p=https%3A//notepad.plus&dtd=22

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310260101/show_ads_impl_fy2021.js?bust=31079206

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

aa0ac614af5db9c952bc77022c2f92a750725ad2b5636f6a771f188e10399faa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://notepad.plus/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 16344
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 26 Oct 2023 13:08:01 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/ Frame CCBC 10 KB
4 KB 36ms
34ms Document
text/html 2607:f8b0:4004:c1b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310260101/show_ads_impl_fy2021.js?bust=31079206

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ad1270333ea16969313802add43789e0558cd75e2bf91e768bcf3937f091a001

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://notepad.plus/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 39720
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4480
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 26 Oct 2023 02:06:01 GMT
etag: 4569948109300706969
expires: Thu, 09 Nov 2023 02:06:01 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/ Frame 8103 10 KB
4 KB 33ms
32ms Document
text/html 2607:f8b0:4004:c1b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310260101/show_ads_impl_fy2021.js?bust=31079206

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ad1270333ea16969313802add43789e0558cd75e2bf91e768bcf3937f091a001

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://notepad.plus/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 39720
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4480
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 26 Oct 2023 02:06:01 GMT
etag: 4569948109300706969
expires: Thu, 09 Nov 2023 02:06:01 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/ Frame 9E5B 10 KB
4 KB 33ms
32ms Document
text/html 2607:f8b0:4004:c1b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310260101/show_ads_impl_fy2021.js?bust=31079206

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ad1270333ea16969313802add43789e0558cd75e2bf91e768bcf3937f091a001

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://notepad.plus/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 39720
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4480
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 26 Oct 2023 02:06:01 GMT
etag: 4569948109300706969
expires: Thu, 09 Nov 2023 02:06:01 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/ Frame 1CC3 10 KB
4 KB 34ms
34ms Document
text/html 2607:f8b0:4004:c1b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202310260101/show_ads_impl_fy2021.js?bust=31079206

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ad1270333ea16969313802add43789e0558cd75e2bf91e768bcf3937f091a001

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://notepad.plus/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 39720
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4480
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 26 Oct 2023 02:06:01 GMT
etag: 4569948109300706969
expires: Thu, 09 Nov 2023 02:06:01 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 568fa2b9-1e83-43db-a896-73eeeb9d93d4.jpg
contextual.media.net/kimg/new/140x110/3/239/194/197/ Frame CA24 14 KB
14 KB 49ms
46ms Image
image/jpeg 23.55.204.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/kimg/new/140x110/3/239/194/197/568fa2b9-1e83-43db-a896-73eeeb9d93d4.jpg?v=9

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/sr/2722522032/SAFEFRAME.html?ule=2955&&kkdd=H*%7Ch%7CnuA9H3*&88=Bc&ld=aJ1i5YgJiT7Y5TJY7Y5&xU*k=T&XF*v=T&8Ul=aT11&SF8r=~Y1i&8dU=imBWeWWa9&8*8U=e84xpuD_Rf9DIaRROkkf8K%3D%3D&8kdU=151iTWg7i&FdAr=1WTuYgT&F8=.h&8yCX=3hjs60o&*dU=i.6j7E-W0&S*dU=Lfg7Jc1&ySS*F=a&kkk=SAjOy~8GO~1GAuqU!k6id~)(JoDNml4B&CFr=g&GK=a&_xU=7&vUSa=imBB1fPi3&vUSY=agg1YaYg7&(UvSv=FUY%3DC_GGZd_kGRG%3DaTZpxrk*X%3DTw5ZUpXR(%3DTwJ1Z(vS%3DT%2CT%2CTZF8U%3DCIZkvr%3DT%2CTZUpXRG%3DYTZlGYkRFU%3DYTY5aTYJTgZd_kGR(%3DJ5Jwg1Z_kGRSn8%3DTZ_kGRkYvR(%3DTZFSU%3D5gTTJaiJa5ZkvS%3DTwTTT%2CTZd*%3Da13N6vzmGX~.Fx4Kl1-DYxZ)((%3DTZkdd*_v%3DT%2CTZk8%3DaZk*FRFU%3DYTY5aTYJT7ZkvUl%3DTwTTT%2CTZ_kGR(%3Daw5gZlGYkR_kGR(%3DTZ_kGRG%3DaTZFGl%3DYJw7YZx8vS%3DgTTg5aZ((%3Da1JZrk*X%3DTw5ZlGYkR_kGRn8%3DT9TZ*FdR8%3DYWWg%2CY%2CT%2CT%2CT%2CT%2CT%2CTZ(X%3DaZ*FdRU%3D5agiJZknr%3DT%2CTZv5*R(%3DWw51%2CJ1wi7ZFU%3DTZ_dU%3DYNv2C)AqI2Y48WbPaBZ8lGYkR(%3D1w7iZ(SU%3DYY51ia55JTWWTg1ggJJJg5YT7gTg1YY5TT7i5aW55YYa5555JT1a775771iigTgYJg5TgYi1Y1Y5YYgigig75J5J5Y51JYig7Tgai7TZ_dX%3DTZknS%3DTwTTT%2CTZpxUY*R(%3DTw1iZFF%3D0hZ88%3DBcZn(RUG%3DC%2FvZ_dK%3DOaZ8r%3DTZk8l%3D75wgWZmN%3D5T5iZn(R_8%3DaZCSF%3DaZn(R_G%3DrCZn(R88nF%3DaZ8S%3DCrK%20IpknZ(FFRtL-%3D0h%2C0hZ(vFdFY%3Da1JZ(vFdFa%3Da1JZn(RSS%3DYZU8%3DiZlGYkR(%3DWw51ZSS%3DY1g5a7Z_GXR*%3DTwaZlKRru8%3DTwW7ZldFRFU%3DJY1Z_kGRk*FR(%3DaawiJZU8Y%3DaZlRvFC%3DWTaZGvFS%3DZ8lpx%3D1w7iZldFR_kGR(%3DTwgJZlGYkRdRFU%3DYTY5aTYJTgZldFR_kGRG%3DTZrS%3DYTZlGYkRdR(%3DTwT5ZldFR(%3DgiYwgaZlGYkR_kGRld%3Da9OaJZ_kGRSld%3DTZll%3DTZ8lGYkRFU%3DJY1Zk)l%3D75wgWZGYkR(%3DaTTTZkvU*%3DTwTTT%2CTZFdU%3D151iTWg7iZ_kGRk*FRn8%3DTZn(RFk8%3Dn((ZlK_%3DTwW7ZUY*RG%3DaTZ8lGY%3D1w7iZ5*8)%3DaTTTwWWZUXXRFSkx%3DyvkXpCIZUY*R(%3DTw1iZk*FR(%3DJ1wi7Z_kGRFk*FR(%3DaawigZknK*%3DTwTTT%2CTZknKU%3DTwTTT%2CTZdFjr)%3DTZdFd)%3DTZ_kGRk*8R(%3DTZ(dU%3DTw5Zn(R*S%3D3pXr*vxrZ_kGRk*FRkl%3DTZ8(U*%3DTwaTiZdSI*rRdU%3DaWZFrGGrkRSvxRdU%3D5gTTJaiJa5ZF_**GIRSvxRdU%3DZUrSr8SrURSvxRdU%3DZldrKv(dGdSI%3DTwW7Z*pF%3DaZv8RSI*r%3DaZvU(Gn%3D5gTTJaiJa5ZvX*%3DaZpx(dU%3DTw5TTZ()Gk%3DTwTaTZF_dU%3DZUS8%3DrvFSRF8ZUXXRrk*X%3D)vGFrZUXX%3DyvkXpCIZ(U*8v*U%3DTZUvGx%3D_CdFpCYJZFxXS%3DypXr*vxrRSr8yCpGpxIR8pX*_SdCxZFp(*%3DZudU%3Dhq!O*_(OiW15Y5W51i571a5WZySXG%3DaZU8_S%3DJgZUpx(%3DTOaZr8*R_FrU%3D(rGpKR4YgZr8*R*Yg%3DiwJJYigTJWTg5TT7JZr8*R*gT%3DaiwJ1YTaYYaiT7YW1iZr8*R*JT%3DY5w711iWg75551iYiWZr8*R*WT%3D5TwTJWT75gY7a17iJgZr8*R*Wg%3D57wT1WaT1YJY1g5Y5Zr8*R*iT%3D51wgTgY5TiY7iTa7aZr8*R*ig%3D7WwiTiiTW7Tg1g7W5Zr8*R*1T%3DJYw5WgJ1i11a1T1YgZr8*R*1g%3D1awWaaa5i57YiYgWYZr8*R*11%3DYgWw1J5a1WJgJYgaiZd(8%3DaZCFA%3DaZSxF%3D1WTuYgTZ(F(%3DTZ(F*%3DTZSXu%3DY7a&CSl=T&XXX=_!pF0)Nq49n%3D&dK=1WT&dCN)k=a&(UkNU=7JT&X8)=JgYa5&IUF*k=a&(vr=D7v4%2Fx7xuv&nvS*kr=a&8vUpXvdC=SAjOy~8GO~O3cy07YO__)UCg6!yYdmT0J4U5YI7Nc8zE63zRnIzpAx%3D%3D&I*G*=a&dFdU=g&vUl=NClrFSpk%20Pp8_F&FFX8kRlrk=g&*xdU=*aWW5YJaaigSYTY5aTYJa5Ti&FFGU=%7B%22FFd*%22%3A%22YJTT%3ATiT5%3ATvii%3ATTTT%3ATTTT%3ATTTT%3ATTTT%3ATTTT%22%2C%22FF88%22%3A%22Bc%22%2C%22FFF8%22%3A%220o%22%2C%22FF8SI%22%3A%22CrK%20Ipkn%22%7D&ySXGFk8=a&ure=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.55.204.22 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

nginx /

Resource Hash

e73b0e39caf1ee1030d6e405fb94e05f167352d7ab2d3fab4f4869a9947f218f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://contextual.media.net/sr/2722522032/SAFEFRAME.html?ule=2955&&kkdd=H*%7Ch%7CnuA9H3*&88=Bc&ld=aJ1i5YgJiT7Y5TJY7Y5&xU*k=T&XF*v=T&8Ul=aT11&SF8r=~Y1i&8dU=imBWeWWa9&8*8U=e84xpuD_Rf9DIaRROkkf8K%3D%3D&8kdU=151iTWg7i&FdAr=1WTuYgT&F8=.h&8yCX=3hjs60o&*dU=i.6j7E-W0&S*dU=Lfg7Jc1&ySS*F=a&kkk=SAjOy~8GO~1GAuqU!k6id~)(JoDNml4B&CFr=g&GK=a&_xU=7&vUSa=imBB1fPi3&vUSY=agg1YaYg7&(UvSv=FUY%3DC_GGZd_kGRG%3DaTZpxrk*X%3DTw5ZUpXR(%3DTwJ1Z(vS%3DT%2CT%2CTZF8U%3DCIZkvr%3DT%2CTZUpXRG%3DYTZlGYkRFU%3DYTY5aTYJTgZd_kGR(%3DJ5Jwg1Z_kGRSn8%3DTZ_kGRkYvR(%3DTZFSU%3D5gTTJaiJa5ZkvS%3DTwTTT%2CTZd*%3Da13N6vzmGX~.Fx4Kl1-DYxZ)((%3DTZkdd*_v%3DT%2CTZk8%3DaZk*FRFU%3DYTY5aTYJT7ZkvUl%3DTwTTT%2CTZ_kGR(%3Daw5gZlGYkR_kGR(%3DTZ_kGRG%3DaTZFGl%3DYJw7YZx8vS%3DgTTg5aZ((%3Da1JZrk*X%3DTw5ZlGYkR_kGRn8%3DT9TZ*FdR8%3DYWWg%2CY%2CT%2CT%2CT%2CT%2CT%2CTZ(X%3DaZ*FdRU%3D5agiJZknr%3DT%2CTZv5*R(%3DWw51%2CJ1wi7ZFU%3DTZ_dU%3DYNv2C)AqI2Y48WbPaBZ8lGYkR(%3D1w7iZ(SU%3DYY51ia55JTWWTg1ggJJJg5YT7gTg1YY5TT7i5aW55YYa5555JT1a775771iigTgYJg5TgYi1Y1Y5YYgigig75J5J5Y51JYig7Tgai7TZ_dX%3DTZknS%3DTwTTT%2CTZpxUY*R(%3DTw1iZFF%3D0hZ88%3DBcZn(RUG%3DC%2FvZ_dK%3DOaZ8r%3DTZk8l%3D75wgWZmN%3D5T5iZn(R_8%3DaZCSF%3DaZn(R_G%3DrCZn(R88nF%3DaZ8S%3DCrK%20IpknZ(FFRtL-%3D0h%2C0hZ(vFdFY%3Da1JZ(vFdFa%3Da1JZn(RSS%3DYZU8%3DiZlGYkR(%3DWw51ZSS%3DY1g5a7Z_GXR*%3DTwaZlKRru8%3DTwW7ZldFRFU%3DJY1Z_kGRk*FR(%3DaawiJZU8Y%3DaZlRvFC%3DWTaZGvFS%3DZ8lpx%3D1w7iZldFR_kGR(%3DTwgJZlGYkRdRFU%3DYTY5aTYJTgZldFR_kGRG%3DTZrS%3DYTZlGYkRdR(%3DTwT5ZldFR(%3DgiYwgaZlGYkR_kGRld%3Da9OaJZ_kGRSld%3DTZll%3DTZ8lGYkRFU%3DJY1Zk)l%3D75wgWZGYkR(%3DaTTTZkvU*%3DTwTTT%2CTZFdU%3D151iTWg7iZ_kGRk*FRn8%3DTZn(RFk8%3Dn((ZlK_%3DTwW7ZUY*RG%3DaTZ8lGY%3D1w7iZ5*8)%3DaTTTwWWZUXXRFSkx%3DyvkXpCIZUY*R(%3DTw1iZk*FR(%3DJ1wi7Z_kGRFk*FR(%3DaawigZknK*%3DTwTTT%2CTZknKU%3DTwTTT%2CTZdFjr)%3DTZdFd)%3DTZ_kGRk*8R(%3DTZ(dU%3DTw5Zn(R*S%3D3pXr*vxrZ_kGRk*FRkl%3DTZ8(U*%3DTwaTiZdSI*rRdU%3DaWZFrGGrkRSvxRdU%3D5gTTJaiJa5ZF_**GIRSvxRdU%3DZUrSr8SrURSvxRdU%3DZldrKv(dGdSI%3DTwW7Z*pF%3DaZv8RSI*r%3DaZvU(Gn%3D5gTTJaiJa5ZvX*%3DaZpx(dU%3DTw5TTZ()Gk%3DTwTaTZF_dU%3DZUS8%3DrvFSRF8ZUXXRrk*X%3D)vGFrZUXX%3DyvkXpCIZ(U*8v*U%3DTZUvGx%3D_CdFpCYJZFxXS%3DypXr*vxrRSr8yCpGpxIR8pX*_SdCxZFp(*%3DZudU%3Dhq!O*_(OiW15Y5W51i571a5WZySXG%3DaZU8_S%3DJgZUpx(%3DTOaZr8*R_FrU%3D(rGpKR4YgZr8*R*Yg%3DiwJJYigTJWTg5TT7JZr8*R*gT%3DaiwJ1YTaYYaiT7YW1iZr8*R*JT%3DY5w711iWg75551iYiWZr8*R*WT%3D5TwTJWT75gY7a17iJgZr8*R*Wg%3D57wT1WaT1YJY1g5Y5Zr8*R*iT%3D51wgTgY5TiY7iTa7aZr8*R*ig%3D7WwiTiiTW7Tg1g7W5Zr8*R*1T%3DJYw5WgJ1i11a1T1YgZr8*R*1g%3D1awWaaa5i57YiYgWYZr8*R*11%3DYgWw1J5a1WJgJYgaiZd(8%3DaZCFA%3DaZSxF%3D1WTuYgTZ(F(%3DTZ(F*%3DTZSXu%3DY7a&CSl=T&XXX=_!pF0)Nq49n%3D&dK=1WT&dCN)k=a&(UkNU=7JT&X8)=JgYa5&IUF*k=a&(vr=D7v4%2Fx7xuv&nvS*kr=a&8vUpXvdC=SAjOy~8GO~O3cy07YO__)UCg6!yYdmT0J4U5YI7Nc8zE63zRnIzpAx%3D%3D&I*G*=a&dFdU=g&vUl=NClrFSpk%20Pp8_F&FFX8kRlrk=g&*xdU=*aWW5YJaaigSYTY5aTYJa5Ti&FFGU=%7B%22FFd*%22%3A%22YJTT%3ATiT5%3ATvii%3ATTTT%3ATTTT%3ATTTT%3ATTTT%3ATTTT%22%2C%22FF88%22%3A%22Bc%22%2C%22FFF8%22%3A%220o%22%2C%22FF8SI%22%3A%22CrK%20Ipkn%22%7D&ySXGFk8=a&ure=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:01 GMT
strict-transport-security: max-age=31536000
last-modified: Thu, 12 Apr 2018 21:18:22 GMT
server: nginx
etag: "5acfcd1e-374e"
content-type: image/jpeg
accept-ranges: bytes
content-length: 14158

GET
DATA 200
OK truncated
/ Frame CA24 107 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: dfa1028a74436c56e0ee1367812c0ee599d6814ec4a3079ca9b9afffba949e26

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 fb06364d-f660-459e-a471-a6ce37959fdc.jpg
contextual.media.net/kimg/new/140x110/3/200/251/4/ Frame CA24 14 KB
14 KB 51ms
48ms Image
image/jpeg 23.55.204.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/kimg/new/140x110/3/200/251/4/fb06364d-f660-459e-a471-a6ce37959fdc.jpg?v=9

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.55.204.22 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

nginx /

Resource Hash

bb6e10680be624496eceaf96af4c252e40763db59eca2a89e91482f6021f287c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://contextual.media.net/sr/2722522032/SAFEFRAME.html?ule=2955&&kkdd=H*%7Ch%7CnuA9H3*&88=Bc&ld=aJ1i5YgJiT7Y5TJY7Y5&xU*k=T&XF*v=T&8Ul=aT11&SF8r=~Y1i&8dU=imBWeWWa9&8*8U=e84xpuD_Rf9DIaRROkkf8K%3D%3D&8kdU=151iTWg7i&FdAr=1WTuYgT&F8=.h&8yCX=3hjs60o&*dU=i.6j7E-W0&S*dU=Lfg7Jc1&ySS*F=a&kkk=SAjOy~8GO~1GAuqU!k6id~)(JoDNml4B&CFr=g&GK=a&_xU=7&vUSa=imBB1fPi3&vUSY=agg1YaYg7&(UvSv=FUY%3DC_GGZd_kGRG%3DaTZpxrk*X%3DTw5ZUpXR(%3DTwJ1Z(vS%3DT%2CT%2CTZF8U%3DCIZkvr%3DT%2CTZUpXRG%3DYTZlGYkRFU%3DYTY5aTYJTgZd_kGR(%3DJ5Jwg1Z_kGRSn8%3DTZ_kGRkYvR(%3DTZFSU%3D5gTTJaiJa5ZkvS%3DTwTTT%2CTZd*%3Da13N6vzmGX~.Fx4Kl1-DYxZ)((%3DTZkdd*_v%3DT%2CTZk8%3DaZk*FRFU%3DYTY5aTYJT7ZkvUl%3DTwTTT%2CTZ_kGR(%3Daw5gZlGYkR_kGR(%3DTZ_kGRG%3DaTZFGl%3DYJw7YZx8vS%3DgTTg5aZ((%3Da1JZrk*X%3DTw5ZlGYkR_kGRn8%3DT9TZ*FdR8%3DYWWg%2CY%2CT%2CT%2CT%2CT%2CT%2CTZ(X%3DaZ*FdRU%3D5agiJZknr%3DT%2CTZv5*R(%3DWw51%2CJ1wi7ZFU%3DTZ_dU%3DYNv2C)AqI2Y48WbPaBZ8lGYkR(%3D1w7iZ(SU%3DYY51ia55JTWWTg1ggJJJg5YT7gTg1YY5TT7i5aW55YYa5555JT1a775771iigTgYJg5TgYi1Y1Y5YYgigig75J5J5Y51JYig7Tgai7TZ_dX%3DTZknS%3DTwTTT%2CTZpxUY*R(%3DTw1iZFF%3D0hZ88%3DBcZn(RUG%3DC%2FvZ_dK%3DOaZ8r%3DTZk8l%3D75wgWZmN%3D5T5iZn(R_8%3DaZCSF%3DaZn(R_G%3DrCZn(R88nF%3DaZ8S%3DCrK%20IpknZ(FFRtL-%3D0h%2C0hZ(vFdFY%3Da1JZ(vFdFa%3Da1JZn(RSS%3DYZU8%3DiZlGYkR(%3DWw51ZSS%3DY1g5a7Z_GXR*%3DTwaZlKRru8%3DTwW7ZldFRFU%3DJY1Z_kGRk*FR(%3DaawiJZU8Y%3DaZlRvFC%3DWTaZGvFS%3DZ8lpx%3D1w7iZldFR_kGR(%3DTwgJZlGYkRdRFU%3DYTY5aTYJTgZldFR_kGRG%3DTZrS%3DYTZlGYkRdR(%3DTwT5ZldFR(%3DgiYwgaZlGYkR_kGRld%3Da9OaJZ_kGRSld%3DTZll%3DTZ8lGYkRFU%3DJY1Zk)l%3D75wgWZGYkR(%3DaTTTZkvU*%3DTwTTT%2CTZFdU%3D151iTWg7iZ_kGRk*FRn8%3DTZn(RFk8%3Dn((ZlK_%3DTwW7ZUY*RG%3DaTZ8lGY%3D1w7iZ5*8)%3DaTTTwWWZUXXRFSkx%3DyvkXpCIZUY*R(%3DTw1iZk*FR(%3DJ1wi7Z_kGRFk*FR(%3DaawigZknK*%3DTwTTT%2CTZknKU%3DTwTTT%2CTZdFjr)%3DTZdFd)%3DTZ_kGRk*8R(%3DTZ(dU%3DTw5Zn(R*S%3D3pXr*vxrZ_kGRk*FRkl%3DTZ8(U*%3DTwaTiZdSI*rRdU%3DaWZFrGGrkRSvxRdU%3D5gTTJaiJa5ZF_**GIRSvxRdU%3DZUrSr8SrURSvxRdU%3DZldrKv(dGdSI%3DTwW7Z*pF%3DaZv8RSI*r%3DaZvU(Gn%3D5gTTJaiJa5ZvX*%3DaZpx(dU%3DTw5TTZ()Gk%3DTwTaTZF_dU%3DZUS8%3DrvFSRF8ZUXXRrk*X%3D)vGFrZUXX%3DyvkXpCIZ(U*8v*U%3DTZUvGx%3D_CdFpCYJZFxXS%3DypXr*vxrRSr8yCpGpxIR8pX*_SdCxZFp(*%3DZudU%3Dhq!O*_(OiW15Y5W51i571a5WZySXG%3DaZU8_S%3DJgZUpx(%3DTOaZr8*R_FrU%3D(rGpKR4YgZr8*R*Yg%3DiwJJYigTJWTg5TT7JZr8*R*gT%3DaiwJ1YTaYYaiT7YW1iZr8*R*JT%3DY5w711iWg75551iYiWZr8*R*WT%3D5TwTJWT75gY7a17iJgZr8*R*Wg%3D57wT1WaT1YJY1g5Y5Zr8*R*iT%3D51wgTgY5TiY7iTa7aZr8*R*ig%3D7WwiTiiTW7Tg1g7W5Zr8*R*1T%3DJYw5WgJ1i11a1T1YgZr8*R*1g%3D1awWaaa5i57YiYgWYZr8*R*11%3DYgWw1J5a1WJgJYgaiZd(8%3DaZCFA%3DaZSxF%3D1WTuYgTZ(F(%3DTZ(F*%3DTZSXu%3DY7a&CSl=T&XXX=_!pF0)Nq49n%3D&dK=1WT&dCN)k=a&(UkNU=7JT&X8)=JgYa5&IUF*k=a&(vr=D7v4%2Fx7xuv&nvS*kr=a&8vUpXvdC=SAjOy~8GO~O3cy07YO__)UCg6!yYdmT0J4U5YI7Nc8zE63zRnIzpAx%3D%3D&I*G*=a&dFdU=g&vUl=NClrFSpk%20Pp8_F&FFX8kRlrk=g&*xdU=*aWW5YJaaigSYTY5aTYJa5Ti&FFGU=%7B%22FFd*%22%3A%22YJTT%3ATiT5%3ATvii%3ATTTT%3ATTTT%3ATTTT%3ATTTT%3ATTTT%22%2C%22FF88%22%3A%22Bc%22%2C%22FFF8%22%3A%220o%22%2C%22FF8SI%22%3A%22CrK%20Ipkn%22%7D&ySXGFk8=a&ure=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:01 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 13 Apr 2018 07:17:40 GMT
server: nginx
etag: "5ad05994-3856"
content-type: image/jpeg
accept-ranges: bytes
content-length: 14422

GET
H2 200 f9e99992-9bce-4118-8f2f-2fe4457edc61.jpg
contextual.media.net/kimg/new/140x110/2/200/12/49/ Frame CA24 12 KB
12 KB 71ms
69ms Image
image/jpeg 23.55.204.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/kimg/new/140x110/2/200/12/49/f9e99992-9bce-4118-8f2f-2fe4457edc61.jpg?v=9

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.55.204.22 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

nginx /

Resource Hash

b6283c9d0e5d509f81f3d03f86ddbf5a467f838418ab23b357c61f6a081198bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://contextual.media.net/sr/2722522032/SAFEFRAME.html?ule=2955&&kkdd=H*%7Ch%7CnuA9H3*&88=Bc&ld=aJ1i5YgJiT7Y5TJY7Y5&xU*k=T&XF*v=T&8Ul=aT11&SF8r=~Y1i&8dU=imBWeWWa9&8*8U=e84xpuD_Rf9DIaRROkkf8K%3D%3D&8kdU=151iTWg7i&FdAr=1WTuYgT&F8=.h&8yCX=3hjs60o&*dU=i.6j7E-W0&S*dU=Lfg7Jc1&ySS*F=a&kkk=SAjOy~8GO~1GAuqU!k6id~)(JoDNml4B&CFr=g&GK=a&_xU=7&vUSa=imBB1fPi3&vUSY=agg1YaYg7&(UvSv=FUY%3DC_GGZd_kGRG%3DaTZpxrk*X%3DTw5ZUpXR(%3DTwJ1Z(vS%3DT%2CT%2CTZF8U%3DCIZkvr%3DT%2CTZUpXRG%3DYTZlGYkRFU%3DYTY5aTYJTgZd_kGR(%3DJ5Jwg1Z_kGRSn8%3DTZ_kGRkYvR(%3DTZFSU%3D5gTTJaiJa5ZkvS%3DTwTTT%2CTZd*%3Da13N6vzmGX~.Fx4Kl1-DYxZ)((%3DTZkdd*_v%3DT%2CTZk8%3DaZk*FRFU%3DYTY5aTYJT7ZkvUl%3DTwTTT%2CTZ_kGR(%3Daw5gZlGYkR_kGR(%3DTZ_kGRG%3DaTZFGl%3DYJw7YZx8vS%3DgTTg5aZ((%3Da1JZrk*X%3DTw5ZlGYkR_kGRn8%3DT9TZ*FdR8%3DYWWg%2CY%2CT%2CT%2CT%2CT%2CT%2CTZ(X%3DaZ*FdRU%3D5agiJZknr%3DT%2CTZv5*R(%3DWw51%2CJ1wi7ZFU%3DTZ_dU%3DYNv2C)AqI2Y48WbPaBZ8lGYkR(%3D1w7iZ(SU%3DYY51ia55JTWWTg1ggJJJg5YT7gTg1YY5TT7i5aW55YYa5555JT1a775771iigTgYJg5TgYi1Y1Y5YYgigig75J5J5Y51JYig7Tgai7TZ_dX%3DTZknS%3DTwTTT%2CTZpxUY*R(%3DTw1iZFF%3D0hZ88%3DBcZn(RUG%3DC%2FvZ_dK%3DOaZ8r%3DTZk8l%3D75wgWZmN%3D5T5iZn(R_8%3DaZCSF%3DaZn(R_G%3DrCZn(R88nF%3DaZ8S%3DCrK%20IpknZ(FFRtL-%3D0h%2C0hZ(vFdFY%3Da1JZ(vFdFa%3Da1JZn(RSS%3DYZU8%3DiZlGYkR(%3DWw51ZSS%3DY1g5a7Z_GXR*%3DTwaZlKRru8%3DTwW7ZldFRFU%3DJY1Z_kGRk*FR(%3DaawiJZU8Y%3DaZlRvFC%3DWTaZGvFS%3DZ8lpx%3D1w7iZldFR_kGR(%3DTwgJZlGYkRdRFU%3DYTY5aTYJTgZldFR_kGRG%3DTZrS%3DYTZlGYkRdR(%3DTwT5ZldFR(%3DgiYwgaZlGYkR_kGRld%3Da9OaJZ_kGRSld%3DTZll%3DTZ8lGYkRFU%3DJY1Zk)l%3D75wgWZGYkR(%3DaTTTZkvU*%3DTwTTT%2CTZFdU%3D151iTWg7iZ_kGRk*FRn8%3DTZn(RFk8%3Dn((ZlK_%3DTwW7ZUY*RG%3DaTZ8lGY%3D1w7iZ5*8)%3DaTTTwWWZUXXRFSkx%3DyvkXpCIZUY*R(%3DTw1iZk*FR(%3DJ1wi7Z_kGRFk*FR(%3DaawigZknK*%3DTwTTT%2CTZknKU%3DTwTTT%2CTZdFjr)%3DTZdFd)%3DTZ_kGRk*8R(%3DTZ(dU%3DTw5Zn(R*S%3D3pXr*vxrZ_kGRk*FRkl%3DTZ8(U*%3DTwaTiZdSI*rRdU%3DaWZFrGGrkRSvxRdU%3D5gTTJaiJa5ZF_**GIRSvxRdU%3DZUrSr8SrURSvxRdU%3DZldrKv(dGdSI%3DTwW7Z*pF%3DaZv8RSI*r%3DaZvU(Gn%3D5gTTJaiJa5ZvX*%3DaZpx(dU%3DTw5TTZ()Gk%3DTwTaTZF_dU%3DZUS8%3DrvFSRF8ZUXXRrk*X%3D)vGFrZUXX%3DyvkXpCIZ(U*8v*U%3DTZUvGx%3D_CdFpCYJZFxXS%3DypXr*vxrRSr8yCpGpxIR8pX*_SdCxZFp(*%3DZudU%3Dhq!O*_(OiW15Y5W51i571a5WZySXG%3DaZU8_S%3DJgZUpx(%3DTOaZr8*R_FrU%3D(rGpKR4YgZr8*R*Yg%3DiwJJYigTJWTg5TT7JZr8*R*gT%3DaiwJ1YTaYYaiT7YW1iZr8*R*JT%3DY5w711iWg75551iYiWZr8*R*WT%3D5TwTJWT75gY7a17iJgZr8*R*Wg%3D57wT1WaT1YJY1g5Y5Zr8*R*iT%3D51wgTgY5TiY7iTa7aZr8*R*ig%3D7WwiTiiTW7Tg1g7W5Zr8*R*1T%3DJYw5WgJ1i11a1T1YgZr8*R*1g%3D1awWaaa5i57YiYgWYZr8*R*11%3DYgWw1J5a1WJgJYgaiZd(8%3DaZCFA%3DaZSxF%3D1WTuYgTZ(F(%3DTZ(F*%3DTZSXu%3DY7a&CSl=T&XXX=_!pF0)Nq49n%3D&dK=1WT&dCN)k=a&(UkNU=7JT&X8)=JgYa5&IUF*k=a&(vr=D7v4%2Fx7xuv&nvS*kr=a&8vUpXvdC=SAjOy~8GO~O3cy07YO__)UCg6!yYdmT0J4U5YI7Nc8zE63zRnIzpAx%3D%3D&I*G*=a&dFdU=g&vUl=NClrFSpk%20Pp8_F&FFX8kRlrk=g&*xdU=*aWW5YJaaigSYTY5aTYJa5Ti&FFGU=%7B%22FFd*%22%3A%22YJTT%3ATiT5%3ATvii%3ATTTT%3ATTTT%3ATTTT%3ATTTT%3ATTTT%22%2C%22FF88%22%3A%22Bc%22%2C%22FFF8%22%3A%220o%22%2C%22FF8SI%22%3A%22CrK%20Ipkn%22%7D&ySXGFk8=a&ure=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:01 GMT
strict-transport-security: max-age=31536000
last-modified: Tue, 21 Sep 2021 11:18:16 GMT
server: nginx
etag: "6149bf78-30ce"
content-type: image/jpeg
accept-ranges: bytes
content-length: 12494

GET
H2 200 cf8e399c-5ff3-4931-b77b-c97971c661cc.jpg
contextual.media.net/kimg/new/140x110/2/252/82/207/ Frame CA24 11 KB
11 KB 73ms
71ms Image
image/jpeg 23.55.204.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/kimg/new/140x110/2/252/82/207/cf8e399c-5ff3-4931-b77b-c97971c661cc.jpg?v=9

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.55.204.22 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

nginx /

Resource Hash

80491170d0cecdfbf68db1499321c666734ae37af7c62dcfa2f7d19533a7919e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://contextual.media.net/sr/2722522032/SAFEFRAME.html?ule=2955&&kkdd=H*%7Ch%7CnuA9H3*&88=Bc&ld=aJ1i5YgJiT7Y5TJY7Y5&xU*k=T&XF*v=T&8Ul=aT11&SF8r=~Y1i&8dU=imBWeWWa9&8*8U=e84xpuD_Rf9DIaRROkkf8K%3D%3D&8kdU=151iTWg7i&FdAr=1WTuYgT&F8=.h&8yCX=3hjs60o&*dU=i.6j7E-W0&S*dU=Lfg7Jc1&ySS*F=a&kkk=SAjOy~8GO~1GAuqU!k6id~)(JoDNml4B&CFr=g&GK=a&_xU=7&vUSa=imBB1fPi3&vUSY=agg1YaYg7&(UvSv=FUY%3DC_GGZd_kGRG%3DaTZpxrk*X%3DTw5ZUpXR(%3DTwJ1Z(vS%3DT%2CT%2CTZF8U%3DCIZkvr%3DT%2CTZUpXRG%3DYTZlGYkRFU%3DYTY5aTYJTgZd_kGR(%3DJ5Jwg1Z_kGRSn8%3DTZ_kGRkYvR(%3DTZFSU%3D5gTTJaiJa5ZkvS%3DTwTTT%2CTZd*%3Da13N6vzmGX~.Fx4Kl1-DYxZ)((%3DTZkdd*_v%3DT%2CTZk8%3DaZk*FRFU%3DYTY5aTYJT7ZkvUl%3DTwTTT%2CTZ_kGR(%3Daw5gZlGYkR_kGR(%3DTZ_kGRG%3DaTZFGl%3DYJw7YZx8vS%3DgTTg5aZ((%3Da1JZrk*X%3DTw5ZlGYkR_kGRn8%3DT9TZ*FdR8%3DYWWg%2CY%2CT%2CT%2CT%2CT%2CT%2CTZ(X%3DaZ*FdRU%3D5agiJZknr%3DT%2CTZv5*R(%3DWw51%2CJ1wi7ZFU%3DTZ_dU%3DYNv2C)AqI2Y48WbPaBZ8lGYkR(%3D1w7iZ(SU%3DYY51ia55JTWWTg1ggJJJg5YT7gTg1YY5TT7i5aW55YYa5555JT1a775771iigTgYJg5TgYi1Y1Y5YYgigig75J5J5Y51JYig7Tgai7TZ_dX%3DTZknS%3DTwTTT%2CTZpxUY*R(%3DTw1iZFF%3D0hZ88%3DBcZn(RUG%3DC%2FvZ_dK%3DOaZ8r%3DTZk8l%3D75wgWZmN%3D5T5iZn(R_8%3DaZCSF%3DaZn(R_G%3DrCZn(R88nF%3DaZ8S%3DCrK%20IpknZ(FFRtL-%3D0h%2C0hZ(vFdFY%3Da1JZ(vFdFa%3Da1JZn(RSS%3DYZU8%3DiZlGYkR(%3DWw51ZSS%3DY1g5a7Z_GXR*%3DTwaZlKRru8%3DTwW7ZldFRFU%3DJY1Z_kGRk*FR(%3DaawiJZU8Y%3DaZlRvFC%3DWTaZGvFS%3DZ8lpx%3D1w7iZldFR_kGR(%3DTwgJZlGYkRdRFU%3DYTY5aTYJTgZldFR_kGRG%3DTZrS%3DYTZlGYkRdR(%3DTwT5ZldFR(%3DgiYwgaZlGYkR_kGRld%3Da9OaJZ_kGRSld%3DTZll%3DTZ8lGYkRFU%3DJY1Zk)l%3D75wgWZGYkR(%3DaTTTZkvU*%3DTwTTT%2CTZFdU%3D151iTWg7iZ_kGRk*FRn8%3DTZn(RFk8%3Dn((ZlK_%3DTwW7ZUY*RG%3DaTZ8lGY%3D1w7iZ5*8)%3DaTTTwWWZUXXRFSkx%3DyvkXpCIZUY*R(%3DTw1iZk*FR(%3DJ1wi7Z_kGRFk*FR(%3DaawigZknK*%3DTwTTT%2CTZknKU%3DTwTTT%2CTZdFjr)%3DTZdFd)%3DTZ_kGRk*8R(%3DTZ(dU%3DTw5Zn(R*S%3D3pXr*vxrZ_kGRk*FRkl%3DTZ8(U*%3DTwaTiZdSI*rRdU%3DaWZFrGGrkRSvxRdU%3D5gTTJaiJa5ZF_**GIRSvxRdU%3DZUrSr8SrURSvxRdU%3DZldrKv(dGdSI%3DTwW7Z*pF%3DaZv8RSI*r%3DaZvU(Gn%3D5gTTJaiJa5ZvX*%3DaZpx(dU%3DTw5TTZ()Gk%3DTwTaTZF_dU%3DZUS8%3DrvFSRF8ZUXXRrk*X%3D)vGFrZUXX%3DyvkXpCIZ(U*8v*U%3DTZUvGx%3D_CdFpCYJZFxXS%3DypXr*vxrRSr8yCpGpxIR8pX*_SdCxZFp(*%3DZudU%3Dhq!O*_(OiW15Y5W51i571a5WZySXG%3DaZU8_S%3DJgZUpx(%3DTOaZr8*R_FrU%3D(rGpKR4YgZr8*R*Yg%3DiwJJYigTJWTg5TT7JZr8*R*gT%3DaiwJ1YTaYYaiT7YW1iZr8*R*JT%3DY5w711iWg75551iYiWZr8*R*WT%3D5TwTJWT75gY7a17iJgZr8*R*Wg%3D57wT1WaT1YJY1g5Y5Zr8*R*iT%3D51wgTgY5TiY7iTa7aZr8*R*ig%3D7WwiTiiTW7Tg1g7W5Zr8*R*1T%3DJYw5WgJ1i11a1T1YgZr8*R*1g%3D1awWaaa5i57YiYgWYZr8*R*11%3DYgWw1J5a1WJgJYgaiZd(8%3DaZCFA%3DaZSxF%3D1WTuYgTZ(F(%3DTZ(F*%3DTZSXu%3DY7a&CSl=T&XXX=_!pF0)Nq49n%3D&dK=1WT&dCN)k=a&(UkNU=7JT&X8)=JgYa5&IUF*k=a&(vr=D7v4%2Fx7xuv&nvS*kr=a&8vUpXvdC=SAjOy~8GO~O3cy07YO__)UCg6!yYdmT0J4U5YI7Nc8zE63zRnIzpAx%3D%3D&I*G*=a&dFdU=g&vUl=NClrFSpk%20Pp8_F&FFX8kRlrk=g&*xdU=*aWW5YJaaigSYTY5aTYJa5Ti&FFGU=%7B%22FFd*%22%3A%22YJTT%3ATiT5%3ATvii%3ATTTT%3ATTTT%3ATTTT%3ATTTT%3ATTTT%22%2C%22FF88%22%3A%22Bc%22%2C%22FFF8%22%3A%220o%22%2C%22FF8SI%22%3A%22CrK%20Ipkn%22%7D&ySXGFk8=a&ure=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:01 GMT
strict-transport-security: max-age=31536000
last-modified: Thu, 22 Mar 2018 09:01:34 GMT
server: nginx
etag: "5ab370ee-2a1d"
content-type: image/jpeg
accept-ranges: bytes
content-length: 10781

