anyfile-notepad.semaan.ca Open in urlscan Pro
172.105.61.58 Public Scan

Software

ESF /

Resource Hash

5848fed0499a99763526e2178efc1bec18842259a88cb1cf12600be9ddabbdcd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 28 Nov 2023 11:22:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 11:22:24 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 28 Nov 2023 11:22:24 GMT

GET
H2 200 application-8ac8a8e77829523edc80484f0aaae715f1532137.min.css
anyfile-notepad.semaan.ca/assets/ 300 KB
300 KB 725ms
721ms Stylesheet
text/css 172.105.61.58
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://anyfile-notepad.semaan.ca/assets/application-8ac8a8e77829523edc80484f0aaae715f1532137.min.css
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.105.61.58 Mumbai, India, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS: 172-105-61-58.ip.linodeusercontent.com
Software: Caddy /
Resource Hash: 3d9d832a8392beea801da416111f4da7a68a574fc4d0d64709b468a0f795f425

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/app
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:24 GMT
x-afn-server: afn-srv-v2-mum-1
x-afn-frontend-version: 2
last-modified: Sun, 30 Jul 2023 00:52:32 GMT
server: Caddy
content-type: text/css; charset=utf-8
access-control-allow-origin: *
accept-ranges: bytes
content-length: 307287

GET
H2 200 application-8ac8a8e77829523edc80484f0aaae715f1532137.min.js Show response
anyfile-notepad.semaan.ca/assets/ 653 KB
653 KB 725ms
722ms Script
application/javascript 172.105.61.58
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://anyfile-notepad.semaan.ca/assets/application-8ac8a8e77829523edc80484f0aaae715f1532137.min.js
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.105.61.58 Mumbai, India, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS: 172-105-61-58.ip.linodeusercontent.com
Software: Caddy /
Resource Hash: d05e631c8d0e5f8e85e4b97a33f40aeca825caa30783371af6d725f48e490c0e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/app
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:24 GMT
x-afn-server: afn-srv-v2-mum-1
x-afn-frontend-version: 2
last-modified: Sun, 30 Jul 2023 00:52:32 GMT
server: Caddy
content-type: application/javascript
access-control-allow-origin: *
accept-ranges: bytes
content-length: 668241

GET
H2 200 ace.js Show response
anyfile-notepad.semaan.ca/ace.js/ 353 KB
353 KB 726ms
723ms Script
application/javascript 172.105.61.58
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://anyfile-notepad.semaan.ca/ace.js/ace.js
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.105.61.58 Mumbai, India, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS: 172-105-61-58.ip.linodeusercontent.com
Software: Caddy /
Resource Hash: e9ce598bb515c234eb962bbafbd1128d45f6c2755538a9b5e04a72ee58ec333e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/app
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:24 GMT
x-afn-server: afn-srv-v2-mum-1
x-afn-frontend-version: 2
last-modified: Sun, 30 Jul 2023 00:52:32 GMT
server: Caddy
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
accept-ranges: bytes
content-length: 360977
expires: 0

GET
H2 200 ext-language_tools.js Show response
anyfile-notepad.semaan.ca/ace.js/ 34 KB
34 KB 726ms
723ms Script
application/javascript 172.105.61.58
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://anyfile-notepad.semaan.ca/ace.js/ext-language_tools.js
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.105.61.58 Mumbai, India, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS: 172-105-61-58.ip.linodeusercontent.com
Software: Caddy /
Resource Hash: 91bfbf51e788250c288a29c462a958ec5a8c5ed80aa542dd2ef439eb4384de2e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/app
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:24 GMT
x-afn-server: afn-srv-v2-mum-1
x-afn-frontend-version: 2
last-modified: Sun, 30 Jul 2023 00:52:32 GMT
server: Caddy
content-type: application/javascript
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
accept-ranges: bytes
content-length: 35073
expires: 0

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 93 KB
31 KB 154ms
84ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

500bb9d49f9d69aa955817dcaf472d3686140456f369896d4c3638a46a723704

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:24 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31069
x-xss-protection: 0
server: cafe
etag: 8 / 19689 / m202311090101 / config-hash: 9262260167945042926
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Tue, 28 Nov 2023 11:22:24 GMT

GET
H2 200 sdbmtiqbxqoopp7t3s9lq.js Show response
storage.googleapis.com/dbmtiqbxqoopp7t3s9lq/ 170 KB
171 KB 167ms
98ms Script
text/javascript 172.253.122.207
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://storage.googleapis.com/dbmtiqbxqoopp7t3s9lq/sdbmtiqbxqoopp7t3s9lq.js
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.253.122.207 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bh-in-f207.1e100.net
Software: UploadServer /
Resource Hash: 08b280a4f0643253a52d633ead8ba7441919dd32155433b061a6032d31453b7b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:24 GMT
x-guploader-uploadid: ABPtcPoQV90mi4Y9Dl2_wZdGvX5q3FdpLLx8eAiNzJxhaLWWow_utCtZcmAxUD1C7RqfxrdFjJnXCW426Q
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 174265
last-modified: Tue, 28 Nov 2023 11:20:10 GMT
server: UploadServer
etag: "3ef537fdfae0face6e220c8bb8cc728e"
x-goog-generation: 1701170410109645
content-type: text/javascript
x-goog-hash: crc32c=Oug7Sw==, md5=PvU3/frg+s5uIgyLuMxyjg==
cache-control: public, max-age=3600
x-goog-stored-content-length: 174265
accept-ranges: bytes
expires: Tue, 28 Nov 2023 12:22:24 GMT

GET
H2 200 vdbmtiqbxqoopp7t3s9lq.js Show response
storage.googleapis.com/dbmtiqbxqoopp7t3s9lq/ 3 KB
3 KB 140ms
72ms Script
text/javascript 172.253.122.207
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://storage.googleapis.com/dbmtiqbxqoopp7t3s9lq/vdbmtiqbxqoopp7t3s9lq.js
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.253.122.207 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bh-in-f207.1e100.net
Software: UploadServer /
Resource Hash: f021848a846c74438092d280daa4bd2fbf31da24198db5940a8314898bdfc296

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:24 GMT
x-guploader-uploadid: ABPtcPotMOZDOo9Pj4bOPgWbJeDyd86a1tnm7oS3FwCgKzJmzJg5_StjWgx_a90dxOghECrGQ42G5gsjWg
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2652
last-modified: Tue, 28 Nov 2023 11:20:09 GMT
server: UploadServer
etag: "aa9a8313552d27362417cdff6cbd47f6"
x-goog-generation: 1701170409831776
content-type: text/javascript
x-goog-hash: crc32c=vixfVA==, md5=qpqDE1UtJzYkF83/bL1H9g==
cache-control: public, max-age=3600
x-goog-stored-content-length: 2652
accept-ranges: bytes
expires: Tue, 28 Nov 2023 12:22:24 GMT

GET
H2 200 application-8ac8a8e77829523edc80484f0aaae715f1532137.css
anyfile-notepad.semaan.ca/assets/ 345 KB
345 KB 709ms
709ms Stylesheet
text/css 172.105.61.58
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://anyfile-notepad.semaan.ca/assets/application-8ac8a8e77829523edc80484f0aaae715f1532137.css
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.105.61.58 Mumbai, India, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS: 172-105-61-58.ip.linodeusercontent.com
Software: Caddy /
Resource Hash: 33793536c303f159d303681369bde4cbab1962beacc194b0c5fda6aa9d9fe20e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/app
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:25 GMT
x-afn-server: afn-srv-v2-mum-1
x-afn-frontend-version: 2
last-modified: Sun, 30 Jul 2023 00:52:32 GMT
server: Caddy
content-type: text/css; charset=utf-8
access-control-allow-origin: *
accept-ranges: bytes
content-length: 353515

GET
H2 200 infolinks_main.js Show response
resources.infolinks.com/js/ 4 KB
3 KB 76ms
31ms Script
application/javascript 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/js/infolinks_main.js
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0a2877d35b782162338bb95faedfa08559e23788db9d926e97da4d0efd2dbfc5

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:24 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 14 Nov 2023 15:31:57 GMT
server: cloudflare
age: 11982
etag: W/"1045-60a1e7cae1276"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=3600
cf-ray: 82d23ba218fe7157-YUL
expires: Tue, 28 Nov 2023 09:02:42 GMT

GET
H2 200 client.js Show response
apis.google.com/js/ 18 KB
8 KB 259ms
49ms Script
text/javascript 142.251.16.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/client.js?onload=gapi_loaded

Requested by

Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d9139d893d8ce76cd9f7b387262a669ced0270373637ba947037c770faef910d

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 28 Nov 2023 11:22:25 GMT
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7116
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="gapi-team"
etag: "a00202bbb14b751a"
vary: Accept-Encoding
report-to: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 28 Nov 2023 11:22:25 GMT

GET
H2 200 client Show response
accounts.google.com/gsi/ 199 KB
79 KB 117ms
51ms Script
application/javascript 172.253.122.84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/gsi/client

Requested by

Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.84 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f84.1e100.net