GET
H2 200 c1a3699c-9431-4055-b730-c9ff5c494f89.jpg
contextual.media.net/kimg/new/140x110/3/230/20/220/ Frame CA24 13 KB
13 KB 70ms
68ms Image
image/jpeg 23.55.204.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/kimg/new/140x110/3/230/20/220/c1a3699c-9431-4055-b730-c9ff5c494f89.jpg?v=9

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.55.204.22 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

nginx /

Resource Hash

64067897e7a222b1e227cf98d2ef84cc951172fbf412b457443792a7d9bad7ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://contextual.media.net/sr/2722522032/SAFEFRAME.html?ule=2955&&kkdd=H*%7Ch%7CnuA9H3*&88=Bc&ld=aJ1i5YgJiT7Y5TJY7Y5&xU*k=T&XF*v=T&8Ul=aT11&SF8r=~Y1i&8dU=imBWeWWa9&8*8U=e84xpuD_Rf9DIaRROkkf8K%3D%3D&8kdU=151iTWg7i&FdAr=1WTuYgT&F8=.h&8yCX=3hjs60o&*dU=i.6j7E-W0&S*dU=Lfg7Jc1&ySS*F=a&kkk=SAjOy~8GO~1GAuqU!k6id~)(JoDNml4B&CFr=g&GK=a&_xU=7&vUSa=imBB1fPi3&vUSY=agg1YaYg7&(UvSv=FUY%3DC_GGZd_kGRG%3DaTZpxrk*X%3DTw5ZUpXR(%3DTwJ1Z(vS%3DT%2CT%2CTZF8U%3DCIZkvr%3DT%2CTZUpXRG%3DYTZlGYkRFU%3DYTY5aTYJTgZd_kGR(%3DJ5Jwg1Z_kGRSn8%3DTZ_kGRkYvR(%3DTZFSU%3D5gTTJaiJa5ZkvS%3DTwTTT%2CTZd*%3Da13N6vzmGX~.Fx4Kl1-DYxZ)((%3DTZkdd*_v%3DT%2CTZk8%3DaZk*FRFU%3DYTY5aTYJT7ZkvUl%3DTwTTT%2CTZ_kGR(%3Daw5gZlGYkR_kGR(%3DTZ_kGRG%3DaTZFGl%3DYJw7YZx8vS%3DgTTg5aZ((%3Da1JZrk*X%3DTw5ZlGYkR_kGRn8%3DT9TZ*FdR8%3DYWWg%2CY%2CT%2CT%2CT%2CT%2CT%2CTZ(X%3DaZ*FdRU%3D5agiJZknr%3DT%2CTZv5*R(%3DWw51%2CJ1wi7ZFU%3DTZ_dU%3DYNv2C)AqI2Y48WbPaBZ8lGYkR(%3D1w7iZ(SU%3DYY51ia55JTWWTg1ggJJJg5YT7gTg1YY5TT7i5aW55YYa5555JT1a775771iigTgYJg5TgYi1Y1Y5YYgigig75J5J5Y51JYig7Tgai7TZ_dX%3DTZknS%3DTwTTT%2CTZpxUY*R(%3DTw1iZFF%3D0hZ88%3DBcZn(RUG%3DC%2FvZ_dK%3DOaZ8r%3DTZk8l%3D75wgWZmN%3D5T5iZn(R_8%3DaZCSF%3DaZn(R_G%3DrCZn(R88nF%3DaZ8S%3DCrK%20IpknZ(FFRtL-%3D0h%2C0hZ(vFdFY%3Da1JZ(vFdFa%3Da1JZn(RSS%3DYZU8%3DiZlGYkR(%3DWw51ZSS%3DY1g5a7Z_GXR*%3DTwaZlKRru8%3DTwW7ZldFRFU%3DJY1Z_kGRk*FR(%3DaawiJZU8Y%3DaZlRvFC%3DWTaZGvFS%3DZ8lpx%3D1w7iZldFR_kGR(%3DTwgJZlGYkRdRFU%3DYTY5aTYJTgZldFR_kGRG%3DTZrS%3DYTZlGYkRdR(%3DTwT5ZldFR(%3DgiYwgaZlGYkR_kGRld%3Da9OaJZ_kGRSld%3DTZll%3DTZ8lGYkRFU%3DJY1Zk)l%3D75wgWZGYkR(%3DaTTTZkvU*%3DTwTTT%2CTZFdU%3D151iTWg7iZ_kGRk*FRn8%3DTZn(RFk8%3Dn((ZlK_%3DTwW7ZUY*RG%3DaTZ8lGY%3D1w7iZ5*8)%3DaTTTwWWZUXXRFSkx%3DyvkXpCIZUY*R(%3DTw1iZk*FR(%3DJ1wi7Z_kGRFk*FR(%3DaawigZknK*%3DTwTTT%2CTZknKU%3DTwTTT%2CTZdFjr)%3DTZdFd)%3DTZ_kGRk*8R(%3DTZ(dU%3DTw5Zn(R*S%3D3pXr*vxrZ_kGRk*FRkl%3DTZ8(U*%3DTwaTiZdSI*rRdU%3DaWZFrGGrkRSvxRdU%3D5gTTJaiJa5ZF_**GIRSvxRdU%3DZUrSr8SrURSvxRdU%3DZldrKv(dGdSI%3DTwW7Z*pF%3DaZv8RSI*r%3DaZvU(Gn%3D5gTTJaiJa5ZvX*%3DaZpx(dU%3DTw5TTZ()Gk%3DTwTaTZF_dU%3DZUS8%3DrvFSRF8ZUXXRrk*X%3D)vGFrZUXX%3DyvkXpCIZ(U*8v*U%3DTZUvGx%3D_CdFpCYJZFxXS%3DypXr*vxrRSr8yCpGpxIR8pX*_SdCxZFp(*%3DZudU%3Dhq!O*_(OiW15Y5W51i571a5WZySXG%3DaZU8_S%3DJgZUpx(%3DTOaZr8*R_FrU%3D(rGpKR4YgZr8*R*Yg%3DiwJJYigTJWTg5TT7JZr8*R*gT%3DaiwJ1YTaYYaiT7YW1iZr8*R*JT%3DY5w711iWg75551iYiWZr8*R*WT%3D5TwTJWT75gY7a17iJgZr8*R*Wg%3D57wT1WaT1YJY1g5Y5Zr8*R*iT%3D51wgTgY5TiY7iTa7aZr8*R*ig%3D7WwiTiiTW7Tg1g7W5Zr8*R*1T%3DJYw5WgJ1i11a1T1YgZr8*R*1g%3D1awWaaa5i57YiYgWYZr8*R*11%3DYgWw1J5a1WJgJYgaiZd(8%3DaZCFA%3DaZSxF%3D1WTuYgTZ(F(%3DTZ(F*%3DTZSXu%3DY7a&CSl=T&XXX=_!pF0)Nq49n%3D&dK=1WT&dCN)k=a&(UkNU=7JT&X8)=JgYa5&IUF*k=a&(vr=D7v4%2Fx7xuv&nvS*kr=a&8vUpXvdC=SAjOy~8GO~O3cy07YO__)UCg6!yYdmT0J4U5YI7Nc8zE63zRnIzpAx%3D%3D&I*G*=a&dFdU=g&vUl=NClrFSpk%20Pp8_F&FFX8kRlrk=g&*xdU=*aWW5YJaaigSYTY5aTYJa5Ti&FFGU=%7B%22FFd*%22%3A%22YJTT%3ATiT5%3ATvii%3ATTTT%3ATTTT%3ATTTT%3ATTTT%3ATTTT%22%2C%22FF88%22%3A%22Bc%22%2C%22FFF8%22%3A%220o%22%2C%22FF8SI%22%3A%22CrK%20Ipkn%22%7D&ySXGFk8=a&ure=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:01 GMT
strict-transport-security: max-age=31536000
last-modified: Sat, 31 Mar 2018 13:24:06 GMT
server: nginx
etag: "5abf8bf6-349b"
content-type: image/jpeg
accept-ranges: bytes
content-length: 13467

GET
H2 200 e9686e59-50b7-4c47-b8d7-db2dab32b21c.jpg
contextual.media.net/kimg/new/140x110/3/21/61/161/ Frame CA24 16 KB
17 KB 72ms
70ms Image
image/jpeg 23.55.204.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/kimg/new/140x110/3/21/61/161/e9686e59-50b7-4c47-b8d7-db2dab32b21c.jpg?v=9

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.55.204.22 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

nginx /

Resource Hash

7cebeb415bdace67c64a9fa97079106e6e3582f4506a509b2ed7388f43c2985d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://contextual.media.net/sr/2722522032/SAFEFRAME.html?ule=2955&&kkdd=H*%7Ch%7CnuA9H3*&88=Bc&ld=aJ1i5YgJiT7Y5TJY7Y5&xU*k=T&XF*v=T&8Ul=aT11&SF8r=~Y1i&8dU=imBWeWWa9&8*8U=e84xpuD_Rf9DIaRROkkf8K%3D%3D&8kdU=151iTWg7i&FdAr=1WTuYgT&F8=.h&8yCX=3hjs60o&*dU=i.6j7E-W0&S*dU=Lfg7Jc1&ySS*F=a&kkk=SAjOy~8GO~1GAuqU!k6id~)(JoDNml4B&CFr=g&GK=a&_xU=7&vUSa=imBB1fPi3&vUSY=agg1YaYg7&(UvSv=FUY%3DC_GGZd_kGRG%3DaTZpxrk*X%3DTw5ZUpXR(%3DTwJ1Z(vS%3DT%2CT%2CTZF8U%3DCIZkvr%3DT%2CTZUpXRG%3DYTZlGYkRFU%3DYTY5aTYJTgZd_kGR(%3DJ5Jwg1Z_kGRSn8%3DTZ_kGRkYvR(%3DTZFSU%3D5gTTJaiJa5ZkvS%3DTwTTT%2CTZd*%3Da13N6vzmGX~.Fx4Kl1-DYxZ)((%3DTZkdd*_v%3DT%2CTZk8%3DaZk*FRFU%3DYTY5aTYJT7ZkvUl%3DTwTTT%2CTZ_kGR(%3Daw5gZlGYkR_kGR(%3DTZ_kGRG%3DaTZFGl%3DYJw7YZx8vS%3DgTTg5aZ((%3Da1JZrk*X%3DTw5ZlGYkR_kGRn8%3DT9TZ*FdR8%3DYWWg%2CY%2CT%2CT%2CT%2CT%2CT%2CTZ(X%3DaZ*FdRU%3D5agiJZknr%3DT%2CTZv5*R(%3DWw51%2CJ1wi7ZFU%3DTZ_dU%3DYNv2C)AqI2Y48WbPaBZ8lGYkR(%3D1w7iZ(SU%3DYY51ia55JTWWTg1ggJJJg5YT7gTg1YY5TT7i5aW55YYa5555JT1a775771iigTgYJg5TgYi1Y1Y5YYgigig75J5J5Y51JYig7Tgai7TZ_dX%3DTZknS%3DTwTTT%2CTZpxUY*R(%3DTw1iZFF%3D0hZ88%3DBcZn(RUG%3DC%2FvZ_dK%3DOaZ8r%3DTZk8l%3D75wgWZmN%3D5T5iZn(R_8%3DaZCSF%3DaZn(R_G%3DrCZn(R88nF%3DaZ8S%3DCrK%20IpknZ(FFRtL-%3D0h%2C0hZ(vFdFY%3Da1JZ(vFdFa%3Da1JZn(RSS%3DYZU8%3DiZlGYkR(%3DWw51ZSS%3DY1g5a7Z_GXR*%3DTwaZlKRru8%3DTwW7ZldFRFU%3DJY1Z_kGRk*FR(%3DaawiJZU8Y%3DaZlRvFC%3DWTaZGvFS%3DZ8lpx%3D1w7iZldFR_kGR(%3DTwgJZlGYkRdRFU%3DYTY5aTYJTgZldFR_kGRG%3DTZrS%3DYTZlGYkRdR(%3DTwT5ZldFR(%3DgiYwgaZlGYkR_kGRld%3Da9OaJZ_kGRSld%3DTZll%3DTZ8lGYkRFU%3DJY1Zk)l%3D75wgWZGYkR(%3DaTTTZkvU*%3DTwTTT%2CTZFdU%3D151iTWg7iZ_kGRk*FRn8%3DTZn(RFk8%3Dn((ZlK_%3DTwW7ZUY*RG%3DaTZ8lGY%3D1w7iZ5*8)%3DaTTTwWWZUXXRFSkx%3DyvkXpCIZUY*R(%3DTw1iZk*FR(%3DJ1wi7Z_kGRFk*FR(%3DaawigZknK*%3DTwTTT%2CTZknKU%3DTwTTT%2CTZdFjr)%3DTZdFd)%3DTZ_kGRk*8R(%3DTZ(dU%3DTw5Zn(R*S%3D3pXr*vxrZ_kGRk*FRkl%3DTZ8(U*%3DTwaTiZdSI*rRdU%3DaWZFrGGrkRSvxRdU%3D5gTTJaiJa5ZF_**GIRSvxRdU%3DZUrSr8SrURSvxRdU%3DZldrKv(dGdSI%3DTwW7Z*pF%3DaZv8RSI*r%3DaZvU(Gn%3D5gTTJaiJa5ZvX*%3DaZpx(dU%3DTw5TTZ()Gk%3DTwTaTZF_dU%3DZUS8%3DrvFSRF8ZUXXRrk*X%3D)vGFrZUXX%3DyvkXpCIZ(U*8v*U%3DTZUvGx%3D_CdFpCYJZFxXS%3DypXr*vxrRSr8yCpGpxIR8pX*_SdCxZFp(*%3DZudU%3Dhq!O*_(OiW15Y5W51i571a5WZySXG%3DaZU8_S%3DJgZUpx(%3DTOaZr8*R_FrU%3D(rGpKR4YgZr8*R*Yg%3DiwJJYigTJWTg5TT7JZr8*R*gT%3DaiwJ1YTaYYaiT7YW1iZr8*R*JT%3DY5w711iWg75551iYiWZr8*R*WT%3D5TwTJWT75gY7a17iJgZr8*R*Wg%3D57wT1WaT1YJY1g5Y5Zr8*R*iT%3D51wgTgY5TiY7iTa7aZr8*R*ig%3D7WwiTiiTW7Tg1g7W5Zr8*R*1T%3DJYw5WgJ1i11a1T1YgZr8*R*1g%3D1awWaaa5i57YiYgWYZr8*R*11%3DYgWw1J5a1WJgJYgaiZd(8%3DaZCFA%3DaZSxF%3D1WTuYgTZ(F(%3DTZ(F*%3DTZSXu%3DY7a&CSl=T&XXX=_!pF0)Nq49n%3D&dK=1WT&dCN)k=a&(UkNU=7JT&X8)=JgYa5&IUF*k=a&(vr=D7v4%2Fx7xuv&nvS*kr=a&8vUpXvdC=SAjOy~8GO~O3cy07YO__)UCg6!yYdmT0J4U5YI7Nc8zE63zRnIzpAx%3D%3D&I*G*=a&dFdU=g&vUl=NClrFSpk%20Pp8_F&FFX8kRlrk=g&*xdU=*aWW5YJaaigSYTY5aTYJa5Ti&FFGU=%7B%22FFd*%22%3A%22YJTT%3ATiT5%3ATvii%3ATTTT%3ATTTT%3ATTTT%3ATTTT%3ATTTT%22%2C%22FF88%22%3A%22Bc%22%2C%22FFF8%22%3A%220o%22%2C%22FF8SI%22%3A%22CrK%20Ipkn%22%7D&ySXGFk8=a&ure=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:01 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 23 Mar 2018 07:38:53 GMT
server: nginx
etag: "5ab4af0d-41a3"
content-type: image/jpeg
accept-ranges: bytes
content-length: 16803

GET
H2 200 4fba0550-bb51-442c-bf16-5bca30f7efad.jpg
contextual.media.net/kimg/new/140x110/2/143/215/87/ Frame CA24 13 KB
13 KB 87ms
85ms Image
image/jpeg 23.55.204.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/kimg/new/140x110/2/143/215/87/4fba0550-bb51-442c-bf16-5bca30f7efad.jpg?v=9

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.55.204.22 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

nginx /

Resource Hash

0f04a5d804840c346fcaae94c445412ed431353fa32a52e899f19d838f234885

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://contextual.media.net/sr/2722522032/SAFEFRAME.html?ule=2955&&kkdd=H*%7Ch%7CnuA9H3*&88=Bc&ld=aJ1i5YgJiT7Y5TJY7Y5&xU*k=T&XF*v=T&8Ul=aT11&SF8r=~Y1i&8dU=imBWeWWa9&8*8U=e84xpuD_Rf9DIaRROkkf8K%3D%3D&8kdU=151iTWg7i&FdAr=1WTuYgT&F8=.h&8yCX=3hjs60o&*dU=i.6j7E-W0&S*dU=Lfg7Jc1&ySS*F=a&kkk=SAjOy~8GO~1GAuqU!k6id~)(JoDNml4B&CFr=g&GK=a&_xU=7&vUSa=imBB1fPi3&vUSY=agg1YaYg7&(UvSv=FUY%3DC_GGZd_kGRG%3DaTZpxrk*X%3DTw5ZUpXR(%3DTwJ1Z(vS%3DT%2CT%2CTZF8U%3DCIZkvr%3DT%2CTZUpXRG%3DYTZlGYkRFU%3DYTY5aTYJTgZd_kGR(%3DJ5Jwg1Z_kGRSn8%3DTZ_kGRkYvR(%3DTZFSU%3D5gTTJaiJa5ZkvS%3DTwTTT%2CTZd*%3Da13N6vzmGX~.Fx4Kl1-DYxZ)((%3DTZkdd*_v%3DT%2CTZk8%3DaZk*FRFU%3DYTY5aTYJT7ZkvUl%3DTwTTT%2CTZ_kGR(%3Daw5gZlGYkR_kGR(%3DTZ_kGRG%3DaTZFGl%3DYJw7YZx8vS%3DgTTg5aZ((%3Da1JZrk*X%3DTw5ZlGYkR_kGRn8%3DT9TZ*FdR8%3DYWWg%2CY%2CT%2CT%2CT%2CT%2CT%2CTZ(X%3DaZ*FdRU%3D5agiJZknr%3DT%2CTZv5*R(%3DWw51%2CJ1wi7ZFU%3DTZ_dU%3DYNv2C)AqI2Y48WbPaBZ8lGYkR(%3D1w7iZ(SU%3DYY51ia55JTWWTg1ggJJJg5YT7gTg1YY5TT7i5aW55YYa5555JT1a775771iigTgYJg5TgYi1Y1Y5YYgigig75J5J5Y51JYig7Tgai7TZ_dX%3DTZknS%3DTwTTT%2CTZpxUY*R(%3DTw1iZFF%3D0hZ88%3DBcZn(RUG%3DC%2FvZ_dK%3DOaZ8r%3DTZk8l%3D75wgWZmN%3D5T5iZn(R_8%3DaZCSF%3DaZn(R_G%3DrCZn(R88nF%3DaZ8S%3DCrK%20IpknZ(FFRtL-%3D0h%2C0hZ(vFdFY%3Da1JZ(vFdFa%3Da1JZn(RSS%3DYZU8%3DiZlGYkR(%3DWw51ZSS%3DY1g5a7Z_GXR*%3DTwaZlKRru8%3DTwW7ZldFRFU%3DJY1Z_kGRk*FR(%3DaawiJZU8Y%3DaZlRvFC%3DWTaZGvFS%3DZ8lpx%3D1w7iZldFR_kGR(%3DTwgJZlGYkRdRFU%3DYTY5aTYJTgZldFR_kGRG%3DTZrS%3DYTZlGYkRdR(%3DTwT5ZldFR(%3DgiYwgaZlGYkR_kGRld%3Da9OaJZ_kGRSld%3DTZll%3DTZ8lGYkRFU%3DJY1Zk)l%3D75wgWZGYkR(%3DaTTTZkvU*%3DTwTTT%2CTZFdU%3D151iTWg7iZ_kGRk*FRn8%3DTZn(RFk8%3Dn((ZlK_%3DTwW7ZUY*RG%3DaTZ8lGY%3D1w7iZ5*8)%3DaTTTwWWZUXXRFSkx%3DyvkXpCIZUY*R(%3DTw1iZk*FR(%3DJ1wi7Z_kGRFk*FR(%3DaawigZknK*%3DTwTTT%2CTZknKU%3DTwTTT%2CTZdFjr)%3DTZdFd)%3DTZ_kGRk*8R(%3DTZ(dU%3DTw5Zn(R*S%3D3pXr*vxrZ_kGRk*FRkl%3DTZ8(U*%3DTwaTiZdSI*rRdU%3DaWZFrGGrkRSvxRdU%3D5gTTJaiJa5ZF_**GIRSvxRdU%3DZUrSr8SrURSvxRdU%3DZldrKv(dGdSI%3DTwW7Z*pF%3DaZv8RSI*r%3DaZvU(Gn%3D5gTTJaiJa5ZvX*%3DaZpx(dU%3DTw5TTZ()Gk%3DTwTaTZF_dU%3DZUS8%3DrvFSRF8ZUXXRrk*X%3D)vGFrZUXX%3DyvkXpCIZ(U*8v*U%3DTZUvGx%3D_CdFpCYJZFxXS%3DypXr*vxrRSr8yCpGpxIR8pX*_SdCxZFp(*%3DZudU%3Dhq!O*_(OiW15Y5W51i571a5WZySXG%3DaZU8_S%3DJgZUpx(%3DTOaZr8*R_FrU%3D(rGpKR4YgZr8*R*Yg%3DiwJJYigTJWTg5TT7JZr8*R*gT%3DaiwJ1YTaYYaiT7YW1iZr8*R*JT%3DY5w711iWg75551iYiWZr8*R*WT%3D5TwTJWT75gY7a17iJgZr8*R*Wg%3D57wT1WaT1YJY1g5Y5Zr8*R*iT%3D51wgTgY5TiY7iTa7aZr8*R*ig%3D7WwiTiiTW7Tg1g7W5Zr8*R*1T%3DJYw5WgJ1i11a1T1YgZr8*R*1g%3D1awWaaa5i57YiYgWYZr8*R*11%3DYgWw1J5a1WJgJYgaiZd(8%3DaZCFA%3DaZSxF%3D1WTuYgTZ(F(%3DTZ(F*%3DTZSXu%3DY7a&CSl=T&XXX=_!pF0)Nq49n%3D&dK=1WT&dCN)k=a&(UkNU=7JT&X8)=JgYa5&IUF*k=a&(vr=D7v4%2Fx7xuv&nvS*kr=a&8vUpXvdC=SAjOy~8GO~O3cy07YO__)UCg6!yYdmT0J4U5YI7Nc8zE63zRnIzpAx%3D%3D&I*G*=a&dFdU=g&vUl=NClrFSpk%20Pp8_F&FFX8kRlrk=g&*xdU=*aWW5YJaaigSYTY5aTYJa5Ti&FFGU=%7B%22FFd*%22%3A%22YJTT%3ATiT5%3ATvii%3ATTTT%3ATTTT%3ATTTT%3ATTTT%3ATTTT%22%2C%22FF88%22%3A%22Bc%22%2C%22FFF8%22%3A%220o%22%2C%22FF8SI%22%3A%22CrK%20Ipkn%22%7D&ySXGFk8=a&ure=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:01 GMT
strict-transport-security: max-age=31536000
last-modified: Mon, 19 Mar 2018 05:11:07 GMT
server: nginx
etag: "5aaf466b-350a"
content-type: image/jpeg
accept-ranges: bytes
content-length: 13578

GET
H2 200 34691131-c91c-4b78-b07b-0e36e2333031.jpg
contextual.media.net/kimg/new/140x110/2/3/205/132/ Frame CA24 15 KB
15 KB 72ms
71ms Image
image/jpeg 23.55.204.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/kimg/new/140x110/2/3/205/132/34691131-c91c-4b78-b07b-0e36e2333031.jpg?v=9

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.55.204.22 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

nginx /

Resource Hash

c75faf05fca742ce8cf0662946dbe164e8ebc13cddcb9a65f5058e8fb3c5c12c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://contextual.media.net/sr/2722522032/SAFEFRAME.html?ule=2955&&kkdd=H*%7Ch%7CnuA9H3*&88=Bc&ld=aJ1i5YgJiT7Y5TJY7Y5&xU*k=T&XF*v=T&8Ul=aT11&SF8r=~Y1i&8dU=imBWeWWa9&8*8U=e84xpuD_Rf9DIaRROkkf8K%3D%3D&8kdU=151iTWg7i&FdAr=1WTuYgT&F8=.h&8yCX=3hjs60o&*dU=i.6j7E-W0&S*dU=Lfg7Jc1&ySS*F=a&kkk=SAjOy~8GO~1GAuqU!k6id~)(JoDNml4B&CFr=g&GK=a&_xU=7&vUSa=imBB1fPi3&vUSY=agg1YaYg7&(UvSv=FUY%3DC_GGZd_kGRG%3DaTZpxrk*X%3DTw5ZUpXR(%3DTwJ1Z(vS%3DT%2CT%2CTZF8U%3DCIZkvr%3DT%2CTZUpXRG%3DYTZlGYkRFU%3DYTY5aTYJTgZd_kGR(%3DJ5Jwg1Z_kGRSn8%3DTZ_kGRkYvR(%3DTZFSU%3D5gTTJaiJa5ZkvS%3DTwTTT%2CTZd*%3Da13N6vzmGX~.Fx4Kl1-DYxZ)((%3DTZkdd*_v%3DT%2CTZk8%3DaZk*FRFU%3DYTY5aTYJT7ZkvUl%3DTwTTT%2CTZ_kGR(%3Daw5gZlGYkR_kGR(%3DTZ_kGRG%3DaTZFGl%3DYJw7YZx8vS%3DgTTg5aZ((%3Da1JZrk*X%3DTw5ZlGYkR_kGRn8%3DT9TZ*FdR8%3DYWWg%2CY%2CT%2CT%2CT%2CT%2CT%2CTZ(X%3DaZ*FdRU%3D5agiJZknr%3DT%2CTZv5*R(%3DWw51%2CJ1wi7ZFU%3DTZ_dU%3DYNv2C)AqI2Y48WbPaBZ8lGYkR(%3D1w7iZ(SU%3DYY51ia55JTWWTg1ggJJJg5YT7gTg1YY5TT7i5aW55YYa5555JT1a775771iigTgYJg5TgYi1Y1Y5YYgigig75J5J5Y51JYig7Tgai7TZ_dX%3DTZknS%3DTwTTT%2CTZpxUY*R(%3DTw1iZFF%3D0hZ88%3DBcZn(RUG%3DC%2FvZ_dK%3DOaZ8r%3DTZk8l%3D75wgWZmN%3D5T5iZn(R_8%3DaZCSF%3DaZn(R_G%3DrCZn(R88nF%3DaZ8S%3DCrK%20IpknZ(FFRtL-%3D0h%2C0hZ(vFdFY%3Da1JZ(vFdFa%3Da1JZn(RSS%3DYZU8%3DiZlGYkR(%3DWw51ZSS%3DY1g5a7Z_GXR*%3DTwaZlKRru8%3DTwW7ZldFRFU%3DJY1Z_kGRk*FR(%3DaawiJZU8Y%3DaZlRvFC%3DWTaZGvFS%3DZ8lpx%3D1w7iZldFR_kGR(%3DTwgJZlGYkRdRFU%3DYTY5aTYJTgZldFR_kGRG%3DTZrS%3DYTZlGYkRdR(%3DTwT5ZldFR(%3DgiYwgaZlGYkR_kGRld%3Da9OaJZ_kGRSld%3DTZll%3DTZ8lGYkRFU%3DJY1Zk)l%3D75wgWZGYkR(%3DaTTTZkvU*%3DTwTTT%2CTZFdU%3D151iTWg7iZ_kGRk*FRn8%3DTZn(RFk8%3Dn((ZlK_%3DTwW7ZUY*RG%3DaTZ8lGY%3D1w7iZ5*8)%3DaTTTwWWZUXXRFSkx%3DyvkXpCIZUY*R(%3DTw1iZk*FR(%3DJ1wi7Z_kGRFk*FR(%3DaawigZknK*%3DTwTTT%2CTZknKU%3DTwTTT%2CTZdFjr)%3DTZdFd)%3DTZ_kGRk*8R(%3DTZ(dU%3DTw5Zn(R*S%3D3pXr*vxrZ_kGRk*FRkl%3DTZ8(U*%3DTwaTiZdSI*rRdU%3DaWZFrGGrkRSvxRdU%3D5gTTJaiJa5ZF_**GIRSvxRdU%3DZUrSr8SrURSvxRdU%3DZldrKv(dGdSI%3DTwW7Z*pF%3DaZv8RSI*r%3DaZvU(Gn%3D5gTTJaiJa5ZvX*%3DaZpx(dU%3DTw5TTZ()Gk%3DTwTaTZF_dU%3DZUS8%3DrvFSRF8ZUXXRrk*X%3D)vGFrZUXX%3DyvkXpCIZ(U*8v*U%3DTZUvGx%3D_CdFpCYJZFxXS%3DypXr*vxrRSr8yCpGpxIR8pX*_SdCxZFp(*%3DZudU%3Dhq!O*_(OiW15Y5W51i571a5WZySXG%3DaZU8_S%3DJgZUpx(%3DTOaZr8*R_FrU%3D(rGpKR4YgZr8*R*Yg%3DiwJJYigTJWTg5TT7JZr8*R*gT%3DaiwJ1YTaYYaiT7YW1iZr8*R*JT%3DY5w711iWg75551iYiWZr8*R*WT%3D5TwTJWT75gY7a17iJgZr8*R*Wg%3D57wT1WaT1YJY1g5Y5Zr8*R*iT%3D51wgTgY5TiY7iTa7aZr8*R*ig%3D7WwiTiiTW7Tg1g7W5Zr8*R*1T%3DJYw5WgJ1i11a1T1YgZr8*R*1g%3D1awWaaa5i57YiYgWYZr8*R*11%3DYgWw1J5a1WJgJYgaiZd(8%3DaZCFA%3DaZSxF%3D1WTuYgTZ(F(%3DTZ(F*%3DTZSXu%3DY7a&CSl=T&XXX=_!pF0)Nq49n%3D&dK=1WT&dCN)k=a&(UkNU=7JT&X8)=JgYa5&IUF*k=a&(vr=D7v4%2Fx7xuv&nvS*kr=a&8vUpXvdC=SAjOy~8GO~O3cy07YO__)UCg6!yYdmT0J4U5YI7Nc8zE63zRnIzpAx%3D%3D&I*G*=a&dFdU=g&vUl=NClrFSpk%20Pp8_F&FFX8kRlrk=g&*xdU=*aWW5YJaaigSYTY5aTYJa5Ti&FFGU=%7B%22FFd*%22%3A%22YJTT%3ATiT5%3ATvii%3ATTTT%3ATTTT%3ATTTT%3ATTTT%3ATTTT%22%2C%22FF88%22%3A%22Bc%22%2C%22FFF8%22%3A%220o%22%2C%22FF8SI%22%3A%22CrK%20Ipkn%22%7D&ySXGFk8=a&ure=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:01 GMT
strict-transport-security: max-age=31536000
last-modified: Thu, 12 Apr 2018 23:34:07 GMT
server: nginx
etag: "5acfecef-3a3c"
content-type: image/jpeg
accept-ranges: bytes
content-length: 14908

GET
DATA 200
OK truncated
/ Frame CA24 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 326c32d7ffbd04762a10cf5bb37441d418397959381d3893c9e9a48217aa5347

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame CA24 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b00af338864761a37a208806e2e8815b46327a5e7e47bf141f4fbdf6d1fd3bcc

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 OpenSans_Bold.woff
contextual.media.net/__media__/fonts/OpenSans_Bold/ Frame CA24 25 KB
25 KB 65ms
65ms Font
font/woff 23.55.204.22
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/__media__/fonts/OpenSans_Bold/OpenSans_Bold.woff

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.55.204.22 Ashburn, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

127.55.160.34.bc.googleusercontent.com

Software

Apache /

Resource Hash

1973bb0e810b8f54792d7ea56c03749f6792541876847b085f58d64fb7adfc07

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://contextual.media.net/sr/2722522032/SAFEFRAME.html?ule=2955&&kkdd=H*%7Ch%7CnuA9H3*&88=Bc&ld=aJ1i5YgJiT7Y5TJY7Y5&xU*k=T&XF*v=T&8Ul=aT11&SF8r=~Y1i&8dU=imBWeWWa9&8*8U=e84xpuD_Rf9DIaRROkkf8K%3D%3D&8kdU=151iTWg7i&FdAr=1WTuYgT&F8=.h&8yCX=3hjs60o&*dU=i.6j7E-W0&S*dU=Lfg7Jc1&ySS*F=a&kkk=SAjOy~8GO~1GAuqU!k6id~)(JoDNml4B&CFr=g&GK=a&_xU=7&vUSa=imBB1fPi3&vUSY=agg1YaYg7&(UvSv=FUY%3DC_GGZd_kGRG%3DaTZpxrk*X%3DTw5ZUpXR(%3DTwJ1Z(vS%3DT%2CT%2CTZF8U%3DCIZkvr%3DT%2CTZUpXRG%3DYTZlGYkRFU%3DYTY5aTYJTgZd_kGR(%3DJ5Jwg1Z_kGRSn8%3DTZ_kGRkYvR(%3DTZFSU%3D5gTTJaiJa5ZkvS%3DTwTTT%2CTZd*%3Da13N6vzmGX~.Fx4Kl1-DYxZ)((%3DTZkdd*_v%3DT%2CTZk8%3DaZk*FRFU%3DYTY5aTYJT7ZkvUl%3DTwTTT%2CTZ_kGR(%3Daw5gZlGYkR_kGR(%3DTZ_kGRG%3DaTZFGl%3DYJw7YZx8vS%3DgTTg5aZ((%3Da1JZrk*X%3DTw5ZlGYkR_kGRn8%3DT9TZ*FdR8%3DYWWg%2CY%2CT%2CT%2CT%2CT%2CT%2CTZ(X%3DaZ*FdRU%3D5agiJZknr%3DT%2CTZv5*R(%3DWw51%2CJ1wi7ZFU%3DTZ_dU%3DYNv2C)AqI2Y48WbPaBZ8lGYkR(%3D1w7iZ(SU%3DYY51ia55JTWWTg1ggJJJg5YT7gTg1YY5TT7i5aW55YYa5555JT1a775771iigTgYJg5TgYi1Y1Y5YYgigig75J5J5Y51JYig7Tgai7TZ_dX%3DTZknS%3DTwTTT%2CTZpxUY*R(%3DTw1iZFF%3D0hZ88%3DBcZn(RUG%3DC%2FvZ_dK%3DOaZ8r%3DTZk8l%3D75wgWZmN%3D5T5iZn(R_8%3DaZCSF%3DaZn(R_G%3DrCZn(R88nF%3DaZ8S%3DCrK%20IpknZ(FFRtL-%3D0h%2C0hZ(vFdFY%3Da1JZ(vFdFa%3Da1JZn(RSS%3DYZU8%3DiZlGYkR(%3DWw51ZSS%3DY1g5a7Z_GXR*%3DTwaZlKRru8%3DTwW7ZldFRFU%3DJY1Z_kGRk*FR(%3DaawiJZU8Y%3DaZlRvFC%3DWTaZGvFS%3DZ8lpx%3D1w7iZldFR_kGR(%3DTwgJZlGYkRdRFU%3DYTY5aTYJTgZldFR_kGRG%3DTZrS%3DYTZlGYkRdR(%3DTwT5ZldFR(%3DgiYwgaZlGYkR_kGRld%3Da9OaJZ_kGRSld%3DTZll%3DTZ8lGYkRFU%3DJY1Zk)l%3D75wgWZGYkR(%3DaTTTZkvU*%3DTwTTT%2CTZFdU%3D151iTWg7iZ_kGRk*FRn8%3DTZn(RFk8%3Dn((ZlK_%3DTwW7ZUY*RG%3DaTZ8lGY%3D1w7iZ5*8)%3DaTTTwWWZUXXRFSkx%3DyvkXpCIZUY*R(%3DTw1iZk*FR(%3DJ1wi7Z_kGRFk*FR(%3DaawigZknK*%3DTwTTT%2CTZknKU%3DTwTTT%2CTZdFjr)%3DTZdFd)%3DTZ_kGRk*8R(%3DTZ(dU%3DTw5Zn(R*S%3D3pXr*vxrZ_kGRk*FRkl%3DTZ8(U*%3DTwaTiZdSI*rRdU%3DaWZFrGGrkRSvxRdU%3D5gTTJaiJa5ZF_**GIRSvxRdU%3DZUrSr8SrURSvxRdU%3DZldrKv(dGdSI%3DTwW7Z*pF%3DaZv8RSI*r%3DaZvU(Gn%3D5gTTJaiJa5ZvX*%3DaZpx(dU%3DTw5TTZ()Gk%3DTwTaTZF_dU%3DZUS8%3DrvFSRF8ZUXXRrk*X%3D)vGFrZUXX%3DyvkXpCIZ(U*8v*U%3DTZUvGx%3D_CdFpCYJZFxXS%3DypXr*vxrRSr8yCpGpxIR8pX*_SdCxZFp(*%3DZudU%3Dhq!O*_(OiW15Y5W51i571a5WZySXG%3DaZU8_S%3DJgZUpx(%3DTOaZr8*R_FrU%3D(rGpKR4YgZr8*R*Yg%3DiwJJYigTJWTg5TT7JZr8*R*gT%3DaiwJ1YTaYYaiT7YW1iZr8*R*JT%3DY5w711iWg75551iYiWZr8*R*WT%3D5TwTJWT75gY7a17iJgZr8*R*Wg%3D57wT1WaT1YJY1g5Y5Zr8*R*iT%3D51wgTgY5TiY7iTa7aZr8*R*ig%3D7WwiTiiTW7Tg1g7W5Zr8*R*1T%3DJYw5WgJ1i11a1T1YgZr8*R*1g%3D1awWaaa5i57YiYgWYZr8*R*11%3DYgWw1J5a1WJgJYgaiZd(8%3DaZCFA%3DaZSxF%3D1WTuYgTZ(F(%3DTZ(F*%3DTZSXu%3DY7a&CSl=T&XXX=_!pF0)Nq49n%3D&dK=1WT&dCN)k=a&(UkNU=7JT&X8)=JgYa5&IUF*k=a&(vr=D7v4%2Fx7xuv&nvS*kr=a&8vUpXvdC=SAjOy~8GO~O3cy07YO__)UCg6!yYdmT0J4U5YI7Nc8zE63zRnIzpAx%3D%3D&I*G*=a&dFdU=g&vUl=NClrFSpk%20Pp8_F&FFX8kRlrk=g&*xdU=*aWW5YJaaigSYTY5aTYJa5Ti&FFGU=%7B%22FFd*%22%3A%22YJTT%3ATiT5%3ATvii%3ATTTT%3ATTTT%3ATTTT%3ATTTT%3ATTTT%22%2C%22FF88%22%3A%22Bc%22%2C%22FFF8%22%3A%220o%22%2C%22FF8SI%22%3A%22CrK%20Ipkn%22%7D&ySXGFk8=a&ure=1
Origin: https://contextual.media.net
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:01 GMT
strict-transport-security: max-age=31536000
last-modified: Mon, 16 May 2016 10:39:41 GMT
server: Apache
content-type: font/woff
access-control-allow-origin: *
cache-control: max-age=86400
accept-ranges: bytes
content-length: 25720
expires: Fri, 27 Oct 2023 13:08:01 GMT

GET
H2 200 bql.php Show response
akl-navvy.media.net/ Frame CA24 15 B
297 B 194ms
106ms Script
text/javascript 34.160.55.127
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://akl-navvy.media.net/bql.php?vgd_len=7852&&vgd_canary=0&vgd_l2type=scs_newfl&fp=1TcgYDbuDj66W40kEcBAmfTmmM4WwEZFmaEnvkZHRhepcE1KQIZjf4M0NUND_AJTBTE2sC2Blb1stWjdTpjgxZ8FqZhPjpQ2GTeoZ4qSseaTa0ooAwITyPzeXvXzN7uc&cme=rn4Z8JvJdq74iDrOYCsNFyAY5AhD7KTNZdqpZmUVhjkDB5YpUodNWueG66YVH6yAUivzL9cKT0hlPL5YxYO0jDjFrXxCW7lne6Mveo8-bQnx5-o2UN3TPSYKeExteHcB4ctOldcy-xUskRCoOd6ulelt6Im0D3C_VR5hBXGq2UbYaopCkvVZZnuDy6fuOHfPntoBm2fOYw_pi6U_15P1MlMwuLFkgSUBMyPxaHfHqec%3D%7C%7Cu8A6SM53vAcxkZY9VHWafLSuY-HKDieQ%7Cgx3D6jWGHsfkL2Qylz9cJh5jjqTfFXux%7CdsA6EMpZ47R6ljdz__nQtthZoUpm2bb5%7Ca0AmFUYXmD4dLNHcwV3FRv0SMe-bT_N9G8Ch8z3AnSg%3D%7CcPcb3VhU0BVjXgWFWEAzinttU1oq1ouO%7CF37h8gevtB9X0ygG0vVhgKdo-S-z6iTRDpUu1yYWkg5z5i4AfxJZFYAuCk-31NvfbY_d9ttgtSuQRERuF_Zn2qoGLb2RpPozqixdS3nHoPu4Tv-eHXycZLtrXtByieqEMPb9shTUPlIB3VPbASv_1yowLBMF-yyGCZS8ASz7sW9tE5MVcuuk-IaDmU3cdbl6ZsQexjf6oJEclaUOZVwf0VBSDlISilTfj1-rQB5PRl3xzFeOiyIhjYve2I5DBY4dW8p3zjLn2mHE1M0xNF7prtx0g8l_c9Mc%7C&subBdr=196&bdrid=460&ksu=224&fdkt=475&vgde_kbbh=ffoyxQJuO&kwd[]=Electronic+Payment+Processing&kwt[]=475&kbc[]=e7e84e51d8bf88029498e5b39fa6a293.d2s&kwp[]=1&kid[]=9573930&kbc2[]=eset%3D1%7Ce_st%3D8%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7C7%3D0.0002%7C8%3D102605%7C13%3D0.1387%7C14%3D102609%7Cokt%3D475%7Cbkt%3D475%7Cir%3D1%7Ciid%3D1755739%7Cps%3D1.011%7C53%3D2.06%7C12%3D0.09%7C60%3D5.33%7C80%3D1.56%7C1%3D1.23%7C2%3D4.45&ktd[]=4503875344535808&kwd[]=Apply+for+Low+Income+Grants&kwt[]=475&kbc[]=e7e84e51d8bf88029498e5b39fa6a293.d2s&kwp[]=2&kid[]=329859234&kbc2[]=eset%3D1%7Ce_st%3D8%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7C7%3D0.0002%7C8%3D102605%7C13%3D0.1192%7C14%3D102609%7Cokt%3D475%7Cbkt%3D475%7Cir%3D1%7Ciid%3D2236099%7Cps%3D1.011%7C53%3D2.90%7C12%3D4.00%7C60%3D2.27%7C80%3D1.87%7C1%3D3.50%7C2%3D8.99&ktd[]=4503875327758592&kwd[]=Apply+for+Cash+Assistance&kwt[]=475&kbc[]=e7e84e51d8bf88029498e5b39fa6a293.d2s&kwp[]=3&kid[]=42444304&kbc2[]=eset%3D1%7Ce_st%3D8%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7C7%3D0.0002%7C8%3D102605%7C13%3D0.1153%7C14%3D102609%7Cokt%3D475%7Cbkt%3D475%7Cir%3D1%7Ciid%3D19851790%7Cps%3D1.011%7C53%3D2.29%7C12%3D1.50%7C60%3D0.78%7C80%3D1.00%7C1%3D1.46%7C2%3D4.93&ktd[]=4503875327766784&kwd[]=Download+Window+10+Software&kwt[]=453&kbc[]=1203581849&kwp[]=4&kid[]=330072755&kbc2[]=clust%3D1%7C%7C%2A~window~10~pro~%2A%7C%7Cdiff%3D1%7C%7Csetid%3D6%7C%7Cbkt%3D0%7C%7Ct%3D3%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7C7%3D0.0009%7C8%3D102605%7C13%3D0.0541%7C14%3D102609%7Cokt%3D453%7Cbkt%3D453%7Cir%3D1%7Ciid%3D1872679%7Cps%3D1.375%7C53%3D1.09%7C12%3D0.35%7C60%3D0.31%7C80%3D0.56%7C1%3D0.56%7C2%3D1.19&ktd[]=1730272038322835712&kwd[]=Apply+for+Free+Grant&kwt[]=475&kbc[]=e7e84e51d8bf88029498e5b39fa6a293.d2s&kwp[]=5&kid[]=316691056&kbc2[]=eset%3D1%7Ce_st%3D8%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7C7%3D0.0002%7C8%3D102605%7C13%3D0.1084%7C14%3D102609%7Cokt%3D475%7Cbkt%3D475%7Cir%3D1%7Ciid%3D7210629%7Cps%3D1.011%7C53%3D1.66%7C12%3D1.17%7C60%3D2.08%7C80%3D0.45%7C1%3D1.59%7C2%3D6.23&ktd[]=4503875344535808&kwd[]=Free+Anti-Virus+Download&kwt[]=265&kbc[]=2349732&kwp[]=6&kid[]=208266714&kbc2[]=3%3D0.30%7C4%3D2.76%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7C7%3D0.0004%7C8%3D102605%7C13%3D0.0714%7C14%3D102609%7Cokt%3D265%7Cbkt%3D265%7Cir%3D1%7Ciid%3D1116996%7Cps%3D0.945%7C53%3D0.76%7C12%3D0.54%7C60%3D0.51%7C80%3D0.10%7C1%3D0.67%7C2%3D2.78&ktd[]=4503878565495040&kwd[]=Free+Online+Templates&kwt[]=475&kbc[]=e7e84e51d8bf88029498e5b39fa6a293.d2s&kwp[]=7&kid[]=11621482&kbc2[]=eset%3D1%7Ce_st%3D8%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7C7%3D0.0006%7C8%3D102605%7C13%3D0.0602%7C14%3D102609%7Cokt%3D475%7Cbkt%3D475%7Cir%3D1%7Ciid%3D5696489%7Cps%3D1.011%7C53%3D0.87%7C12%3D0.33%7C60%3D0.33%7C80%3D2.91%7C1%3D0.72%7C2%3D1.67&ktd[]=4503876149842176&kwd[]=Download+Device+Drivers&kwt[]=453&kbc[]=1203581849&kwp[]=8&kid[]=8832533&kbc2[]=3%3D0.15%7C4%3D3.93%7C5%3D-1%7C6%3D-1%7C16%3D-1%7C19%3D0.00%7C7%3D0.0006%7C8%3D102605%7C13%3D0.0533%7C14%3D102609%7Cokt%3D453%7Cbkt%3D453%7Cir%3D1%7Ciid%3D5345839%7Cps%3D1.375%7C53%3D0.41%7C12%3D0.51%7C60%3D0.45%7C80%3D0.40%7C1%3D0.45%7C2%3D1.28&ktd[]=275716899072&v=1&geo=40.8%7C-73.97&dlper=20&lper=100&lpid=&tsid=15062&hint=&cc=US&wsip=170775010&bca=0&ugd=4&vgde_setid=Nff&ssld=%7B%22QQNN%22%3A%22Pb%22%2C%22QQN75%22%3A%22zJBn5mLU%22%2C%22QQ8E%22%3A%22fF99%3A9W9A%3A91WW%3A9999%3A9999%3A9999%3A9999%3A9999%22%2C%22QQQN%22%3A%22I3%22%7D&cid=8CU7Q771E&vi=1698325680423062423&vsid=3413272815668618&tdAdd[]=asnum%3D701&vgde_test_data_struct=%7B%22EO7E8O%22%3Au%7D&vgd_adprefflag=11&vgd_adpref_diff=0100&vgd_fm_lang=EN&vgd_implt=3&vgd_cage=0&vgd_tsce=L298-S298&vgd_imdtl=1&vgd_l3_sc=PA&vgd_chost=contextual.media.net&vgd_sslb=1111&vgd_hb_audit_1=8CUU9JF8H&vgd_hb_audit_2=155921254&vgd_pdtid=1&vgd_nrrv=82094&vgd_nrrmf=3000ca2a&vgd_nrrsf=scrr&vgd_cty=new+york&vgd_ifrmode=14&sttm=1698325681068&upk=1698325681.13443&hvsid=00001698325681068034604566862499&verid=3111299&sbdrId=196&tsrc=entity&tdAdd[]=%7C%40%7Cfsap%3D1%7C%40%7Clsat%3D3&vgd_l1rakh=1698325680158127814&vgd_ecrid=1700080807684000970025000059500&vgd_isiolc=1&kbbq=%26asn%3D701&vgde_ydsp=%7B%22QEx%22%3A%22%2FKTP4nXuWX%22%7D&vgd_mcf=65213&vgd_vstrid=3413272815668618&vgde_bdata=QOfvzxjj~8xLjMjvu9~myJLEYv9.A~OmYMGv9.Fi~G17v9%2C9%2C9~QNOvz5~L1Jv9%2C9~OmYMjvf9~ejfLMQOvf9fAu9fF9X~8xLjMGvFAF.Xi~xLjM7UNv9~xLjMLf1MGv9~Q7OvAX99FuWFuA~L17v9.999%2C9~8EvuiqVa1d%3DjYT0Qy%20BeipRfy~kGGv9~L88Ex1v9%2C9~LNvu~LEQMQOvf9fAu9fF9H~L1Oev9.999%2C9~xLjMGvu.AX~ejfLMxLjMGv9~xLjMjvu9~QjevfF.Hf~yN17vX99XAu~GGvuiF~JLEYv9.A~ejfLMxLjMUNv949~EQ8MNvfhhX%2Cf%2C9%2C9%2C9%2C9%2C9%2C9~GYvu~EQ8MOvAuXWF~LUJv9%2C9~1AEMGvh.Ai%2CFi.WH~QOv9~x8OvfV1Zzklr5Zf%20Nh2suP~NejfLMGvi.HW~G7OvffAiWuAAF9hh9XiXXFFFXAf9HX9XiffA99HWAuhAAffuAAAAF9iuHHAHHiWWX9XfFXA9XfWififAffXWXWXHAFAFAfAiFfWXH9XuWH9~x8Yv9~LU7v9.999%2C9~myOfEMGv9.iW~QQvIK~NNvPb~UGMOjvzS1~x8Bvou~NJv9~LNevHA.Xh~%3DVvA9AW~UGMxNvu~z7Qvu~UGMxjvJz~UGMNNUQvu~N7vzJBn5mLU~GQQMC_pvIK%2CIK~G1Q8QfvuiF~G1Q8QuvuiF~UGM77vf~ONvW~ejfLMGvh.Ai~77vfiXAuH~xjYMEv9.u~eBMJ-Nv9.hH~e8QMQOvFfi~xLjMLEQMGvuu.WF~ONfvu~eM1Qzvh9u~j1Q7v~Nemyvi.HW~e8QMxLjMGv9.XF~ejfLM8MQOvf9fAu9fF9X~e8QMxLjMjv9~J7vf9~ejfLM8MGv9.9A~e8QMGvXWf.Xu~ejfLMxLjMe8vu4ouF~xLjM7e8v9~eev9~NejfLMQOvFfi~LkevHA.Xh~jfLMGvu999~L1OEv9.999%2C9~Q8OviAiW9hXHW~xLjMLEQMUNv9~UGMQLNvUGG~eBxv9.hH~OfEMjvu9~Nejfvi.HW~AENkvu999.hh~OYYMQ7Lyvw1LYmz5~OfEMGv9.iW~LEQMGvFi.WH~xLjMQLEQMGvuu.WX~LUBEv9.999%2C9~LUBOv9.999%2C9~8QDJkv9~8Q8kv9~xLjMLENMGv9~G8Ov9.A~UGME7vqmYJE1yJ~xLjMLEQMLev9~NGOEv9.u9W~875EJM8Ovuh~QJjjJLM71yM8OvAX99FuWFuA~QxEEj5M71yM8Ov~OJ7JN7JOM71yM8Ov~e8JB1G8j875v9.hH~EmQvu~1NM75EJvu~1OGjUvAX99FuWFuA~1YEvu~myG8Ov9.A99~GkjLv9.9u9~Qx8Ov~O7NvJ1Q7MQN~OYYMJLEYvk1jQJ~OYYvw1LYmz5~GOEN1EOv9~O1jyvxz8QmzfF~QyY7vwmYJE1yJM7JNwzmjmy5MNmYEx78zy~QmGEv~-8OvKrtoExGoWhiAfAhAiWAHiuAh~w7Yjvu~ONx7vFX~OmyGv9ou~JNEMxQJOvGJjmBM%20fX~JNEMEfXvW.FFfWX9Fh9XA99HF~JNEMEX9vuW.Fif9uffuW9HfhiW~JNEMEF9vfA.HiiWhXHAAAiWfWh~JNEMEh9vA9.9Fh9HAXfHuiHWFX~JNEMEhXvAH.9ihu9ifFfiXAfA~JNEMEW9vAi.X9XfA9WfHW9uHu~JNEMEWXvHh.W9WW9hH9XiXHhA~JNEMEi9vFf.AhXFiWiiui9ifX~JNEMEiXviu.huuuAWAHfWfXhf~JNEMEiivfXh.iFAuihFXFfXuW~8GNvu~zQlvu~7yQvih9-fX9~GQGv9~GQEv9~7Y-vfHu&vgd_bhv_kbb=1&vgd_cfud=230323&vgd_scsver=229&vgd_optout=0&vgd_ydspr=1&vgd_l2shld=1&vgd_rensize=970_250&vgd_scr_h=1200&vgd_scr_w=1600&vgd_dma=504&vgd_ect=4g&vgde_ydata=duh%25Aru&vgd_l1cdv=1099&vgd_l1rpth=%2Fnmedianet.js&vgd_lbt=1000&vgd_mbr=1&vgd_pgids=1&tdAdd[]=uiparams%3D%3Brend_w%3A970%3Brend_h%3A250&vgd_uspa=0&vgd_sc=PA&vgd_l1rhst=contextual.media.net&hvsid=00001698325681068034604566862499&rc=0&rand=1698325681495&acid=69eea43db760710f5f981bb0209946b1&matm=1698325681496&vgd_ltimesrc=1&vgd_ltime=761&vgd_rtime=759&vgd_etm=14&vgd_l1hcsd=Otp9r%7C7077&vgda_l1btm=%5B%22SPAMPXL%22%5D&vgd_l1ch=1&vgd_lhl=5856&vgd_pgid=p1773261185t202310261308&vgd_kclkp_d=%26sgmt%3D100085%252C100109&vgd_csip=rtb-appnexus-75dc8cbb94-b4zbg.SC&vgd_sbSup=1&vgd_nrrs=82094&vgd_cntrdt=SF%7Cgoogleads.g.doubleclick.net&vgd_eadm=1&vgd_matchstr=hr%3D0%7C&vgd_end=2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.160.55.127 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000

Request headers

accept-language: en-US,en;q=0.9
Referer: https://contextual.media.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:01 GMT
via: 1.1 google
strict-transport-security: max-age=63072000
accept-ch: Sec-CH-UA-Full-Version-List, Sec-CH-UA-Full-Version, Sec-CH-UA-Platform-Version
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15
expires: Tue, 24 Oct 2023 01:26:45 GMT

GET
H2 200 css2
fonts.googleapis.com/ Frame CCBC 4 KB
767 B 53ms
51ms Stylesheet
text/css 2607:f8b0:4004:c06::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::5f Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 26 Oct 2023 13:08:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 26 Oct 2023 12:54:37 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 26 Oct 2023 13:08:01 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame CCBC 205 B
651 B 163ms
51ms Image
image/png 2607:f8b0:4004:c08::5e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::5e Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Sat, 21 Oct 2023 10:26:10 GMT
x-content-type-options: nosniff
age: 441711
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sun, 20 Oct 2024 10:26:10 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame CCBC 604 B
695 B 164ms
51ms Image
image/png 2607:f8b0:4004:c08::5e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::5e Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 08:09:50 GMT
x-content-type-options: nosniff
age: 17891
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Fri, 25 Oct 2024 08:09:50 GMT

GET
H2 200 fullscreen_api_adapter_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231024/r20110914/elements/html/ Frame CCBC 15 KB
7 KB 43ms
42ms Script
text/javascript 2607:f8b0:4004:c1b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231024/r20110914/elements/html/fullscreen_api_adapter_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1cc933a2cffa5971635779412d5ea0fcd6d3d7950271c6784c5e44c0a76c8beb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 02:01:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40019
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6584
x-xss-protection: 0
server: cafe
etag: 17761768058797188040
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Nov 2023 02:01:02 GMT

GET
H2 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231024/r20110914/elements/html/ Frame CCBC 20 KB
8 KB 44ms
43ms Script
text/javascript 2607:f8b0:4004:c1b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231024/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3f5676a86af87439536dd10d678b3d458eee7d107a4a9bb0bac62752cc738fb0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 02:01:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40019
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8598
x-xss-protection: 0
server: cafe
etag: 10300645532664441910
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Nov 2023 02:01:02 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 9EC2 624 B
242 B 78ms
76ms Document
text/html 2607:f8b0:4004:c1b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQgL6YlQQY0vue-gEwAQ&v=APEucNUZ362ytQZCwH39appaPDOmLnjVrjH453qkDeFJWNqOuPUaNMLyNJ_xPGaC6Vbs7-uTaQpHh22DJjhXs6mi5DlCYlyL7A

Requested by

Host: notepad.plus
URL: https://notepad.plus/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 26 Oct 2023 13:08:01 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame CD42 89 KB
31 KB 109ms
108ms Script
text/javascript 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: notepad.plus
URL: https://notepad.plus/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6c0bd41a591f67aa54215c9f9c1f0e86935d86b6546a0ba0bf9cebbed53a9ebc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:01 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31491
x-xss-protection: 0
server: cafe
etag: 6167930392490353973
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Thu, 26 Oct 2023 13:08:01 GMT

GET
H2 200 adj Show response
fw.adsafeprotected.com/rjss/bgd/1712960/75657828/xbbe/creative/ Frame CD42 258 KB
79 KB 172ms
39ms Script
application/javascript 100.26.67.92
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/bgd/1712960/75657828/xbbe/creative/adj?p=APEucNUySr-ptmum7FUrNTWZ2H8r2hJn2DZA4Jd0Klhc-k-rVeFtYDg&d=CokBAKAmf-AxGL2T2jkOXNIds2jkUuF-4XIDV53rBBEqnCi2przU0gGvje5DYtpKEkdlF1j9OCYyht3TAhrhOePU_A_QK5mxZhbzaprSAOtWhj1VuDLHJN4NBxUCKk40vt82KZ8sbwrHkZ3tW0l_Mhj6KozH_CC92QDdc-HjlnbysynU8lbekP0493QS6RMAoCZ_4E5B1G696fhFOkHEjKUaDLW2R4Y6nmyOAf174VtMK4oiw1FVtn0Zuf-BndyLhiS9dVWkwV_FlyWSkLo1K-g7v8dzQbcNSEmHusFXMA8VYvPIx2noysjwuYAgx2MGGlPN2yA1-rwNqqb5uEqiHpgiqmmDgqJzeX6SgOPp9tcfZXWAEypm8OuwFo0yBgTJdAa5fQ9O_I0HGatnCWs7HO2ATodu9h4a8r2YZcmnDxKQJcQ-Lw-CBkJsRnB5fsrnN4C7JVVKhFKXY1UZcViu3_v9Ig19R6xTBqoaWBvYV2DN1N8PnEtp91VL7Rvh-PQQGPm7vYFNHTSCLEqdERBs2sKlPoMVn2H0u8evAMyJN1dT2_zFJtYlpE6N9zsrfx-3F0Gq5qSA5Ysd5GSNbrutXFFzsnkU-ehmbWo0jyswFGaQFA7-eBrdttdw0c55tqd1Nx7pWWRo0DS_r7DGQtptX5ekeaIOBqxt3r5MZ_k8Qjs6TqVOuApFMKnR4oudklLg3rP4PGYXqy771qA8a8qMNMnQ3bnvu_UyOVfGJF-TcHFrRtC6oMXGKi1N777VJf1vAVeRRPggvgRPUKYokmqAN8nmWODnFGJyd54MXX_uyaGLHsSneKFZzCRRjV15gdK-zaGWgBysZTzm6h9wqe4Uj7eFQmKoRe4DT3Io_3ofsoiJh8MZ2bz2NeoCfcWLEeVhJ7hU5TQrvQ5VWeCKVeechG98gRYAVS2LgD-wQQBgNWXpjvpD0TwY8KWB9yQWpbspk36IAzxmwLDi4wwKpzY1jTdm0dK3iY2AeLWlFikXUTa-7jSnOep6un-yFBV-rpCM-yoqgI5mWRX9KDHLSzx76DzyAFeOScZ0JQVB8PEV-0BjRnwgR6X15Kss8S8MP0GCBspq3HM6NrM6q2tUrfETKgRaBGBfGQuR6FHTPQ22rzu05iR_7HqT3KEk0r8UFcKudX3x13lnORpA_jQR194r_RjJA00DkKTzgkMlDf5TiDRPmTnaE1ogdjwEr6oxHOcJXbHLNYbkhl13MXIbnvUuwhbYLwEYDcYAMOsiUgMVjdm1fQQyisEFzv1qVgfiC7gp1TD1SzaaqdPqVI4hE5AEI4bH3wsEKG5KPzxsfHk92BA4a0miwXFQl56UPNbA0GWLypkSzP4IIW4SjjD_zwpt0nUNvPKMBydlJMk5ld6M-_aHsFQ09IKy76dZ3zK35SyCINE8ef-AvH9T8gffx4EfDK6pJ4FX_rNVpWn7zn6s7wgFt3h46AhaHsExo8N5R4yAthDqPFQ1-KCEe1yL_2YNOP04fPbrvzAFf3I0PzOQf6wXBQq4jLBLVB0GidUFYCgXEC6IgRs_8RG6AYFPK4JRKq5qVUdOcOLlFtSfTByhnK-9p0a4cz3lZSllRfAc_Ds14tKU7potjBSton2f_HWpL_9HyB8i6WZtPs6fBivTU6stxhXHbvdjXDI4NiGKSH_lr_8NfNUod4RweOSO3PdE2JTAtLEI3L62by_BP07p7atJdOBq9UKOtOdk1SsgxCBX-o7AVgDH_OFkBox_hiJb8lJiq7swkVxYeXuyKEMfZ-VICBdAEwKU-zbSIN-58M1yPDwWQ8D5_oliN1R5662VWLJ-erTK_uLvYYpcfmdD6CUgVLBBvIeRZcBvc2gJXSko4XxRGjxRfnTccFXrJ2ggYCM6gcglQddZFH-LFmkBu28XRFykVtkUAuQrnqLPKTrwm19l03oixUD_YDNoYKkcyuVZrWMBT_J7pU4KtbvzmiYS51EvytEi9fRChgcArS-e-_o-4gNYcGpWd06-N3s4ICIY_bcz9Z7apBz45H9-5LtI5OpjqDlvgoAdMrmsfS7Ll45iTB1113twtbElqr5j_pzAbN8e3DzSzF8WnE_kINCpfx7gOK7muP8R7junX1N13UYKJUGHOei7is9KegxUf5yhsR51MscJO-k0xtTxybxn6FaaQNu9yhW2qcCHcdegn8TkP0c3uOnJl5hmLSdoS8rb5DPUgfDzoj_QKSsyaHA5SbNoncf2S884mLvF7BEovBfivHivjdK-kc_2kFQGWp20POizhaKPTDncErbC32dClBwG8FtsWl0YQ2OWAXLcHg8sJlbC0DI0uR6OewvczAM350m4maqdz3nDuzN-zPGx61jKgqY8R-CdwH7BH8hXacFdynpy4ijqX18v4EhvMtTkFpQ8GscWjQy82Ztwx7QnV4hJpPT43ePr2TNNR1j5yx9xFAGieZbWrKybsQ-7ivv0jSw0OeW9tXSus1228gFSHUxFnRWmTgdMy0tmC3LhGkykf5zAIgJlHtHu2YlgVdXXIXp2Gjz9wrRPX25ueKCqpOTp3xOCVrU6yYIktvXsR1jU58Hp4AkUD7dcH7lQ1MeO0eaIp8D3WQirStDCmKQNnynI3SydpLyec7_NL6FJ97C3r4RpV5Dq4a6CChfbpyDUfDLNguKL4l8gHqCWi8ZpKY96idVUy817TGBBCCGr_o0ckgfZHpV0PAMOVNNMatPQcvndhWsVJgmQJYBBs4h4UW9pcB6J4fdN-NEx1A4KlE-VkyZ6aXHhKvpGf8uYkYFWAYjbzXEGQwxhkE7zkj58-lEL9iPdIINERgAmmK7kPEyujNPXfw7pqfakp3a8ULKIfIZbMOBLoNjB1b3YXdOKDQH5I5OcdnChzbgjTa2-nc0NbumZcaxlao0wiYFKzvgo5zhSbqHKBulCAd_zJ31N_8vrNF8q20LkcvKj5czYg3Cu3DZNOlFjf9bNW1jGwGwI2ehorIz6Cll7Pe6cxaLuVpNaxSpbizDFcx6Bsb2HxZD0_aDPuNg-lOAOykqrCcjJ9q6n8yDSqAqbCBAWTRa_-MmNzoXnELsoXwxx97vBq0c4Y3nEC4bqILJ-aHfqI7SrsLxx58e6AOcSQ6oWy29it2GBqznKUuTAcoK5IJz7IYSorW-Ls-H_NDjZDZyIRCT34rffcQxwPFJ9k-thsH86lmXcHDBxJMUSm3KOB0v5QHpI3rlwor7ULsUBkzLC11E9YfMKC48CdDMlMRWnhnuqTHjh6a-W5JxJ1KwyfRpwiNGlooygZqkMmepBIZvOKB1llJsHiiXAQg5FCLxe44vQ6mbF9WWr2iCAvjw8WIEDDpzNkAnq-VbFTbqnsDHYl8I2_AWDikizUkgar0aBcEP54a4Y27ZnuOiYeqGmr8XGNvK_8NgRl0HqGJLXas-Bdy2JXV8MRPN-L_DotTQtBbxQ3OZtSNnnfr5vvm--Iux6BO6k8Q-covSXNA0PZ54oOxfYIHgxdNkd1V2hWY9QzgndIEcx1bCRVF4Q-Og-pq0FN6UkwpEleCshu88WjQ_02gfDy6QaM7erv3771AlDCysf5lveNC8eWhpSCAQSTADICaaNdpj-l4RUSOw-5UBFA81Y4Dp-FEP0iUjA5ebEgTwFNKwOI9jsdgDYlCFjTHuQrtcPEU-M1hsuXdY2KthsP4yzC3Gkn4t4lt4YAWAB&bundleId=&ias_dspID=3&ias_campId=1014440192&ias_pubId=pub-8793237398349137&ias_chanId=1&ias_placementId=20647159193&bidurl=https://notepad.plus/&ias_dealId=&ias_xappb=&adsafe_par&ias_impId=v4~~ABAjH0gkCJNTZfkUh3rLwzJisOIO
Requested by: Host: notepad.plus
URL: https://notepad.plus/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 100.26.67.92 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-100-26-67-92.compute-1.amazonaws.com
Software: /
Resource Hash: e6a3c5fa843ed483b2d90948fa6f484c4f76b439b63de98563a0bc31c1159250

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:01 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231024/r20110914/client/ Frame CD42 3 KB
1 KB 49ms
47ms Script
text/javascript 2607:f8b0:4004:c1b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231024/r20110914/client/window_focus_fy2021.js

Requested by

Host: notepad.plus
URL: https://notepad.plus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 01:56:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40291
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Nov 2023 01:56:30 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231024/r20110914/client/ Frame CD42 20 KB
8 KB 37ms
36ms Script
text/javascript 2607:f8b0:4004:c1b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231024/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: notepad.plus
URL: https://notepad.plus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a198f092051a356c1e62c1296f628da5732045abafbd974eb7fff157e14ff042

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 01:56:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40276
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8426
x-xss-protection: 0
server: cafe
etag: 17696348727749479825
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Nov 2023 01:56:45 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame CD42 187 KB
59 KB 39ms
38ms Script
text/javascript 2607:f8b0:4004:c1d::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: notepad.plus
URL: https://notepad.plus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4e155284926ba010442d774fd493ff925a0256bd427f54596b1244791a3fa170

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60190
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1698233972131352"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 26 Oct 2023 13:08:01 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame CD42 42 B
63 B 75ms
74ms Image
image/gif 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-D3YpX3VuZ7RSvN0o30gWjW8vVjIj-LquT8lOQpEQtSbz9rpBD8b2iBEf088UmDuG870iLp8tTynK74OpVHsrup1OX_Am4X6plaqMGCHH-5GVyVrz8

Requested by

Host: notepad.plus
URL: https://notepad.plus/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame CD42 0
20 B 75ms
74ms Image
image/gif 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=14871821254279322308&x=1&ct=76

Requested by

Host: notepad.plus
URL: https://notepad.plus/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame BB36 640 B
262 B 62ms
61ms Document
text/html 2607:f8b0:4004:c1b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQgL6YlQQY0vue-gEwAQ&v=APEucNXJ-81q0RFo17PHePNrrxvWSJqpw_MKlVoa5wIKhbEUTDKvDGSa4vocNLOT2y2_yQroYJXDD68D1ZmCb075Scc9NYLRgA

Requested by

Host: notepad.plus
URL: https://notepad.plus/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 26 Oct 2023 13:08:01 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 1CC0 89 KB
31 KB 131ms
130ms Script
text/javascript 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: notepad.plus
URL: https://notepad.plus/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6c0bd41a591f67aa54215c9f9c1f0e86935d86b6546a0ba0bf9cebbed53a9ebc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:01 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31491
x-xss-protection: 0
server: cafe
etag: 6167930392490353973
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Thu, 26 Oct 2023 13:08:01 GMT