Software

ESF /

Resource Hash

40f9533694183d6ee63203f0e0d9c6fff8ecc6e713b58eee364051f6ed3470ab

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Xrum6U04NNpXjmZlTFZ0rg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:26 GMT
content-security-policy: script-src 'report-sample' 'nonce-Xrum6U04NNpXjmZlTFZ0rg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
report-to: {"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]}
content-type: application/javascript; charset=utf-8
cache-control: private, max-age=1800
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1"
expires: Tue, 28 Nov 2023 11:22:26 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 98ms
31ms Script
text/javascript 142.251.163.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f138.1e100.net

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 28 Nov 2023 11:08:41 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 825
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Tue, 28 Nov 2023 13:08:41 GMT

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/ 429 KB
135 KB 34ms
32ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b04dfae5d49297b8b6a514bd8bf1c7bea7ebe622232401a5abed5a92809a2b66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Tue, 28 Nov 2023 09:54:44 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5262
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 137535
x-xss-protection: 0
server: cafe
etag: 18342593356503948095
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Wed, 27 Nov 2024 09:54:44 GMT

GET
H2 200 rum.js Show response
pagead2.googlesyndication.com/pagead/js/ 64 KB
24 KB 98ms
32ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/rum.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

25679e64b105c0acb0da7fe3cf9f7988027e9511a28c536f5ea322ac08e642dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:03 GMT
content-encoding: br
x-content-type-options: nosniff
age: 23
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24357
x-xss-protection: 0
server: cafe
etag: 17020722232796629264
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Tue, 28 Nov 2023 12:22:03 GMT

POST
H2 204 ortb Show response
bid.contextweb.com/header/ 0
203 B 81ms
26ms XHR
text/plain 198.148.27.131
PULSEPOINT

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.contextweb.com/header/ortb?src=prebid

Requested by

Host: storage.googleapis.com
URL: https://storage.googleapis.com/dbmtiqbxqoopp7t3s9lq/sdbmtiqbxqoopp7t3s9lq.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

198.148.27.131 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://anyfile-notepad.semaan.ca
access-control-expose-headers: Access-Control-Allow-Origin
strict-transport-security: max-age=15768000
access-control-allow-credentials: true
x-no-bid-reason: Passback by decision

POST
H/1.1 200
OK prebid Show response
lockerdome.com/ladbid/ 11 B
345 B 242ms
61ms XHR
application/json 104.154.142.214
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://lockerdome.com/ladbid/prebid
Requested by: Host: storage.googleapis.com
URL: https://storage.googleapis.com/dbmtiqbxqoopp7t3s9lq/sdbmtiqbxqoopp7t3s9lq.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.154.142.214 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 214.142.154.104.bc.googleusercontent.com
Software: /
Resource Hash: 846949c5a40e3ffbb702473e54dfac0646541aa624a844369b6e24e51ddaf96b

Request headers

Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://anyfile-notepad.semaan.ca
Date: Tue, 28 Nov 2023 11:22:26 GMT
Cache-Control: no-cache, max-age=0, must-revalidate, no-store
Access-Control-Allow-Credentials: true
Content-Encoding: gzip
Content-Length: 31
Content-Type: application/json; charset=utf-8

POST
H2 200 / Show response
prebid.admedia.com/bidder/ 322 B
327 B 89ms
24ms XHR
application/json 173.198.200.125
TURNKEY-INTERNET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.admedia.com/bidder/
Requested by: Host: storage.googleapis.com
URL: https://storage.googleapis.com/dbmtiqbxqoopp7t3s9lq/sdbmtiqbxqoopp7t3s9lq.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 173.198.200.125 Latham, United States, ASN40244 (TURNKEY-INTERNET, US),
Reverse DNS: 173-198-200-125.static.as40244.net
Software: nginx /
Resource Hash: a1e50719a968ea53edbc079f52b7c11dd246df4313372fd7a584d50bc04a568c

Request headers

Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:26 GMT
content-encoding: gzip
server: nginx
content-type: application/json; charset=utf-8
access-control-allow-origin: https://anyfile-notepad.semaan.ca
cache-control: no-cache, no-store, private
access-control-allow-credentials: true
expires: 0

GET
H2 200 ice.js Show response
resources.infolinks.com/js/1895.006-3.034/ 187 KB
57 KB 31ms
31ms Script
application/javascript 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/js/1895.006-3.034/ice.js
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 54eacec863498628814d62c486eca8cd1c580c77a4dda865b5941006e40c6e66

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:26 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 07 Nov 2023 17:45:04 GMT
server: cloudflare
age: 11329
etag: W/"2ede2-6099387db510d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 82d23baa6c1d7157-YUL
expires: Thu, 28 Dec 2023 08:13:37 GMT

POST
H2 200 stats Show response
api.anyfile-notepad.semaan.ca/ 2 B
235 B 145ms
27ms XHR
text/plain 159.89.121.194
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://api.anyfile-notepad.semaan.ca/stats
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/assets/application-8ac8a8e77829523edc80484f0aaae715f1532137.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 159.89.121.194 Toronto, Canada, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: srv.semaan.ca
Software: Caddy, Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 mod_wsgi/3.4 Python/2.7.5 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Accept: */*
Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

access-control-allow-origin: *
date: Tue, 28 Nov 2023 11:22:26 GMT
server: Caddy, Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 mod_wsgi/3.4 Python/2.7.5
access-control-allow-headers: Content-Type, Authorization
content-length: 2
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/plain; charset=utf-8

GET
H2 200 Material-Design-Icons.woff
anyfile-notepad.semaan.ca/fonts/ 100 KB
100 KB 256ms
255ms Font
font/woff 172.105.61.58
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://anyfile-notepad.semaan.ca/fonts/Material-Design-Icons.woff?3ocs8m
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/assets/application-8ac8a8e77829523edc80484f0aaae715f1532137.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.105.61.58 Mumbai, India, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS: 172-105-61-58.ip.linodeusercontent.com
Software: Caddy /
Resource Hash: be00e19b662046cb8f2eb6eb86e4689edeefb0c003f6a215df9c22f0e15e16ad

Request headers

Referer: https://anyfile-notepad.semaan.ca/assets/application-8ac8a8e77829523edc80484f0aaae715f1532137.min.css
Origin: https://anyfile-notepad.semaan.ca
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:26 GMT
x-afn-server: afn-srv-v2-mum-1
x-afn-frontend-version: 2
last-modified: Sun, 30 Jul 2023 00:52:32 GMT
server: Caddy
content-type: font/woff
access-control-allow-origin: *
accept-ranges: bytes
content-length: 101968

GET
H2 200 Lato-Regular.ttf
anyfile-notepad.semaan.ca/fonts/ 593 KB
594 KB 258ms
257ms Font
font/ttf 172.105.61.58
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://anyfile-notepad.semaan.ca/fonts/Lato-Regular.ttf
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/assets/application-8ac8a8e77829523edc80484f0aaae715f1532137.min.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.105.61.58 Mumbai, India, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS: 172-105-61-58.ip.linodeusercontent.com
Software: Caddy /
Resource Hash: 089ab6d4a57e0e6c4dd3b681b6fd50a5184f1b902429d35e1227e52d6ccad1bd

Request headers

Referer: https://anyfile-notepad.semaan.ca/assets/application-8ac8a8e77829523edc80484f0aaae715f1532137.min.css
Origin: https://anyfile-notepad.semaan.ca
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:26 GMT
x-afn-server: afn-srv-v2-mum-1
x-afn-frontend-version: 2
last-modified: Sun, 30 Jul 2023 00:52:32 GMT
server: Caddy
content-type: font/ttf
access-control-allow-origin: *
accept-ranges: bytes
content-length: 607720

GET
H2 200 logo.png
anyfile-notepad.semaan.ca/ 6 KB
6 KB 259ms
259ms Image
image/png 172.105.61.58
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://anyfile-notepad.semaan.ca/logo.png
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.105.61.58 Mumbai, India, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS: 172-105-61-58.ip.linodeusercontent.com
Software: Caddy /
Resource Hash: bfb6a8799c9f3a60f0a04e2cc9c1d9df6c591708ae4aaa3eda711fcde2d31df9

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/app
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:26 GMT
x-afn-server: afn-srv-v2-mum-1
x-afn-frontend-version: 2
last-modified: Sun, 30 Jul 2023 00:52:32 GMT
server: Caddy
content-type: image/png
access-control-allow-origin: *
accept-ranges: bytes
content-length: 6277

POST
H2 200 collect Show response
www.google-analytics.com/j/ 15 B
227 B 40ms
39ms XHR
text/plain 142.251.163.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=561326475&t=pageview&_s=1&dl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp&ul=en-us&de=UTF-8&dt=Anyfile%20Notepad&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAACAAI~&jid=1523744782&gjid=1369748307&cid=378767801.1701170546&tid=UA-69003440-1&_gid=1919965575.1701170546&_r=1&_slc=1&z=81099183

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.163.138 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f138.1e100.net

Software

Golfe2 /

Resource Hash

a59d6fec09f986c957c8192fbd71a84cc53315793fb9cde7de010e6a0cfccaea

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:26 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://anyfile-notepad.semaan.ca
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.AOzoyjtjrhQ.O/m=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA/ 316 KB
108 KB 33ms
32ms Script
text/javascript 142.251.16.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.AOzoyjtjrhQ.O/m=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA/cb=gapi.loaded_0?le=scs

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/client.js?onload=gapi_loaded

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.16.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3253ebd8d1a3c41f020b8e18e84bf61b96b0c1bba646b047fa90d87e72438371