GET
H2 200 adj Show response
fw.adsafeprotected.com/rjss/bgd/1712960/75657828/xbbe/creative/ Frame 1CC0 258 KB
79 KB 179ms
64ms Script
application/javascript 100.26.67.92
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/bgd/1712960/75657828/xbbe/creative/adj?p=APEucNUySr-ptmum7FUrNTWZ2H8r2hJn2DZA4Jd0Klhc-k-rVeFtYDg&d=CokBAKAmf-CaVigwWvahuC9qoukDsBGFteOtDkGsfhHwxWw4NDr5Uet-fw12PqFt2KauRbdIwdahuuJ-cpSbmUPHIZQbo16z6XYjQwwGWvOGoZ_6lFB-OSFxAIcPTXYroUaZ_Ss31vbPky6tg5kqrkBceBnrBTCt_sf3DpXJUY0CGoTnF0-U4KBDbEgS2RMAoCZ_4PR4_XI5wYIEZTnW25y0lqQPTV8rcQNMteHIR1HGGXq5ogmcgmzIiQbNyWQjpCL_FAHuE04FKogeNb_ZtRO7glCBOhLydQXFMJ8uOe17GS6xXSlyIp8jbTziVVsHxR5kfDWVQMb5AhO7EfUEwOm01vvz5wXP7fiYYOMfxXjSPZlkF3Z8FeqhgMLyT3v6PnfSEN7G-FdMuPbQfjs75PqUbVBC-b8GxXYGzooKww-qCtkTggMhsaI7LZPNeMwkcoLbw4Vy2zmfeyM-HEeTQjsXoV1k3WxykJ8NF5ArcAVa3emkq4Tq7YJ79ubAX4dZT7mvUUoi7aCs8HqN9WkMcYg94O0eDNfCoDjmndUw3wFHQ3o_9Bb2GsKb7gCtuy4jjp1owa67F0F_lOzAlOMpEdczSC1uJ73ZmRJ9LZKf2Ysas18uhPB8FNh5MIonaY5i2lYSIyOe8HbA1RQAKIEuOyzA9eD2PkhuOt14ETdDy72zsrBOLysd1lWpZmLajzIltHW0x1UmXWsz9u8ETymykqRhXuqTrvmNR7pLwj1J5LESLXzPCLTT7aJqa8g4ax520ayo1XUOrdzvxKAbYlLPDIxdmRna0UuKOXZ_T_kuilr8YHBsZVoyl0m3wUsgJn0Mz1dlrMALl0czD-6OyO4qWnkZe01ijzYB3lZQxL1879jw1_XfQGfvRAqMaeZlEQ5Uihuvq72RDvnXTuO9h1W7IQZMqiCxn4j0TcKVZdgnX9o64Duc24uhN7ZOnMyzkUgBulyrm9XHy88YAINlMbjH463Myi-E6atIaW64fN8CyneTwaiSXIGbqiTQyNCjLTfVCk-gNkzjrNpyHfScPyU1gLqHIctQlHojaoY3N_96EYQkmow1S_n7kex7shh843edDeZu1XfH53NxtIiralx190uUyxB706S6EURRfm6B02s8jjwgYFOUF2usUsTxoG2SefZt5kj0znFdryzw4meI3ofjVlwiopmaCDiQH_8Zcwlosi1V70udT3dr9Uwj0CkKHghvOsMgpDko7FiXbxzUWDbF4WzObmqDXmGZraUFGJQ_-PqeW1LKkMypzlBkxeP6xwpACKNR4zY6cgd-h8vB0gmmDvGMl5TjjTyfXky8wTLmUH3uNn4ksusVStYT-lvg-ybtuAIuq_USFtj-xyREIRdOsC7RAjXFEumPccosk4IGEDzeSloc3PJSnKv37o6HKDqX9nRcEpD5SwNUCtKthtFOmJ9WYLTj8j6dlD7agM9TrkUOBKg8x9LRvltJYcIa26O0pma2SkOGbdvd8Z2TjsRZM-jN45esz2GUuCmiOSm3sAql4V9GVdAxK5gdMPGeIJgZfWpgFdGB1UAx4qkyjLrcThy--ZDkgUbejgrpmbKDQPpY6zTtw7wPGWFUe2iCMYgeuo-diPnJxmiYmaYhMelX7GV6hxHlWJHSVgkWpRKPiZJ9dop-hiBBgVWOeI3hjDt3sQea0p_3zdfVdZczJX6thhdAoOF5-mpkbuS_d1kRvz6H1S_cJAqh8WKtpWWWvMdYnohaKgJxbAHku8gnu_07TCh6qzAZgu14mRna-h4UtNy1leESrvq9lR59RryX_67CmgR3s4rn2CyHw_zV8en4m8lGXLg1KsZOW-ABkNFniAJ28T72AiWXhWY_AKi1KWhC-8UQZaV_vDU0i0deC6AMqJUWLSZCtbaeTaajPPIJm8-ilI3l8UzcCHdnt2c_b3qiTGaJFgsv_ehpw-VwgWx3oP4UsN2XoI0qWAq7PbTPm7Z0uFZGpJTK_dXutjUvdhdGJqTFDFV0LO4qCVcpojp8qM3WrOatnhSAY6O55uv9FYNTAvzM4VT_BlMPTciXcJLBcaDdkx9JU6GrLioywenlkIn1aDp_3wWpaQWsoRb50s61-50nhrwDQt4OH5qcokoBHudx6LYKn8dpq60HJ5Ip00NC1y-03eOBcTuA2wOu1ZwxAEhLq5-kmjZTnaSKxOsuvmeTi3_P-wnXLag2gewcQreHdNdMQdk5xOSWajVucclovp8stshkLWOUlHaiJfOR7G5cMtFWRKMymm_E3--nhcD2osNuoYhYhL54jf0dXdz37MjHgHbEkrik2Q-VOG-NvKuR0vuavJQUDrzvd3N0vI5z9RDyYMJNF_b4S0hf0mVWw0XC17gY5YB9DhxsKOCwy59VNMMOwxXCvFulxB2gOPDu1NtnBLoIoCCoGwmgNjPXp4bjRkuQBHJWCHRvptLnU0ARkAJ2I3g82EmApSySP7cP3j0niTjb2_nSMjuM5T9lyEMiWCniAJ_COUZGUIsVsFMpm0n2emY4TFNYxx-YtGmsM3DaQsz1LIOaX7CW7YP6GXBPh07JZ8P3rnz3PpH-wBFjG3eR5oTe8jedW-kkoAluB9f1QM62qAo7pGs1Xv88iKP9V7i5ImnnCaM_GH7CfZTI8eLtNu8WQlGz5XyilBiE2PuvRXLw8U_VwQqPMy7qHNBrDCRa0p6uA1cl6JUSDg2hlQMBiHJJRxKFKBsW2TMczB6yapP-QXDKjKKlETd1jEuNNC2y7k_8SRHAmZmh0yKtOa_sZh-Nbh4E_0306VXCCO-BzaTEPnhNYV30eEgzKcrklh_0-1IRwNSWYDRKqp4gRQdiWwXaG__916nBeTuudnORuTWfcKquYEGiUdgcECFXbaAlN9Djua5VMJR4oXiZGxx2LIouPDjoZCHhpGISxF6625KjAe_DewzTnrBe_FY7-Ua8pIDQhDZMUKPL1r_DSNVOFDVvxMAsepveA21dqv56qPXUUZy3onTBQZlolaKBOQPFY-U3xzDsJ9CX9ZJu6YVuo6qU_eanx1z0OD3MvYMdChwlthzsxficgzxdH7FWlTgm1kYCmNfmccETDIlVuOhqEKmommvgiSmV3oPxdnEOSB70qpFWOuCnwUel_Lv80H_30_z1BGd9Im15iWas2ttQo0Uf_X9DX-L32P4sQR-R90BB0s7oKc76kjz0agF8YZUgv-ETNOgu68QH3SGXbNiOPKlRGTkghjkUciaCp6JDTV1xfEYCcEz_EN5Wm0c-CGhgV5UJuZhm2Kub0RhO_47MliiD9ozsd3d31cut3sVzufIX8HgcJN2mOWam_FpW6gImYxq8IBusP71NsguT1Pt6Kehawm-xvFjO4cFo0GQEXYm5ObVwaLYxucreXfxMxp6ICWpa6kdO-YgO6wBvj8qGeIV-qeaCaQFcd31ezPxLiZ_s2xFGTLrbliuG32z0FANG1yno2057tbcEB_D1G2GYlDutq9yuhDrWbGylPjDdTswKEkNG89j2XVGdvsPSPA_d59QGgh642nMZveBv2wpGrNL3LOlNdubR_RwhZtb8GlIIBBJMAMgJpo12mP6XhFRI7D7lQEUDzVjgOn4UQ_SJSMDl5sSBPAU0rA4j2Ox2ANiUIWNMe5Cu1w8RT4zWGy5d1jYq2Gw_jLMLcaSfi3iW3hgBYAE&bundleId=&ias_dspID=3&ias_campId=1014440192&ias_pubId=pub-8793237398349137&ias_chanId=1&ias_placementId=20647159193&bidurl=https://notepad.plus/&ias_dealId=&ias_xappb=&adsafe_par&ias_impId=v4~~ABAjH0j1tH9Ge5dw_CbkhYP-vJj-
Requested by: Host: notepad.plus
URL: https://notepad.plus/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 100.26.67.92 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-100-26-67-92.compute-1.amazonaws.com
Software: /
Resource Hash: 7154ebbb7e644ba3e116cfa5fc54020c3d5cc7faffd2a3d38bfcd3f47b4b3172

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:01 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231024/r20110914/client/ Frame 1CC0 3 KB
1 KB 38ms
36ms Script
text/javascript 2607:f8b0:4004:c1b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231024/r20110914/client/window_focus_fy2021.js

Requested by

Host: notepad.plus
URL: https://notepad.plus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 01:56:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40291
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Nov 2023 01:56:30 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231024/r20110914/client/ Frame 1CC0 20 KB
8 KB 36ms
35ms Script
text/javascript 2607:f8b0:4004:c1b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231024/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: notepad.plus
URL: https://notepad.plus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a198f092051a356c1e62c1296f628da5732045abafbd974eb7fff157e14ff042

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 01:56:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40276
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8426
x-xss-protection: 0
server: cafe
etag: 17696348727749479825
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Nov 2023 01:56:45 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1CC0 187 KB
59 KB 38ms
37ms Script
text/javascript 2607:f8b0:4004:c1d::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: notepad.plus
URL: https://notepad.plus/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4e155284926ba010442d774fd493ff925a0256bd427f54596b1244791a3fa170

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60190
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1698233972131352"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 26 Oct 2023 13:08:01 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1CC0 42 B
63 B 62ms
61ms Image
image/gif 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Ai1Bqyw443OYE_4OVBxPi4v7CeCucUncrtnIv8-ynMiCJdo1fLKD4jFESifxaP7WANjTGJdryG31PG2m2sHgXfSBTz1lEgun_G6O4h5PWqxU7hlX0

Requested by

Host: notepad.plus
URL: https://notepad.plus/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1CC0 0
20 B 62ms
62ms Image
image/gif 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=11914175694824698152&x=1&ct=76

Requested by

Host: notepad.plus
URL: https://notepad.plus/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 1CC3 4 KB
728 B 48ms
48ms Stylesheet
text/css 2607:f8b0:4004:c06::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C700

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::5f Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3d2b34675fd418a1b23c652fa791f4875ccc12860d9b4b6ec8ae4aa09d51ec1e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 26 Oct 2023 13:08:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 26 Oct 2023 12:55:26 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 26 Oct 2023 13:08:01 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231024/r20110914/client/ Frame 1CC3 2 KB
907 B 53ms
52ms Script
text/javascript 2607:f8b0:4004:c1b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231024/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d66ca23a7be1d8803307f937a250d0f90959f1289862b8e870d6795000f2b731

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 01:58:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40177
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 798
x-xss-protection: 0
server: cafe
etag: 15713038447858168282
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Nov 2023 01:58:24 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231024/r20110914/ Frame 1CC3 23 KB
9 KB 49ms
48ms Script
text/javascript 2607:f8b0:4004:c1b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231024/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

45edbc85483b4cde24376ffc1a6b93969f8e51cd2e73547f84824c8f54fb79f9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 01:57:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40233
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9137
x-xss-protection: 0
server: cafe
etag: 5200559654007170660
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Nov 2023 01:57:28 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231024/r20110914/client/ Frame 1CC3 3 KB
1 KB 54ms
54ms Script
text/javascript 2607:f8b0:4004:c1b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231024/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 01:56:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40291
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Nov 2023 01:56:30 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231024/r20110914/client/ Frame 1CC3 20 KB
8 KB 51ms
51ms Script
text/javascript 2607:f8b0:4004:c1b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231024/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a198f092051a356c1e62c1296f628da5732045abafbd974eb7fff157e14ff042

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 01:56:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40276
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8426
x-xss-protection: 0
server: cafe
etag: 17696348727749479825
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Nov 2023 01:56:45 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1CC3 187 KB
59 KB 39ms
38ms Script
text/javascript 2607:f8b0:4004:c1d::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4e155284926ba010442d774fd493ff925a0256bd427f54596b1244791a3fa170

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60190
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1698233972131352"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 26 Oct 2023 13:08:01 GMT

GET
H2 200 b043ffb3bb2c6d533211f24c7a1dfd38.js Show response
www.gstatic.com/mysidia/ Frame 1CC3 35 KB
15 KB 108ms
52ms Script
text/javascript 2607:f8b0:4004:c08::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/b043ffb3bb2c6d533211f24c7a1dfd38.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::5e Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

98187c8f71e10f25e2a147adc03bdf9055da702c1105815f9510790138b9ddfb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Tue, 24 Oct 2023 19:51:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 148565
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15030
x-xss-protection: 0
last-modified: Tue, 17 Oct 2023 21:06:08 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 22 Jan 2024 19:51:56 GMT

GET
H2 200 6592766407814317453
tpc.googlesyndication.com/simgad/13166418295280165978/ Frame 1CC3 51 KB
51 KB 51ms
51ms Image
image/jpeg 2607:f8b0:4004:c1b::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/13166418295280165978/6592766407814317453

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce8b03d30c7943658d423d30d9018281cad908e8a83b6a1d2ff83f025a32728d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 10:07:44 GMT
x-content-type-options: nosniff
age: 10817
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51745
x-xss-protection: 0
last-modified: Mon, 28 Nov 2022 15:24:30 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 25 Oct 2024 10:07:44 GMT

GET
H2 200 14763004658117789537
tpc.googlesyndication.com/simgad/15652676048262168485/ Frame 1CC3 4 KB
5 KB 51ms
50ms Image
image/png 2607:f8b0:4004:c1b::84
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/15652676048262168485/14763004658117789537?w=100&h=100&tw=1&q=75

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c32906775261693700b234cb6101b26f1af2f3649d2b6f1779e89a116b6a8d0a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 18:43:00 GMT
x-content-type-options: nosniff
age: 584701
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4281
x-xss-protection: 0
last-modified: Tue, 30 Aug 2022 09:36:45 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 18 Oct 2024 18:43:00 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 7A11 6 KB
779 B 73ms
72ms Stylesheet
text/css 2607:f8b0:4004:c06::5f
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c06::5f Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

9a4eb2c9445287c34cb0a9ed5cc673460362483f0855bc91f8230dfa46a955e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 26 Oct 2023 13:08:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 26 Oct 2023 13:03:43 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 26 Oct 2023 13:08:01 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231024/r20110914/client/ Frame 7A11 2 KB
859 B 41ms
41ms Script
text/javascript 2607:f8b0:4004:c1b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231024/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d66ca23a7be1d8803307f937a250d0f90959f1289862b8e870d6795000f2b731

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 01:58:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40177
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 798
x-xss-protection: 0
server: cafe
etag: 15713038447858168282
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Nov 2023 01:58:24 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231024/r20110914/ Frame 7A11 23 KB
9 KB 38ms
38ms Script
text/javascript 2607:f8b0:4004:c1b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231024/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

45edbc85483b4cde24376ffc1a6b93969f8e51cd2e73547f84824c8f54fb79f9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 01:57:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40233
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9137
x-xss-protection: 0
server: cafe
etag: 5200559654007170660
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Nov 2023 01:57:28 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231024/r20110914/client/ Frame 7A11 3 KB
1 KB 42ms
41ms Script
text/javascript 2607:f8b0:4004:c1b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231024/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 01:56:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40291
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Nov 2023 01:56:30 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231024/r20110914/client/ Frame 7A11 20 KB
8 KB 40ms
40ms Script
text/javascript 2607:f8b0:4004:c1b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231024/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a198f092051a356c1e62c1296f628da5732045abafbd974eb7fff157e14ff042

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 01:56:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40276
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8426
x-xss-protection: 0
server: cafe
etag: 17696348727749479825
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Nov 2023 01:56:45 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7A11 187 KB
59 KB 53ms
52ms Script
text/javascript 2607:f8b0:4004:c1d::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c1d::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4e155284926ba010442d774fd493ff925a0256bd427f54596b1244791a3fa170

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60190
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1698233972131352"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 26 Oct 2023 13:08:01 GMT

GET
H2 200 b043ffb3bb2c6d533211f24c7a1dfd38.js Show response
www.gstatic.com/mysidia/ Frame 7A11 35 KB
15 KB 59ms
58ms Script
text/javascript 2607:f8b0:4004:c08::5e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/b043ffb3bb2c6d533211f24c7a1dfd38.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c08::5e Ashburn, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

98187c8f71e10f25e2a147adc03bdf9055da702c1105815f9510790138b9ddfb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Tue, 24 Oct 2023 19:51:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 148565
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15030
x-xss-protection: 0
last-modified: Tue, 17 Oct 2023 21:06:08 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 22 Jan 2024 19:51:56 GMT

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame 9EC2
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIVSoRnHTDEd9fHm_0mFduk&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIVSoRnHTDEd9fHm_0mFduk&google_cver=1&C=1

43 B
339 B

49ms
47ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIVSoRnHTDEd9fHm_0mFduk&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQgL6YlQQY0vue-gEwAQ&v=APEucNUZ362ytQZCwH39appaPDOmLnjVrjH453qkDeFJWNqOuPUaNMLyNJ_xPGaC6Vbs7-uTaQpHh22DJjhXs6mi5DlCYlyL7A
Protocol: H2
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:01 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XQiumCnKgRFrIgcvm6xYHABWV%2Bl9uZmgvP%2FrEAa5OHgh2j6qZvzE5JEjK4y9Mmb%2FKsyCCall9sZE7kMTnovt6lY8h66qyZbjJHZRGu%2B0JEdoj1odVNXZoEN8RinCIrVpJwGq17ZsHAkN2w%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 81c2ecf769998ca2-EWR
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:01 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OgW%2FSNvDKG05jq%2BNOhgHvHvKpzWLo%2FW37929BOtDTpK32X4T3t%2F0qIrrF2XUXnqCSmXjaCCNPuPimEZn3l%2BKXy0HRxDiatQ127tRxQGDko9JYH%2FAUrghIB4e%2FevYFXmbush3K07MizLw2w%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=45&external_user_id=CAESEIVSoRnHTDEd9fHm_0mFduk&google_cver=1&C=1
cache-control: no-cache
cf-ray: 81c2ecf709578ca2-EWR
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 9EC2
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZTpksWkHHPj7qS3whSGm2wAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIVSoRnHTDEd9fHm_0mFduk&google_cver=1

43 B
766 B

64ms
62ms

Image
image/gif

104.18.27.193
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIVSoRnHTDEd9fHm_0mFduk&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQgL6YlQQY0vue-gEwAQ&v=APEucNUZ362ytQZCwH39appaPDOmLnjVrjH453qkDeFJWNqOuPUaNMLyNJ_xPGaC6Vbs7-uTaQpHh22DJjhXs6mi5DlCYlyL7A
Protocol: H3
Server: 104.18.27.193 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:02 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TX5dhr2g9Vbz6E0w4uYpfu4DZN6u6H6HTzTkK0cIcWNtp6febSgmRQXjhS7WZHYnaYWlVU1Huz2ljPPpZzZ7EBiiV%2FfzzG9NqDbsANdlTNs4lY90Zk93twe39udm3H90RzPDEcNUUxSmVw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 81c2ecf868b60f4b-EWR
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:01 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIVSoRnHTDEd9fHm_0mFduk&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

bounce
ib.adnxs.com/ Frame 9EC2
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEO0ZjrCl7RTse3F05U2v34I&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEO0ZjrCl7RTse3F05U2v34I%26google_cver%3D1

43 B
892 B

118ms
117ms

Image
image/gif

68.67.160.26
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEO0ZjrCl7RTse3F05U2v34I%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQgL6YlQQY0vue-gEwAQ&v=APEucNUZ362ytQZCwH39appaPDOmLnjVrjH453qkDeFJWNqOuPUaNMLyNJ_xPGaC6Vbs7-uTaQpHh22DJjhXs6mi5DlCYlyL7A

Protocol

Server

68.67.160.26 Fairfield, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:01 GMT
an-x-request-uuid: 08558634-9a68-4c7a-b7bb-5f88ed97ff2b
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 206.66.96.238; 206.66.96.238; 567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:01 GMT
an-x-request-uuid: c295033a-93fc-4a42-b481-6f418d1d74e0
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEO0ZjrCl7RTse3F05U2v34I%26google_cver%3D1
cache-control: no-store, no-cache, private
x-proxy-origin: 206.66.96.238; 206.66.96.238; 567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9EC2
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDYzOTI0NTY2NzU2MDAyNzk2OA%3D%3D

170 B
188 B

47ms
46ms

Image
image/png

172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDYzOTI0NTY2NzU2MDAyNzk2OA%3D%3D

Requested by

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:01 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:01 GMT
an-x-request-uuid: d12a2cac-3d08-420e-afd2-2d240fa558e3
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDYzOTI0NTY2NzU2MDAyNzk2OA%3D%3D
x-proxy-origin: 206.66.96.238; 206.66.96.238; 567.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame BB36
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEKYC_xNU0E-57QcGvctGlY0&google_cver=1
https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEKYC_xNU0E-57QcGvctGlY0&google_cver=1

43 B
172 B

70ms
68ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEKYC_xNU0E-57QcGvctGlY0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQgL6YlQQY0vue-gEwAQ&v=APEucNXJ-81q0RFo17PHePNrrxvWSJqpw_MKlVoa5wIKhbEUTDKvDGSa4vocNLOT2y2_yQroYJXDD68D1ZmCb075Scc9NYLRgA
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:01 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537072991&val=CAESEKYC_xNU0E-57QcGvctGlY0&google_cver=1
date: Thu, 26 Oct 2023 13:08:01 GMT
via: 1.1 google
server: OXGW/0.0.0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BB36
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YjgzNGY0Y2UtNTAxYi0yOTk2LWM5MzgtZjk3YWRjODI1M2Ni

170 B
188 B

45ms
45ms

Image
image/png

172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YjgzNGY0Y2UtNTAxYi0yOTk2LWM5MzgtZjk3YWRjODI1M2Ni

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQgL6YlQQY0vue-gEwAQ&v=APEucNXJ-81q0RFo17PHePNrrxvWSJqpw_MKlVoa5wIKhbEUTDKvDGSa4vocNLOT2y2_yQroYJXDD68D1ZmCb075Scc9NYLRgA

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:02 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 26 Oct 2023 13:08:01 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YjgzNGY0Y2UtNTAxYi0yOTk2LWM5MzgtZjk3YWRjODI1M2Ni
p3p: CP="CUR ADM OUR NOR STA NID"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

um
sync.teads.tv/ Frame BB36
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEE1CkrG4tih4gbox-ZZj6yE&google_cver=1

23 B
278 B

127ms
78ms

Image
image/gif

23.205.56.163
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEE1CkrG4tih4gbox-ZZj6yE&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQgL6YlQQY0vue-gEwAQ&v=APEucNXJ-81q0RFo17PHePNrrxvWSJqpw_MKlVoa5wIKhbEUTDKvDGSa4vocNLOT2y2_yQroYJXDD68D1ZmCb075Scc9NYLRgA
Protocol: H2
Server: 23.205.56.163 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-205-56-163.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

expires: Thu, 26 Oct 2023 13:08:01 GMT
pragma: no-cache
date: Thu, 26 Oct 2023 13:08:01 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:01 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEE1CkrG4tih4gbox-ZZj6yE&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BB36
Redirect Chain

https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=YzQ1ZTQ3YzktM2JhYy00ZjVmLWIyNmEtZDY2MjEzMzFkMTNj

170 B
188 B

46ms
45ms

Image
image/png

172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=YzQ1ZTQ3YzktM2JhYy00ZjVmLWIyNmEtZDY2MjEzMzFkMTNj

Requested by

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:01 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:01 GMT
server: pekko-http/1.0.0
content-type: text/html; charset=UTF-8
location: https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=YzQ1ZTQ3YzktM2JhYy00ZjVmLWIyNmEtZDY2MjEzMzFkMTNj
cache-control: max-age=0, no-cache, no-store
content-length: 189
expires: Thu, 26 Oct 2023 13:08:01 GMT

GET
DATA 200
OK truncated
/ Frame 1CC3 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b56c11fffab3a9a97cdff2039becbaec297a8490e5b7a4c687e6093c02b8f4f8

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Content-Type: image/png

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame CD42 0
20 B 75ms
75ms Ping
image/gif 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=5143489270837&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame CD42 0
20 B 72ms
72ms Ping
image/gif 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=5143489270837&version=m202309260101&ct=76&x=1&cor=14871821254279322000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame CD42 17 KB
13 KB 70ms
69ms Script
text/javascript 2607:f8b0:4004:c1b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CS3L4t0mfHPFLendAbNdvMVjhrWCZ7wUFbNuAjv2CaE6qwEFJTdXmxuolKxK6zsy9pLUQ44TWzSSwG5G8mF06TCXhQDqYTmpDExV27coXhRsxHrhWMvI9kn7NxvFK7OgoMY_WxOH2IhNjdYhopvxqir2d5D9a6syuqQiVogC59SKwKo68&cry=1&dbm_d=AKAmf-Ao5C5VxFk8l6WIDKqCO77SJVed4OMJeq2vwrKTPJVv6IZdrFSViC9FLaEZl0c6KmvuhU8fVZuXiRUVzSDbiXKyOd-skwBJiiTIRt_oZFC6FpV-5fpaakVcrAzcmJ0Ryu94PFacHw6Ud3MqIF8zcVUf5r3zudPoLJOYDidpwTuXCwqsqLm-7X7DO7_j7VydWUCzJNWGf5uPTQxp3vj8zL86orRm8oYKJBTpPC4lhH_OXigLjud3pmRIJqZwThgunDD4g5-PMR1Zwr-pmrkp4fUOhFavrSgecnt2DpD_OlKQk6nf-l8p_ABIaDz1pT37ZuiJfxMRPq-GNEtnoRUGgjUZVWxLYoxRQKa-tXdMEWhJOPpoRbJL8baoKQXN-R6ycy_5uY20f4HmSLlFE-dsDexAPwC1sjI_YukDDM7u1accZPP4mkd1RCapI636jrqoj-8hSC-iCuOkOwjWrc_rmZBIIHJhW8ZZ8FifDvxPbmeUroVYnNAOXuQmofzGxh_2zLVKHbyiBFlZAw5-ZJeUovoAPHMH2Z0FLnpnUxOkBQbzWDyYOPuZRCM5fl79zyeuWT7mb5elcg9-BfehqevDHP2Pi6dhVZlo1iWU-uM4oZ1zXQuuVynMA2xhqAWdUYxvNkx-jU7RtYF7f6ExvMff-RzPxgT3vFdGZaqKbZGcBJSZ8StmcJfLfDiQZrn1VEoLRL4txRKBr9NGqtMgB9wTn3RXgr3Styhf54LN6TcJkX8rtd6uyobYXm75CWXvQLTJgj5CIR4Oe7wOkGw63SPR3Ca5zOQ-eriDdo-ow-v5fUFqSbFW6HqHPAfrftbUMPdDcR7LN6sA4jneUkh0BsIq3ta57LK_L9EY2d5X7RG8f1YUlBWDKBAakQpsH9gI3kw9uH4A2V5eJ95IT4vAIo4wxqAw1j_9rnN0PEAidUaaO1SfPjjDdtxsO8vkWNa2Onf5PDy_hc90GcGpdkYz7j1B1vihSbrXiAhW1LyFS6-I7iHWMxcS_7D9I0qvV2RgdT9BdHcXByT7DPWm1byiu_SE4QvRgqnLEVOrpCZyePkgXTSYQ8C1bpN2xSau5N4K-t6Im_a94h3o4bnGAojxEiLXjgvw1PiSCcVbBs1FczsPPCavk4p4PDPsUaEBOhm2SijB_xx6GZx6KGesMtWiZUTBdc_GLVNmE86wCpXM7JIORaI4ANUu_41TJnYdPNvoxMA_VDpk9ZWEALo8ToD8K6whO48pUbE6CVIpYV_zJU4-TW7aXL-Qk_jWI1VuC9pZKOF5QrB4Plt2yXz2Y9HIkjRPtcL1lFiBH4kUTPVNFsqdaE_2Tn3_orzAG1SvBxEYb-vmz3fj6C3uzv2CON1Zg54LP3QHyo8UEWSBMUxwNwuGYXvRa5exwnJfTIGvwZcbvtHYiD8jC2oMnLuZKHjN8IMxPiykFIBQHb-GEl47kR9reokZvu8Z7DXqrB5ZEbi7OlVc5U9L3iUNJwpqSM8DexoWo5Y1uKrMmI0XaBQxreQEJxX171-sMw8QI4JLN7Uc0hg0ZbdYkIN0oRARdsWC4c_w57wwkLslVXb7dyfdhFMrndBL8yGr-yC6TmLxk8RsxSq0iw-LDAcFbT8Pc03gjw6glEsvZ4xdCdK4Cu0r5Xysr0LwKJNG7Fqj_yXUT86198oCnHQhKOgbppsDwZ-j3EVjiN0zUdgnUBHtN3S0voq6pBqnINDUxC2FmxWMMRmznfDhq7N6dR7bXXuQtrh-ZeG0yKs0M3QkPsubPqa6E_jt6nL8_cRveg5pmUHUV1FSgIlB65bBRIv0zYiaa2vus51ftYtqphxY8d8Ro9E4V-9siwVDOgclX_7KyRf_7wdmJakwNc40sZD7IcGV3Ab8iQRoCYnKgwiUJX3rhmnysj4zkOyuohcg-r1fZsGaTs3Yl5BN_TBvwLup1gXMIzyZtj9DnPwqVIIaekqrbKp_1cowlJbzES-F-kDBJdxG6qBvuLgHseoI3wtCzddeLwIetOlbxwXodRuRhWijVXnsMRJZ3NX0H0xkUwbLfGdXThI7N3EBnhZQLUL7_jRYK9NjVKY_EkS6t5XLE-MK6tFqsh7sqmIcUfOJ5cFpWBJ7XZ0aM8AwfVFXnyVx5TD5kSw4jPV8cJiffYKF1y5ujE1MdhICwlQmtdDxRyX0PX5Vvx35cibjIZa3Tzp5W3qTmNAfuE7tthJ4Zxvv7eeV5uY54eDy9WVoXvCY2uy2xiwv03DBPU25rgDeKA1omYlX3MkXqxV3OsVuncfcvR5gxmb47_MDu6GuFInSNqDIwJLS8pSgYbheH9YQQJsvVwqLFmCIy43mZNoC4YvhoInHj5VOXwa3oBnIN0Ld11nR_cNKjPvqqWVq6XHJVbhTGtFx7H5VLbvd-SeqvE-VkYQ09vkuOFg7uHCg_VqIJCKfvs1U4jbj59ULDhjA4-RR7DpPs3BSx1dviXuQ91-TN3Woh_S2V4l2lcD6t_oR6bbEExtgs9HpPMDDAME3Rj1Pe4k3Lz21I09hLzGj8vYiAotxJeRrViJ_TwBpnv3E9p5kV8pd79bU3yzX0_YhBECcydry_WD5VIZQpoM5IhMHdzMcsNUZpr0k9-O8d1xYVLidg-H1ps9ccgSxpJgB3qsCq4tfScczGtEw1trqYpajGA9MHYwewaJARYSzyA1fQOZAgK7S1TPaamkXgWsgKf5Xsr_8dc2p2D_HK1KsCoc7grqGANZ811NlcEb1hDZFsXja7jio4M4GQ5P0KlqddRL5up51JmlBytUARyuHOxWVIeiOSHU2uS8LR_6ucqhNFOhnofohquZVHw13UqbF7AmaQ3ZSBMlsa2m370B-zPQEgRDJBXvUdTJaCN4SCAHJMgnfKn-gqp063F3T4hOX4QrmZlQfTU1gW3g4jeS-t2FumxsvlDkJQAPGCMqa1OjkU-PzbD1IDqkjcONBOoe4j-3XC5aQQPgXBXs6ZV8GA6URSWSOw768O7EswRWVdV9CTxg&cid=CAQSTADICaaNdpj-l4RUSOw-5UBFA81Y4Dp-FEP0iUjA5ebEgTwFNKwOI9jsdgDYlCFjTHuQrtcPEU-M1hsuXdY2KthsP4yzC3Gkn4t4lt4YAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Fnotepad.plus%2F&ds=l&xdt=1&iif=1&cor=14871821254279322000&adk=1877897943&idt=134&cac=0&dtd=7

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

df6dacf30819c799d3e0ee7cd303240a065b0b10264770911017688a603910c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:01 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12922
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231024/r20110914/client/ Frame 0D56 3 KB
1 KB 52ms
50ms Script
text/javascript 2607:f8b0:4004:c1b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231024/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8793237398349137&output=html&h=280&adk=3809598800&adf=854766408&pi=t.aa~a.3093707004~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1698361681&rafmt=1&to=qs&pwprc=4354248216&format=1200x280&url=https%3A%2F%2Fnotepad.plus%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1698325681326&bpp=1&bdt=3282&idt=0&shv=r20231024&mjsv=m202310260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db38f74f5bba9cd29%3AT%3D1698325679%3ART%3D1698325679%3AS%3DALNI_MbFOhtzjBTfbED67puskk9feSK6ZQ&gpic=UID%3D00000d9cb191db97%3AT%3D1698325679%3ART%3D1698325679%3AS%3DALNI_MZ6ZUkzpsMstOsdeFgOXcsuu-BAqw&prev_fmts=0x0%2C970x250%2C1030x280%2C1050x280&nras=4&correlator=3972234055011&frm=20&pv=1&ga_vid=2061795391.1698325679&ga_sid=1698325679&ga_hid=1146444982&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=3767&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079078%2C44805932%2C44806737%2C31078297%2C31079206&oid=2&psts=AOrYGsnymZq8uzdJoDkwlNsvW-NaSna0XYpnXdP_mu2O8X1-JPfzYwozuJp1M-FBp8XkKpQeFinhy0ybRtjj&pvsid=464992494868551&tmod=122040629&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=GhWwA9iBgf&p=https%3A//notepad.plus&dtd=22

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 01:56:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40291
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Nov 2023 01:56:30 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231024/r20110914/client/ Frame 0D56 20 KB
8 KB 53ms
51ms Script
text/javascript 2607:f8b0:4004:c1b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231024/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a198f092051a356c1e62c1296f628da5732045abafbd974eb7fff157e14ff042

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 01:56:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40276
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8426
x-xss-protection: 0
server: cafe
etag: 17696348727749479825
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Nov 2023 01:56:45 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 0D56 0
0 206ms
96ms Image
text/html 2607:f8b0:4004:c17::93
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSBLHxG7PAZRjSEUwd-uysDqOk08q4Dl9KECG8WDotMotOL7pyxj6QUs5Gitg33bOhai7Fx4plJ3_tS1lX0rIDkt5fs8Q
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8793237398349137&output=html&h=280&adk=3809598800&adf=854766408&pi=t.aa~a.3093707004~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1698361681&rafmt=1&to=qs&pwprc=4354248216&format=1200x280&url=https%3A%2F%2Fnotepad.plus%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1698325681326&bpp=1&bdt=3282&idt=0&shv=r20231024&mjsv=m202310260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db38f74f5bba9cd29%3AT%3D1698325679%3ART%3D1698325679%3AS%3DALNI_MbFOhtzjBTfbED67puskk9feSK6ZQ&gpic=UID%3D00000d9cb191db97%3AT%3D1698325679%3ART%3D1698325679%3AS%3DALNI_MZ6ZUkzpsMstOsdeFgOXcsuu-BAqw&prev_fmts=0x0%2C970x250%2C1030x280%2C1050x280&nras=4&correlator=3972234055011&frm=20&pv=1&ga_vid=2061795391.1698325679&ga_sid=1698325679&ga_hid=1146444982&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=3767&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079078%2C44805932%2C44806737%2C31078297%2C31079206&oid=2&psts=AOrYGsnymZq8uzdJoDkwlNsvW-NaSna0XYpnXdP_mu2O8X1-JPfzYwozuJp1M-FBp8XkKpQeFinhy0ybRtjj&pvsid=464992494868551&tmod=122040629&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=GhWwA9iBgf&p=https%3A//notepad.plus&dtd=22
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c17::93 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0D56 187 KB
59 KB 55ms
54ms Script
text/javascript 2607:f8b0:4004:c1d::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1d::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4e155284926ba010442d774fd493ff925a0256bd427f54596b1244791a3fa170

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60190
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1698233972131352"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 26 Oct 2023 13:08:01 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1CC0 0
20 B 58ms
58ms Ping
image/gif 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=9924029481340&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1CC0 0
20 B 56ms
56ms Ping
image/gif 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=9924029481340&version=m202309260101&ct=76&x=1&cor=11914175694824698000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 1CC0 17 KB
13 KB 79ms
78ms Script
text/javascript 2607:f8b0:4004:c1b::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DKXSOuSE15kY_6Y964KUxJ0tBxvEqt9_o21Cg3eVUkH6GLtYDVGJHKl7jZcBfGiJ8R7XNxDFJN6KKACesttJoF9Z6T-NuhJvhwYgdK_lL-dMGwpfaxiSXJJHVw2WfEC4C8nHc2Hg9EQ5NJJ6vK3ZvadH5GkW_ttDK2vacQJXO2QCSUF6M&cry=1&dbm_d=AKAmf-C8SrNeF2MQy5xvzUS9VTc-iIjRx24GjEkcVO-2BqRffhmbAamR2_fhoX3-VIb85loSW5HN4YSUP5YrKZGitTxp3CjYh4z4vpQ7YLfTzQsK2fBhzyirjrHzJNzcHmBeo35cciAr__Vda88YA9sPprCEigaR5r5bePa1X9pPxv7p1za_M3fSUsdOOaKePUG18aq2fLIeRkMwBoMw5n0v8NN7Ujtk_XM7UJ1NyTHhynLUEO4Pfeu1k457VHrWvSjbCr35nwRjA2lDEki5GKtc876Jupc1vNllgbZEkJwzbW9rbBe4Ie7dTi-gDpzFogqjMnKUD599QDZkjO6123mBjqtYWjpKrodQ8wqg5i9mCjE8eH4-3IfGpw0ikZnVJzqcWktdaXrGpwQZEGaPOiKIKWMDgAOpe6-ltEwTJKrJOpeJyaiR4LotUm_9v1nuCvC65GD24LlMJz3rjScKrLVqQCZpkfnFzZzlXaMtWtJWKF9qH9v5Fjlga8_ooVVIEVbnKomOYNZDz74jirNICo9kCGqHFR3b73w0Jeffum7Qa-bLyzPh6nel0s3f2zORyDObn5Txc_Q_rieYU1_oArFbSSZQc7nZBrUYlZvSIi7PtH7nm3nsqVwQxuLJy46vHfYVC1pnINnxbvSADt7a7RUUxLIuWvcM7EANBrEiVTxlDI6cEBADJlTWdohP0czQTVaz6vd5lY1UOOr6QQDxUE_BsfXyV-HCxJgjqz4WF_HxXmoYMf3vh0C0smR3LGfYszAp2bV-FlvgDYnrg_FmbG_zXS1mhxPRXOJq2poUjDFbsO8rmCV5osx6a3Ufooc7x0IJ2WHHEHOCJ0to3pCDh4fsuxtcBRdHADjZh-tlG3LLTsZDwj_EnJwg1hoPAGUvmFIVA6sLOY5QOcMcIgSsR_BXXGWYlbANmhJrmrDjR6tTzxyCEtCKk5WuVujL5htv_mOF-ojIuSOxinEDwFaM4x-Sd6hRRqSSmz3FUTHwBiJ71-Gk0kTM6rpVF6Oj2aNl0IZhaclH1SJnCNVBrCDEnBd4xmKJQXLp4PAwct6bTYQa3KFTLbu8cueGd_Z12jh-PVfcl4mZvoyA3bXPwGGJl6RWPgSsre9G_Snm8s-vQc3uowkcd0Pmbw7M6behkdtFjOL9ftsdZp-wpl7M_AznxlGK5gTZW-B6Xc8dCxtP6rae7qmujIsYq4KNHdwegtK501HkMN8Ha_xMO3t7X-4islSHEgjFKb-9XOC8M4ehzPqCE1L_J33tm2DUuKOGSAMEM_s3tMPKHA48g2g2C5tyKFaxsz79V8HiEKcr9KxsA8i3OVmWSdQO1cPeXjILApDDMQXdrAPGRbROHTbI33DSYZcqHbTaYj0IdTM2vqx6xHmBPhwLRMPSk8NqWQmWtJPiJRXcSYmJK4iwKBDmPmaher8rqZAe3b9hroAd7DbHV2ObnXyq6bHPhJRoyj6nmS_MMvFYHQsUGZwzm9_rgxJiYS_3JfEIhqRaLeIHjnqqEHbj-ilu5WTVgHxXobgFEP_jYIUJtAguGogH_ReF4yY20RZJ7joTB0L80YpbKIUZQvrSXpqJre7uDqWCY0rZnPEa-0i7Qw0ejZsDKYgCD2-w9y2-0woMpRPb3Tpl8zoidrCScOVeMrItH-FzrQFcjjlEO3nvYyHr9Pfa_yE5NCzHl9g8oiwfB3XYW407s7wC8r6bWz8K9nrkSG4c4_yfemGWzOtLMth5U_zDMmEmgvO39ZK4w7T8ZZ4rBPrJiT7tjZE0qjhlvLyd9ki41qYNhX-a1cexUN5o0ZvAY7zmnM1pyNsoc1l3b0Y6x7TLBesTMn_vDbjdr1K70286jm5NwXLfm68pENWywEOKX2iWJzavgGvXU_jElUhcp_HBCA_arL4YXQ8zkouM72AKRoifqQjPfLjXFCyqd0xG0Tccqq2TdAKOGk1CKTMb9Hr1UpQvQLsFQZwSRg7SMmvSe26Fly5aRKjdO-ckE8bOPmtJWyZ06g0l4JZIxDufWwkVElhQcmRnAcbshT_3dEj41W_tiBTPF4J_5qsTN4qI5hhUR6AFhtioiSXIFBEd0-1aQ6qo9y4LJ1sKh7kwaI2DBmtlrJeYwA0JmUCilB7V_h8PfuiFzvlIjxUjIerm-X0AWuV1jkjOe3QYUjLBICSnFgylyLIwjO0LcruEDyNsMkFAzQ24iOhFvcqizH3gyog-4509BjkW5znaFAqskSfHdTyRCE9QQY5AjwMnvorWRwiNqF1aE0RrHz5UCoqHK173myDb_ODnylB-vncphIJXi0nJ_i2YsXWopSq2SSbfbxUk4Hu8vkH6M-dbonPXKTqiipFdNqoOgNz6eK9ft9chYXt-CYsc3vnfZN7ZxEmNOoxhEbQWkmJ4c8aWwUM9CChhcDxiLbDeU5Qv9usY4d7RCK6epZxK4TzyzqzCiN3bBx26D7c4ayKzSib9YbYCtEFtdcDQQc8qisvJypaGuLdyL1amQwxHi6QTJy3FJbXnnnDIXq2Y5l5jI1UH3z01-aw3UdSKBoBaLlWe3U1OiehOMfxYfCeQYpUw2Cc2Nto5Gp8zP0boVsfVISyy6HZTIboJxl6sr8tuwbpoDo5fByAfbLkCgJtyrm7xzLY0iu_7UiLaN2LJnwVir2zJXPrFLwdG5WyPqjt_oW9buK--19_6oWRSlIvP9v37yPFmwExW7J44nZDNqoWn9eTsbLtxOjaoeWL25f0kz3To1c_P_GA9YF1sigGlkuKcPQMRCI8xXV0JmvXECVnjuWEkqmFGZkFa2QL-n0ahWBQjWGVcKikchIjiAvB3wErRZsZQ0ZQ0N9LmbfBdfcLbk1bo8Y25ek55N299ZTR5_dtxjUsWaU90Fb02moJmzl_Gz4i4FnECHpCx4ZfoFOUbvVuDEsXPopBwHhvKR8iDmRbZKEUoBTwM8Fu1qYqsJAu2B2PMUZTQpOq3q096nPNf2h0pfRB9zA&cid=CAQSTADICaaNdpj-l4RUSOw-5UBFA81Y4Dp-FEP0iUjA5ebEgTwFNKwOI9jsdgDYlCFjTHuQrtcPEU-M1hsuXdY2KthsP4yzC3Gkn4t4lt4YAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Fnotepad.plus%2F&ds=l&xdt=1&iif=1&cor=11914175694824698000&adk=929882891&idt=148&cac=0&dtd=3

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::9a Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ae13dc1853fc0a434d6b32e95ea96daedd6b24e6b17c29f94afb455c6edbdf29

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:01 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12794
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 afr.php Show response
ads.us.criteo.com/delivery/r/ Frame 323D 189 KB
56 KB 234ms
129ms Document
text/html 2620:100:a001::24
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.us.criteo.com/delivery/r/afr.php?z=ZTpksQAF6jEBy5LUAAGCiKn2zoQLcyfCJd0Y6Q&u=%7CTIVlNeULxIbDQCLueaOAB65suUgbUaqWeVDQA%2BfXdtI%3D%7C&c1=TUPLs6ok1IhDgnvJmJgq2b8G6XvEBIvqAb79lxbNLn-Y29LVqxBSOQhZKVxZui5pXNlU4WPrBd9-dzZ-iTLkdn4iCWrkEk_c7V37h3O1uNpc7l9p3RaxObo3oWgvCWGvwuSS1li6tg9CxAzRg8UgW2cKt5wKwfqExTACL3pKbxf0baTOvkClYxt1iFShf82BNOs44yR-NTv9my_xnnMBvmP_g54znTZDPZ5fcB7qnEkXpK8tVFBB7xr9GAXj5vC868yzlITwNXwjDZYu18U2dy5T6dlZfRfXx9kgvndm7ltv8C9RhfMXWIJRL98ikyzdeM__-0An-Nz9hXlzyUmTNGk8yW6zazurQJ4eGNkbM4qxejld4jwwMwtZwR4lJeqkzh5sW_w9MaJHCXj_QqRY6eC8Knk9EKxQZNc2llaws-3v2lGsM-jJ7I_8l53ss2FN2DJAlJPlTHg901C3h54rqR2wQHBLv49Cp2zeUA4jMoLfLtOxvto1Msk5W2aEPw-KXVWf0efHzpiKWKf3T-WrjjJ5b3U-qXpEftXYZ9A3QqZM7B_-HGAUnaYv3E0IB06c_3VZRk3bcYAjjs_4OZpo10nS6d0ZAS4mVE2wflpDkFDiLW-WqKkPjkDB7FdhPEIQSR8hv_TlZ57QXMgqDn4g4g&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCuyZSsWQ6ZbHUF9Slrr4PiIWGuAWcge-wXKqxqqp0wI23ARABIABgyQaCARdjYS1wdWItODc5MzIzNzM5ODM0OTEzN8gBCagDAcgDAqoExwFP0Cy1sV10cblQuuX8KVGoYj9q1JhAe_zJt9Je4bD0IlPTlNADShSynNfngiQDD09PrtoaXfwR-txV6Ri7GJKzVkpMw0MyZX1_MWeOEbHTfprXOnisR_4AUMwzBiW5mZKVvNrtdC3sepFfbUCeipZ2xIHCu5PqvRMuZy87z4ajKCV4w2GAycQCLUX5arNVzI-0rwpfzJ9aGJvpyy5NErVCOGNXZfQud3pmnt1d7xSDU7g6aKroaD129Umj1rdZ8ZID6NMb1U3GgAbL_Na85PqiriSgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggSCIBhEAEyAooCOgKAQEi9_cE6-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_1BOjoR13gJLczzYHyYjBm_jD7RRA%26client%3Dca-pub-8793237398349137%26adurl%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::24 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

110b1d88941fd860026f43f52e938ed77bef0c68b01dfb0cdab12b2f3f352867

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Thu, 26 Oct 2023 13:08:01 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.us.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.us.criteo.net/heavyad?cppv=3&cpp=T5EEC9aLxGjWD8YGFzHW7w6uuxB6cb7KJ6F6vi3eURAaiMRqsS-18_HIgJzC_MV4fJaur01vTYS9ZmjpfCl76k7VECY4G0bGDBSi7FFBHjlEkccob80KZN7m-487jxyiymj1tFMUaYidyrX9G6jnlpPImftlagZxACK0xp6Jmh1ess4yIrpCs6IkkBcEWKKZh055ykUs84IGuWmB3hlnnswdFbYkg9h_dXwEjR7Ov8NYwH-SXgr_nQmzAeYofkK4ALsvEg"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 79781521
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame AB08 1 KB
643 B 34ms
32ms Document
text/html 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 83719
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 25 Oct 2023 13:52:42 GMT
etag: 48472445140208031
expires: Thu, 26 Oct 2023 13:52:42 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231024/r20110914/client/ Frame AAA0 3 KB
1 KB 33ms
32ms Script
text/javascript 2607:f8b0:4004:c1b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231024/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8793237398349137&output=html&h=280&adk=965705852&adf=4284688756&pi=t.aa~a.4100179273~rp.4&w=1050&fwrn=4&fwrnh=100&lmt=1698361681&rafmt=1&to=qs&pwprc=4354248216&format=1050x280&url=https%3A%2F%2Fnotepad.plus%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1698325681326&bpp=1&bdt=3282&idt=-M&shv=r20231024&mjsv=m202310260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db38f74f5bba9cd29%3AT%3D1698325679%3ART%3D1698325679%3AS%3DALNI_MbFOhtzjBTfbED67puskk9feSK6ZQ&gpic=UID%3D00000d9cb191db97%3AT%3D1698325679%3ART%3D1698325679%3AS%3DALNI_MZ6ZUkzpsMstOsdeFgOXcsuu-BAqw&prev_fmts=0x0%2C970x250%2C1030x280&nras=3&correlator=3972234055011&frm=20&pv=1&ga_vid=2061795391.1698325679&ga_sid=1698325679&ga_hid=1146444982&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=275&ady=3092&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079078%2C44805932%2C44806737%2C31078297%2C31079206&oid=2&psts=AOrYGsnymZq8uzdJoDkwlNsvW-NaSna0XYpnXdP_mu2O8X1-JPfzYwozuJp1M-FBp8XkKpQeFinhy0ybRtjj&pvsid=464992494868551&tmod=122040629&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=i085cixuMS&p=https%3A//notepad.plus&dtd=17

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 01:56:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40291
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Nov 2023 01:56:30 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231024/r20110914/client/ Frame AAA0 20 KB
8 KB 35ms
33ms Script
text/javascript 2607:f8b0:4004:c1b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231024/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a198f092051a356c1e62c1296f628da5732045abafbd974eb7fff157e14ff042

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 01:56:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40276
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8426
x-xss-protection: 0
server: cafe
etag: 17696348727749479825
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Nov 2023 01:56:45 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame AAA0 0
0 151ms
95ms Image
text/html 2607:f8b0:4004:c17::93
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTBzuFoj0ZEx40cBx9eQiXq9yJ3XJGKHL1re1vE4AjxSfyBvR2E7aqmyiW85qTVC7U4OYCXRdSnE78az04pZNUJncWoRw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8793237398349137&output=html&h=280&adk=965705852&adf=4284688756&pi=t.aa~a.4100179273~rp.4&w=1050&fwrn=4&fwrnh=100&lmt=1698361681&rafmt=1&to=qs&pwprc=4354248216&format=1050x280&url=https%3A%2F%2Fnotepad.plus%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1698325681326&bpp=1&bdt=3282&idt=-M&shv=r20231024&mjsv=m202310260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db38f74f5bba9cd29%3AT%3D1698325679%3ART%3D1698325679%3AS%3DALNI_MbFOhtzjBTfbED67puskk9feSK6ZQ&gpic=UID%3D00000d9cb191db97%3AT%3D1698325679%3ART%3D1698325679%3AS%3DALNI_MZ6ZUkzpsMstOsdeFgOXcsuu-BAqw&prev_fmts=0x0%2C970x250%2C1030x280&nras=3&correlator=3972234055011&frm=20&pv=1&ga_vid=2061795391.1698325679&ga_sid=1698325679&ga_hid=1146444982&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=275&ady=3092&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079078%2C44805932%2C44806737%2C31078297%2C31079206&oid=2&psts=AOrYGsnymZq8uzdJoDkwlNsvW-NaSna0XYpnXdP_mu2O8X1-JPfzYwozuJp1M-FBp8XkKpQeFinhy0ybRtjj&pvsid=464992494868551&tmod=122040629&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=i085cixuMS&p=https%3A//notepad.plus&dtd=17
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c17::93 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame AAA0 187 KB
59 KB 50ms
49ms Script
text/javascript 2607:f8b0:4004:c1d::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1d::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4e155284926ba010442d774fd493ff925a0256bd427f54596b1244791a3fa170

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60190
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1698233972131352"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 26 Oct 2023 13:08:01 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 1CC3
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CWigir2Q6ZcW7CODMhQbGzqLIBdDon-pz6NzDkJ4Rh4XM2NoPEAEgkZnAkAFgyQagAZWAse8oyAEJqAMByAPLBKoExwFP0GrHlaiv9MTH1BYMzHGnfr0IFnR7Ho0t_FsnTvm6UDENJJkSL76...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xdfb575f7a0daf1340000000000000000%22,%222%22:%220xaf9d8a6223cfd4040000000000000000%22,%223%22:%220xbf6aa1...

0
0

156ms
48ms

Fetch
text/css

172.253.62.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xdfb575f7a0daf1340000000000000000%22,%222%22:%220xaf9d8a6223cfd4040000000000000000%22,%223%22:%220xbf6aa1900ef8afd80000000000000000%22,%224%22:%220xc5087d503d158fb20000000000000000%22,%225%22:%220x9ff8d5562fd2ccf0000000000000000%22},%22debug_key%22:%224732591415423470756%22,%22debug_reporting%22:true,%22destination%22:%22https://questtips.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2210971004949%22],%224%22:[%2210-26%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%222621579786589537377%22}&andc=true

Requested by

Host: notepad.plus
URL: https://notepad.plus/

Protocol

Server

172.253.62.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:02 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"1":"0xdfb575f7a0daf1340000000000000000","2":"0xaf9d8a6223cfd4040000000000000000","3":"0xbf6aa1900ef8afd80000000000000000","4":"0xc5087d503d158fb20000000000000000","5":"0x9ff8d5562fd2ccf0000000000000000"},"debug_key":"4732591415423470756","debug_reporting":true,"destination":"https://questtips.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["10971004949"],"4":["10-26"],"6":["true"]},"priority":"500","source_event_id":"2621579786589537377"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 26 Oct 2023 13:08:02 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 26 Oct 2023 13:08:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"aggregation_keys":{"1":"0xdfb575f7a0daf1340000000000000000","2":"0xaf9d8a6223cfd4040000000000000000","3":"0xbf6aa1900ef8afd80000000000000000","4":"0xc5087d503d158fb20000000000000000","5":"0x9ff8d5562fd2ccf0000000000000000"},"debug_key":"4732591415423470756","debug_reporting":true,"destination":"https://questtips.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["10971004949"],"4":["10-26"],"6":["true"]},"priority":"500","source_event_id":"2621579786589537377"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 afr.php Show response
ads.us.criteo.com/delivery/r/ Frame 37AC 146 KB
47 KB 149ms
91ms Document
text/html 2620:100:a001::24
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.us.criteo.com/delivery/r/afr.php?z=ZTpksQAF0r8By6AkAAZ6JeuB_IBy1X4uLQQdgQ&u=%7CTIVlNeULxIYp6RnTTZHGErQt1nrZn%2FZdcid1JSTkTk4%3D%7C&c1=TUPLs6ok1IhDgnvJmJgq2b8G6XvEBIvqAb79lxbNLn-Y29LVqxBSOQhZKVxZui5pXNlU4WPrBd9-dzZ-iTLkdn4iCWrkEk_c0jgPPMIjIQU-TE3in1PibGkZKE5tD8qqACT13OAWplwUbMFDPkytS07i2BC4mIy8W22Lft-c_hvNw8_mOTTzxdIxxxO5LcMCzLHnh8efYuxz8zlAk5tJE49ivghyCsRKsB0EVZ6oFIlJAMAaDwQktdT9U-xGCyAJhHTp1VUoFEqPI4twKMMdITlT9NddkIlnGrtwQaIQ5NGww0dUrLA-WGHOY0ex2go-wp0QHJ_bzF1Vqsag2ctC9tv7Ua9MUfpWZ7T0SpMDBWHFja_1pQ6bv0ezs5S9UC7zrg1V8J7UYxz1v8sNUKiyWaCESi684co7DtCBl9MlyOlWvMlkvNzjV8GZg5AIHBjBqYycmYwe3CHsTbsPQZaffU39HwbtKTM-8pI2lcFOs1cDBEXJX7clT_BzT8Hly7OZnpmuJY1GHyvb4GTNxshgaInFgUDXzUnnPf--aMxEWavKRdUmUuxvTqdfIsV_djyJSE6FHMQSRd5JREE9rcnAkO0NG1Q3CEvNCZdcA8XziWi8Z1x-K3MfwV7Yk0AA0QsELObxu_Imh2CDhOqeGp2iQw&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCVSQ3sWQ6Zb-lF6TArr4PpfSZqA2cge-wXKqbqap0wI23ARABIABgyQaCARdjYS1wdWItODc5MzIzNzM5ODM0OTEzN8gBCagDAcgDAqoExwFP0JH6GwU-1lt_IT3bkJMNPQ28YvY2-JTGkAqWIddlbed65-SQq5lFoDqZB1Xiqtv_OA5-JCf9HATGlhj_HJ254qgfAe8loBVzEPqUF7KKU6tpC7PIWKSdaHCbpJf8GyMryYsrmsojr6U_tiLA9uu_rLS_pABxulyQl45RoSbQ2cZ9c0aLz0qcE9TvLFC0x6DyRRWS_UKq44ekqY5JZgc9rscfYWIgOPKAVhzSW-OEiYjX5xVLOvUbyriD29498s7eUAwUqKfLgAag94Dzp_Pgw2SgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggSCIBhEAEyAooCOgKAQEi9_cE6-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2qVwC0-nzl-4XNmFVInqJyY-ySdA%26client%3Dca-pub-8793237398349137%26adurl%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::24 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

1130653b156239aa7bc8e9bff4122c9154ece37aaaa2e5ee173b3190fbbc45e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Thu, 26 Oct 2023 13:08:01 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.us.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.us.criteo.net/heavyad?cppv=3&cpp=X1-K6daLxGjWD8YG313FC7za6KRBgx11govjHMmlIkFHO176jvbwj2wfsJoesWNmFnBwjtAj41QBPXFsGrliVEeK_10k7t2UGIVulsWpNU-NFoK5-P900ssMQ4t4hdcuA2N1dnRnepWYcaVNlZ9Miey41pqr3yREKoXweqUW_lHzem-wB2WKx-jFKPosXoV9pfN5vvCUtN8eDD8lawFJ4eNkj8qBuR6NzGcse656VXeTZMCt7Ce0nsW9zMUYPp2-vhqxWA"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 38608825
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 3B0B 1 KB
643 B 38ms
37ms Document
text/html 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 83719
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 25 Oct 2023 13:52:42 GMT
etag: 48472445140208031
expires: Thu, 26 Oct 2023 13:52:42 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame CD42 41 KB
14 KB 35ms
35ms Script
text/javascript 2607:f8b0:4004:c1b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CS3L4t0mfHPFLendAbNdvMVjhrWCZ7wUFbNuAjv2CaE6qwEFJTdXmxuolKxK6zsy9pLUQ44TWzSSwG5G8mF06TCXhQDqYTmpDExV27coXhRsxHrhWMvI9kn7NxvFK7OgoMY_WxOH2IhNjdYhopvxqir2d5D9a6syuqQiVogC59SKwKo68&cry=1&dbm_d=AKAmf-Ao5C5VxFk8l6WIDKqCO77SJVed4OMJeq2vwrKTPJVv6IZdrFSViC9FLaEZl0c6KmvuhU8fVZuXiRUVzSDbiXKyOd-skwBJiiTIRt_oZFC6FpV-5fpaakVcrAzcmJ0Ryu94PFacHw6Ud3MqIF8zcVUf5r3zudPoLJOYDidpwTuXCwqsqLm-7X7DO7_j7VydWUCzJNWGf5uPTQxp3vj8zL86orRm8oYKJBTpPC4lhH_OXigLjud3pmRIJqZwThgunDD4g5-PMR1Zwr-pmrkp4fUOhFavrSgecnt2DpD_OlKQk6nf-l8p_ABIaDz1pT37ZuiJfxMRPq-GNEtnoRUGgjUZVWxLYoxRQKa-tXdMEWhJOPpoRbJL8baoKQXN-R6ycy_5uY20f4HmSLlFE-dsDexAPwC1sjI_YukDDM7u1accZPP4mkd1RCapI636jrqoj-8hSC-iCuOkOwjWrc_rmZBIIHJhW8ZZ8FifDvxPbmeUroVYnNAOXuQmofzGxh_2zLVKHbyiBFlZAw5-ZJeUovoAPHMH2Z0FLnpnUxOkBQbzWDyYOPuZRCM5fl79zyeuWT7mb5elcg9-BfehqevDHP2Pi6dhVZlo1iWU-uM4oZ1zXQuuVynMA2xhqAWdUYxvNkx-jU7RtYF7f6ExvMff-RzPxgT3vFdGZaqKbZGcBJSZ8StmcJfLfDiQZrn1VEoLRL4txRKBr9NGqtMgB9wTn3RXgr3Styhf54LN6TcJkX8rtd6uyobYXm75CWXvQLTJgj5CIR4Oe7wOkGw63SPR3Ca5zOQ-eriDdo-ow-v5fUFqSbFW6HqHPAfrftbUMPdDcR7LN6sA4jneUkh0BsIq3ta57LK_L9EY2d5X7RG8f1YUlBWDKBAakQpsH9gI3kw9uH4A2V5eJ95IT4vAIo4wxqAw1j_9rnN0PEAidUaaO1SfPjjDdtxsO8vkWNa2Onf5PDy_hc90GcGpdkYz7j1B1vihSbrXiAhW1LyFS6-I7iHWMxcS_7D9I0qvV2RgdT9BdHcXByT7DPWm1byiu_SE4QvRgqnLEVOrpCZyePkgXTSYQ8C1bpN2xSau5N4K-t6Im_a94h3o4bnGAojxEiLXjgvw1PiSCcVbBs1FczsPPCavk4p4PDPsUaEBOhm2SijB_xx6GZx6KGesMtWiZUTBdc_GLVNmE86wCpXM7JIORaI4ANUu_41TJnYdPNvoxMA_VDpk9ZWEALo8ToD8K6whO48pUbE6CVIpYV_zJU4-TW7aXL-Qk_jWI1VuC9pZKOF5QrB4Plt2yXz2Y9HIkjRPtcL1lFiBH4kUTPVNFsqdaE_2Tn3_orzAG1SvBxEYb-vmz3fj6C3uzv2CON1Zg54LP3QHyo8UEWSBMUxwNwuGYXvRa5exwnJfTIGvwZcbvtHYiD8jC2oMnLuZKHjN8IMxPiykFIBQHb-GEl47kR9reokZvu8Z7DXqrB5ZEbi7OlVc5U9L3iUNJwpqSM8DexoWo5Y1uKrMmI0XaBQxreQEJxX171-sMw8QI4JLN7Uc0hg0ZbdYkIN0oRARdsWC4c_w57wwkLslVXb7dyfdhFMrndBL8yGr-yC6TmLxk8RsxSq0iw-LDAcFbT8Pc03gjw6glEsvZ4xdCdK4Cu0r5Xysr0LwKJNG7Fqj_yXUT86198oCnHQhKOgbppsDwZ-j3EVjiN0zUdgnUBHtN3S0voq6pBqnINDUxC2FmxWMMRmznfDhq7N6dR7bXXuQtrh-ZeG0yKs0M3QkPsubPqa6E_jt6nL8_cRveg5pmUHUV1FSgIlB65bBRIv0zYiaa2vus51ftYtqphxY8d8Ro9E4V-9siwVDOgclX_7KyRf_7wdmJakwNc40sZD7IcGV3Ab8iQRoCYnKgwiUJX3rhmnysj4zkOyuohcg-r1fZsGaTs3Yl5BN_TBvwLup1gXMIzyZtj9DnPwqVIIaekqrbKp_1cowlJbzES-F-kDBJdxG6qBvuLgHseoI3wtCzddeLwIetOlbxwXodRuRhWijVXnsMRJZ3NX0H0xkUwbLfGdXThI7N3EBnhZQLUL7_jRYK9NjVKY_EkS6t5XLE-MK6tFqsh7sqmIcUfOJ5cFpWBJ7XZ0aM8AwfVFXnyVx5TD5kSw4jPV8cJiffYKF1y5ujE1MdhICwlQmtdDxRyX0PX5Vvx35cibjIZa3Tzp5W3qTmNAfuE7tthJ4Zxvv7eeV5uY54eDy9WVoXvCY2uy2xiwv03DBPU25rgDeKA1omYlX3MkXqxV3OsVuncfcvR5gxmb47_MDu6GuFInSNqDIwJLS8pSgYbheH9YQQJsvVwqLFmCIy43mZNoC4YvhoInHj5VOXwa3oBnIN0Ld11nR_cNKjPvqqWVq6XHJVbhTGtFx7H5VLbvd-SeqvE-VkYQ09vkuOFg7uHCg_VqIJCKfvs1U4jbj59ULDhjA4-RR7DpPs3BSx1dviXuQ91-TN3Woh_S2V4l2lcD6t_oR6bbEExtgs9HpPMDDAME3Rj1Pe4k3Lz21I09hLzGj8vYiAotxJeRrViJ_TwBpnv3E9p5kV8pd79bU3yzX0_YhBECcydry_WD5VIZQpoM5IhMHdzMcsNUZpr0k9-O8d1xYVLidg-H1ps9ccgSxpJgB3qsCq4tfScczGtEw1trqYpajGA9MHYwewaJARYSzyA1fQOZAgK7S1TPaamkXgWsgKf5Xsr_8dc2p2D_HK1KsCoc7grqGANZ811NlcEb1hDZFsXja7jio4M4GQ5P0KlqddRL5up51JmlBytUARyuHOxWVIeiOSHU2uS8LR_6ucqhNFOhnofohquZVHw13UqbF7AmaQ3ZSBMlsa2m370B-zPQEgRDJBXvUdTJaCN4SCAHJMgnfKn-gqp063F3T4hOX4QrmZlQfTU1gW3g4jeS-t2FumxsvlDkJQAPGCMqa1OjkU-PzbD1IDqkjcONBOoe4j-3XC5aQQPgXBXs6ZV8GA6URSWSOw768O7EswRWVdV9CTxg&cid=CAQSTADICaaNdpj-l4RUSOw-5UBFA81Y4Dp-FEP0iUjA5ebEgTwFNKwOI9jsdgDYlCFjTHuQrtcPEU-M1hsuXdY2KthsP4yzC3Gkn4t4lt4YAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Fnotepad.plus%2F&ds=l&xdt=1&iif=1&cor=14871821254279322000&adk=1877897943&idt=134&cac=0&dtd=7

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 18:15:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 586353
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 18 Oct 2024 18:15:28 GMT

GET
H2

200

adj Show response
bid.g.doubleclick.net/xbbe/creative/ Frame CD42
Redirect Chain

https://fw.adsafeprotected.com/rfw/bgd/1712960/75657828/xbbe/creative/adj?p=APEucNUySr-ptmum7FUrNTWZ2H8r2hJn2DZA4Jd0Klhc-k-rVeFtYDg&d=CokBAKAmf-AxGL2T2jkOXNIds2jkUuF-4XIDV53rBBEqnCi2przU0gGvje5DYtp...
https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNUySr-ptmum7FUrNTWZ2H8r2hJn2DZA4Jd0Klhc-k-rVeFtYDg&d=CokBAKAmf-AxGL2T2jkOXNIds2jkUuF-4XIDV53rBBEqnCi2przU0gGvje5DYtpKEkdlF1j9OCYyht3TAhrhOePU_...

62 KB
24 KB

84ms
79ms

Script
text/javascript

172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNUySr-ptmum7FUrNTWZ2H8r2hJn2DZA4Jd0Klhc-k-rVeFtYDg&d=CokBAKAmf-AxGL2T2jkOXNIds2jkUuF-4XIDV53rBBEqnCi2przU0gGvje5DYtpKEkdlF1j9OCYyht3TAhrhOePU_A_QK5mxZhbzaprSAOtWhj1VuDLHJN4NBxUCKk40vt82KZ8sbwrHkZ3tW0l_Mhj6KozH_CC92QDdc-HjlnbysynU8lbekP0493QS6RMAoCZ_4E5B1G696fhFOkHEjKUaDLW2R4Y6nmyOAf174VtMK4oiw1FVtn0Zuf-BndyLhiS9dVWkwV_FlyWSkLo1K-g7v8dzQbcNSEmHusFXMA8VYvPIx2noysjwuYAgx2MGGlPN2yA1-rwNqqb5uEqiHpgiqmmDgqJzeX6SgOPp9tcfZXWAEypm8OuwFo0yBgTJdAa5fQ9O_I0HGatnCWs7HO2ATodu9h4a8r2YZcmnDxKQJcQ-Lw-CBkJsRnB5fsrnN4C7JVVKhFKXY1UZcViu3_v9Ig19R6xTBqoaWBvYV2DN1N8PnEtp91VL7Rvh-PQQGPm7vYFNHTSCLEqdERBs2sKlPoMVn2H0u8evAMyJN1dT2_zFJtYlpE6N9zsrfx-3F0Gq5qSA5Ysd5GSNbrutXFFzsnkU-ehmbWo0jyswFGaQFA7-eBrdttdw0c55tqd1Nx7pWWRo0DS_r7DGQtptX5ekeaIOBqxt3r5MZ_k8Qjs6TqVOuApFMKnR4oudklLg3rP4PGYXqy771qA8a8qMNMnQ3bnvu_UyOVfGJF-TcHFrRtC6oMXGKi1N777VJf1vAVeRRPggvgRPUKYokmqAN8nmWODnFGJyd54MXX_uyaGLHsSneKFZzCRRjV15gdK-zaGWgBysZTzm6h9wqe4Uj7eFQmKoRe4DT3Io_3ofsoiJh8MZ2bz2NeoCfcWLEeVhJ7hU5TQrvQ5VWeCKVeechG98gRYAVS2LgD-wQQBgNWXpjvpD0TwY8KWB9yQWpbspk36IAzxmwLDi4wwKpzY1jTdm0dK3iY2AeLWlFikXUTa-7jSnOep6un-yFBV-rpCM-yoqgI5mWRX9KDHLSzx76DzyAFeOScZ0JQVB8PEV-0BjRnwgR6X15Kss8S8MP0GCBspq3HM6NrM6q2tUrfETKgRaBGBfGQuR6FHTPQ22rzu05iR_7HqT3KEk0r8UFcKudX3x13lnORpA_jQR194r_RjJA00DkKTzgkMlDf5TiDRPmTnaE1ogdjwEr6oxHOcJXbHLNYbkhl13MXIbnvUuwhbYLwEYDcYAMOsiUgMVjdm1fQQyisEFzv1qVgfiC7gp1TD1SzaaqdPqVI4hE5AEI4bH3wsEKG5KPzxsfHk92BA4a0miwXFQl56UPNbA0GWLypkSzP4IIW4SjjD_zwpt0nUNvPKMBydlJMk5ld6M-_aHsFQ09IKy76dZ3zK35SyCINE8ef-AvH9T8gffx4EfDK6pJ4FX_rNVpWn7zn6s7wgFt3h46AhaHsExo8N5R4yAthDqPFQ1-KCEe1yL_2YNOP04fPbrvzAFf3I0PzOQf6wXBQq4jLBLVB0GidUFYCgXEC6IgRs_8RG6AYFPK4JRKq5qVUdOcOLlFtSfTByhnK-9p0a4cz3lZSllRfAc_Ds14tKU7potjBSton2f_HWpL_9HyB8i6WZtPs6fBivTU6stxhXHbvdjXDI4NiGKSH_lr_8NfNUod4RweOSO3PdE2JTAtLEI3L62by_BP07p7atJdOBq9UKOtOdk1SsgxCBX-o7AVgDH_OFkBox_hiJb8lJiq7swkVxYeXuyKEMfZ-VICBdAEwKU-zbSIN-58M1yPDwWQ8D5_oliN1R5662VWLJ-erTK_uLvYYpcfmdD6CUgVLBBvIeRZcBvc2gJXSko4XxRGjxRfnTccFXrJ2ggYCM6gcglQddZFH-LFmkBu28XRFykVtkUAuQrnqLPKTrwm19l03oixUD_YDNoYKkcyuVZrWMBT_J7pU4KtbvzmiYS51EvytEi9fRChgcArS-e-_o-4gNYcGpWd06-N3s4ICIY_bcz9Z7apBz45H9-5LtI5OpjqDlvgoAdMrmsfS7Ll45iTB1113twtbElqr5j_pzAbN8e3DzSzF8WnE_kINCpfx7gOK7muP8R7junX1N13UYKJUGHOei7is9KegxUf5yhsR51MscJO-k0xtTxybxn6FaaQNu9yhW2qcCHcdegn8TkP0c3uOnJl5hmLSdoS8rb5DPUgfDzoj_QKSsyaHA5SbNoncf2S884mLvF7BEovBfivHivjdK-kc_2kFQGWp20POizhaKPTDncErbC32dClBwG8FtsWl0YQ2OWAXLcHg8sJlbC0DI0uR6OewvczAM350m4maqdz3nDuzN-zPGx61jKgqY8R-CdwH7BH8hXacFdynpy4ijqX18v4EhvMtTkFpQ8GscWjQy82Ztwx7QnV4hJpPT43ePr2TNNR1j5yx9xFAGieZbWrKybsQ-7ivv0jSw0OeW9tXSus1228gFSHUxFnRWmTgdMy0tmC3LhGkykf5zAIgJlHtHu2YlgVdXXIXp2Gjz9wrRPX25ueKCqpOTp3xOCVrU6yYIktvXsR1jU58Hp4AkUD7dcH7lQ1MeO0eaIp8D3WQirStDCmKQNnynI3SydpLyec7_NL6FJ97C3r4RpV5Dq4a6CChfbpyDUfDLNguKL4l8gHqCWi8ZpKY96idVUy817TGBBCCGr_o0ckgfZHpV0PAMOVNNMatPQcvndhWsVJgmQJYBBs4h4UW9pcB6J4fdN-NEx1A4KlE-VkyZ6aXHhKvpGf8uYkYFWAYjbzXEGQwxhkE7zkj58-lEL9iPdIINERgAmmK7kPEyujNPXfw7pqfakp3a8ULKIfIZbMOBLoNjB1b3YXdOKDQH5I5OcdnChzbgjTa2-nc0NbumZcaxlao0wiYFKzvgo5zhSbqHKBulCAd_zJ31N_8vrNF8q20LkcvKj5czYg3Cu3DZNOlFjf9bNW1jGwGwI2ehorIz6Cll7Pe6cxaLuVpNaxSpbizDFcx6Bsb2HxZD0_aDPuNg-lOAOykqrCcjJ9q6n8yDSqAqbCBAWTRa_-MmNzoXnELsoXwxx97vBq0c4Y3nEC4bqILJ-aHfqI7SrsLxx58e6AOcSQ6oWy29it2GBqznKUuTAcoK5IJz7IYSorW-Ls-H_NDjZDZyIRCT34rffcQxwPFJ9k-thsH86lmXcHDBxJMUSm3KOB0v5QHpI3rlwor7ULsUBkzLC11E9YfMKC48CdDMlMRWnhnuqTHjh6a-W5JxJ1KwyfRpwiNGlooygZqkMmepBIZvOKB1llJsHiiXAQg5FCLxe44vQ6mbF9WWr2iCAvjw8WIEDDpzNkAnq-VbFTbqnsDHYl8I2_AWDikizUkgar0aBcEP54a4Y27ZnuOiYeqGmr8XGNvK_8NgRl0HqGJLXas-Bdy2JXV8MRPN-L_DotTQtBbxQ3OZtSNnnfr5vvm--Iux6BO6k8Q-covSXNA0PZ54oOxfYIHgxdNkd1V2hWY9QzgndIEcx1bCRVF4Q-Og-pq0FN6UkwpEleCshu88WjQ_02gfDy6QaM7erv3771AlDCysf5lveNC8eWhpSCAQSTADICaaNdpj-l4RUSOw-5UBFA81Y4Dp-FEP0iUjA5ebEgTwFNKwOI9jsdgDYlCFjTHuQrtcPEU-M1hsuXdY2KthsP4yzC3Gkn4t4lt4YAWAB&bundleId=&ias_xappb=

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b293502da19eddce2054ed20fe52beb832a4be226c7af5c2f1b6005be5631957