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 13:30:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 165093
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 110396
x-xss-protection: 0
last-modified: Tue, 03 Oct 2023 15:22:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
vary: Accept-Encoding
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 25 Nov 2024 13:30:53 GMT

GET
H2 200 manage Show response
router.infolinks.com/usync/ Frame DACC 12 KB
2 KB 69ms
63ms Document
text/html 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1895.006-3.034/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa52b86a220ee4ecb3b4a4d9f471edb4df9a85583cea3d86629cd7e9fda03067

Request headers

Referer: https://anyfile-notepad.semaan.ca/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

cache-control: no-store
cf-cache-status: DYNAMIC
cf-ray: 82d23bab5d9a7157-YUL
content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Tue, 28 Nov 2023 11:22:26 GMT
p3p: CP="NON DSP NID OUR COR"
server: cloudflare
via: 1.1 google

GET
H2 200 lcmanage Show response
router.infolinks.com/usync/ 283 B
307 B 72ms
71ms Script
application/javascript 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://router.infolinks.com/usync/lcmanage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1895.006-3.034/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b7dcb0bafec5b35be330a5f26cdae5a6d921c7542816928bdecbc4a71bd2f9e2

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:26 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
content-type: application/javascript;charset=ISO-8859-1
p3p: CP="NON DSP NID OUR COR"
cache-control: no-store
cf-ray: 82d23bab5d9d7157-YUL

GET
H2 200 gsd Show response
router.infolinks.com/ 321 B
486 B 65ms
65ms Script
text/javascript 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://router.infolinks.com/gsd?evt=afterGSD&pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp&jsv=1895.006-3.034&_cb=17011705464500
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1895.006-3.034/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6e9251f4f365c8a3001c19fa338a55d1db115b76acca6a7b47d944447f05b955

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:26 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
content-type: text/javascript;charset=UTF-8
p3p: CP="NON DSP NID OUR COR"
cache-control: max-age=0
cf-ray: 82d23bab5d9e7157-YUL
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 227 KB
81 KB 113ms
47ms Script
application/javascript 172.253.115.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-3VRGCWTSLB&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f97.1e100.net

Software

Google Tag Manager /

Resource Hash

0dd3c3d3b80df59b91bc5d6244af3c69e18eddfebe1b8ceb6605b2bb30f11fc6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:26 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 82723
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 28 Nov 2023 11:22:26 GMT

GET
H2 200 proxy.html Show response
content.googleapis.com/static/ Frame AE08 382 B
907 B 38ms
34ms Document
text/html 172.253.62.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://content.googleapis.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.AOzoyjtjrhQ.O%2Fd%3D1%2Frs%3DAHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA%2Fm%3D__features__

Requested by

Host: apis.google.com
URL: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.AOzoyjtjrhQ.O/m=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA/cb=gapi.loaded_0?le=scs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

894af212f5cf669045334018d7ca56f9f2972a1d923cbf5a23aa6bf33027c732

Security Headers

Name	Value
Content-Security-Policy	script-src 'nonce-U2T3ABrajmAMPAuBPbqU5A' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/apiserving; base-uri 'none' require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apiserving
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://anyfile-notepad.semaan.ca/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: gzip
content-length: 273
content-security-policy: script-src 'nonce-U2T3ABrajmAMPAuBPbqU5A' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/apiserving; base-uri 'none' require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apiserving
content-type: text/html
cross-origin-embedder-policy: require-corp; report-to="apiserving"
cross-origin-opener-policy-report-only: same-origin; report-to="apiserving"
cross-origin-resource-policy: cross-origin
date: Tue, 28 Nov 2023 11:22:26 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
last-modified: Tue, 14 Nov 2023 14:08:00 GMT
pragma: no-cache
report-to: {"group":"apiserving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apiserving"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

/ Show response
hde.tynt.com/deb/ Frame 447F
Redirect Chain

https://de.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV
https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1

1 KB
2 KB

120ms
40ms

Document
text/html

67.202.105.34
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.34 , United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip34.67-202-105.static.steadfastdns.net
Software: /
Resource Hash: cb6b79645fca646cd94b40f4945ceeb887036d3d1b24311e0d18178b48cdfba7

Request headers

Referer: https://router.infolinks.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Model, Sec-CH-UA-Full-Version-List, Sec-CH-UA, Sec-CH-UA-Mobile
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
content-length: 1403
content-type: text/html
date: Tue, 28 Nov 2023 11:22:26 GMT
expires: Sat, 26 Jul 1997 05:00:00 GMT
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
referrer-policy: unsafe-url

Redirect headers

accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Model, Sec-CH-UA-Full-Version-List, Sec-CH-UA, Sec-CH-UA-Mobile
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
content-length: 0
date: Tue, 28 Nov 2023 11:22:26 GMT
expires: Sat, 26 Jul 1997 05:00:00 GMT
location: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
referrer-policy: unsafe-url

GET
H2

200

usermatch Show response
ssum-sec.casalemedia.com/ Frame FE41
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=191306&cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1

2 KB
853 B

50ms
50ms

Document
text/html

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 554acee44334dda30d98c507fb9af6a1a6bf24836238f6ac8dde5489522eab48

Request headers

Referer: https://router.infolinks.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 82d23bac5e356e0b-YUL
content-encoding: br
content-type: text/html
date: Tue, 28 Nov 2023 11:22:26 GMT
expires: 0
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S0l5C5cORU8TsLXuMjwsiM5gbTEjtYtjmjD2zubXvlOPao%2FjimSx4s%2BHKHherWpNw0BmD8CCA0T9PpeW03FOOTf7mFo21ASJwz5VPvoS5ySKLWlR443pe3OgCQcBcYb%2FbXCqv5kYh67MsA%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-cache
cf-cache-status: DYNAMIC
cf-ray: 82d23bac1dce6e0b-YUL
content-length: 0
date: Tue, 28 Nov 2023 11:22:26 GMT
expires: 0
location: /usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=s9ryod5nD2AVtI%2FHthnVqV0pfG5XDp7kYKVHl0lmzBf4VpA8b6KLwFRZHwA5EywOST1bzYmkmrLkDK8M7fDLxAMXx3AQiyWaQGu%2F0Tzod%2B9DCWTsUxAlWLkBYUveWNWt3GJX2VZi2ArJFg%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame C544 4 KB
2 KB 63ms
20ms Document
text/html 51.222.239.230
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Requested by

Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.222.239.230 , Canada, ASN16276 (OVH, FR),

Reverse DNS

62.113.111.34.bc.googleusercontent.com

Software

Resource Hash

6bee7905c3b85affbb11d0371b74a15f3170a78fc5198076a17c0edfc78b92a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://router.infolinks.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 1407
content-type: text/html
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
strict-transport-security: max-age=15552000

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame DACC
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=156872&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156872%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infoli...
https://image8.pubmatic.com/AdServer/ImgSync?p=156872&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D156872%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infoli...
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NjExMDBGMjAtREZBQy00MDg2LTlBRTEtNzQ4MDQzMjZBOTNG&gdpr=-1&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=-1&gdpr_consent=

0
225 B

1337ms
26ms

Image
text/html

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=-1&gdpr_consent=
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Tue, 28 Nov 2023 11:22:27 GMT
cache-control: no-store, no-cache, private
content-encoding: gzip
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:26 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=-1&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

apn-usync
router.infolinks.com/dyn/ Frame DACC
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fapn-usync%3Fuser_id%3D%24UID
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Frouter.infolinks.com%252Fdyn%252Fapn-usync%253Fuser_id%253D%2524UID
https://router.infolinks.com/dyn/apn-usync?user_id=6452867190558037403

35 B
186 B

62ms
62ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/apn-usync?user_id=6452867190558037403
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:26 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82d23baceffd7157-YUL
content-length: 35
expires: Mon, 28 Nov 2022 11:22:26 GMT

Redirect headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:26 GMT
an-x-request-uuid: ee35f2c9-8c71-4ded-9477-4e32740eedc3
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://router.infolinks.com/dyn/apn-usync?user_id=6452867190558037403
x-proxy-origin: 185.193.64.134; 185.193.64.134; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sthr-us
router.infolinks.com/dyn/ Frame DACC
Redirect Chain

https://match.sharethrough.com/universal/v1?supply_id=k0cy4N0g
https://router.infolinks.com/dyn/sthr-us?user_id=ba91c4d2-a682-4e0a-a6e4-abdfb0b256c2

35 B
199 B

63ms
62ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/sthr-us?user_id=ba91c4d2-a682-4e0a-a6e4-abdfb0b256c2
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:26 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82d23bac9f877157-YUL
content-length: 35
expires: Mon, 28 Nov 2022 11:22:26 GMT

Redirect headers

location: https://router.infolinks.com/dyn/sthr-us?user_id=ba91c4d2-a682-4e0a-a6e4-abdfb0b256c2
date: Tue, 28 Nov 2023 11:22:26 GMT
content-length: 0

GET
H2

200

iqm-us
router.infolinks.com/dyn/ Frame DACC
Redirect Chain

https://pxl.iqm.com/i/ck/infolink?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fiqm-us%3Fuid%3D%7BIQM_COOKIE%7D%20
https://router.infolinks.com/dyn/iqm-us?uid=0235f168-9fe2-4f19-bf11-6190b139894b