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:02 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24339
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:01 GMT
server: nginx
x-server-name: app14.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNUySr-ptmum7FUrNTWZ2H8r2hJn2DZA4Jd0Klhc-k-rVeFtYDg&d=CokBAKAmf-AxGL2T2jkOXNIds2jkUuF-4XIDV53rBBEqnCi2przU0gGvje5DYtpKEkdlF1j9OCYyht3TAhrhOePU_A_QK5mxZhbzaprSAOtWhj1VuDLHJN4NBxUCKk40vt82KZ8sbwrHkZ3tW0l_Mhj6KozH_CC92QDdc-HjlnbysynU8lbekP0493QS6RMAoCZ_4E5B1G696fhFOkHEjKUaDLW2R4Y6nmyOAf174VtMK4oiw1FVtn0Zuf-BndyLhiS9dVWkwV_FlyWSkLo1K-g7v8dzQbcNSEmHusFXMA8VYvPIx2noysjwuYAgx2MGGlPN2yA1-rwNqqb5uEqiHpgiqmmDgqJzeX6SgOPp9tcfZXWAEypm8OuwFo0yBgTJdAa5fQ9O_I0HGatnCWs7HO2ATodu9h4a8r2YZcmnDxKQJcQ-Lw-CBkJsRnB5fsrnN4C7JVVKhFKXY1UZcViu3_v9Ig19R6xTBqoaWBvYV2DN1N8PnEtp91VL7Rvh-PQQGPm7vYFNHTSCLEqdERBs2sKlPoMVn2H0u8evAMyJN1dT2_zFJtYlpE6N9zsrfx-3F0Gq5qSA5Ysd5GSNbrutXFFzsnkU-ehmbWo0jyswFGaQFA7-eBrdttdw0c55tqd1Nx7pWWRo0DS_r7DGQtptX5ekeaIOBqxt3r5MZ_k8Qjs6TqVOuApFMKnR4oudklLg3rP4PGYXqy771qA8a8qMNMnQ3bnvu_UyOVfGJF-TcHFrRtC6oMXGKi1N777VJf1vAVeRRPggvgRPUKYokmqAN8nmWODnFGJyd54MXX_uyaGLHsSneKFZzCRRjV15gdK-zaGWgBysZTzm6h9wqe4Uj7eFQmKoRe4DT3Io_3ofsoiJh8MZ2bz2NeoCfcWLEeVhJ7hU5TQrvQ5VWeCKVeechG98gRYAVS2LgD-wQQBgNWXpjvpD0TwY8KWB9yQWpbspk36IAzxmwLDi4wwKpzY1jTdm0dK3iY2AeLWlFikXUTa-7jSnOep6un-yFBV-rpCM-yoqgI5mWRX9KDHLSzx76DzyAFeOScZ0JQVB8PEV-0BjRnwgR6X15Kss8S8MP0GCBspq3HM6NrM6q2tUrfETKgRaBGBfGQuR6FHTPQ22rzu05iR_7HqT3KEk0r8UFcKudX3x13lnORpA_jQR194r_RjJA00DkKTzgkMlDf5TiDRPmTnaE1ogdjwEr6oxHOcJXbHLNYbkhl13MXIbnvUuwhbYLwEYDcYAMOsiUgMVjdm1fQQyisEFzv1qVgfiC7gp1TD1SzaaqdPqVI4hE5AEI4bH3wsEKG5KPzxsfHk92BA4a0miwXFQl56UPNbA0GWLypkSzP4IIW4SjjD_zwpt0nUNvPKMBydlJMk5ld6M-_aHsFQ09IKy76dZ3zK35SyCINE8ef-AvH9T8gffx4EfDK6pJ4FX_rNVpWn7zn6s7wgFt3h46AhaHsExo8N5R4yAthDqPFQ1-KCEe1yL_2YNOP04fPbrvzAFf3I0PzOQf6wXBQq4jLBLVB0GidUFYCgXEC6IgRs_8RG6AYFPK4JRKq5qVUdOcOLlFtSfTByhnK-9p0a4cz3lZSllRfAc_Ds14tKU7potjBSton2f_HWpL_9HyB8i6WZtPs6fBivTU6stxhXHbvdjXDI4NiGKSH_lr_8NfNUod4RweOSO3PdE2JTAtLEI3L62by_BP07p7atJdOBq9UKOtOdk1SsgxCBX-o7AVgDH_OFkBox_hiJb8lJiq7swkVxYeXuyKEMfZ-VICBdAEwKU-zbSIN-58M1yPDwWQ8D5_oliN1R5662VWLJ-erTK_uLvYYpcfmdD6CUgVLBBvIeRZcBvc2gJXSko4XxRGjxRfnTccFXrJ2ggYCM6gcglQddZFH-LFmkBu28XRFykVtkUAuQrnqLPKTrwm19l03oixUD_YDNoYKkcyuVZrWMBT_J7pU4KtbvzmiYS51EvytEi9fRChgcArS-e-_o-4gNYcGpWd06-N3s4ICIY_bcz9Z7apBz45H9-5LtI5OpjqDlvgoAdMrmsfS7Ll45iTB1113twtbElqr5j_pzAbN8e3DzSzF8WnE_kINCpfx7gOK7muP8R7junX1N13UYKJUGHOei7is9KegxUf5yhsR51MscJO-k0xtTxybxn6FaaQNu9yhW2qcCHcdegn8TkP0c3uOnJl5hmLSdoS8rb5DPUgfDzoj_QKSsyaHA5SbNoncf2S884mLvF7BEovBfivHivjdK-kc_2kFQGWp20POizhaKPTDncErbC32dClBwG8FtsWl0YQ2OWAXLcHg8sJlbC0DI0uR6OewvczAM350m4maqdz3nDuzN-zPGx61jKgqY8R-CdwH7BH8hXacFdynpy4ijqX18v4EhvMtTkFpQ8GscWjQy82Ztwx7QnV4hJpPT43ePr2TNNR1j5yx9xFAGieZbWrKybsQ-7ivv0jSw0OeW9tXSus1228gFSHUxFnRWmTgdMy0tmC3LhGkykf5zAIgJlHtHu2YlgVdXXIXp2Gjz9wrRPX25ueKCqpOTp3xOCVrU6yYIktvXsR1jU58Hp4AkUD7dcH7lQ1MeO0eaIp8D3WQirStDCmKQNnynI3SydpLyec7_NL6FJ97C3r4RpV5Dq4a6CChfbpyDUfDLNguKL4l8gHqCWi8ZpKY96idVUy817TGBBCCGr_o0ckgfZHpV0PAMOVNNMatPQcvndhWsVJgmQJYBBs4h4UW9pcB6J4fdN-NEx1A4KlE-VkyZ6aXHhKvpGf8uYkYFWAYjbzXEGQwxhkE7zkj58-lEL9iPdIINERgAmmK7kPEyujNPXfw7pqfakp3a8ULKIfIZbMOBLoNjB1b3YXdOKDQH5I5OcdnChzbgjTa2-nc0NbumZcaxlao0wiYFKzvgo5zhSbqHKBulCAd_zJ31N_8vrNF8q20LkcvKj5czYg3Cu3DZNOlFjf9bNW1jGwGwI2ehorIz6Cll7Pe6cxaLuVpNaxSpbizDFcx6Bsb2HxZD0_aDPuNg-lOAOykqrCcjJ9q6n8yDSqAqbCBAWTRa_-MmNzoXnELsoXwxx97vBq0c4Y3nEC4bqILJ-aHfqI7SrsLxx58e6AOcSQ6oWy29it2GBqznKUuTAcoK5IJz7IYSorW-Ls-H_NDjZDZyIRCT34rffcQxwPFJ9k-thsH86lmXcHDBxJMUSm3KOB0v5QHpI3rlwor7ULsUBkzLC11E9YfMKC48CdDMlMRWnhnuqTHjh6a-W5JxJ1KwyfRpwiNGlooygZqkMmepBIZvOKB1llJsHiiXAQg5FCLxe44vQ6mbF9WWr2iCAvjw8WIEDDpzNkAnq-VbFTbqnsDHYl8I2_AWDikizUkgar0aBcEP54a4Y27ZnuOiYeqGmr8XGNvK_8NgRl0HqGJLXas-Bdy2JXV8MRPN-L_DotTQtBbxQ3OZtSNnnfr5vvm--Iux6BO6k8Q-covSXNA0PZ54oOxfYIHgxdNkd1V2hWY9QzgndIEcx1bCRVF4Q-Og-pq0FN6UkwpEleCshu88WjQ_02gfDy6QaM7erv3771AlDCysf5lveNC8eWhpSCAQSTADICaaNdpj-l4RUSOw-5UBFA81Y4Dp-FEP0iUjA5ebEgTwFNKwOI9jsdgDYlCFjTHuQrtcPEU-M1hsuXdY2KthsP4yzC3Gkn4t4lt4YAWAB&bundleId=&ias_xappb=
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame 6C17 91 KB
23 KB 163ms
42ms Script
application/javascript 2600:9000:24f4:ee00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:24f4:ee00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Sun, 02 Apr 2023 06:31:15 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 4e2b60a8131e436f5ac38dc8a953edf4.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD55-P3
age: 17908608
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: vLpajnN5EziDVppzfl_BENo8lFPFcivUSAWyRBMmfj01SlwL4KdFkA==

GET
H3 200 e-1idJnmKXhqbZCX02ep4aMqudS3YiNEm3eSGPFEZgs.js Show response
pagead2.googlesyndication.com/bg/ Frame 444B 50 KB
19 KB 35ms
35ms Script
text/javascript 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/e-1idJnmKXhqbZCX02ep4aMqudS3YiNEm3eSGPFEZgs.js

Requested by

Host: notepad.plus
URL: https://notepad.plus/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7bed627499e629786a6d9097d367a9e1a32ab9d4b76223449b779218f144660b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Wed, 25 Oct 2023 02:02:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 126342
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19700
x-xss-protection: 0
last-modified: Mon, 23 Oct 2023 12:08:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 24 Oct 2024 02:02:19 GMT

GET
H3 200 e-1idJnmKXhqbZCX02ep4aMqudS3YiNEm3eSGPFEZgs.js Show response
pagead2.googlesyndication.com/bg/ Frame 9728 50 KB
19 KB 39ms
39ms Script
text/javascript 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/e-1idJnmKXhqbZCX02ep4aMqudS3YiNEm3eSGPFEZgs.js

Requested by

Host: notepad.plus
URL: https://notepad.plus/

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7bed627499e629786a6d9097d367a9e1a32ab9d4b76223449b779218f144660b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Wed, 25 Oct 2023 02:02:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 126342
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19700
x-xss-protection: 0
last-modified: Mon, 23 Oct 2023 12:08:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 24 Oct 2024 02:02:19 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231024/r20110914/client/ Frame DD15 3 KB
1 KB 36ms
35ms Script
text/javascript 2607:f8b0:4004:c1b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231024/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8793237398349137&output=html&h=280&adk=221352476&adf=2860179214&pi=t.aa~a.2227863559~rp.1&w=1030&fwrn=4&fwrnh=100&lmt=1698361681&rafmt=1&to=qs&pwprc=4354248216&format=1030x280&url=https%3A%2F%2Fnotepad.plus%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1698325681326&bpp=1&bdt=3282&idt=-M&shv=r20231024&mjsv=m202310260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db38f74f5bba9cd29%3AT%3D1698325679%3ART%3D1698325679%3AS%3DALNI_MbFOhtzjBTfbED67puskk9feSK6ZQ&gpic=UID%3D00000d9cb191db97%3AT%3D1698325679%3ART%3D1698325679%3AS%3DALNI_MZ6ZUkzpsMstOsdeFgOXcsuu-BAqw&prev_fmts=0x0%2C970x250&nras=2&correlator=3972234055011&frm=20&pv=1&ga_vid=2061795391.1698325679&ga_sid=1698325679&ga_hid=1146444982&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=285&ady=1669&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079078%2C44805932%2C44806737%2C31078297%2C31079206&oid=2&psts=AOrYGsnymZq8uzdJoDkwlNsvW-NaSna0XYpnXdP_mu2O8X1-JPfzYwozuJp1M-FBp8XkKpQeFinhy0ybRtjj&pvsid=464992494868551&tmod=122040629&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=VjUxJeEZsd&p=https%3A//notepad.plus&dtd=11

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 01:56:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40291
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Nov 2023 01:56:30 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231024/r20110914/client/ Frame DD15 20 KB
8 KB 53ms
52ms Script
text/javascript 2607:f8b0:4004:c1b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231024/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a198f092051a356c1e62c1296f628da5732045abafbd974eb7fff157e14ff042

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 01:56:45 GMT
content-encoding: br
x-content-type-options: nosniff
age: 40276
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8426
x-xss-protection: 0
server: cafe
etag: 17696348727749479825
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 09 Nov 2023 01:56:45 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame DD15 0
0 51ms
50ms Image
text/html 2607:f8b0:4004:c17::93
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSalRB_hCCBGSCbVfhxS-tvjxK4PBgWoKXYNSOubXHBZ4bxqVpKBIH3Tx2Ikeikz891HIOuJnb-nC47aL7Bj6Br-1HLig
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8793237398349137&output=html&h=280&adk=221352476&adf=2860179214&pi=t.aa~a.2227863559~rp.1&w=1030&fwrn=4&fwrnh=100&lmt=1698361681&rafmt=1&to=qs&pwprc=4354248216&format=1030x280&url=https%3A%2F%2Fnotepad.plus%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1698325681326&bpp=1&bdt=3282&idt=-M&shv=r20231024&mjsv=m202310260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db38f74f5bba9cd29%3AT%3D1698325679%3ART%3D1698325679%3AS%3DALNI_MbFOhtzjBTfbED67puskk9feSK6ZQ&gpic=UID%3D00000d9cb191db97%3AT%3D1698325679%3ART%3D1698325679%3AS%3DALNI_MZ6ZUkzpsMstOsdeFgOXcsuu-BAqw&prev_fmts=0x0%2C970x250&nras=2&correlator=3972234055011&frm=20&pv=1&ga_vid=2061795391.1698325679&ga_sid=1698325679&ga_hid=1146444982&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=285&ady=1669&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079078%2C44805932%2C44806737%2C31078297%2C31079206&oid=2&psts=AOrYGsnymZq8uzdJoDkwlNsvW-NaSna0XYpnXdP_mu2O8X1-JPfzYwozuJp1M-FBp8XkKpQeFinhy0ybRtjj&pvsid=464992494868551&tmod=122040629&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=VjUxJeEZsd&p=https%3A//notepad.plus&dtd=11
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c17::93 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame DD15 187 KB
59 KB 54ms
53ms Script
text/javascript 2607:f8b0:4004:c1d::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1d::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4e155284926ba010442d774fd493ff925a0256bd427f54596b1244791a3fa170

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60190
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1698233972131352"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 26 Oct 2023 13:08:01 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame CD42 43 B
215 B 203ms
56ms Image
image/gif 2600:1f18:1aca:4280:b716:d20c:53fa:e647
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1712960&asId=42a7ea54-8602-e5ed-3212-19289c9b7a7b&tv=%7Bc:s7dXQq,pingTime:-3,time:104,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:0,h:0,t:40%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:104,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:40,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:i,cc:NaN.NaN.0.0,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B98~0%5D,as:%5B98~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tTNvu3k+11%7C12%7C131%7C132%7C14%7C151%7C152%7C161%7C162%7C1711%7C181*.1712960-75657828%7C1811%7C1911%7C1a1,idMap:181*,rmeas:1,rend:0,renddet:IMG.us,siq:42%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:b716:d20c:53fa:e647 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:02 GMT
server: nginx
x-server-name: dt12.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame CD42 43 B
216 B 193ms
54ms Image
image/gif 2600:1f18:1aca:4280:b716:d20c:53fa:e647
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1712960&asId=42a7ea54-8602-e5ed-3212-19289c9b7a7b&tv=%7Bc:s7dXQx,pingTime:-6,time:111,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:111,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:40,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:i,cc:NaN.NaN.0.0,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B104~0%5D,as:%5B105~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tTNvu3k+11%7C12%7C131%7C132%7C14%7C151%7C152%7C161%7C162%7C1711%7C181*.1712960-75657828%7C1811%7C1911%7C1a1,idMap:181*,rmeas:1,rend:0,renddet:IMG.us,siq:42%7D&tpiLookup=ao:notepad.plus*%2Cgoogleads.g.doubleclick.net*&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:b716:d20c:53fa:e647 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:02 GMT
server: nginx
x-server-name: dt11.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 152ms
55ms Preflight
text/html 172.253.62.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f157.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 26 Oct 2023 13:08:02 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 0D56 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 53ecb8781cd25a142b557d92a005ca3c4b4a725ccd5060a1cde940b82636260a

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 afr.php Show response
ads.us.criteo.com/delivery/r/ Frame A50F 224 KB
61 KB 147ms
146ms Document
text/html 2620:100:a001::24
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.us.criteo.com/delivery/r/afr.php?z=ZTpksQAFvb8By6JNAAIBFfHAcs_exhoQr44nvQ&u=%7CTIVlNeULxIZOGuc14XnG7the065bIbqlzxJdPB%2BAe1Y%3D%7C&c1=TUPLs6ok1IhDgnvJmJgq2b8G6XvEBIvqAb79lxbNLn-Y29LVqxBSOQhZKVxZui5pXNlU4WPrBd9-dzZ-iTLkdn4iCWrkEk_cy5W8rcgE58osEeZA-_wBmY8QBdqwOcy33vzeGqqBrDOo5E39HEsWzX9eYq33yPlD8chSiYLVtMUqAsxrfq2bmPAf-4Ma0GbXu53qZ7wlZSQ9qkKtMeMULq-Uxg02ChTUQpcaqtGSvzVh3e2JponZ1j8I6LVLGs3wGv2EJxf8odjJGu1QuXpySIblC9hsZFp5dCdPqdWJ3j1ZoKcIHKcsH8mmap8GL3P3elUr33oKutpEEpcuAJsCIaKh1QbRSi_UBDOgpdRz5CATDnQCOifv2hc-fNszCXBOcSxJSYgNZRaD89MCvRhFWj4CasL_fUBXDD-AgFwbGPpjflpfGld2YcaBFQBeTthMe8KMGvvEHb6i_DNvVLAJEEd57C9dU61bxFxXy4Ed33i-8B5KpzbbiP4T69UKvsqy-DIak1XT0U8jX87EP688IGRxAd_fv8lxpDm-XEK27ai013gH7t6CyzMM4oJsPFhP-FS7FPqhLL5LtFfg-k7amCKsCLCP77jP8GZrSfTCPQe42fwgcbp0_Oyb0fWy1QTjJOIj-KdPTYQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCjToPsWQ6Zb_7Fs3Err4PlYKIgA-cge-wXKqbqap0wI23ARABIABgyQaCARdjYS1wdWItODc5MzIzNzM5ODM0OTEzN8gBCagDAcgDAqoExwFP0DRLGlJfx67c1GPubSXImo9_nOcNiJi8kOZYrddX_dVAYINwmSD4sGQpSw_K5iyUxMZj5_aU3Xl6XeWS-K7BDoLq7vjjfpTJPcsUzivbjiBtNGIk6-wIPNiGAiXLQ21iNQ4zPdC5p03vSkAk-TWq0zCq8qNsrREYqlN2UpGNX31e359KPlpb5mEElOmDlxdQpSqvJEgbcEC7nDtaQMP1_ZN3Q11mdB6_pYKG8be1srkYUPk9wUMXNnvZJs9iP3_U64Eoe1R_gAbL_Na85PqiriSgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggSCIBhEAEyAooCOgKAQEi9_cE6-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2Mqmaad5raE1TNOOaT5yJ2XxACNA%26client%3Dca-pub-8793237398349137%26adurl%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::24 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

618c400721df205f89129cd91caec57527ead1def3048f904d837d035e1614d3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Thu, 26 Oct 2023 13:08:01 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.us.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.us.criteo.net/heavyad?cppv=3&cpp=tHl-0taLxGjWD8YGKVWBNLlG5FugaLExrcCNwF5mkJvkG9zReih1-rkUpYhtHmazTTDfOiMOCSnOcPw6si1xF6gjcL3oF_xSosRJ-Fv3GHJop3-4-YYomTB29ge3_a2R7AxBpUevv9BnN2ZfFoq7wToqNitHfQchyWURdOwF3mqERrEaOTlv1AMqonlEUjjOYTe0j_HkRF5zmTwiPu3rYq2wS1WF8bFG8ygvCjLSiGmauIppuVFGeqBb5Z60NCSj98Ljvg"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 69499917
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 05B7 1 KB
643 B 52ms
48ms Document
text/html 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

age: 83720
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 25 Oct 2023 13:52:42 GMT
etag: 48472445140208031
expires: Thu, 26 Oct 2023 13:52:42 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 1CC0 41 KB
14 KB 48ms
46ms Script
text/javascript 2607:f8b0:4004:c1b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DKXSOuSE15kY_6Y964KUxJ0tBxvEqt9_o21Cg3eVUkH6GLtYDVGJHKl7jZcBfGiJ8R7XNxDFJN6KKACesttJoF9Z6T-NuhJvhwYgdK_lL-dMGwpfaxiSXJJHVw2WfEC4C8nHc2Hg9EQ5NJJ6vK3ZvadH5GkW_ttDK2vacQJXO2QCSUF6M&cry=1&dbm_d=AKAmf-C8SrNeF2MQy5xvzUS9VTc-iIjRx24GjEkcVO-2BqRffhmbAamR2_fhoX3-VIb85loSW5HN4YSUP5YrKZGitTxp3CjYh4z4vpQ7YLfTzQsK2fBhzyirjrHzJNzcHmBeo35cciAr__Vda88YA9sPprCEigaR5r5bePa1X9pPxv7p1za_M3fSUsdOOaKePUG18aq2fLIeRkMwBoMw5n0v8NN7Ujtk_XM7UJ1NyTHhynLUEO4Pfeu1k457VHrWvSjbCr35nwRjA2lDEki5GKtc876Jupc1vNllgbZEkJwzbW9rbBe4Ie7dTi-gDpzFogqjMnKUD599QDZkjO6123mBjqtYWjpKrodQ8wqg5i9mCjE8eH4-3IfGpw0ikZnVJzqcWktdaXrGpwQZEGaPOiKIKWMDgAOpe6-ltEwTJKrJOpeJyaiR4LotUm_9v1nuCvC65GD24LlMJz3rjScKrLVqQCZpkfnFzZzlXaMtWtJWKF9qH9v5Fjlga8_ooVVIEVbnKomOYNZDz74jirNICo9kCGqHFR3b73w0Jeffum7Qa-bLyzPh6nel0s3f2zORyDObn5Txc_Q_rieYU1_oArFbSSZQc7nZBrUYlZvSIi7PtH7nm3nsqVwQxuLJy46vHfYVC1pnINnxbvSADt7a7RUUxLIuWvcM7EANBrEiVTxlDI6cEBADJlTWdohP0czQTVaz6vd5lY1UOOr6QQDxUE_BsfXyV-HCxJgjqz4WF_HxXmoYMf3vh0C0smR3LGfYszAp2bV-FlvgDYnrg_FmbG_zXS1mhxPRXOJq2poUjDFbsO8rmCV5osx6a3Ufooc7x0IJ2WHHEHOCJ0to3pCDh4fsuxtcBRdHADjZh-tlG3LLTsZDwj_EnJwg1hoPAGUvmFIVA6sLOY5QOcMcIgSsR_BXXGWYlbANmhJrmrDjR6tTzxyCEtCKk5WuVujL5htv_mOF-ojIuSOxinEDwFaM4x-Sd6hRRqSSmz3FUTHwBiJ71-Gk0kTM6rpVF6Oj2aNl0IZhaclH1SJnCNVBrCDEnBd4xmKJQXLp4PAwct6bTYQa3KFTLbu8cueGd_Z12jh-PVfcl4mZvoyA3bXPwGGJl6RWPgSsre9G_Snm8s-vQc3uowkcd0Pmbw7M6behkdtFjOL9ftsdZp-wpl7M_AznxlGK5gTZW-B6Xc8dCxtP6rae7qmujIsYq4KNHdwegtK501HkMN8Ha_xMO3t7X-4islSHEgjFKb-9XOC8M4ehzPqCE1L_J33tm2DUuKOGSAMEM_s3tMPKHA48g2g2C5tyKFaxsz79V8HiEKcr9KxsA8i3OVmWSdQO1cPeXjILApDDMQXdrAPGRbROHTbI33DSYZcqHbTaYj0IdTM2vqx6xHmBPhwLRMPSk8NqWQmWtJPiJRXcSYmJK4iwKBDmPmaher8rqZAe3b9hroAd7DbHV2ObnXyq6bHPhJRoyj6nmS_MMvFYHQsUGZwzm9_rgxJiYS_3JfEIhqRaLeIHjnqqEHbj-ilu5WTVgHxXobgFEP_jYIUJtAguGogH_ReF4yY20RZJ7joTB0L80YpbKIUZQvrSXpqJre7uDqWCY0rZnPEa-0i7Qw0ejZsDKYgCD2-w9y2-0woMpRPb3Tpl8zoidrCScOVeMrItH-FzrQFcjjlEO3nvYyHr9Pfa_yE5NCzHl9g8oiwfB3XYW407s7wC8r6bWz8K9nrkSG4c4_yfemGWzOtLMth5U_zDMmEmgvO39ZK4w7T8ZZ4rBPrJiT7tjZE0qjhlvLyd9ki41qYNhX-a1cexUN5o0ZvAY7zmnM1pyNsoc1l3b0Y6x7TLBesTMn_vDbjdr1K70286jm5NwXLfm68pENWywEOKX2iWJzavgGvXU_jElUhcp_HBCA_arL4YXQ8zkouM72AKRoifqQjPfLjXFCyqd0xG0Tccqq2TdAKOGk1CKTMb9Hr1UpQvQLsFQZwSRg7SMmvSe26Fly5aRKjdO-ckE8bOPmtJWyZ06g0l4JZIxDufWwkVElhQcmRnAcbshT_3dEj41W_tiBTPF4J_5qsTN4qI5hhUR6AFhtioiSXIFBEd0-1aQ6qo9y4LJ1sKh7kwaI2DBmtlrJeYwA0JmUCilB7V_h8PfuiFzvlIjxUjIerm-X0AWuV1jkjOe3QYUjLBICSnFgylyLIwjO0LcruEDyNsMkFAzQ24iOhFvcqizH3gyog-4509BjkW5znaFAqskSfHdTyRCE9QQY5AjwMnvorWRwiNqF1aE0RrHz5UCoqHK173myDb_ODnylB-vncphIJXi0nJ_i2YsXWopSq2SSbfbxUk4Hu8vkH6M-dbonPXKTqiipFdNqoOgNz6eK9ft9chYXt-CYsc3vnfZN7ZxEmNOoxhEbQWkmJ4c8aWwUM9CChhcDxiLbDeU5Qv9usY4d7RCK6epZxK4TzyzqzCiN3bBx26D7c4ayKzSib9YbYCtEFtdcDQQc8qisvJypaGuLdyL1amQwxHi6QTJy3FJbXnnnDIXq2Y5l5jI1UH3z01-aw3UdSKBoBaLlWe3U1OiehOMfxYfCeQYpUw2Cc2Nto5Gp8zP0boVsfVISyy6HZTIboJxl6sr8tuwbpoDo5fByAfbLkCgJtyrm7xzLY0iu_7UiLaN2LJnwVir2zJXPrFLwdG5WyPqjt_oW9buK--19_6oWRSlIvP9v37yPFmwExW7J44nZDNqoWn9eTsbLtxOjaoeWL25f0kz3To1c_P_GA9YF1sigGlkuKcPQMRCI8xXV0JmvXECVnjuWEkqmFGZkFa2QL-n0ahWBQjWGVcKikchIjiAvB3wErRZsZQ0ZQ0N9LmbfBdfcLbk1bo8Y25ek55N299ZTR5_dtxjUsWaU90Fb02moJmzl_Gz4i4FnECHpCx4ZfoFOUbvVuDEsXPopBwHhvKR8iDmRbZKEUoBTwM8Fu1qYqsJAu2B2PMUZTQpOq3q096nPNf2h0pfRB9zA&cid=CAQSTADICaaNdpj-l4RUSOw-5UBFA81Y4Dp-FEP0iUjA5ebEgTwFNKwOI9jsdgDYlCFjTHuQrtcPEU-M1hsuXdY2KthsP4yzC3Gkn4t4lt4YAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Fnotepad.plus%2F&ds=l&xdt=1&iif=1&cor=11914175694824698000&adk=929882891&idt=148&cac=0&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 19 Oct 2023 18:15:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 586354
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 18 Oct 2024 18:15:28 GMT

GET
H3

200

adj Show response
bid.g.doubleclick.net/xbbe/creative/ Frame 1CC0
Redirect Chain

https://fw.adsafeprotected.com/rfw/bgd/1712960/75657828/xbbe/creative/adj?p=APEucNUySr-ptmum7FUrNTWZ2H8r2hJn2DZA4Jd0Klhc-k-rVeFtYDg&d=CokBAKAmf-CaVigwWvahuC9qoukDsBGFteOtDkGsfhHwxWw4NDr5Uet-fw12PqF...
https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNUySr-ptmum7FUrNTWZ2H8r2hJn2DZA4Jd0Klhc-k-rVeFtYDg&d=CokBAKAmf-CaVigwWvahuC9qoukDsBGFteOtDkGsfhHwxWw4NDr5Uet-fw12PqFt2KauRbdIwdahuuJ-cpSbmUPHI...

62 KB
24 KB

79ms
78ms

Script
text/javascript

172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNUySr-ptmum7FUrNTWZ2H8r2hJn2DZA4Jd0Klhc-k-rVeFtYDg&d=CokBAKAmf-CaVigwWvahuC9qoukDsBGFteOtDkGsfhHwxWw4NDr5Uet-fw12PqFt2KauRbdIwdahuuJ-cpSbmUPHIZQbo16z6XYjQwwGWvOGoZ_6lFB-OSFxAIcPTXYroUaZ_Ss31vbPky6tg5kqrkBceBnrBTCt_sf3DpXJUY0CGoTnF0-U4KBDbEgS2RMAoCZ_4PR4_XI5wYIEZTnW25y0lqQPTV8rcQNMteHIR1HGGXq5ogmcgmzIiQbNyWQjpCL_FAHuE04FKogeNb_ZtRO7glCBOhLydQXFMJ8uOe17GS6xXSlyIp8jbTziVVsHxR5kfDWVQMb5AhO7EfUEwOm01vvz5wXP7fiYYOMfxXjSPZlkF3Z8FeqhgMLyT3v6PnfSEN7G-FdMuPbQfjs75PqUbVBC-b8GxXYGzooKww-qCtkTggMhsaI7LZPNeMwkcoLbw4Vy2zmfeyM-HEeTQjsXoV1k3WxykJ8NF5ArcAVa3emkq4Tq7YJ79ubAX4dZT7mvUUoi7aCs8HqN9WkMcYg94O0eDNfCoDjmndUw3wFHQ3o_9Bb2GsKb7gCtuy4jjp1owa67F0F_lOzAlOMpEdczSC1uJ73ZmRJ9LZKf2Ysas18uhPB8FNh5MIonaY5i2lYSIyOe8HbA1RQAKIEuOyzA9eD2PkhuOt14ETdDy72zsrBOLysd1lWpZmLajzIltHW0x1UmXWsz9u8ETymykqRhXuqTrvmNR7pLwj1J5LESLXzPCLTT7aJqa8g4ax520ayo1XUOrdzvxKAbYlLPDIxdmRna0UuKOXZ_T_kuilr8YHBsZVoyl0m3wUsgJn0Mz1dlrMALl0czD-6OyO4qWnkZe01ijzYB3lZQxL1879jw1_XfQGfvRAqMaeZlEQ5Uihuvq72RDvnXTuO9h1W7IQZMqiCxn4j0TcKVZdgnX9o64Duc24uhN7ZOnMyzkUgBulyrm9XHy88YAINlMbjH463Myi-E6atIaW64fN8CyneTwaiSXIGbqiTQyNCjLTfVCk-gNkzjrNpyHfScPyU1gLqHIctQlHojaoY3N_96EYQkmow1S_n7kex7shh843edDeZu1XfH53NxtIiralx190uUyxB706S6EURRfm6B02s8jjwgYFOUF2usUsTxoG2SefZt5kj0znFdryzw4meI3ofjVlwiopmaCDiQH_8Zcwlosi1V70udT3dr9Uwj0CkKHghvOsMgpDko7FiXbxzUWDbF4WzObmqDXmGZraUFGJQ_-PqeW1LKkMypzlBkxeP6xwpACKNR4zY6cgd-h8vB0gmmDvGMl5TjjTyfXky8wTLmUH3uNn4ksusVStYT-lvg-ybtuAIuq_USFtj-xyREIRdOsC7RAjXFEumPccosk4IGEDzeSloc3PJSnKv37o6HKDqX9nRcEpD5SwNUCtKthtFOmJ9WYLTj8j6dlD7agM9TrkUOBKg8x9LRvltJYcIa26O0pma2SkOGbdvd8Z2TjsRZM-jN45esz2GUuCmiOSm3sAql4V9GVdAxK5gdMPGeIJgZfWpgFdGB1UAx4qkyjLrcThy--ZDkgUbejgrpmbKDQPpY6zTtw7wPGWFUe2iCMYgeuo-diPnJxmiYmaYhMelX7GV6hxHlWJHSVgkWpRKPiZJ9dop-hiBBgVWOeI3hjDt3sQea0p_3zdfVdZczJX6thhdAoOF5-mpkbuS_d1kRvz6H1S_cJAqh8WKtpWWWvMdYnohaKgJxbAHku8gnu_07TCh6qzAZgu14mRna-h4UtNy1leESrvq9lR59RryX_67CmgR3s4rn2CyHw_zV8en4m8lGXLg1KsZOW-ABkNFniAJ28T72AiWXhWY_AKi1KWhC-8UQZaV_vDU0i0deC6AMqJUWLSZCtbaeTaajPPIJm8-ilI3l8UzcCHdnt2c_b3qiTGaJFgsv_ehpw-VwgWx3oP4UsN2XoI0qWAq7PbTPm7Z0uFZGpJTK_dXutjUvdhdGJqTFDFV0LO4qCVcpojp8qM3WrOatnhSAY6O55uv9FYNTAvzM4VT_BlMPTciXcJLBcaDdkx9JU6GrLioywenlkIn1aDp_3wWpaQWsoRb50s61-50nhrwDQt4OH5qcokoBHudx6LYKn8dpq60HJ5Ip00NC1y-03eOBcTuA2wOu1ZwxAEhLq5-kmjZTnaSKxOsuvmeTi3_P-wnXLag2gewcQreHdNdMQdk5xOSWajVucclovp8stshkLWOUlHaiJfOR7G5cMtFWRKMymm_E3--nhcD2osNuoYhYhL54jf0dXdz37MjHgHbEkrik2Q-VOG-NvKuR0vuavJQUDrzvd3N0vI5z9RDyYMJNF_b4S0hf0mVWw0XC17gY5YB9DhxsKOCwy59VNMMOwxXCvFulxB2gOPDu1NtnBLoIoCCoGwmgNjPXp4bjRkuQBHJWCHRvptLnU0ARkAJ2I3g82EmApSySP7cP3j0niTjb2_nSMjuM5T9lyEMiWCniAJ_COUZGUIsVsFMpm0n2emY4TFNYxx-YtGmsM3DaQsz1LIOaX7CW7YP6GXBPh07JZ8P3rnz3PpH-wBFjG3eR5oTe8jedW-kkoAluB9f1QM62qAo7pGs1Xv88iKP9V7i5ImnnCaM_GH7CfZTI8eLtNu8WQlGz5XyilBiE2PuvRXLw8U_VwQqPMy7qHNBrDCRa0p6uA1cl6JUSDg2hlQMBiHJJRxKFKBsW2TMczB6yapP-QXDKjKKlETd1jEuNNC2y7k_8SRHAmZmh0yKtOa_sZh-Nbh4E_0306VXCCO-BzaTEPnhNYV30eEgzKcrklh_0-1IRwNSWYDRKqp4gRQdiWwXaG__916nBeTuudnORuTWfcKquYEGiUdgcECFXbaAlN9Djua5VMJR4oXiZGxx2LIouPDjoZCHhpGISxF6625KjAe_DewzTnrBe_FY7-Ua8pIDQhDZMUKPL1r_DSNVOFDVvxMAsepveA21dqv56qPXUUZy3onTBQZlolaKBOQPFY-U3xzDsJ9CX9ZJu6YVuo6qU_eanx1z0OD3MvYMdChwlthzsxficgzxdH7FWlTgm1kYCmNfmccETDIlVuOhqEKmommvgiSmV3oPxdnEOSB70qpFWOuCnwUel_Lv80H_30_z1BGd9Im15iWas2ttQo0Uf_X9DX-L32P4sQR-R90BB0s7oKc76kjz0agF8YZUgv-ETNOgu68QH3SGXbNiOPKlRGTkghjkUciaCp6JDTV1xfEYCcEz_EN5Wm0c-CGhgV5UJuZhm2Kub0RhO_47MliiD9ozsd3d31cut3sVzufIX8HgcJN2mOWam_FpW6gImYxq8IBusP71NsguT1Pt6Kehawm-xvFjO4cFo0GQEXYm5ObVwaLYxucreXfxMxp6ICWpa6kdO-YgO6wBvj8qGeIV-qeaCaQFcd31ezPxLiZ_s2xFGTLrbliuG32z0FANG1yno2057tbcEB_D1G2GYlDutq9yuhDrWbGylPjDdTswKEkNG89j2XVGdvsPSPA_d59QGgh642nMZveBv2wpGrNL3LOlNdubR_RwhZtb8GlIIBBJMAMgJpo12mP6XhFRI7D7lQEUDzVjgOn4UQ_SJSMDl5sSBPAU0rA4j2Ox2ANiUIWNMe5Cu1w8RT4zWGy5d1jYq2Gw_jLMLcaSfi3iW3hgBYAE&bundleId=&ias_xappb=