35 B
192 B

58ms
57ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/iqm-us?uid=0235f168-9fe2-4f19-bf11-6190b139894b
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:26 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82d23bac9f8a7157-YUL
content-length: 35
expires: Mon, 28 Nov 2022 11:22:26 GMT

Redirect headers

date: Tue, 28 Nov 2023 11:22:26 GMT
server: nginx
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/avif;charset=UTF-8
location: https://router.infolinks.com/dyn/iqm-us?uid=0235f168-9fe2-4f19-bf11-6190b139894b
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 81

GET
H2

200

eqv-us
router.infolinks.com/dyn/ Frame DACC
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=112&gdpr=0&gdpr_consent=
https://router.infolinks.com/dyn/eqv-us?user_id=675713542914935445&gdpr=0&gdpr_consent=

35 B
231 B

60ms
60ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/eqv-us?user_id=675713542914935445&gdpr=0&gdpr_consent=
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:26 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82d23bad18367157-YUL
content-length: 35
expires: Mon, 28 Nov 2022 11:22:26 GMT

Redirect headers

location: https://router.infolinks.com/dyn/eqv-us?user_id=675713542914935445&gdpr=0&gdpr_consent=
date: Tue, 28 Nov 2023 11:22:26 GMT
content-length: 0

GET
H2 200 cm
u.openx.net/w/1.0/ Frame DACC 43 B
295 B 96ms
52ms Image
image/gif 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://u.openx.net/w/1.0/cm?id=9b5994f2-035d-46de-8c12-bc0e9a4e66c2&r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fox-usync%3Fuid%3D
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:26 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3

200

receive
pixel.tapad.com/idsync/ex/ Frame DACC
Redirect Chain

https://ups.analytics.yahoo.com/ups/58786/sync?redir=true
https://ups.analytics.yahoo.com/ups/58786/sync?redir=true&verify=true
https://router.infolinks.com/dyn/VR-usync?uid=y-4R5ZlL1E2uLo6WodyFdNQQWiwEoHe0l5~A
https://pixel.tapad.com/idsync/ex/receive?partner_id=3399&partner_device_id=y-4R5ZlL1E2uLo6WodyFdNQQWiwEoHe0l5~A
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3399&partner_device_id=y-4R5ZlL1E2uLo6WodyFdNQQWiwEoHe0l5~A
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=6b580a86-f996-4239-8687-e0079457f069%252C%252C&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=2a521745-e49f-4708-b4de-95cb384f5236&ttd_puid=6b580a86-f996-4239-8687-e0079457f069%2C%2C

95 B
124 B

114ms
114ms

Image
image/png

34.111.113.62
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=2a521745-e49f-4708-b4de-95cb384f5236&ttd_puid=6b580a86-f996-4239-8687-e0079457f069%2C%2C

Requested by

Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp

Protocol

Server

34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Jetty(11.0.13) /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:27 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
content-type: image/png
access-control-allow-origin: *
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95

Redirect headers

location: https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=2a521745-e49f-4708-b4de-95cb384f5236&ttd_puid=6b580a86-f996-4239-8687-e0079457f069%2C%2C
date: Tue, 28 Nov 2023 11:22:27 GMT
server: Kestrel
content-length: 359

GET
H2

200

ur-usync
router.infolinks.com/dyn/ Frame DACC
Redirect Chain

https://sync.1rx.io/usersync2/infolinks
https://sync.1rx.io/usersync2/infolinks?zcc=1&cb=1701170546673
https://ad.turn.com/r/cs?pid=45&rndcb=4837216476
https://sync.1rx.io/usersync/turn/2318422496224746352?dspret=1&gdpr=&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-20ee7faf-044d-4a33-8604-c5c01bc37378-005?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fur-usync%3Fuid%3DRX-20ee7faf-044d-4a33-8604-c5c01bc37378-005
https://router.infolinks.com/dyn/ur-usync?uid=RX-20ee7faf-044d-4a33-8604-c5c01bc37378-005

35 B
92 B

163ms
163ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/ur-usync?uid=RX-20ee7faf-044d-4a33-8604-c5c01bc37378-005
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:30 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82d23bc578b87157-YUL
content-length: 35
expires: Mon, 28 Nov 2022 11:22:30 GMT

Redirect headers

Date: Tue, 28 Nov 2023 11:22:30 GMT
Server: Tengine
ETag: RX20ee7faf044d4a338604c5c01bc37378005
Transfer-Encoding: chunked
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location: https://router.infolinks.com/dyn/ur-usync?uid=RX-20ee7faf-044d-4a33-8604-c5c01bc37378-005
Content-Type: text/html
Connection: keep-alive

GET
H2

200

zmn-usync
router.infolinks.com/dyn/ Frame DACC
Redirect Chain

https://b1sync.zemanta.com/usersync/infolinks/?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fzmn-usync%3Fuid%3D__ZUID__
https://b1sync.zemanta.com/usersync/infolinks/?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fzmn-usync%3Fuid%3D__ZUID__&s=2
https://router.infolinks.com/dyn/zmn-usync?uid=KTx07if4_x_t-LdpdnQI

35 B
189 B

62ms
62ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/zmn-usync?uid=KTx07if4_x_t-LdpdnQI
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:26 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82d23baccfd47157-YUL
content-length: 35
expires: Mon, 28 Nov 2022 11:22:26 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 28 Nov 2023 11:22:26 GMT
Content-Type: text/html; charset=utf-8
Location: https://router.infolinks.com/dyn/zmn-usync?uid=KTx07if4_x_t-LdpdnQI
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 90
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2

200

tplift
router.infolinks.com/dyn/ Frame DACC
Redirect Chain

https://eb2.3lift.com/getuid?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Ftplift%3Fuid%3D%24UID
https://eb2.3lift.com/getuid?ld=1&gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Ftplift%3Fuid%3D%24UID
https://router.infolinks.com/dyn/tplift?uid=3640422820248028610086

35 B
188 B

58ms
58ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/tplift?uid=3640422820248028610086
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:26 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82d23bacdfde7157-YUL
content-length: 35
expires: Mon, 28 Nov 2022 11:22:26 GMT

Redirect headers

location: https://router.infolinks.com/dyn/tplift?uid=3640422820248028610086
date: Tue, 28 Nov 2023 11:22:26 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

sonobi-usync
router.infolinks.com/dyn/ Frame DACC
Redirect Chain

https://sync.go.sonobi.com/us?loc=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsonobi-usync%3Fuid%3D%5BUID%5D
https://router.infolinks.com/dyn/sonobi-usync?uid=c4b8b092-4f3c-4dc3-a427-de1915ff3bb0

35 B
215 B

60ms
60ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/sonobi-usync?uid=c4b8b092-4f3c-4dc3-a427-de1915ff3bb0
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:26 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82d23bad38697157-YUL
content-length: 35
expires: Mon, 28 Nov 2022 11:22:26 GMT

Redirect headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:26 GMT
server: sonobi-go
vary: negotiate,Accept-Encoding
x-go-server: go-iad-2-5-163
content-type: text/plain; charset=utf8
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://router.infolinks.com/dyn/sonobi-usync?uid=c4b8b092-4f3c-4dc3-a427-de1915ff3bb0
cache-control: no-cache, no-store, private
tcn: Choice
content-length: 0
x-xss-protection: 0
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

imd-usync
router.infolinks.com/dyn/ Frame DACC
Redirect Chain

https://ad.360yield.com/server_match?r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fimd-usync%3Fuser_id%3D%7BPUB_USER_ID%7D%26partner_id%3D1531
https://ad.360yield.com/ul_cb/server_match?r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fimd-usync%3Fuser_id%3D%7BPUB_USER_ID%7D%26partner_id%3D1531
https://router.infolinks.com/dyn/imd-usync?user_id=cde6c865-b41c-4610-8a49-ce5e1d748091&partner_id=1531

35 B
245 B

80ms
80ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/imd-usync?user_id=cde6c865-b41c-4610-8a49-ce5e1d748091&partner_id=1531
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:29 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82d23bc0da097157-YUL
content-length: 35
expires: Mon, 28 Nov 2022 11:22:29 GMT

Redirect headers

location: https://router.infolinks.com/dyn/imd-usync?user_id=cde6c865-b41c-4610-8a49-ce5e1d748091&partner_id=1531
access-control-allow-origin: *
date: Tue, 28 Nov 2023 11:22:29 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2

200

outh-usync
router.infolinks.com/dyn/ Frame DACC
Redirect Chain

https://pixel.advertising.com/ups/58237/sync?&gdpr=&gdpr_consent=&redir=true
https://ups.analytics.yahoo.com/ups/58237/sync?&gdpr=&gdpr_consent=&redir=true
https://router.infolinks.com/dyn/outh-usync?uid=y-YNG5_ldE2uHIw4Nl6b4JVZFnpYL5ATu8~A

35 B
204 B

59ms
59ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/outh-usync?uid=y-YNG5_ldE2uHIw4Nl6b4JVZFnpYL5ATu8~A
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:26 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82d23bad78ad7157-YUL
content-length: 35
expires: Mon, 28 Nov 2022 11:22:26 GMT

Redirect headers

location: https://router.infolinks.com/dyn/outh-usync?uid=y-YNG5_ldE2uHIw4Nl6b4JVZFnpYL5ATu8~A
date: Tue, 28 Nov 2023 11:22:26 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.87
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

sovrn-usync
router.infolinks.com/dyn/ Frame DACC
Redirect Chain

https://ap.lijit.com/pixel?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsovrn-usync%3Fuid%3D%24UID
https://ap.lijit.com/pixel?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fsovrn-usync%3Fuid%3D%24UID&sovrn_retry=true
https://router.infolinks.com/dyn/sovrn-usync?uid=Hu0KhLZHv8TBZ_6xQxKpYooO

35 B
250 B

58ms
57ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/sovrn-usync?uid=Hu0KhLZHv8TBZ_6xQxKpYooO
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:26 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82d23bae095c7157-YUL
content-length: 35
expires: Mon, 28 Nov 2022 11:22:26 GMT

Redirect headers

Date: Tue, 28 Nov 2023 11:22:26 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://router.infolinks.com/dyn/sovrn-usync?uid=Hu0KhLZHv8TBZ_6xQxKpYooO
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap1dca1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame DACC
Redirect Chain

https://image8.pubmatic.com/AdServer/ImgSync?p=60809&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D60809%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infolink...
https://image8.pubmatic.com/AdServer/ImgSync?p=60809&gdpr=&gdpr_consent=&pu=https%3A%2F%2Fimage4.pubmatic.com%2FAdServer%2FSPug%3Fp%3D60809%26pmc%3DPM_PMC%26pr%3Dhttps%253A%252F%252Frouter.infolink...
https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=NjdBMzRDQjktNEJGNC00MTBBLTg1OTgtNzlGMTE4NzJDQTgz&gdpr=-1&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=-1&gdpr_consent=

0
74 B

1338ms
27ms

Image
text/html

162.248.18.37
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=-1&gdpr_consent=
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 162.248.18.37 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-type: text/html; charset=utf-8
date: Tue, 28 Nov 2023 11:22:27 GMT
cache-control: no-store, no-cache, private
content-encoding: gzip
server: nginx
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:26 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=-1&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

mnet-usync
router.infolinks.com/dyn/ Frame DACC
Redirect Chain

https://cs.media.net/cksync?cs=41&ovsid=setstatuscode&type=inf&redirect=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fmnet-usync%3Fuid%3D%3Cvsid%3E
https://router.infolinks.com/dyn/mnet-usync?uid=3441721474992699000V10

35 B
190 B

62ms
61ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/mnet-usync?uid=3441721474992699000V10
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:27 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82d23bb459197157-YUL
content-length: 35
expires: Mon, 28 Nov 2022 11:22:27 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 28 Nov 2023 11:22:27 GMT
Server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Location: https://router.infolinks.com/dyn/mnet-usync?uid=3441721474992699000V10
Content-Type: text/html
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 154
x-mnet-hl2: E
Expires: Tue, 28 Nov 2023 11:22:27 GMT

GET
H2

200

mgid-us
router.infolinks.com/dyn/ Frame DACC
Redirect Chain

https://cm-x.mgid.com/5abf3d2eff2f70c0a0669cd9f0f84ba0.gif?puid=[UID]&redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fmgid-us%3Fuser_id%3D%5BUID%5D
https://router.infolinks.com/dyn/mgid-us?user_id=c329aa5c-d64f-4e64-851e-e29079eb0183

35 B
200 B

59ms
59ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/mgid-us?user_id=c329aa5c-d64f-4e64-851e-e29079eb0183
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:27 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82d23bafbb7b7157-YUL
content-length: 35
expires: Mon, 28 Nov 2022 11:22:27 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 28 Nov 2023 11:22:27 GMT
Transfer-Encoding: chunked
Location: https://router.infolinks.com/dyn/mgid-us?user_id=c329aa5c-d64f-4e64-851e-e29079eb0183
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Keep-Alive: timeout=5
Expires: 0

GET
H2

200

ur-usync
router.infolinks.com/dyn/ Frame DACC
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=infolinks
https://ad.turn.com/r/cs?pid=45&rndcb=1797716308
https://sync.1rx.io/usersync/turn/3399286406793665392?dspret=1&gdpr=&gdpr_consent=&us_privacy=
https://sync.targeting.unrulymedia.com/csync/RX-20ee7faf-044d-4a33-8604-c5c01bc37378-005?redir=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fur-usync%3Fuid%3DRX-20ee7faf-044d-4a33-8604-c5c01bc37378-005
https://router.infolinks.com/dyn/ur-usync?uid=RX-20ee7faf-044d-4a33-8604-c5c01bc37378-005

35 B
204 B

61ms
60ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/ur-usync?uid=RX-20ee7faf-044d-4a33-8604-c5c01bc37378-005
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:30 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82d23bc5487a7157-YUL
content-length: 35
expires: Mon, 28 Nov 2022 11:22:30 GMT

Redirect headers

Date: Tue, 28 Nov 2023 11:22:30 GMT
Server: Tengine
ETag: RX20ee7faf044d4a338604c5c01bc37378005
Transfer-Encoding: chunked
P3P: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
Location: https://router.infolinks.com/dyn/ur-usync?uid=RX-20ee7faf-044d-4a33-8604-c5c01bc37378-005
Content-Type: text/html
Connection: keep-alive

GET
H2

200

qc-usync
router.infolinks.com/dyn/ Frame DACC
Redirect Chain

https://cms.quantserve.com/pixel/p-u1vdacBMXAcfT.gif?idmatch=0
https://router.infolinks.com/dyn/qc-usync?gdpr=0&uid=Yo5qmzffa515iz3NbIhxmmCDbZt5iz2XY458KbT9

35 B
250 B

58ms
58ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/qc-usync?gdpr=0&uid=Yo5qmzffa515iz3NbIhxmmCDbZt5iz2XY458KbT9
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:27 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82d23baf6b207157-YUL
content-length: 35
expires: Mon, 28 Nov 2022 11:22:27 GMT

Redirect headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:27 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://router.infolinks.com/dyn/qc-usync?gdpr=0&uid=Yo5qmzffa515iz3NbIhxmmCDbZt5iz2XY458KbT9
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

zeta-usync
router.infolinks.com/dyn/ Frame DACC
Redirect Chain

https://p.rfihub.com/cm?pub=43153&in=1
https://router.infolinks.com/dyn/zeta-usync?uid=2810316568135618125

35 B
241 B

63ms
63ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/zeta-usync?uid=2810316568135618125
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:30 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82d23bc14aa07157-YUL
content-length: 35
expires: Mon, 28 Nov 2022 11:22:29 GMT

Redirect headers

Location: https://router.infolinks.com/dyn/zeta-usync?uid=2810316568135618125
Date: Tue, 28 Nov 2023 11:22:29 GMT
Server: Jetty(9.4.51.v20230217)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

disus
router.infolinks.com/dyn/ Frame DACC
Redirect Chain

https://ssp.disqus.com/redirectuser?r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fdisus%3Fuid%3D%24UID&partner=infolinks
https://ads.betweendigital.com/match?bidder_id=45188&callback_url=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D32%26buyeruid%3D%24%7BUSER_ID%7D%26r%3DCid1YS02MjY3ZWVhMS04YzE4LTMxNTEtOTkxYi1lNmYz...
https://ads.betweendigital.com/match?bidder_id=45188&callback_url=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D32%26buyeruid%3D%24%7BUSER_ID%7D%26r%3DCid1YS02MjY3ZWVhMS04YzE4LTMxNTEtOTkxYi1lNmYz...
https://ssp.disqus.com/match?bidder=32&buyeruid=1aa82cfd-616e-534c-bf60-88a0da0545d4&r=Cid1YS02MjY3ZWVhMS04YzE4LTMxNTEtOTkxYi1lNmYzYWUwZjg4ZTYQ____________ASpSaHR0cHM6Ly9yb3V0ZXIuaW5mb2xpbmtzLmNvbS...
https://ce.lijit.com/merge?pid=279534&3pid=ua-6267eea1-8c18-3151-991b-e6f3ae0f88e6&gdpr=&gdpr_consent=&us_privacy=&location=https%3A%2F%2Fssp.disqus.com%2Fmatch%3Fbidder%3D12%26buyeruid%3D%5BSOVRNI...
https://ssp.disqus.com/match?bidder=12&buyeruid=Hu0KhLZHv8TBZ_6xQxKpYooO&r=Cid1YS02MjY3ZWVhMS04YzE4LTMxNTEtOTkxYi1lNmYzYWUwZjg4ZTYQ____________ASpSaHR0cHM6Ly9yb3V0ZXIuaW5mb2xpbmtzLmNvbS9keW4vZGlzdX...
https://router.infolinks.com/dyn/disus?uid=ua-6267eea1-8c18-3151-991b-e6f3ae0f88e6

35 B
224 B

60ms
60ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/disus?uid=ua-6267eea1-8c18-3151-991b-e6f3ae0f88e6
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:28 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82d23bb8efa37157-YUL
content-length: 35
expires: Mon, 28 Nov 2022 11:22:28 GMT

Redirect headers

location: https://router.infolinks.com/dyn/disus?uid=ua-6267eea1-8c18-3151-991b-e6f3ae0f88e6
pragma: no-cache
date: Tue, 28 Nov 2023 11:22:28 GMT
cache-control: no-store
content-length: 0
expires: 0

GET
H2

200

33a-usync
router.infolinks.com/dyn/ Frame DACC
Redirect Chain

https://ssc-cms.33across.com/ps/?ri=0010b00002CpYhEAAV&ru=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2F33a-usync%3Fuid%3D33XUSERID33X
https://router.infolinks.com/dyn/33a-usync?uid=212360409319474

35 B
184 B

81ms
80ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/33a-usync?uid=212360409319474
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:30 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82d23bc13a8c7157-YUL
content-length: 35
expires: Mon, 28 Nov 2022 11:22:29 GMT

Redirect headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:29 GMT
referrer-policy: unsafe-url
server: 33XP001
x-33x-status: 100000000008200000C
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://router.infolinks.com/dyn/33a-usync?uid=212360409319474
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

ProfilesEngineServlet
sync1.intentiq.com/profiles_engine/ Frame DACC
Redirect Chain

https://router.infolinks.com/dyn/iq-usync
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=1509139146&pcid=b503b030-0088-4396-929a-90f2529f8bc5&3rddpi=2023874098&3rdpcid=ZWXNchYK0kJrlgySALH81QAA%26522&3rddpi=...
https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=1509139146&pcid=b503b030-0088-4396-929a-90f2529f8bc5&3rddpi=2023874098&3rdpcid=ZWXNchYK0kJrlgySALH81QAA%26522&3rddpi...

43 B
1 KB

97ms
80ms

Image
image/gif

52.85.132.4
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=1509139146&pcid=b503b030-0088-4396-929a-90f2529f8bc5&3rddpi=2023874098&3rdpcid=ZWXNchYK0kJrlgySALH81QAA%26522&3rddpi=1810047279&3rdpcid=0235f168-9fe2-4f19-bf11-6190b139894b&3rddpi=1639354730&3rdpcid=y-YNG5_ldE2uHIw4Nl6b4JVZFnpYL5ATu8%7EA&3rddpi=445262707&3rdpcid=7i5TQo7vQhiG_SrnfEuNAeKFRzVsGUb5pWcUIKR-ARQ&3rddpi=1634346717&3rdpcid=KTx07if4_x_t-LdpdnQI&3rddpi=1213503647&3rdpcid=y-4R5ZlL1E2uLo6WodyFdNQQWiwEoHe0l5%7EA&3rddpi=443164713&3rdpcid=Yo5qmzffa515iz3NbIhxmmCDbZt5iz2XY458KbT9&ckls=true&ci=xDA0frvYR0&nc=false&trid=-670813030
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/manage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Server: 52.85.132.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-132-4.iad50.r.cloudfront.net
Software: Apache-Coyote/1.1 /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://router.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:27 GMT
via: 1.1 6d327e3d2da66fac5e95b3d2d2e18852.cloudfront.net (CloudFront)
server: Apache-Coyote/1.1
x-amz-cf-pop: IAD50-C2
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=86400
content-length: 43
x-amz-cf-id: -MLlTQSoSz8UHq0EzK3YJcjHQkkloFQYQ0iMc1GCSsI8USVkPKDAnw==
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:27 GMT
via: 1.1 6d327e3d2da66fac5e95b3d2d2e18852.cloudfront.net (CloudFront)
server: Apache-Coyote/1.1
x-amz-cf-pop: IAD50-C2
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
location: https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&dpi=1509139146&pcid=b503b030-0088-4396-929a-90f2529f8bc5&3rddpi=2023874098&3rdpcid=ZWXNchYK0kJrlgySALH81QAA%26522&3rddpi=1810047279&3rdpcid=0235f168-9fe2-4f19-bf11-6190b139894b&3rddpi=1639354730&3rdpcid=y-YNG5_ldE2uHIw4Nl6b4JVZFnpYL5ATu8%7EA&3rddpi=445262707&3rdpcid=7i5TQo7vQhiG_SrnfEuNAeKFRzVsGUb5pWcUIKR-ARQ&3rddpi=1634346717&3rdpcid=KTx07if4_x_t-LdpdnQI&3rddpi=1213503647&3rdpcid=y-4R5ZlL1E2uLo6WodyFdNQQWiwEoHe0l5%7EA&3rddpi=443164713&3rdpcid=Yo5qmzffa515iz3NbIhxmmCDbZt5iz2XY458KbT9&ckls=true&ci=xDA0frvYR0&nc=false&trid=-670813030
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
patent: https://www.almondnet.com/ip
alt-svc: h3=":443"; ma=86400
content-length: 43
x-amz-cf-id: vJMYw31IpSXiQOWwvfmLQKAsHw3M7Ven7h6gvgT323RPmdijSD_YqA==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 25 KB
11 KB 362ms
361ms Fetch
text/plain 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3291251754408132&correlator=947789466864555&eid=31079659%2C31079668%2C31079672%2C31079674%2C31078015%2C31079525%2C31061691%2C31061693&output=ldjh&gdfp_req=1&vrg=202311090101&ptt=17&impl=fif&iu_parts=61772569%2Cdbmtiqbxqoopp7t3s9lq_anyfilenotepadsemaanca_160x600_1&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=1&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1701170546543&lmt=1690678352&adxs=1440&adys=65&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-480&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp&rumc=3291251754408132&rume=1&vis=1&psz=0x-1&msz=160x-1&fws=644&ohw=1600&ga_vid=378767801.1701170546&ga_sid=1701170547&ga_hid=561326475&ga_fc=true&dlt=1701170544441&idt=1814&adks=450036033&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0ef04c593633f77baf84dfc72a038d7edb5ad5aafde5cf4599556ad0d22d09ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:26 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10904
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://anyfile-notepad.semaan.ca
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 441C 6 KB
3 KB 105ms
32ms Document
text/html 172.253.62.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f132.1e100.net

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://anyfile-notepad.semaan.ca/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 28 Nov 2023 11:22:26 GMT
expires: Wed, 27 Nov 2024 11:22:26 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 apiserving
csp.withgoogle.com/csp/ Frame AE08 0
0 117ms
52ms Other
text/html 172.253.63.141
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csp.withgoogle.com/csp/apiserving
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.253.63.141 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: bi-in-f141.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://content.googleapis.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/csp-report

Response headers

GET
H3 200 googleapis.proxy.js Show response
apis.google.com/js/ Frame AE08 18 KB
7 KB 53ms
52ms Script
text/javascript 142.251.16.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/googleapis.proxy.js?onload=startup

Requested by

Host: content.googleapis.com
URL: https://content.googleapis.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.AOzoyjtjrhQ.O%2Fd%3D1%2Frs%3DAHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA%2Fm%3D__features__

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f92e7baf6054ada951110842b4751571b3b16b43e826ff46eb36520f0294f59d

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://content.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 28 Nov 2023 11:22:26 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7117
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="gapi-team"
etag: "5f95998ecb7c0577"
vary: Accept-Encoding
report-to: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 28 Nov 2023 11:22:26 GMT

POST
H2 200 doq.htm Show response
rt3043.infolinks.com/action/ 3 KB
2 KB 242ms
188ms XHR
text/html 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rt3043.infolinks.com/action/doq.htm?pcode=utf-8&r=17011705465681
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1895.006-3.034/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 90ad435142b0d4e04e3046b8858e84c3f83a8af9d9617a69499d2ca08a4a828a

Request headers

Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:26 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: text/html;charset=UTF-8
access-control-allow-origin: https://anyfile-notepad.semaan.ca
p3p: CP="NON DSP NID OUR COR"
cache-control: no-cache,no-store
access-control-allow-credentials: true
content-language: en-CA
cf-ray: 82d23bac79666e0a-YUL
x-application-context: application:prod
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 iqusync-1.25.min.js Show response
resources.infolinks.com/static/usync/ 2 KB
1 KB 33ms
33ms Script
application/javascript 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/static/usync/iqusync-1.25.min.js
Requested by: Host: router.infolinks.com
URL: https://router.infolinks.com/usync/lcmanage?pid=3221959&wsid=0&pdom=anyfile-notepad.semaan.ca&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7e035885f253b73836d41088415cc8c467e43385ca3452b111431e6ab76f990b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:26 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 22 May 2023 09:55:02 GMT
server: cloudflare
age: 3905
etag: W/"8e7-5fc4543bc811d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 82d23bac2ec77157-YUL
expires: Thu, 28 Dec 2023 10:17:21 GMT

GET
H2

200

/
onetag-sys.com/match/ Frame C544
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=75&redir=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D1%26uid%3D%5BMM_UUID%5D%26gdpr%3D1%26gdpr_consent%3D
https://onetag-sys.com/match/?int_id=1&uid=e81d6565-cd72-4b00-8e3c-df640c8e1456&gdpr=1&gdpr_consent=

0
340 B

19ms
18ms

Image
text/plain

51.222.239.230
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=1&uid=e81d6565-cd72-4b00-8e3c-df640c8e1456&gdpr=1&gdpr_consent=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Protocol

Server

51.222.239.230 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Date: Tue, 28 Nov 2023 11:22:26 GMT
Server: MT3 1143 599e619 master ord ord-pixel-x15 config_version:"418"
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://onetag-sys.com/match/?int_id=1&uid=e81d6565-cd72-4b00-8e3c-df640c8e1456&gdpr=1&gdpr_consent=
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Tue, 28 Nov 2023 11:22:25 GMT

GET
H/1.1 204
No Content sync.php
pixel-eu.rubiconproject.com/exchange/ Frame C544 0
239 B 429ms
101ms Image
image/gif 213.19.162.90
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-eu.rubiconproject.com/exchange/sync.php?p=onetag&gdpr=1&gdpr_consent=
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 213.19.162.90 , United Kingdom, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: 19600bc21eacf9565125744d917cac10
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