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

74948a91e0665286d74d7505d7bf8fb4c44aba6e2b3d1f3160ce174c8bc1826a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:02 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24336
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:02 GMT
server: nginx
x-server-name: app32.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNUySr-ptmum7FUrNTWZ2H8r2hJn2DZA4Jd0Klhc-k-rVeFtYDg&d=CokBAKAmf-CaVigwWvahuC9qoukDsBGFteOtDkGsfhHwxWw4NDr5Uet-fw12PqFt2KauRbdIwdahuuJ-cpSbmUPHIZQbo16z6XYjQwwGWvOGoZ_6lFB-OSFxAIcPTXYroUaZ_Ss31vbPky6tg5kqrkBceBnrBTCt_sf3DpXJUY0CGoTnF0-U4KBDbEgS2RMAoCZ_4PR4_XI5wYIEZTnW25y0lqQPTV8rcQNMteHIR1HGGXq5ogmcgmzIiQbNyWQjpCL_FAHuE04FKogeNb_ZtRO7glCBOhLydQXFMJ8uOe17GS6xXSlyIp8jbTziVVsHxR5kfDWVQMb5AhO7EfUEwOm01vvz5wXP7fiYYOMfxXjSPZlkF3Z8FeqhgMLyT3v6PnfSEN7G-FdMuPbQfjs75PqUbVBC-b8GxXYGzooKww-qCtkTggMhsaI7LZPNeMwkcoLbw4Vy2zmfeyM-HEeTQjsXoV1k3WxykJ8NF5ArcAVa3emkq4Tq7YJ79ubAX4dZT7mvUUoi7aCs8HqN9WkMcYg94O0eDNfCoDjmndUw3wFHQ3o_9Bb2GsKb7gCtuy4jjp1owa67F0F_lOzAlOMpEdczSC1uJ73ZmRJ9LZKf2Ysas18uhPB8FNh5MIonaY5i2lYSIyOe8HbA1RQAKIEuOyzA9eD2PkhuOt14ETdDy72zsrBOLysd1lWpZmLajzIltHW0x1UmXWsz9u8ETymykqRhXuqTrvmNR7pLwj1J5LESLXzPCLTT7aJqa8g4ax520ayo1XUOrdzvxKAbYlLPDIxdmRna0UuKOXZ_T_kuilr8YHBsZVoyl0m3wUsgJn0Mz1dlrMALl0czD-6OyO4qWnkZe01ijzYB3lZQxL1879jw1_XfQGfvRAqMaeZlEQ5Uihuvq72RDvnXTuO9h1W7IQZMqiCxn4j0TcKVZdgnX9o64Duc24uhN7ZOnMyzkUgBulyrm9XHy88YAINlMbjH463Myi-E6atIaW64fN8CyneTwaiSXIGbqiTQyNCjLTfVCk-gNkzjrNpyHfScPyU1gLqHIctQlHojaoY3N_96EYQkmow1S_n7kex7shh843edDeZu1XfH53NxtIiralx190uUyxB706S6EURRfm6B02s8jjwgYFOUF2usUsTxoG2SefZt5kj0znFdryzw4meI3ofjVlwiopmaCDiQH_8Zcwlosi1V70udT3dr9Uwj0CkKHghvOsMgpDko7FiXbxzUWDbF4WzObmqDXmGZraUFGJQ_-PqeW1LKkMypzlBkxeP6xwpACKNR4zY6cgd-h8vB0gmmDvGMl5TjjTyfXky8wTLmUH3uNn4ksusVStYT-lvg-ybtuAIuq_USFtj-xyREIRdOsC7RAjXFEumPccosk4IGEDzeSloc3PJSnKv37o6HKDqX9nRcEpD5SwNUCtKthtFOmJ9WYLTj8j6dlD7agM9TrkUOBKg8x9LRvltJYcIa26O0pma2SkOGbdvd8Z2TjsRZM-jN45esz2GUuCmiOSm3sAql4V9GVdAxK5gdMPGeIJgZfWpgFdGB1UAx4qkyjLrcThy--ZDkgUbejgrpmbKDQPpY6zTtw7wPGWFUe2iCMYgeuo-diPnJxmiYmaYhMelX7GV6hxHlWJHSVgkWpRKPiZJ9dop-hiBBgVWOeI3hjDt3sQea0p_3zdfVdZczJX6thhdAoOF5-mpkbuS_d1kRvz6H1S_cJAqh8WKtpWWWvMdYnohaKgJxbAHku8gnu_07TCh6qzAZgu14mRna-h4UtNy1leESrvq9lR59RryX_67CmgR3s4rn2CyHw_zV8en4m8lGXLg1KsZOW-ABkNFniAJ28T72AiWXhWY_AKi1KWhC-8UQZaV_vDU0i0deC6AMqJUWLSZCtbaeTaajPPIJm8-ilI3l8UzcCHdnt2c_b3qiTGaJFgsv_ehpw-VwgWx3oP4UsN2XoI0qWAq7PbTPm7Z0uFZGpJTK_dXutjUvdhdGJqTFDFV0LO4qCVcpojp8qM3WrOatnhSAY6O55uv9FYNTAvzM4VT_BlMPTciXcJLBcaDdkx9JU6GrLioywenlkIn1aDp_3wWpaQWsoRb50s61-50nhrwDQt4OH5qcokoBHudx6LYKn8dpq60HJ5Ip00NC1y-03eOBcTuA2wOu1ZwxAEhLq5-kmjZTnaSKxOsuvmeTi3_P-wnXLag2gewcQreHdNdMQdk5xOSWajVucclovp8stshkLWOUlHaiJfOR7G5cMtFWRKMymm_E3--nhcD2osNuoYhYhL54jf0dXdz37MjHgHbEkrik2Q-VOG-NvKuR0vuavJQUDrzvd3N0vI5z9RDyYMJNF_b4S0hf0mVWw0XC17gY5YB9DhxsKOCwy59VNMMOwxXCvFulxB2gOPDu1NtnBLoIoCCoGwmgNjPXp4bjRkuQBHJWCHRvptLnU0ARkAJ2I3g82EmApSySP7cP3j0niTjb2_nSMjuM5T9lyEMiWCniAJ_COUZGUIsVsFMpm0n2emY4TFNYxx-YtGmsM3DaQsz1LIOaX7CW7YP6GXBPh07JZ8P3rnz3PpH-wBFjG3eR5oTe8jedW-kkoAluB9f1QM62qAo7pGs1Xv88iKP9V7i5ImnnCaM_GH7CfZTI8eLtNu8WQlGz5XyilBiE2PuvRXLw8U_VwQqPMy7qHNBrDCRa0p6uA1cl6JUSDg2hlQMBiHJJRxKFKBsW2TMczB6yapP-QXDKjKKlETd1jEuNNC2y7k_8SRHAmZmh0yKtOa_sZh-Nbh4E_0306VXCCO-BzaTEPnhNYV30eEgzKcrklh_0-1IRwNSWYDRKqp4gRQdiWwXaG__916nBeTuudnORuTWfcKquYEGiUdgcECFXbaAlN9Djua5VMJR4oXiZGxx2LIouPDjoZCHhpGISxF6625KjAe_DewzTnrBe_FY7-Ua8pIDQhDZMUKPL1r_DSNVOFDVvxMAsepveA21dqv56qPXUUZy3onTBQZlolaKBOQPFY-U3xzDsJ9CX9ZJu6YVuo6qU_eanx1z0OD3MvYMdChwlthzsxficgzxdH7FWlTgm1kYCmNfmccETDIlVuOhqEKmommvgiSmV3oPxdnEOSB70qpFWOuCnwUel_Lv80H_30_z1BGd9Im15iWas2ttQo0Uf_X9DX-L32P4sQR-R90BB0s7oKc76kjz0agF8YZUgv-ETNOgu68QH3SGXbNiOPKlRGTkghjkUciaCp6JDTV1xfEYCcEz_EN5Wm0c-CGhgV5UJuZhm2Kub0RhO_47MliiD9ozsd3d31cut3sVzufIX8HgcJN2mOWam_FpW6gImYxq8IBusP71NsguT1Pt6Kehawm-xvFjO4cFo0GQEXYm5ObVwaLYxucreXfxMxp6ICWpa6kdO-YgO6wBvj8qGeIV-qeaCaQFcd31ezPxLiZ_s2xFGTLrbliuG32z0FANG1yno2057tbcEB_D1G2GYlDutq9yuhDrWbGylPjDdTswKEkNG89j2XVGdvsPSPA_d59QGgh642nMZveBv2wpGrNL3LOlNdubR_RwhZtb8GlIIBBJMAMgJpo12mP6XhFRI7D7lQEUDzVjgOn4UQ_SJSMDl5sSBPAU0rA4j2Ox2ANiUIWNMe5Cu1w8RT4zWGy5d1jYq2Gw_jLMLcaSfi3iW3hgBYAE&bundleId=&ias_xappb=
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame D823 91 KB
23 KB 37ms
37ms Script
application/javascript 2600:9000:24f4:ee00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:24f4:ee00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Sun, 02 Apr 2023 06:31:15 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 4e2b60a8131e436f5ac38dc8a953edf4.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD55-P3
age: 17908608
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: 2SNrXF-q4xvtqTMONNyHJNyIm8TLeaYFqvW9dD3kqGfQXSNPD4gkyg==

GET
H2 200 dt
dt.adsafeprotected.com/ Frame CD42 43 B
215 B 98ms
56ms Image
image/gif 2600:1f18:1aca:4280:b716:d20c:53fa:e647
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1712960&asId=42a7ea54-8602-e5ed-3212-19289c9b7a7b&tv=%7Bc:s7dXS8,pingTime:-2,time:210,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:306,beZ:308,mfA:310,cmA:311,inA:312,inZ:315,prA:316,prZ:340,si:347,poA:348,poZ:373,cmZ:373,mfZ:373,loA:417,loZ:420,ltA:516,ltZ:516%7D%7D,sca:%7Bdfp:%7Bdf:0%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:0,h:0,t:40%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:210,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:40,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:i,cc:NaN.NaN.0.0,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B203~0%5D,as:%5B203~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tTNvu3k+11%7C12%7C131%7C132%7C14%7C151%7C152%7C161%7C162%7C1711%7C181*.1712960-75657828%7C1811%7C1911%7C1a1,idMap:181*,pd:CV8L.internal-pdf-viewer,rmeas:1,rend:0,renddet:IMG.us,siq:42,sinceFw:167,readyFired:false%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:b716:d20c:53fa:e647 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:02 GMT
server: nginx
x-server-name: dt18.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame AB08
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEBZ3P1yGscsC7enRZPGGCN0&google_cver=1&google_push=AXcoOmR5IiF5AhCzi0RioQGFRCyMW03SldFk9DwmGJ-rPGPs3nd5jMIhr4onkRtxKJQqHsWAjIJNO7wtg74xhcuF73RAho8jonE8v...
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=NDU4ODY1MzU5NDUwODMyMzU4MQ==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEKyikPJ1RzvCSikJVer2ItI&google_cver=1

43 B
398 B

55ms
54ms

Image
image/gif

2620:112:f002:bbbb::21
TURN-US-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEKyikPJ1RzvCSikJVer2ItI&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8793237398349137&output=html&h=280&adk=3809598800&adf=854766408&pi=t.aa~a.3093707004~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1698361681&rafmt=1&to=qs&pwprc=4354248216&format=1200x280&url=https%3A%2F%2Fnotepad.plus%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1698325681326&bpp=1&bdt=3282&idt=0&shv=r20231024&mjsv=m202310260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db38f74f5bba9cd29%3AT%3D1698325679%3ART%3D1698325679%3AS%3DALNI_MbFOhtzjBTfbED67puskk9feSK6ZQ&gpic=UID%3D00000d9cb191db97%3AT%3D1698325679%3ART%3D1698325679%3AS%3DALNI_MZ6ZUkzpsMstOsdeFgOXcsuu-BAqw&prev_fmts=0x0%2C970x250%2C1030x280%2C1050x280&nras=4&correlator=3972234055011&frm=20&pv=1&ga_vid=2061795391.1698325679&ga_sid=1698325679&ga_hid=1146444982&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=3767&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079078%2C44805932%2C44806737%2C31078297%2C31079206&oid=2&psts=AOrYGsnymZq8uzdJoDkwlNsvW-NaSna0XYpnXdP_mu2O8X1-JPfzYwozuJp1M-FBp8XkKpQeFinhy0ybRtjj&pvsid=464992494868551&tmod=122040629&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=GhWwA9iBgf&p=https%3A//notepad.plus&dtd=22
Protocol: H2
Server: 2620:112:f002:bbbb::21 , United States, ASN6336 (TURN-US-ASN, US),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 26 Oct 2023 13:08:02 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:02 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEKyikPJ1RzvCSikJVer2ItI&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame AB08 35 B
463 B 178ms
69ms Image
image/gif 2620:116:800b:21:c1e8:5385:5098:6bf0
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEDjasRV9XhNFl5YUJdbitfg&google_cver=1&google_push=AXcoOmR3yYXUgJFiDnAlZWaDIY83zypPz_B20k66qDnWM1Htlg7bOri793CuwdILOhLQyyMqLZC2ZQ6ZVdFPIBDUNadpOvgVam3kq7GONL-JqHhJKa2uzYECe1waPvaVnqT-63P6BTsTuvaum_99m2EJ2h3NlA

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800b:21:c1e8:5385:5098:6bf0 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:02 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame AB08
Redirect Chain

https://px.owneriq.net/ecmg?google_gid=CAESEDuzWEFMjsQaA08FkB0ERQU&google_cver=1&google_push=AXcoOmRreKaGU6mRyXoh56gNugvCuQcM4_nFpFCZcNqF9Sib1QHtph8uCSgZlbRDd0_AC7zk-cC-3pDuJqkyAVxXii3yZ42xul3XAVm7...
https://px.owneriq.net/ecc?redir=https%3a%2f%2fcm.g.doubleclick.net%2fpixel%3fgoogle_nid%3downeriq1%26google_sc%26google_push%3dAXcoOmRreKaGU6mRyXoh56gNugvCuQcM4_nFpFCZcNqF9Sib1QHtph8uCSgZlbRDd0_AC...
https://cm.g.doubleclick.net/pixel?google_nid=owneriq1&google_sc&google_push=AXcoOmRreKaGU6mRyXoh56gNugvCuQcM4_nFpFCZcNqF9Sib1QHtph8uCSgZlbRDd0_AC7zk-cC-3pDuJqkyAVxXii3yZ42xul3XAVm74z_tw6OCH3wUKWzL...

170 B
188 B

68ms
68ms

Image
image/png

172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=owneriq1&google_sc&google_push=AXcoOmRreKaGU6mRyXoh56gNugvCuQcM4_nFpFCZcNqF9Sib1QHtph8uCSgZlbRDd0_AC7zk-cC-3pDuJqkyAVxXii3yZ42xul3XAVm74z_tw6OCH3wUKWzLlaya1epUDL3ObzmjscZZUZBlj_lI3D4DV6VgyO4&google_cver=1&google_gid=CAESEDuzWEFMjsQaA08FkB0ERQU&google_hm=UTc1MTYxMjA4MjEzMTMyMjk1MDI=

Requested by

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:02 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Thu, 26 Oct 2023 13:08:02 GMT
Server: Apache/2.4.6 (CentOS)
X-Powered-By: PHP/7.3.33
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://cm.g.doubleclick.net/pixel?google_nid=owneriq1&google_sc&google_push=AXcoOmRreKaGU6mRyXoh56gNugvCuQcM4_nFpFCZcNqF9Sib1QHtph8uCSgZlbRDd0_AC7zk-cC-3pDuJqkyAVxXii3yZ42xul3XAVm74z_tw6OCH3wUKWzLlaya1epUDL3ObzmjscZZUZBlj_lI3D4DV6VgyO4&google_cver=1&google_gid=CAESEDuzWEFMjsQaA08FkB0ERQU&google_hm=UTc1MTYxMjA4MjEzMTMyMjk1MDI=
Content-Type: text/html
Cache-Control: max-age=85004
Connection: keep-alive
Content-Length: 154

GET
H2 204 AdxPixel
tr.blismedia.com/v1/api/sync/ Frame AB08 0
173 B 154ms
49ms Image
text/plain 34.96.105.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEMsnz519-TAYUsQv-P5FjSk&google_cver=1&google_push=AXcoOmQudNqymSGKmPdoCxbWCcxB293AiDXzb0_4r3dbEn_MWVEGH1C1ApR0kUjkurTWlKsLwEvPtFVPsC4RBl7HekSKyVcolv2neOLKlNEdVfKia_NnXHDc1QBIOBUuvHW8H1zOaMoXZ4HgTZY8XSGpLK1UibM
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8793237398349137&output=html&h=280&adk=3809598800&adf=854766408&pi=t.aa~a.3093707004~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1698361681&rafmt=1&to=qs&pwprc=4354248216&format=1200x280&url=https%3A%2F%2Fnotepad.plus%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1698325681326&bpp=1&bdt=3282&idt=0&shv=r20231024&mjsv=m202310260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db38f74f5bba9cd29%3AT%3D1698325679%3ART%3D1698325679%3AS%3DALNI_MbFOhtzjBTfbED67puskk9feSK6ZQ&gpic=UID%3D00000d9cb191db97%3AT%3D1698325679%3ART%3D1698325679%3AS%3DALNI_MZ6ZUkzpsMstOsdeFgOXcsuu-BAqw&prev_fmts=0x0%2C970x250%2C1030x280%2C1050x280&nras=4&correlator=3972234055011&frm=20&pv=1&ga_vid=2061795391.1698325679&ga_sid=1698325679&ga_hid=1146444982&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=3767&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079078%2C44805932%2C44806737%2C31078297%2C31079206&oid=2&psts=AOrYGsnymZq8uzdJoDkwlNsvW-NaSna0XYpnXdP_mu2O8X1-JPfzYwozuJp1M-FBp8XkKpQeFinhy0ybRtjj&pvsid=464992494868551&tmod=122040629&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=GhWwA9iBgf&p=https%3A//notepad.plus&dtd=22
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:02 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 204 CookieSyncAdX
rtb.adentifi.com/ Frame AB08 0
285 B 156ms
51ms Image
text/plain 34.203.64.127
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncAdX?google_gid=CAESEE0oMSxG_rST077kibyRW7I&google_cver=1&google_push=AXcoOmTI0-9mJOrOM-fQTq8DtiK_yosM4pylA5ShgQNn1sZo3DjQEpjxWCLstc27oLphnVN_xMtfKiXnY04w3zCPfgwplqevs6kS2698KA0YjRX7WXQ8U61McuMsS5IN8DmYgmw1jIBRbheBY9D_8UHkt5MEIw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8793237398349137&output=html&h=280&adk=3809598800&adf=854766408&pi=t.aa~a.3093707004~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1698361681&rafmt=1&to=qs&pwprc=4354248216&format=1200x280&url=https%3A%2F%2Fnotepad.plus%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1698325681326&bpp=1&bdt=3282&idt=0&shv=r20231024&mjsv=m202310260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db38f74f5bba9cd29%3AT%3D1698325679%3ART%3D1698325679%3AS%3DALNI_MbFOhtzjBTfbED67puskk9feSK6ZQ&gpic=UID%3D00000d9cb191db97%3AT%3D1698325679%3ART%3D1698325679%3AS%3DALNI_MZ6ZUkzpsMstOsdeFgOXcsuu-BAqw&prev_fmts=0x0%2C970x250%2C1030x280%2C1050x280&nras=4&correlator=3972234055011&frm=20&pv=1&ga_vid=2061795391.1698325679&ga_sid=1698325679&ga_hid=1146444982&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=3767&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079078%2C44805932%2C44806737%2C31078297%2C31079206&oid=2&psts=AOrYGsnymZq8uzdJoDkwlNsvW-NaSna0XYpnXdP_mu2O8X1-JPfzYwozuJp1M-FBp8XkKpQeFinhy0ybRtjj&pvsid=464992494868551&tmod=122040629&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=GhWwA9iBgf&p=https%3A//notepad.plus&dtd=22
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.203.64.127 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-203-64-127.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:02 GMT

GET
H2

200

spacer.gif
an.yandex.ru/resource/ Frame AB08
Redirect Chain

https://an.yandex.ru/mapuid/google/CAESEArUWHkzPODkWXLSga8J_Vs?ext-param=AXcoOmQCUkJR-mubVx0gVPWdWGuxdSrSGYPFZDwC3b3RBJMko_Ze2XAOe6tj5ehrYDLLnXVgsKAX8jdToQWZ6Ix-Ro_FVK-JKw42t0h6AvHOpCFJEOeNOPjrBBGI...
https://cm.g.doubleclick.net/pixel?google_nid=yandex_ag&google_hm=CAESEArUWHkzPODkWXLSga8J_Vs&google_redir=https%3A%2F%2Fan.yandex.ru%2Fresource%2Fspacer.gif
https://an.yandex.ru/resource/spacer.gif

43 B
144 B

220ms
220ms

Image
image/gif

2a02:6b8::90
GLOBAL_DC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://an.yandex.ru/resource/spacer.gif

Requested by

Protocol

Server

2a02:6b8::90 Ulyanovsk, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:02 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000
last-modified: Wed, 18 Apr 2001 10:28:03 GMT
content-type: image/gif
p3p: CP="NOI DEVa TAIa OUR BUS UNI STA"
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Thu, 10 Oct 2024 13:08:02 GMT

Redirect headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:02 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://an.yandex.ru/resource/spacer.gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 237
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame AB08
Redirect Chain

https://trace.mediago.io/cs/google?google_gid=CAESECml3kV2DIS3DZCGbv2MWVk&google_cver=1&google_push=AXcoOmQ3xl9X0lS-TUSl3279jSFCNmFx5El_zvBx7uFVonhY0ESSNvNNuCVcG_ahHpybzKyw_d3yzhwydP0xdBrV6Un9uViy7...
https://cm.g.doubleclick.net/pixel?google_nid=baidu_mediago&google_push=AXcoOmQ3xl9X0lS-TUSl3279jSFCNmFx5El_zvBx7uFVonhY0ESSNvNNuCVcG_ahHpybzKyw_d3yzhwydP0xdBrV6Un9uViy7qhVgsKw1N2m0YnsJM_sPeirzgekG...

170 B
188 B

44ms
44ms

Image
image/png

172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=baidu_mediago&google_push=AXcoOmQ3xl9X0lS-TUSl3279jSFCNmFx5El_zvBx7uFVonhY0ESSNvNNuCVcG_ahHpybzKyw_d3yzhwydP0xdBrV6Un9uViy7qhVgsKw1N2m0YnsJM_sPeirzgekGYRJixq2XI0ZQKng0fWgXEgb0ToukXR6iQ7u&google_hm=2a46ab3483671da110f9qt00lo779f8b

Requested by

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:02 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=baidu_mediago&google_push=AXcoOmQ3xl9X0lS-TUSl3279jSFCNmFx5El_zvBx7uFVonhY0ESSNvNNuCVcG_ahHpybzKyw_d3yzhwydP0xdBrV6Un9uViy7qhVgsKw1N2m0YnsJM_sPeirzgekGYRJixq2XI0ZQKng0fWgXEgb0ToukXR6iQ7u&google_hm=2a46ab3483671da110f9qt00lo779f8b
date: Thu, 26 Oct 2023 13:08:02 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 306
content-type: text/html; charset=utf-8

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame AB08 0
12 B 43ms
43ms Image
text/html 172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Kw6ZM7WHaxSq2Bslh32KJRo96ZGHnrmIGDysFjYxj2LWwSyEetHN12ZNVkoxWgnb_vgbGW2tE

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:02 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 37AC 2 KB
1 KB 160ms
46ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.us.criteo.com
URL: https://ads.us.criteo.com/delivery/r/afr.php?z=ZTpksQAF0r8By6AkAAZ6JeuB_IBy1X4uLQQdgQ&u=%7CTIVlNeULxIYp6RnTTZHGErQt1nrZn%2FZdcid1JSTkTk4%3D%7C&c1=TUPLs6ok1IhDgnvJmJgq2b8G6XvEBIvqAb79lxbNLn-Y29LVqxBSOQhZKVxZui5pXNlU4WPrBd9-dzZ-iTLkdn4iCWrkEk_c0jgPPMIjIQU-TE3in1PibGkZKE5tD8qqACT13OAWplwUbMFDPkytS07i2BC4mIy8W22Lft-c_hvNw8_mOTTzxdIxxxO5LcMCzLHnh8efYuxz8zlAk5tJE49ivghyCsRKsB0EVZ6oFIlJAMAaDwQktdT9U-xGCyAJhHTp1VUoFEqPI4twKMMdITlT9NddkIlnGrtwQaIQ5NGww0dUrLA-WGHOY0ex2go-wp0QHJ_bzF1Vqsag2ctC9tv7Ua9MUfpWZ7T0SpMDBWHFja_1pQ6bv0ezs5S9UC7zrg1V8J7UYxz1v8sNUKiyWaCESi684co7DtCBl9MlyOlWvMlkvNzjV8GZg5AIHBjBqYycmYwe3CHsTbsPQZaffU39HwbtKTM-8pI2lcFOs1cDBEXJX7clT_BzT8Hly7OZnpmuJY1GHyvb4GTNxshgaInFgUDXzUnnPf--aMxEWavKRdUmUuxvTqdfIsV_djyJSE6FHMQSRd5JREE9rcnAkO0NG1Q3CEvNCZdcA8XziWi8Z1x-K3MfwV7Yk0AA0QsELObxu_Imh2CDhOqeGp2iQw&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCVSQ3sWQ6Zb-lF6TArr4PpfSZqA2cge-wXKqbqap0wI23ARABIABgyQaCARdjYS1wdWItODc5MzIzNzM5ODM0OTEzN8gBCagDAcgDAqoExwFP0JH6GwU-1lt_IT3bkJMNPQ28YvY2-JTGkAqWIddlbed65-SQq5lFoDqZB1Xiqtv_OA5-JCf9HATGlhj_HJ254qgfAe8loBVzEPqUF7KKU6tpC7PIWKSdaHCbpJf8GyMryYsrmsojr6U_tiLA9uu_rLS_pABxulyQl45RoSbQ2cZ9c0aLz0qcE9TvLFC0x6DyRRWS_UKq44ekqY5JZgc9rscfYWIgOPKAVhzSW-OEiYjX5xVLOvUbyriD29498s7eUAwUqKfLgAag94Dzp_Pgw2SgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggSCIBhEAEyAooCOgKAQEi9_cE6-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2qVwC0-nzl-4XNmFVInqJyY-ySdA%26client%3Dca-pub-8793237398349137%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:02 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 20 Oct 2024 13:08:02 GMT

GET
H2 200 adchoices_en.svg
static.criteo.net/flash/icon/ Frame 37AC 2 KB
1 KB 163ms
49ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_en.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

60bcafbd631f6fa0805e158ca3b235e76225350db6fbb423596d4c4954b27573

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:02 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-759"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 20 Oct 2024 13:08:02 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 37AC 308 B
636 B 92ms
49ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:02 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Sun, 20 Oct 2024 13:08:02 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 37AC 293 B
621 B 91ms
48ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:02 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Sun, 20 Oct 2024 13:08:02 GMT

GET
H2 200 lg.php
cat.va.us.criteo.com/delivery/ Frame 37AC 43 B
348 B 196ms
70ms Image
image/gif 74.119.119.147
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.va.us.criteo.com/delivery/lg.php?cppv=3&cpp=5Nea2dQh_6dpXCRvB0a4CpTyD9mAG8_UFR1SkcuhNFnwVSz0fpBAycXTHBIRSJkbIqUe8yabu8UI0KdmczkMtx29ceBNLmPA34SDmCdlQTmutjKkfug132p5PV6obxc4vuh7qATRPP2l4eFwSJwNFH_RLo9_KCiueJ8zRglZtSIeu-DqrjbJbr6-rPjnGwn1dTa8bCGsFiXLEn2p7KRhSe32yCxFl9SFAEbZ9wWkNtBhA1FUJC5apN0WJZ-agk0a3Vg1xbNAqziJRIEgDAk81ysFrg2HeBfN1ioCk1vS-QcD5rravPB3sJyJRltQsiIDhQVaRmQzQB1KEaw3a3rZza2f-DYMyPvP-45hUIc6tHsiCtzlV1hjBzVzOcc_sC4YfhLLPwXo_7SNp5gfxHQdzhCPP55kMn2fZr57IgfgpQjZRKao

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.147 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:01 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1714761
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 1CC0 43 B
215 B 75ms
55ms Image
image/gif 2600:1f18:1aca:4280:b716:d20c:53fa:e647
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1712960&asId=32fcb002-2bd0-4e87-f07c-e74b86635889&tv=%7Bc:s7dXSu,pingTime:-3,time:82,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:0,h:0,t:30%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:82,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:30,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:i,cc:NaN.NaN.0.0,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B74~0%5D,as:%5B74~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tTNvu5K+11%7C12%7C131%7C132%7C141%7C142%7C151%7C152%7C161%7C162%7C1711%7C1811%7C1812%7C191*.1712960-75657828%7C1911%7C1a1,idMap:191*,rmeas:1,rend:0,renddet:IMG.us,siq:32%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:b716:d20c:53fa:e647 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:02 GMT
server: nginx
x-server-name: dt21.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 1CC0 43 B
215 B 72ms
55ms Image
image/gif 2600:1f18:1aca:4280:b716:d20c:53fa:e647
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1712960&asId=32fcb002-2bd0-4e87-f07c-e74b86635889&tv=%7Bc:s7dXSv,pingTime:-6,time:83,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:83,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:30,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:i,cc:NaN.NaN.0.0,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B75~0%5D,as:%5B75~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tTNvu5K+11%7C12%7C131%7C132%7C141%7C142%7C151%7C152%7C161%7C162%7C1711%7C1811%7C1812%7C191*.1712960-75657828%7C1911%7C1a1,idMap:191*,rmeas:1,rend:0,renddet:IMG.us,siq:32%7D&tpiLookup=ao:notepad.plus*%2Cgoogleads.g.doubleclick.net*&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:b716:d20c:53fa:e647 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:02 GMT
server: nginx
x-server-name: dt13.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 323D 2 KB
1 KB 142ms
47ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.us.criteo.com
URL: https://ads.us.criteo.com/delivery/r/afr.php?z=ZTpksQAF6jEBy5LUAAGCiKn2zoQLcyfCJd0Y6Q&u=%7CTIVlNeULxIbDQCLueaOAB65suUgbUaqWeVDQA%2BfXdtI%3D%7C&c1=TUPLs6ok1IhDgnvJmJgq2b8G6XvEBIvqAb79lxbNLn-Y29LVqxBSOQhZKVxZui5pXNlU4WPrBd9-dzZ-iTLkdn4iCWrkEk_c7V37h3O1uNpc7l9p3RaxObo3oWgvCWGvwuSS1li6tg9CxAzRg8UgW2cKt5wKwfqExTACL3pKbxf0baTOvkClYxt1iFShf82BNOs44yR-NTv9my_xnnMBvmP_g54znTZDPZ5fcB7qnEkXpK8tVFBB7xr9GAXj5vC868yzlITwNXwjDZYu18U2dy5T6dlZfRfXx9kgvndm7ltv8C9RhfMXWIJRL98ikyzdeM__-0An-Nz9hXlzyUmTNGk8yW6zazurQJ4eGNkbM4qxejld4jwwMwtZwR4lJeqkzh5sW_w9MaJHCXj_QqRY6eC8Knk9EKxQZNc2llaws-3v2lGsM-jJ7I_8l53ss2FN2DJAlJPlTHg901C3h54rqR2wQHBLv49Cp2zeUA4jMoLfLtOxvto1Msk5W2aEPw-KXVWf0efHzpiKWKf3T-WrjjJ5b3U-qXpEftXYZ9A3QqZM7B_-HGAUnaYv3E0IB06c_3VZRk3bcYAjjs_4OZpo10nS6d0ZAS4mVE2wflpDkFDiLW-WqKkPjkDB7FdhPEIQSR8hv_TlZ57QXMgqDn4g4g&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCuyZSsWQ6ZbHUF9Slrr4PiIWGuAWcge-wXKqxqqp0wI23ARABIABgyQaCARdjYS1wdWItODc5MzIzNzM5ODM0OTEzN8gBCagDAcgDAqoExwFP0Cy1sV10cblQuuX8KVGoYj9q1JhAe_zJt9Je4bD0IlPTlNADShSynNfngiQDD09PrtoaXfwR-txV6Ri7GJKzVkpMw0MyZX1_MWeOEbHTfprXOnisR_4AUMwzBiW5mZKVvNrtdC3sepFfbUCeipZ2xIHCu5PqvRMuZy87z4ajKCV4w2GAycQCLUX5arNVzI-0rwpfzJ9aGJvpyy5NErVCOGNXZfQud3pmnt1d7xSDU7g6aKroaD129Umj1rdZ8ZID6NMb1U3GgAbL_Na85PqiriSgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggSCIBhEAEyAooCOgKAQEi9_cE6-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_1BOjoR13gJLczzYHyYjBm_jD7RRA%26client%3Dca-pub-8793237398349137%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:02 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 20 Oct 2024 13:08:02 GMT

GET
H2 200 adchoices_en.svg
static.criteo.net/flash/icon/ Frame 323D 2 KB
1 KB 144ms
50ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_en.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

60bcafbd631f6fa0805e158ca3b235e76225350db6fbb423596d4c4954b27573

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:02 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-759"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 20 Oct 2024 13:08:02 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 323D 308 B
636 B 76ms
48ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:02 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Sun, 20 Oct 2024 13:08:02 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 323D 293 B
621 B 76ms
47ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:02 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Sun, 20 Oct 2024 13:08:02 GMT

GET
H2 200 lg.php
cat.va.us.criteo.com/delivery/ Frame 323D 43 B
347 B 183ms
70ms Image
image/gif 74.119.119.147
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.va.us.criteo.com/delivery/lg.php?cppv=3&cpp=XZo2fDPJLUTyAGAHNjkSuEfwRdOX2YVK4hIcrZBu6g-505D-sHnQH-ljB65wkrYQoX15oB7XfIBjJ9Hc-xIH4lc0g0cOxbne3ODqyOS-UaqfB45g-doRu2zaoLDgqRyUb9XWXsWN2HTFJ5F_K3PRmTMkjFcD3yAru6Po-Gz6tJyyb1et2l8eZCTW3yZ_yzvuWqghNRdrIAAYLSeK0zFKufF8i97ZL2mAX0aQK4xEHu0hcJ_kTHBgZiXUbM1705BkH4TesJ5_TGRDXJO2xhZ0i6ax2KfRsK1s9rDGug8aZ9Nb4bBOY9HDQ7blClh5_hl_fSHIMW69VjEZYJawlf4-XZyUbiDyuHs5oRcmdN5iBry_lB-em3n2Gfr5PJzSdAMK29Gwnusz-bEl9TIElwNPCP0NQTbRNNw73xO0cBhcMk5AKqVz

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.147 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:01 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1687321
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
DATA 200
OK truncated
/ Frame AAA0 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: de8a68d9b9df597750d37209711470d206af59936ff6db7de467710585a4d65d

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame F91B 38 KB
13 KB 52ms
51ms Document
text/html 2607:f8b0:4004:c1b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 586504
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 19 Oct 2023 18:12:58 GMT
expires: Fri, 18 Oct 2024 18:12:58 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 3B0B
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEBZ3P1yGscsC7enRZPGGCN0&google_cver=1&google_push=AXcoOmSAFecjsRtyVDDckAOiOlwGkVtpJAO0cVp54sYBs4qE-VqPFfSwPUJqzPONigrdbmuDdXw7Ba5kj4gLZkHdE9N5DoWs8mmv66w
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=NzQ3MDk1NzM1NjAyNTQ0MTAyMQ==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEKyikPJ1RzvCSikJVer2ItI&google_cver=1

43 B
398 B

54ms
53ms

Image
image/gif

2620:112:f002:bbbb::21
TURN-US-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEKyikPJ1RzvCSikJVer2ItI&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8793237398349137&output=html&h=280&adk=965705852&adf=4284688756&pi=t.aa~a.4100179273~rp.4&w=1050&fwrn=4&fwrnh=100&lmt=1698361681&rafmt=1&to=qs&pwprc=4354248216&format=1050x280&url=https%3A%2F%2Fnotepad.plus%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1698325681326&bpp=1&bdt=3282&idt=-M&shv=r20231024&mjsv=m202310260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db38f74f5bba9cd29%3AT%3D1698325679%3ART%3D1698325679%3AS%3DALNI_MbFOhtzjBTfbED67puskk9feSK6ZQ&gpic=UID%3D00000d9cb191db97%3AT%3D1698325679%3ART%3D1698325679%3AS%3DALNI_MZ6ZUkzpsMstOsdeFgOXcsuu-BAqw&prev_fmts=0x0%2C970x250%2C1030x280&nras=3&correlator=3972234055011&frm=20&pv=1&ga_vid=2061795391.1698325679&ga_sid=1698325679&ga_hid=1146444982&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=275&ady=3092&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079078%2C44805932%2C44806737%2C31078297%2C31079206&oid=2&psts=AOrYGsnymZq8uzdJoDkwlNsvW-NaSna0XYpnXdP_mu2O8X1-JPfzYwozuJp1M-FBp8XkKpQeFinhy0ybRtjj&pvsid=464992494868551&tmod=122040629&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=i085cixuMS&p=https%3A//notepad.plus&dtd=17
Protocol: H2
Server: 2620:112:f002:bbbb::21 , United States, ASN6336 (TURN-US-ASN, US),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 26 Oct 2023 13:08:02 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:02 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEKyikPJ1RzvCSikJVer2ItI&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame 3B0B
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEO9RGVXDTrwXJK5p8xDS4uk&google_cver=1&google_push=AXcoOmScG2QLGaRjvoH11fCSHdZgPbLeTk_5VriN72sfC-cS-LKiBfNPf5Li8qPHa5Y7l15vnP7uSPfnzUvQSHSNOQIRvXP16_k8l...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEO9RGVXDTrwXJK5p8xDS4uk&google_cver=1&google_push=AXcoOmScG2QLGaRjvoH11fCSHdZgPbLeTk_5VriN72sfC-cS-LKiBfNPf5Li8qPHa5Y7l15vnP7uSPfnzUvQSHSNOQIRvXP16_k...

43 B
422 B

107ms
106ms

Image
image/gif

2606:4700::6812:18ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEO9RGVXDTrwXJK5p8xDS4uk&google_cver=1&google_push=AXcoOmScG2QLGaRjvoH11fCSHdZgPbLeTk_5VriN72sfC-cS-LKiBfNPf5Li8qPHa5Y7l15vnP7uSPfnzUvQSHSNOQIRvXP16_k8lNr1&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmScG2QLGaRjvoH11fCSHdZgPbLeTk_5VriN72sfC-cS-LKiBfNPf5Li8qPHa5Y7l15vnP7uSPfnzUvQSHSNOQIRvXP16_k8lNr1%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8793237398349137&output=html&h=280&adk=965705852&adf=4284688756&pi=t.aa~a.4100179273~rp.4&w=1050&fwrn=4&fwrnh=100&lmt=1698361681&rafmt=1&to=qs&pwprc=4354248216&format=1050x280&url=https%3A%2F%2Fnotepad.plus%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1698325681326&bpp=1&bdt=3282&idt=-M&shv=r20231024&mjsv=m202310260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db38f74f5bba9cd29%3AT%3D1698325679%3ART%3D1698325679%3AS%3DALNI_MbFOhtzjBTfbED67puskk9feSK6ZQ&gpic=UID%3D00000d9cb191db97%3AT%3D1698325679%3ART%3D1698325679%3AS%3DALNI_MZ6ZUkzpsMstOsdeFgOXcsuu-BAqw&prev_fmts=0x0%2C970x250%2C1030x280&nras=3&correlator=3972234055011&frm=20&pv=1&ga_vid=2061795391.1698325679&ga_sid=1698325679&ga_hid=1146444982&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=275&ady=3092&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079078%2C44805932%2C44806737%2C31078297%2C31079206&oid=2&psts=AOrYGsnymZq8uzdJoDkwlNsvW-NaSna0XYpnXdP_mu2O8X1-JPfzYwozuJp1M-FBp8XkKpQeFinhy0ybRtjj&pvsid=464992494868551&tmod=122040629&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=i085cixuMS&p=https%3A//notepad.plus&dtd=17
Protocol: H2
Server: 2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:02 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 81c2ecfafa8f4223-EWR
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:02 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 40
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEO9RGVXDTrwXJK5p8xDS4uk&google_cver=1&google_push=AXcoOmScG2QLGaRjvoH11fCSHdZgPbLeTk_5VriN72sfC-cS-LKiBfNPf5Li8qPHa5Y7l15vnP7uSPfnzUvQSHSNOQIRvXP16_k8lNr1&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmScG2QLGaRjvoH11fCSHdZgPbLeTk_5VriN72sfC-cS-LKiBfNPf5Li8qPHa5Y7l15vnP7uSPfnzUvQSHSNOQIRvXP16_k8lNr1%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 81c2ecfa19614223-EWR
alt-svc: h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3B0B
Redirect Chain

https://mweb.ck.inmobi.com/sync/3?redirect=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dinmobi_pte_limited%26google_hm%3D%24DSP_CKID&google_gid=CAESEAlDbgw-k2ku1LVk6y3bq0k&google_cver=...
https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=MGU2NzViZWYtYzljMC00ZjczLTgwMGItMzM3NDAyMmEwMmMy&google_gid=CAESEAlDbgw-k2ku1LVk6y3bq0k&google_cver=1&google_push=AXcoOmR9...