/
onetag-sys.com/match/ Frame C544
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D98%26gdpr%3D1%26gdpr_consent%3D%26uid%3D$UID
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fonetag-sys.com%252Fmatch%252F%253Fint_id%253D98%2526gdpr%253D1%2526gdpr_consent%253D%2526uid%253D%24UID
https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=6452867190558037403

0
340 B

19ms
18ms

Image
text/plain

51.222.239.230
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=6452867190558037403

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Protocol

Server

51.222.239.230 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:26 GMT
an-x-request-uuid: 05cf8adb-0e20-4fa2-8d76-4cf3d8932e34
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://onetag-sys.com/match/?int_id=98&gdpr=1&gdpr_consent=&uid=6452867190558037403
x-proxy-origin: 185.193.64.134; 185.193.64.134; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

/
onetag-sys.com/match/ Frame C544
Redirect Chain

https://ads.stickyadstv.com/user-matching?id=3679&gdpr=1&gdpr_consent=
https://onetag-sys.com/match/?int_id=3&uid=156e5c7e7698a6905a6d4927b2b563&gdpr_consent=&gdpr=1

0
340 B

18ms
18ms

Image
text/plain

51.222.239.230
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=3&uid=156e5c7e7698a6905a6d4927b2b563&gdpr_consent=&gdpr=1

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Protocol

Server

51.222.239.230 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

Pragma: no-cache
Date: Tue, 28 Nov 2023 11:22:26 GMT
Server: nginx
Access-Control-Allow-Origin: *
Location: https://onetag-sys.com/match/?int_id=3&uid=156e5c7e7698a6905a6d4927b2b563&gdpr_consent=&gdpr=1
Cache-Control: no-cache
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
x-sticky-vk: 1701170546734023-281

GET
H/1.1 200
OK tap.php
pixel.rubiconproject.com/ Frame C544 42 B
775 B 102ms
33ms Image
image/gif 8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=223352&nid=4584&put=7i5TQo7vQhiG_SrnfEuNAeKFRzVsGUb5pWcUIKR-ARQ
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 207bf73b93f199ba0825203b77fa46ae
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame C544
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&ot_initiated=1
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABjBWqh7M2Rw4k8auxST0rZf_TDsrdCVK5Yg

170 B
243 B

44ms
43ms

Image
image/png

172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABjBWqh7M2Rw4k8auxST0rZf_TDsrdCVK5Yg

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Protocol

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:26 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=AAABjBWqh7M2Rw4k8auxST0rZf_TDsrdCVK5Yg
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H2 200 sync
ssbsync-global.smartadserver.com/api/ Frame C544 0
45 B 134ms
34ms Image
text/plain 23.105.12.143
LEASEWEB-USA-WDC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync-global.smartadserver.com/api/sync?callerId=5&gdpr=1&gdpr_consent=&us_privacy=&redirectUri=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D107%26uid%3D[ssb_sync_pid]
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.105.12.143 Manassas, United States, ASN30633 (LEASEWEB-USA-WDC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:26 GMT
content-length: 0

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame C544
Redirect Chain

https://onetag-sys.com/match/?int_id=113&gdpr=1&gdpr_consent=&callback=https%3A%2F%2Fs.amazon-adsystem.com%2Fecm3%3Fex%3Donetag.com%26id%3D%24%7BUSER_TOKEN%7D&ot_initiated=1
https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=7i5TQo7vQhiG_SrnfEuNAeKFRzVsGUb5pWcUIKR-ARQ

43 B
479 B

107ms
38ms

Image
image/gif

52.46.143.56
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=7i5TQo7vQhiG_SrnfEuNAeKFRzVsGUb5pWcUIKR-ARQ

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Protocol

HTTP/1.1

Server

52.46.143.56 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 28 Nov 2023 11:22:26 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: RE9SVSMY6W3X9EDRXS9N
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location: https://s.amazon-adsystem.com/ecm3?ex=onetag.com&id=7i5TQo7vQhiG_SrnfEuNAeKFRzVsGUb5pWcUIKR-ARQ
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H2 200 ImgSync
image8.pubmatic.com/AdServer/ Frame C544 0
42 B 215ms
94ms Image
text/plain 104.36.113.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image8.pubmatic.com/AdServer/ImgSync?p=159706&gdpr=1&gdpr_consent=&us_privacy=&pu=https%3A%2F%2Fonetag-sys.com%2Fmatch%2F%3Fint_id%3D114%26gdpr%3D${GDPR}%26gdpr_consent%3D${GDPR_STRING}%26uid%3D%23PMUID
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.36.113.110 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:25 GMT
content-length: 0

GET
H2

200

/
onetag-sys.com/match/ Frame C544
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=onetag_eb&google_cm
https://cm.g.doubleclick.net/pixel?google_nid=onetag_eb&google_cm=&google_tc=
https://onetag-sys.com/match/?int_id=106&google_gid=CAESEPKuJtdRJK8si1St9J60G1c&google_cver=1

0
340 B

19ms
19ms

Image
text/plain

51.222.239.230
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=106&google_gid=CAESEPKuJtdRJK8si1St9J60G1c&google_cver=1

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Protocol

Server

51.222.239.230 , Canada, ASN16276 (OVH, FR),

Reverse DNS

ec2-3-225-218-10.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:26 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/match/?int_id=106&google_gid=CAESEPKuJtdRJK8si1St9J60G1c&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 298
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 occ
ups.analytics.yahoo.com/ups/58488/ Frame C544 0
15 B 35ms
34ms Image
text/plain 3.225.218.10
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/58488/occ?&gdpr=1&gdpr_consent=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.225.218.10 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

ATS/9.1.10.87 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:26 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.87
age: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

/
onetag-sys.com/match/ Frame C544
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=vw6iyrn&ttd_tpi=1&gpdr=1&gdpr_consent=
https://match.adsrvr.org/track/cmb/generic?ttd_pid=vw6iyrn&ttd_tpi=1&gpdr=1&gdpr_consent=
https://onetag-sys.com/match/?int_id=29&uid=2a521745-e49f-4708-b4de-95cb384f5236&gdpr=0&gdpr_consent=

0
340 B

19ms
18ms

Image
text/plain

51.222.239.230
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=29&uid=2a521745-e49f-4708-b4de-95cb384f5236&gdpr=0&gdpr_consent=

Requested by

Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90

Protocol

Server

51.222.239.230 , Canada, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

location: https://onetag-sys.com/match/?int_id=29&uid=2a521745-e49f-4708-b4de-95cb384f5236&gdpr=0&gdpr_consent=
date: Tue, 28 Nov 2023 11:22:26 GMT
server: Kestrel
content-length: 233

GET
H/1.1 200
OK sync
x.bidswitch.net/ Frame C544 43 B
235 B 138ms
45ms Image
image/gif 35.211.178.172
GOOGLE-2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=onetag&gdpr=1&gdpr_consent=
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.211.178.172 North Charleston, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 172.178.211.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 28 Nov 2023 11:22:26 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H2 200 onetag-usync
router.infolinks.com/dyn/ Frame C544 35 B
262 B 60ms
59ms Image
image/gif 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/onetag-usync?uid=7i5TQo7vQhiG_SrnfEuNAeKFRzVsGUb5pWcUIKR-ARQ
Requested by: Host: onetag-sys.com
URL: https://onetag-sys.com/usync/?pubId=598ce3ddaee8c90
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://onetag-sys.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:26 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82d23bac5f027157-YUL
content-length: 35
expires: Mon, 28 Nov 2022 11:22:26 GMT

GET
H2 200 iquid.js Show response
resources.infolinks.com/static/ 54 KB
13 KB 34ms
33ms Script
application/javascript 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/static/iquid.js
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/usync/iqusync-1.25.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4c35a725ae1976af59c99556ad69e993dd9cf474033a75bb9406d59819d573d4

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:26 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 20 Mar 2023 11:30:07 GMT
server: cloudflare
age: 3696
etag: W/"d8c3-5f7533fc75a6e"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 82d23bac5f0f7157-YUL
expires: Thu, 28 Dec 2023 10:20:50 GMT

GET
H2 200 ima.js Show response
cdn-ima.33across.com/ 10 KB
4 KB 79ms
27ms Script
application/javascript 104.18.35.167
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-ima.33across.com/ima.js
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/usync/iqusync-1.25.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.35.167 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c5194891d3a8501374db8afe22463ed2a49fa28f22eaa4a1991d2e6e8a15191e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:26 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 30 Oct 2023 20:31:07 GMT
server: cloudflare
age: 436599
etag: W/"6540128b-2675"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 82d23bacadce4bd6-YUL
expires: Fri, 01 Dec 2023 11:22:26 GMT

GET
H2 200 id5.js Show response
resources.infolinks.com/static/ 58 KB
17 KB 38ms
38ms Script
application/javascript 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/static/id5.js
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/usync/iqusync-1.25.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 05e77dab19940dd457e00282837faecc886434cc8cc5f631575a5e6c386de774

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:26 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Sun, 26 Mar 2023 15:25:02 GMT
server: cloudflare
age: 3696
etag: W/"e65f-5f7cf3aed6f0f"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 82d23bac5f127157-YUL
expires: Thu, 28 Dec 2023 10:20:50 GMT

POST
H3 204 collect
www.google-analytics.com/g/ 0
17 B 44ms
44ms Ping
text/plain 142.251.163.138
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-3VRGCWTSLB&gtm=45je3b81v9123192625&_p=1701170546452&gcd=11l1l1l1l2&dma=0&ul=en-us&sr=1600x1200&cid=378767801.1701170546&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EBAI&ngs=1&_s=1&dl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp&dt=Anyfile%20Notepad&sid=1701170546&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&tfd=3811
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-3VRGCWTSLB&cx=c&_slc=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.251.163.138 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: wv-in-f138.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:26 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://anyfile-notepad.semaan.ca
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.AOzoyjtjrhQ.O/m=googleapis_proxy/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA/ Frame AE08 77 KB
27 KB 33ms
33ms Script
text/javascript 142.251.16.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.AOzoyjtjrhQ.O/m=googleapis_proxy/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA/cb=gapi.loaded_0?le=scs

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/googleapis.proxy.js?onload=startup

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns31533570.ip-162-19-138.eu

Software

sffe /

Resource Hash

84b4d9bd7d1de7f01972743862afa12b6899d2015e89eebfb7cac12232611e5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://content.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 02:49:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 462765
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27742
x-xss-protection: 0
last-modified: Tue, 03 Oct 2023 15:22:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
vary: Accept-Encoding
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 22 Nov 2024 02:49:41 GMT

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame FE41
Redirect Chain

https://match.adsrvr.org/track/cmf/casale
https://match.adsrvr.org/track/cmb/casale?
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=2a521745-e49f-4708-b4de-95cb384f5236&expiration=1703762546&gdpr=0&gdpr_consent=

43 B
337 B

45ms
44ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=2a521745-e49f-4708-b4de-95cb384f5236&expiration=1703762546&gdpr=0&gdpr_consent=
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol: H2
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:26 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eOjB4pGSiXG7RN0R6EBfuQpfcs8v4fWbnTe7sVtx9MZG3OE%2BGEZROV8p7NZ0fA5zwu5mRhtENFROm7Id%2B%2Ft3lD9S0CRRWxMMXACjp2IqcavtXe8Q4kTr47DfPZETmZ068C27qHeVJHm9Dw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 82d23bad2fe86e0b-YUL
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=2a521745-e49f-4708-b4de-95cb384f5236&expiration=1703762546&gdpr=0&gdpr_consent=
date: Tue, 28 Nov 2023 11:22:26 GMT
server: Kestrel
content-length: 323

GET
H3

200

362358.gif
idsync.rlcdn.com/ Frame FE41
Redirect Chain

https://i.liadm.com/s/31327?bidder_id=14481&bidder_uuid=ZWXNchYK0kJrlgySALH81QAA%26522&gpdr=&gdpr_consent=&us_privacy=&gpp=&gpp_sid=
https://i.liadm.com/s/31327?gdpr_consent=&bidder_id=14481&gpp=&bidder_uuid=ZWXNchYK0kJrlgySALH81QAA%26522&_li_chk=true&gpp_sid=&us_privacy=&gpdr=&previous_uuid=c6cbe1c0bee24913b7c9edbe79f77ee3
https://d.turn.com/r/dd/id/L21rdC8xOTcxL2NpZC8xNzQ5ODczMjc1L3QvMg/url/https://i.liadm.com/s/53233?bidder_id=183658&bidder_uuid=$!%7BTURN_UUID%7D
https://i.liadm.com/s/53233?bidder_id=183658&bidder_uuid=4190281632590857853
https://live.rezync.com/sync?c=0aa2530f29e4f4a05b5d5d9bb35d60c2&p=93c1662463a616a7155169889dd99651&pid=c6cbe1c0-bee2-4913-b7c9-edbe79f77ee3
https://p.rfihub.com/cm?pub=39342&in=1&userid=6df7e10b-3c43-47a1-b37d-085880eb2b11%3A1701170550.5563965&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3D6df7e10b-3c43-47a1-b37d-085880e...
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=2810316568135618125&referrer={encSite}&forward=https%3A%2F%2Fidsync.rlcdn.com%2F501709.gif%3Fpartner_uid%3D6df7e10b-3c43-47a1-b3...
https://idsync.rlcdn.com/501709.gif?partner_uid=6df7e10b-3c43-47a1-b37d-085880eb2b11%3A1701170550.5563965&_=1701170550.5591793
https://idsync.rlcdn.com/1000.gif?memo=CM3PHhJBCj0IARAFGjc2ZGY3ZTEwYi0zYzQzLTQ3YTEtYjM3ZC0wODU4ODBlYjJiMTE6MTcwMTE3MDU1MC41NTYzOTY1EAAaDQj2mperBhIFCOgHEABCAEoA
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEGfZsmGUPW-CnS6P-leoVMM&google_cver=1

42 B
60 B

51ms
50ms

Image
image/gif

35.244.154.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEGfZsmGUPW-CnS6P-leoVMM&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol: H3
Server: 35.244.154.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:30 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:30 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEGfZsmGUPW-CnS6P-leoVMM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 289
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame FE41
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=ZWXNchYK0kJrlgySALH81QAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEK3ZIgaIkWQ1abG1zrV7Wb8&google_cver=1

43 B
735 B

38ms
38ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEK3ZIgaIkWQ1abG1zrV7Wb8&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:26 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IMPSfUTDJJJiIdT%2FeEQjx%2BG4BDfOG6%2BUEwJVESmJoSw7j01Ak8coaNvzXXXfedK0rdw7EphmMJPW0aBQYDnJlU8AMQMLAP8FikjQsHxmhl44VtrVD%2BHBaxxeof6%2BICgFLti9ssr3skZdZg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 82d23bad9bef6e02-YUL
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:26 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEK3ZIgaIkWQ1abG1zrV7Wb8&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame FE41
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZWXNchYK0kJrlgySALH81QAAAgoAAAIB&gpp=&gpp_sid=
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZWXNchYK0kJrlgySALH81QAAAgoAAAIB&gpp=&gpp_sid=&dcc=t

43 B
855 B

55ms
54ms

Image
image/gif

52.46.143.56
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZWXNchYK0kJrlgySALH81QAAAgoAAAIB&gpp=&gpp_sid=&dcc=t

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1

Protocol

HTTP/1.1

Server

52.46.143.56 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 28 Nov 2023 11:22:26 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: SEMX2ZPG98BR6P0797R6
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 28 Nov 2023 11:22:26 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: K6P8ZA5NHH9HB1F27AJJ
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=&gdpr_consent=&id=ZWXNchYK0kJrlgySALH81QAAAgoAAAIB&gpp=&gpp_sid=&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

crum
dsum.casalemedia.com/ Frame FE41
Redirect Chain

https://dmp.brand-display.com/cm/api/index?cm_dsp_id=191&cm_user_id=%3cIndex_user_id%3e
https://dsum.casalemedia.com/crum?cm_dsp_id=191&external_user_id=c2911410-29c6-23dc-79b1988f

43 B
540 B

42ms
40ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum.casalemedia.com/crum?cm_dsp_id=191&external_user_id=c2911410-29c6-23dc-79b1988f
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol: H2
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:27 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kBuvrUUg0Ay80Es29xQ9ItSH%2BI4JtLHOeD2GziPgy03mAujm%2FEFuIPXXyB9sJbOL%2Fb9wn1ogQjCZDI3M4QhDILjSMvMbWPeqK%2FnOMrpO7OQXxNul55PrW2jgKEvipxXxVKT2Xde3"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 82d23bb3bb076e0b-YUL
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

date: Tue, 28 Nov 2023 11:22:27 GMT
via: 1.1 google
server: nginx/1.24.0
p3p: CP='This is not a P3P policy!'
access-control-allow-origin: *
location: https://dsum.casalemedia.com/crum?cm_dsp_id=191&external_user_id=c2911410-29c6-23dc-79b1988f
content-type: text/html; charset=utf-8
cache-control: max-age=3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 119

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame FE41
Redirect Chain

https://um.simpli.fi/pm_match?https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=$UID
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=D6BC4FB7DA334D92BD0CB46480B2F3D5

43 B
733 B

49ms
49ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=D6BC4FB7DA334D92BD0CB46480B2F3D5
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:29 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hpjV%2BAqmMrnxfjUg6HC5ejbefKCmjqluOCls4Hsbi7cij2HPvU0wSFYIaNGHkL0RpHuIxyWC0yfFBvX%2FFJJJFMBSCXDREfQeqmQgTNICEqF0e0V6U1Wj%2BNDEBG85XR3YqT0109szGConIg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 82d23bc08b086e02-YUL
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

date: Tue, 28 Nov 2023 11:22:29 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=90&external_user_id=D6BC4FB7DA334D92BD0CB46480B2F3D5
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Mon, 27 Nov 2023 11:22:29 GMT

GET
H3

200

crum
dsum-sec.casalemedia.com/ Frame FE41
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=29
https://c1.adform.net/serving/cookie/match?CC=1&party=29
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=111&external_user_id=6226513512215277920&expiration=1702380145

43 B
727 B

38ms
38ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=111&external_user_id=6226513512215277920&expiration=1702380145
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:27 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=i3qikrreJQ