170 B
188 B

43ms
43ms

Image
image/png

172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=MGU2NzViZWYtYzljMC00ZjczLTgwMGItMzM3NDAyMmEwMmMy&google_gid=CAESEAlDbgw-k2ku1LVk6y3bq0k&google_cver=1&google_push=AXcoOmR9FbFtApDFuPRQGbyToBLBYDcb93r6Vrklm2lZYBhioBZU-EVly0GRf8N3My3HDNWgS1fsa2qBJjrtjUyqPEt_zWmqJMVAFH0L

Requested by

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:02 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=MGU2NzViZWYtYzljMC00ZjczLTgwMGItMzM3NDAyMmEwMmMy&google_gid=CAESEAlDbgw-k2ku1LVk6y3bq0k&google_cver=1&google_push=AXcoOmR9FbFtApDFuPRQGbyToBLBYDcb93r6Vrklm2lZYBhioBZU-EVly0GRf8N3My3HDNWgS1fsa2qBJjrtjUyqPEt_zWmqJMVAFH0L
date: Thu, 26 Oct 2023 13:08:02 GMT
strict-transport-security: max-age=15724800; includeSubDomains
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 204 CookieSyncAdX
rtb.adentifi.com/ Frame 3B0B 0
284 B 89ms
52ms Image
text/plain 34.203.64.127
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieSyncAdX?google_gid=CAESEE0oMSxG_rST077kibyRW7I&google_cver=1&google_push=AXcoOmR4vdxjAralTZF-GyW9MWbMzvMUQRqmW1d_swJSpl5ZAEds5wsHVsDczuyluUlLzL_ktI5OWlnwTtT0pbDPWKKMwq70X6X7eFiG
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8793237398349137&output=html&h=280&adk=965705852&adf=4284688756&pi=t.aa~a.4100179273~rp.4&w=1050&fwrn=4&fwrnh=100&lmt=1698361681&rafmt=1&to=qs&pwprc=4354248216&format=1050x280&url=https%3A%2F%2Fnotepad.plus%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1698325681326&bpp=1&bdt=3282&idt=-M&shv=r20231024&mjsv=m202310260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db38f74f5bba9cd29%3AT%3D1698325679%3ART%3D1698325679%3AS%3DALNI_MbFOhtzjBTfbED67puskk9feSK6ZQ&gpic=UID%3D00000d9cb191db97%3AT%3D1698325679%3ART%3D1698325679%3AS%3DALNI_MZ6ZUkzpsMstOsdeFgOXcsuu-BAqw&prev_fmts=0x0%2C970x250%2C1030x280&nras=3&correlator=3972234055011&frm=20&pv=1&ga_vid=2061795391.1698325679&ga_sid=1698325679&ga_hid=1146444982&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=275&ady=3092&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079078%2C44805932%2C44806737%2C31078297%2C31079206&oid=2&psts=AOrYGsnymZq8uzdJoDkwlNsvW-NaSna0XYpnXdP_mu2O8X1-JPfzYwozuJp1M-FBp8XkKpQeFinhy0ybRtjj&pvsid=464992494868551&tmod=122040629&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=i085cixuMS&p=https%3A//notepad.plus&dtd=17
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.203.64.127 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-203-64-127.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:02 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3B0B
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEK9MPVeOH6fzb7o3wTHvzYQ&google_cver=1&google_push=AXcoOmSLqHtkUW1Yc_i64vn7P9Gz1U9A607XrqL4IMf5DDM2Ls9An1nAm2jKyNOqfPhu75WcTi2IlwN4y1d7sLt1GMWbGHX...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmSLqHtkUW1Yc_i64vn7P9Gz1U9A607XrqL4IMf5DDM2Ls9An1nAm2jKyNOqfPhu75WcTi2IlwN4y1d7sLt1GMWbGHXOr6dQlig&google_hm=eS1MSExNTk9wRTJwRXA...

170 B
188 B

44ms
44ms

Image
image/png

172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmSLqHtkUW1Yc_i64vn7P9Gz1U9A607XrqL4IMf5DDM2Ls9An1nAm2jKyNOqfPhu75WcTi2IlwN4y1d7sLt1GMWbGHXOr6dQlig&google_hm=eS1MSExNTk9wRTJwRXA0OEhWb0lnVU9GbUJ2RWFRbjdxRX5B

Requested by

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:02 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 26 Oct 2023 13:08:02 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmSLqHtkUW1Yc_i64vn7P9Gz1U9A607XrqL4IMf5DDM2Ls9An1nAm2jKyNOqfPhu75WcTi2IlwN4y1d7sLt1GMWbGHXOr6dQlig&google_hm=eS1MSExNTk9wRTJwRXA0OEhWb0lnVU9GbUJ2RWFRbjdxRX5B
content-length: 0

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame 3B0B 43 B
363 B 182ms
83ms Image
image/gif 74.119.119.150
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmQE6Dj0OzbDzjxihxnxeaLPHa_uGekiXWpDrss_uIpSRxXjqkaMtK6vdRecc2GGZ_4a9H-xsMAcHle1hazaa0SplSOQY5kdJ64&google_gid=CAESEOi_ACOTdYT0-I7KvO9wJqU&google_cver=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.150 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:01 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 405514
expires: Thu, 26 Oct 2023 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3B0B
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESEOvjCavh__VAFGSEU8FxhCo&google_cver=1&google_push=AXcoOmSeea_587Rgcs98VO8ts_aE4z0pPwvaoHWKzVIeb3jpaBGw2MKQAV_coEuVaiwlXzkUcBXYkAj1ofE2u5k...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=KUelr3DLU5tB5MS9Vyd28c5CYO4&google_push=AXcoOmSeea_587Rgcs98VO8ts_aE4z0pPwvaoHWKzVIeb3jpaBGw2MKQAV_coEuVaiwlXzkUcBXYkAj1ofE2u5...

170 B
188 B

49ms
48ms

Image
image/png

172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=KUelr3DLU5tB5MS9Vyd28c5CYO4&google_push=AXcoOmSeea_587Rgcs98VO8ts_aE4z0pPwvaoHWKzVIeb3jpaBGw2MKQAV_coEuVaiwlXzkUcBXYkAj1ofE2u5kqCiYQtVF3XuixIqeC

Requested by

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:02 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=KUelr3DLU5tB5MS9Vyd28c5CYO4&google_push=AXcoOmSeea_587Rgcs98VO8ts_aE4z0pPwvaoHWKzVIeb3jpaBGw2MKQAV_coEuVaiwlXzkUcBXYkAj1ofE2u5kqCiYQtVF3XuixIqeC
Date: Thu, 26 Oct 2023 13:08:02 GMT
Connection: keep-alive
Content-Length: 246
Content-Type: text/html; charset=utf-8

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 3B0B 0
12 B 55ms
54ms Image
text/html 172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LGLGsMfthbTsIterqRVoXAXMnLZ_6-XlpY35I-cyDf8JD-dy2tk_q_liFoX4LSm0y6Yag-

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:02 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

POST
H2 200 92322123 Show response
mc.yandex.ru/webvisor/ 43 B
209 B 454ms
414ms XHR
image/gif 2a02:6b8::1:119
GLOBAL_DC

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.ru/webvisor/92322123?wv-part=1&wmode=0&wv-hit=774446965&page-url=https%3A%2F%2Fnotepad.plus%2F&rn=533563083&wv-type=7&browser-info=bt%3A1%3Awe%3A1%3Aet%3A1698325682%3Aw%3A1600x1200%3Av%3A1142%3Az%3A-600%3Ai%3A20231026030802%3Au%3A169832567980256721%3Avf%3Aetku62lhchtfcedhsff42qn%3Ast%3A1698325682&t=gdpr(14)ti(2)

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/yandex-metrica-watch/tag.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:6b8::1:119 Ulyanovsk, Russian Federation, ASN208722 (GLOBAL_DC, FI),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

Referer: https://notepad.plus/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:02 GMT
strict-transport-security: max-age=31536000
last-modified: Thu, 26-Oct-2023 13:08:02 GMT
content-type: image/gif
access-control-allow-origin: https://notepad.plus
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 43
x-xss-protection: 1; mode=block
expires: Thu, 26-Oct-2023 13:08:02 GMT

GET
H2 200 webfontloader.js Show response
cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/ Frame 37AC 12 KB
5 KB 147ms
42ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:02 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 3012399
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 4420
last-modified: Mon, 04 May 2020 16:17:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04030-30d9"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MnM%2B0FhsH86jGjY%2BdSti3HHg3%2BwZZ5J6FNK%2B19g%2BrEPv8fnNYiRazPOpGjf2VSrmmNwWKApTasFPBleezbA%2F2ip%2FqiKt2w4PEFuzfWwsVn6wFgkn%2F7FFU7AFZzAkFv33oHi270lFeD8J1dJEQgZX57bB"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 81c2ecfa4b7143f9-EWR
expires: Tue, 15 Oct 2024 13:08:02 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 37AC 12 KB
6 KB 89ms
55ms Script
text/javascript 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:02 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 20 Oct 2024 13:08:02 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 1CC0 43 B
215 B 53ms
53ms Image
image/gif 2600:1f18:1aca:4280:b716:d20c:53fa:e647
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1712960&asId=32fcb002-2bd0-4e87-f07c-e74b86635889&tv=%7Bc:s7dXTK,pingTime:-2,time:160,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:438,beZ:439,mfA:442,cmA:443,inA:444,inZ:448,prA:448,prZ:463,si:469,poA:470,poZ:494,cmZ:494,mfZ:494,loA:521,loZ:523,ltA:598,ltZ:598%7D%7D,sca:%7Bdfp:%7Bdf:0%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:0,h:0,t:30%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:161,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:30,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:i,cc:NaN.NaN.0.0,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B153~0%5D,as:%5B153~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tTNvu3k+11%7C12%7C131%7C132%7C141%7C142%7C151%7C152%7C161%7C162%7C1711%7C181.1712960-75657828%7C1811%7C1812%7C191*.1712960-75657828%7C1911%7C1a1,idMap:191*,pd:0YtC.internal-nacl-plugin,rmeas:1,rend:0,renddet:IMG.us,siq:32,sinceFw:127,readyFired:false%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231024/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:b716:d20c:53fa:e647 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:02 GMT
server: nginx
x-server-name: dt27.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 323D 12 KB
6 KB 75ms
56ms Script
text/javascript 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:02 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 20 Oct 2024 13:08:02 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame A50F 2 KB
1 KB 34ms
33ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.us.criteo.com
URL: https://ads.us.criteo.com/delivery/r/afr.php?z=ZTpksQAFvb8By6JNAAIBFfHAcs_exhoQr44nvQ&u=%7CTIVlNeULxIZOGuc14XnG7the065bIbqlzxJdPB%2BAe1Y%3D%7C&c1=TUPLs6ok1IhDgnvJmJgq2b8G6XvEBIvqAb79lxbNLn-Y29LVqxBSOQhZKVxZui5pXNlU4WPrBd9-dzZ-iTLkdn4iCWrkEk_cy5W8rcgE58osEeZA-_wBmY8QBdqwOcy33vzeGqqBrDOo5E39HEsWzX9eYq33yPlD8chSiYLVtMUqAsxrfq2bmPAf-4Ma0GbXu53qZ7wlZSQ9qkKtMeMULq-Uxg02ChTUQpcaqtGSvzVh3e2JponZ1j8I6LVLGs3wGv2EJxf8odjJGu1QuXpySIblC9hsZFp5dCdPqdWJ3j1ZoKcIHKcsH8mmap8GL3P3elUr33oKutpEEpcuAJsCIaKh1QbRSi_UBDOgpdRz5CATDnQCOifv2hc-fNszCXBOcSxJSYgNZRaD89MCvRhFWj4CasL_fUBXDD-AgFwbGPpjflpfGld2YcaBFQBeTthMe8KMGvvEHb6i_DNvVLAJEEd57C9dU61bxFxXy4Ed33i-8B5KpzbbiP4T69UKvsqy-DIak1XT0U8jX87EP688IGRxAd_fv8lxpDm-XEK27ai013gH7t6CyzMM4oJsPFhP-FS7FPqhLL5LtFfg-k7amCKsCLCP77jP8GZrSfTCPQe42fwgcbp0_Oyb0fWy1QTjJOIj-KdPTYQ&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCjToPsWQ6Zb_7Fs3Err4PlYKIgA-cge-wXKqbqap0wI23ARABIABgyQaCARdjYS1wdWItODc5MzIzNzM5ODM0OTEzN8gBCagDAcgDAqoExwFP0DRLGlJfx67c1GPubSXImo9_nOcNiJi8kOZYrddX_dVAYINwmSD4sGQpSw_K5iyUxMZj5_aU3Xl6XeWS-K7BDoLq7vjjfpTJPcsUzivbjiBtNGIk6-wIPNiGAiXLQ21iNQ4zPdC5p03vSkAk-TWq0zCq8qNsrREYqlN2UpGNX31e359KPlpb5mEElOmDlxdQpSqvJEgbcEC7nDtaQMP1_ZN3Q11mdB6_pYKG8be1srkYUPk9wUMXNnvZJs9iP3_U64Eoe1R_gAbL_Na85PqiriSgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggSCIBhEAEyAooCOgKAQEi9_cE6-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2Mqmaad5raE1TNOOaT5yJ2XxACNA%26client%3Dca-pub-8793237398349137%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:02 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 20 Oct 2024 13:08:02 GMT

GET
H2 200 adchoices_en.svg
static.criteo.net/flash/icon/ Frame A50F 2 KB
1 KB 58ms
58ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_en.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

60bcafbd631f6fa0805e158ca3b235e76225350db6fbb423596d4c4954b27573

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:02 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-759"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 20 Oct 2024 13:08:02 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame A50F 308 B
636 B 46ms
46ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:02 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Sun, 20 Oct 2024 13:08:02 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame A50F 293 B
621 B 55ms
55ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:02 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Sun, 20 Oct 2024 13:08:02 GMT

GET
H2 200 lg.php
cat.va.us.criteo.com/delivery/ Frame A50F 43 B
347 B 39ms
39ms Image
image/gif 74.119.119.147
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.va.us.criteo.com/delivery/lg.php?cppv=3&cpp=eBY49DPJLUTyAGAHNjkSuEfwRdNS3RTnMXEjZ-rhpozeC-tqPHvk7sXRqiLP78Tf5K_jR1w_rvvb8prLgFZVVHTDoJD-bt-J4sI_IuLo0VKeHW_q68fqR_CDiroBfl3j-Wn88av0feX8s0RVg0D9D_CdfCOKXsS5nFRVci9EfKILBLSK58I4Dgr16OYDMbF_6NmOyJqKubsWTNUG-x6dW-YuXiVxcNrlmWKdy7kC9w-t5R-6_uMhMxajXxMA5Eq5u-9r9HCz5-omF6UhonAAZRt8tk3al2jfbhlMgl4TVQH6PRwrktmIqSzzvmNJRMcgQ3L9JDulV_1yt1igBR_l3h0LlH9VF1wJPr35eM497rn2mf91fJ-0V8DYpIlGdf0XYtiXJwa9gBvbJLgDykBvLj2n-l5-07hk7_KdF8GMyAng9kZC

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.147 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:01 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1647558
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 37AC 10 KB
10 KB 151ms
41ms Image
image/png 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?h=556&m=0&partner=100968&q=80&r=0&u=https%3A%2F%2Fstatic.va.us.criteo.net%2Fdesign%2Fdt%2F100968%2F4802526%2Fa6c43ab8dd52443cbc36274e6bbf8664_logo_n_vertical.png&v=3&w=196&rid=4&s=2CEsiU5bF6ciQ1F0zCJNz8qB

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

a3ad94f3806365ea17486d4cfe082eb778b279cea18bbc6505bfced1a78cd74d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:01 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 10409
expires: Fri, 13 Sep 2024 11:41:23 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 37AC 22 KB
22 KB 183ms
74ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?cq=256&h=400&m=0&partner=100968&q=80&r=0&u=https%3A%2F%2Fi.gstatvb.com%2Fb5e34c17d80bd1a5628a73f5aec1cf5e1696509656.rng.jpg&v=3&w=400&rid=4&s=tMy8zHAqtfcs12mBIJw2yB9g&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

91d2de0cd8395f3aef799bb19d895e96ad2769c74a879b7f802598a5e11c0534

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:01 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=3600
timing-allow-origin: *
content-length: 22056
expires: Thu, 26 Oct 2023 13:48:16 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 37AC 18 KB
18 KB 162ms
53ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?cq=256&h=400&m=0&partner=100968&q=80&r=0&u=https%3A%2F%2Fi.gstatvb.com%2F9db675e63aa909c918787be1a1056c2a1696509599.rng.jpg&v=3&w=400&rid=4&s=-mwGGIWqZUrNqKf90ElBZs5L&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

efc7b860b007b0f6802990fab2629ab3d4c1a4509abddcee7cdd774c82501740

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:01 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=3600
timing-allow-origin: *
content-length: 18212
expires: Thu, 26 Oct 2023 13:44:11 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 37AC 15 KB
15 KB 170ms
62ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?cq=256&h=400&m=0&partner=100968&q=80&r=0&u=https%3A%2F%2Fi.gstatvb.com%2Fd1ade87db74110bb8ae0b56492aa73751696509696.rng.jpg&v=3&w=400&rid=4&s=rqHqhmV9nfl7w3Gl7q7K6E4w&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

9868a0b63f401e1457af58c5ae6bff2ab73cc0516a84ea3c36c5ef93f1d9c8ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:02 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=3600
timing-allow-origin: *
content-length: 15370
expires: Thu, 26 Oct 2023 13:44:13 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 37AC 14 KB
14 KB 172ms
64ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?cq=256&h=400&m=0&partner=100968&q=80&r=0&u=https%3A%2F%2Fi.gstatvb.com%2Fac6e6d9a3bf97322890400c4f89faddf1696509690.rng.jpg&v=3&w=400&rid=4&s=ab1rxJCjWc3qsKTs9gx5kL4V&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

e9cef0419ba6f5a1be239b440097dace70e9c093a01322a68978197352acfad2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:01 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=3600
timing-allow-origin: *
content-length: 14172
expires: Thu, 26 Oct 2023 14:05:09 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 37AC 14 KB
15 KB 178ms
70ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?cq=256&h=400&m=0&partner=100968&q=80&r=0&u=https%3A%2F%2Fi.gstatvb.com%2F438df11b3d4b522ed51f99476c8ff7e31696509684.rng.jpg&v=3&w=400&rid=4&s=zPlQhqKGmqW1ovXAyFcFW3aG&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

40576d15be6b105131b3a2dca7aa02782e40a59b4baaba8a56b93af7a233b2d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:01 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=3600
timing-allow-origin: *
content-length: 14688
expires: Thu, 26 Oct 2023 13:41:17 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 37AC 23 KB
23 KB 82ms
82ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?cq=256&h=400&m=0&partner=100968&q=80&r=0&u=https%3A%2F%2Fi.gstatvb.com%2Fa76a5e363c1639737a38c2afb5fe16671696509669.rng.jpg&v=3&w=400&rid=4&s=XIIhCBFChu2k-PPoxN2vSeKS&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

60f5bcf8f0bffe739ba3718b2e9d9faa28302a036756b4468211a511fbbce35f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:02 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=3600
timing-allow-origin: *
content-length: 23722
expires: Thu, 26 Oct 2023 13:49:55 GMT

POST
H2 200 all
csm.us.criteo.net/ Frame 37AC 0
128 B 192ms
83ms Ping
text/plain 2620:100:a001::16
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.us.criteo.net/all?cppv=3&cpp=X1-K6daLxGjWD8YG313FC7za6KRBgx11govjHMmlIkFHO176jvbwj2wfsJoesWNmFnBwjtAj41QBPXFsGrliVEeK_10k7t2UGIVulsWpNU-NFoK5-P900ssMQ4t4hdcuA2N1dnRnepWYcaVNlZ9Miey41pqr3yREKoXweqUW_lHzem-wB2WKx-jFKPosXoV9pfN5vvCUtN8eDD8lawFJ4eNkj8qBuR6NzGcse656VXeTZMCt7Ce0nsW9zMUYPp2-vhqxWA&sds=2&rev=89054&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::16 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.us.criteo.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 26 Oct 2023 13:08:02 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 37AC 2 KB
1 KB 40ms
38ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:02 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 20 Oct 2024 13:08:02 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 37AC 2 KB
1 KB 40ms
39ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:02 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 20 Oct 2024 13:08:02 GMT

GET
DATA 200
OK truncated
/ Frame DD15 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 160f97aafd91afe5381d9b02a8717785b126cd6af58d84b109cf0f33aa4db537

Request headers

accept-language: en-US,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 323D 8 KB
8 KB 122ms
65ms Image
image/png 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?h=556&m=0&partner=106547&q=80&r=0&u=http%3A%2F%2Fstatic.va.us.criteo.net%2Fdesign%2Fdt%2F106547%2F4857094%2Fa3aeb6810c4b4243aa717e74db9571e8_round_logo.png&v=3&w=196&rid=4&s=dOWYBmr5wKjquI3MNMe08CDO

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

b5839e9ae2d0fc3af20d25755150b99365a2a61c0a275c3b80103ec5014095df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:02 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 8106
expires: Mon, 16 Sep 2024 02:54:37 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 323D 13 KB
13 KB 138ms
82ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=106547&q=80&r=0&u=https%3A%2F%2Fminio.lattehub.com%2Fimg%2F720%2F0%2Fresize%2F649bda83ca24f400097ca369%2F2023%2F07%2F20%2Flatte-image-64b8ea3228140f73a0ef36f1.jpeg&v=3&w=800&rid=4&s=8Ye_qPn55s-R6ehx9TY52d5D&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

18019d270e781bb6853c1de2eba031235b661f464604ad820516abb47ae88efd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:02 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 13434
expires: Wed, 25 Sep 2024 00:57:56 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 323D 14 KB
14 KB 139ms
82ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=106547&q=80&r=0&u=https%3A%2F%2Fminio.lattehub.com%2Fimg%2F720%2F0%2Fresize%2F649bda83ca24f400097ca369%2F2023%2F10%2F12%2Fproduct-img-6527d4ea7bc2365b8e5f0d35.jpg&v=3&w=800&rid=4&s=Yr8-lvlp4Bn1uYMbMM7OG-2P&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

6e47a9d6f97e61d11ec686deffb967b20eb1d37a8edf60c909940936389cf9ca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:01 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 14314
expires: Mon, 07 Oct 2024 09:36:42 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 323D 14 KB
15 KB 136ms
80ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=106547&q=80&r=0&u=https%3A%2F%2Fminio.lattehub.com%2Fimg%2F720%2F0%2Fresize%2F649bda83ca24f400097ca369%2F2023%2F07%2F20%2Flatte-image-64b8e90a28140f73a0ef059e.jpg&v=3&w=800&rid=4&s=MYqeQ8cyf2BmcBsAk5zawds0&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

d31347186ab2431e6310107a391938b0d2e2f2cf0d843991a3a7805a9f1b15d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:02 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 14634
expires: Wed, 25 Sep 2024 02:26:24 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 323D 13 KB
13 KB 134ms
78ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=106547&q=80&r=0&u=https%3A%2F%2Fminio.lattehub.com%2Fimg%2F720%2F0%2Fresize%2F649bda83ca24f400097ca369%2F2023%2F07%2F20%2Flatte-image-64b8ea3528140f73a0ef37f2.jpg&v=3&w=800&rid=4&s=RoqI6G5qAwpemmh5_-whS_A_&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

803ad9555c31c2516d141298e511121573bde2d28022f4a7d595013afb400dd0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:01 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 12984
expires: Wed, 25 Sep 2024 01:14:43 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 323D 16 KB
16 KB 125ms
69ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=106547&q=80&r=0&u=https%3A%2F%2Fminio.lattehub.com%2Fimg%2F720%2F0%2Fresize%2F649bda83ca24f400097ca369%2F2023%2F07%2F20%2Flatte-image-64b8ea3928140f73a0ef39c0.jpg&v=3&w=800&rid=4&s=4CvNzEqKsOOMLUPCdYYCYTAx&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

b2470bfd7d857cb5bd1c0595d25a1813c4754f5519344f597f6fddf51a37342e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:01 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 16370
expires: Wed, 25 Sep 2024 02:23:40 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 323D 15 KB
15 KB 65ms
64ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=106547&q=80&r=0&u=https%3A%2F%2Fminio.lattehub.com%2Fimg%2F720%2F0%2Fresize%2F649bda83ca24f400097ca369%2F2023%2F07%2F20%2Flatte-image-64b8ea5128140f73a0ef3d45.jpg&v=3&w=800&rid=4&s=YMPT6ooFG5ngko9ir-stNUPo&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

1abbbdfcdb39ef84dd70947e6944d9cd88154ac14591f4121e0722965a1b4b05

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:02 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 15438
expires: Wed, 25 Sep 2024 01:20:03 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 323D 13 KB
13 KB 86ms
85ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=106547&q=80&r=0&u=https%3A%2F%2Fminio.lattehub.com%2Fimg%2F720%2F0%2Fresize%2F649bda83ca24f400097ca369%2F2023%2F07%2F20%2Flatte-image-64b8ea7528140f73a0ef448d.webp&v=3&w=800&rid=4&s=ndRgGfIMf7HL70E58OAt9LuO&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

15c2e34807653e38a9f61087517ee6fec46e87908c16be49d1eb22b8748dc674

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:02 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 12974
expires: Wed, 25 Sep 2024 02:50:31 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 323D 41 KB
42 KB 66ms
66ms Image
image/png 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=106547&q=80&r=0&u=https%3A%2F%2Fminio.lattehub.com%2Fimg%2F720%2F0%2Fresize%2F649bda83ca24f400097ca369%2F2023%2F07%2F20%2Flatte-image-64b8e90d28140f73a0ef06de.png&v=3&w=800&rid=4&s=EaDRmsJTGcy4eI8bEX3c7IEI&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

2e6409dbd738a305c9b638b0b5b3ebde55bb7e79824b2597ba73b41e4ca4202d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:02 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 42290
expires: Wed, 25 Sep 2024 00:54:51 GMT

GET
H2 200 img
imageproxy.us.criteo.net/img/ Frame 323D 14 KB
14 KB 63ms
63ms Image
image/webp 2620:100:a001::9
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.us.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=106547&q=80&r=0&u=https%3A%2F%2Fminio.lattehub.com%2Fimg%2F720%2F0%2Fresize%2F649bda83ca24f400097ca369%2F2023%2F10%2F12%2Fproduct-img-6527d4f27bc2365b8e5f0f8b.jpg&v=3&w=800&rid=4&s=jXgrayRrioewzqttQCVaH5mO&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::9 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

800060771c46d0e7190640df3cc385fc73ad32c7994c5ba674817fc997a8acfb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:02 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 14012
expires: Mon, 07 Oct 2024 09:36:42 GMT

POST
H2 200 all
csm.us.criteo.net/ Frame 323D 0
127 B 139ms
84ms Ping
text/plain 2620:100:a001::16
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.us.criteo.net/all?cppv=3&cpp=T5EEC9aLxGjWD8YGFzHW7w6uuxB6cb7KJ6F6vi3eURAaiMRqsS-18_HIgJzC_MV4fJaur01vTYS9ZmjpfCl76k7VECY4G0bGDBSi7FFBHjlEkccob80KZN7m-487jxyiymj1tFMUaYidyrX9G6jnlpPImftlagZxACK0xp6Jmh1ess4yIrpCs6IkkBcEWKKZh055ykUs84IGuWmB3hlnnswdFbYkg9h_dXwEjR7Ov8NYwH-SXgr_nQmzAeYofkK4ALsvEg&sds=2&rev=89054&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::16 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.us.criteo.com/
accept-language: en-US,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 26 Oct 2023 13:08:01 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 323D 2 KB
1 KB 44ms
44ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:02 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 20 Oct 2024 13:08:02 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 323D 2 KB
1 KB 44ms
44ms Image
image/svg+xml 2620:100:a001::4
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::4 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://ads.us.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:02 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 20 Oct 2024 13:08:02 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame CBA3 38 KB
13 KB 36ms
36ms Document
text/html 2607:f8b0:4004:c1b::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4004:c1b::84 Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36
accept-language: en-US,en;q=0.9

Response headers

accept-ranges: bytes
age: 586504
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 19 Oct 2023 18:12:58 GMT
expires: Fri, 18 Oct 2024 18:12:58 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 05B7
Redirect Chain

https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEMsnz519-TAYUsQv-P5FjSk&google_cver=1&google_push=AXcoOmSHFMrgIgpWp_ynm9HykJ362gOeXyNA413lYnY0J6ruOCExvvHq9fLdm7voj00u92g5IkdP85NsO9jt9D...
https://cm.g.doubleclick.net/pixel?google_nid=blismobile&google_push=AXcoOmSHFMrgIgpWp_ynm9HykJ362gOeXyNA413lYnY0J6ruOCExvvHq9fLdm7voj00u92g5IkdP85NsO9jt9DZ39WWvTCX_tCvs8hw&google_hm=hmU6ZLKAiuvhVS...

170 B
188 B

67ms
67ms

Image
image/png

172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=blismobile&google_push=AXcoOmSHFMrgIgpWp_ynm9HykJ362gOeXyNA413lYnY0J6ruOCExvvHq9fLdm7voj00u92g5IkdP85NsO9jt9DZ39WWvTCX_tCvs8hw&google_hm=hmU6ZLKAiuvhVSYpuQ&google_redir=https%3A%2F%2Ftr.blismedia.com%2Fv1%2Fredirect%2FAdxPixel%3F%25%25GOOGLE_ERROR_PAIR%25%25%26partner_device_id%3D653A64B2808AEBE1552629B9BLIS

Requested by

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:02 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=blismobile&google_push=AXcoOmSHFMrgIgpWp_ynm9HykJ362gOeXyNA413lYnY0J6ruOCExvvHq9fLdm7voj00u92g5IkdP85NsO9jt9DZ39WWvTCX_tCvs8hw&google_hm=hmU6ZLKAiuvhVSYpuQ&google_redir=https%3A%2F%2Ftr.blismedia.com%2Fv1%2Fredirect%2FAdxPixel%3F%25%25GOOGLE_ERROR_PAIR%25%25%26partner_device_id%3D653A64B2808AEBE1552629B9BLIS
date: Thu, 26 Oct 2023 13:08:02 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 05B7
Redirect Chain

https://mweb.ck.inmobi.com/sync/3?redirect=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dinmobi_pte_limited%26google_hm%3D%24DSP_CKID&google_gid=CAESEAlDbgw-k2ku1LVk6y3bq0k&google_cver=...
https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=MGU2NzViZWYtYzljMC00ZjczLTgwMGItMzM3NDAyMmEwMmMy&google_gid=CAESEAlDbgw-k2ku1LVk6y3bq0k&google_cver=1&google_push=AXcoOmTf...

170 B
188 B

67ms
63ms

Image
image/png

172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=MGU2NzViZWYtYzljMC00ZjczLTgwMGItMzM3NDAyMmEwMmMy&google_gid=CAESEAlDbgw-k2ku1LVk6y3bq0k&google_cver=1&google_push=AXcoOmTfco1I_2Nf-JBbLx6_p8wIQC_RhZRPAjq6J249BBxUSOX7FYHsieKaDfjQujRD3HxlxBpfh9RgSf89VT2vjFSN_G48njBYAg

Requested by

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:02 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=inmobi_pte_limited&google_hm=MGU2NzViZWYtYzljMC00ZjczLTgwMGItMzM3NDAyMmEwMmMy&google_gid=CAESEAlDbgw-k2ku1LVk6y3bq0k&google_cver=1&google_push=AXcoOmTfco1I_2Nf-JBbLx6_p8wIQC_RhZRPAjq6J249BBxUSOX7FYHsieKaDfjQujRD3HxlxBpfh9RgSf89VT2vjFSN_G48njBYAg
date: Thu, 26 Oct 2023 13:08:02 GMT
strict-transport-security: max-age=15724800; includeSubDomains
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 05B7
Redirect Chain

https://beacon.walmart.com/etap.gif?tap=gAds&google_gid=CAESEL-DYuTaDsTpLFP1WkGA2mw&google_cver=1&google_push=AXcoOmQSzIGUac7eesCj23nWLiPUM-RMb337xjgmYqlQGU0NNH0hJCrza5WfE7vR62LL09cP7uK7umrWG9hXhZu...
https://cm.g.doubleclick.net/pixel?google_nid=walmart&google_hm=Q1Un8cC4ykcHcJiJldk6pQ&tap=gAds&google_gid=CAESEL-DYuTaDsTpLFP1WkGA2mw&google_cver=1&google_push=AXcoOmQSzIGUac7eesCj23nWLiPUM-RMb337...

170 B
188 B

45ms
45ms

Image
image/png

172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=walmart&google_hm=Q1Un8cC4ykcHcJiJldk6pQ&tap=gAds&google_gid=CAESEL-DYuTaDsTpLFP1WkGA2mw&google_cver=1&google_push=AXcoOmQSzIGUac7eesCj23nWLiPUM-RMb337xjgmYqlQGU0NNH0hJCrza5WfE7vR62LL09cP7uK7umrWG9hXhZuhdeQpJbwub7_b3g

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:03 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Via: HTTP/1.1 odnd
Date: Thu, 26 Oct 2023 13:08:02 GMT
Last-Modified: Tue, 24 Oct 2023 03:42:11 GMT
Content-Type: text/plain; charset=utf-8
Location: https://cm.g.doubleclick.net/pixel?google_nid=walmart&google_hm=Q1Un8cC4ykcHcJiJldk6pQ&tap=gAds&google_gid=CAESEL-DYuTaDsTpLFP1WkGA2mw&google_cver=1&google_push=AXcoOmQSzIGUac7eesCj23nWLiPUM-RMb337xjgmYqlQGU0NNH0hJCrza5WfE7vR62LL09cP7uK7umrWG9hXhZuhdeQpJbwub7_b3g
Cache-Control: no-store, no-cache, must-revalidate
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 0
X-Tb: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 503
Service Unavailable: Back-end server is at capacity r.gif
sync.extend.tv/ Frame 05B7 0
111 B 157ms
28ms Image
text/plain 54.198.186.194
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.extend.tv/r.gif?exchange=googleadx&google_gid=CAESEOzs1IEEhUWS94WMPmhqlVw&google_cver=1&google_push=AXcoOmRGhUGL8aSzzJsOiQ2Z4doS7BcAIIFRijZATwLIX44QQeR6-eWxtRYhMIPoy7z8f2gLzOPQdTv5QySA5-FNrEi9pbADDWHR75E
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8793237398349137&output=html&h=280&adk=221352476&adf=2860179214&pi=t.aa~a.2227863559~rp.1&w=1030&fwrn=4&fwrnh=100&lmt=1698361681&rafmt=1&to=qs&pwprc=4354248216&format=1030x280&url=https%3A%2F%2Fnotepad.plus%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1698325681326&bpp=1&bdt=3282&idt=-M&shv=r20231024&mjsv=m202310260101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Db38f74f5bba9cd29%3AT%3D1698325679%3ART%3D1698325679%3AS%3DALNI_MbFOhtzjBTfbED67puskk9feSK6ZQ&gpic=UID%3D00000d9cb191db97%3AT%3D1698325679%3ART%3D1698325679%3AS%3DALNI_MZ6ZUkzpsMstOsdeFgOXcsuu-BAqw&prev_fmts=0x0%2C970x250&nras=2&correlator=3972234055011&frm=20&pv=1&ga_vid=2061795391.1698325679&ga_sid=1698325679&ga_hid=1146444982&ga_fc=1&u_tz=-600&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=285&ady=1669&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C31079078%2C44805932%2C44806737%2C31078297%2C31079206&oid=2&psts=AOrYGsnymZq8uzdJoDkwlNsvW-NaSna0XYpnXdP_mu2O8X1-JPfzYwozuJp1M-FBp8XkKpQeFinhy0ybRtjj&pvsid=464992494868551&tmod=122040629&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=VjUxJeEZsd&p=https%3A//notepad.plus&dtd=11
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.198.186.194 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-198-186-194.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 0

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame 05B7 43 B
362 B 32ms
31ms Image
image/gif 74.119.119.150
AS-CRITEO

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmQJbsr9DThVHlatdTSGQsv1LW74zAMLXqIOF4Q1ckWtJ_symnzx3vxXxpWXRX2ttv6UBu7WnTDw6qsHBvD1NPlGRiWB02n-E7E&google_gid=CAESEOi_ACOTdYT0-I7KvO9wJqU&google_cver=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.119.119.150 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:01 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 487376
expires: Thu, 26 Oct 2023 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 05B7
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEH-QzXR-xKB64oO-KuY0PGY&google_cver=1&google_push=AXcoOmSJkvb0-dfLPoqtm68TmG0TCL35RnXS6JW6mmyDtMwzMvYSGoel7NAHMGUGNhoGWRiBoInircIdn_Vk...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmSJkvb0-dfLPoqtm68TmG0TCL35RnXS6JW6mmyDtMwzMvYSGoel7NAHMGUGNhoGWRiBoInircIdn_Vklpetl4D_YlUEDBFHqcM

170 B
188 B

53ms
53ms

Image
image/png

172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmSJkvb0-dfLPoqtm68TmG0TCL35RnXS6JW6mmyDtMwzMvYSGoel7NAHMGUGNhoGWRiBoInircIdn_Vklpetl4D_YlUEDBFHqcM

Requested by

Protocol

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:02 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmSJkvb0-dfLPoqtm68TmG0TCL35RnXS6JW6mmyDtMwzMvYSGoel7NAHMGUGNhoGWRiBoInircIdn_Vklpetl4D_YlUEDBFHqcM
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET googleredir
googlecm.hit.gemius.pl/ Frame 05B7 0
0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 05B7 0
12 B 42ms
41ms Image
text/html 172.253.63.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JCAKllagpBEyBXHLmIlthizip2fydm7TMgX6DXob4lJDZmt9BU2ggO6H4_8LVIxlZde-4I6g

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

date: Thu, 26 Oct 2023 13:08:02 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 7CA9 42 B
174 B 61ms
60ms Fetch
image/gif 2607:f8b0:4004:c17::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstljo5hZJoc3ylagyO6UpeECZcZRHF-pqsAVtPaGm76btNmWJnQ7OFBm-U_M0dUMjwdYaxIMm1jbSBopeljS-Rce5FDNfRVURyKqG0Z&sig=Cg0ArKJSzC8zYjT4LRHaEAE&id=lidar2&mcvt=1205&p=0,0,254,970&mtos=0,1205,1205,1205,1205&tos=0,1205,0,0,0&v=20231025&bin=7&avms=nio&bs=0,0&mc=0.98&if=1&vu=1&app=0&itpl=20&adk=3500618613&rs=2&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1698325679110&rpt=2064&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4004:c17::9d Washington, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-US,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.117 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 26 Oct 2023 13:08:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 log
hblg.media.net/ Frame 7CA9 35 B
191 B 47ms
47ms Image
image/gif 23.216.84.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://hblg.media.net/log?logid=kfke&evtid=adpvlog&__q=AfIFMgCAjAQAAACAAAAAgAEAAAAIAAAEAAEAAAAAAgEEAAAAAAAAIAAAAAAAAAxQwAQAQDY5ZWVhNDNkYjc2MDcxMGY1Zjk4MWJiMDIwOTk0NmIxzK3ZlAGYBwRVUxhub3RlcGFkLnBsdXMSOENVVTlKRjhIAA45NzB4MjUwDmVhc3Rfc2MEMjMGQURYEjhQUjExM0pHQw5CSURfQVBJAAACMEBydGItYXBwbmV4dXMtNzVkYzhjYmI5NC1iNHpiZy5TQz4xNzAwMDgwODA3Njg0MDAwOTcwMDI1MDAwMDU5NTAwAjAAIgAQRVhDSEFOR0UCAmQ&evttyp=1

Requested by

Host: notepad.plus
URL: https://notepad.plus/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.216.84.23 Atlanta, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS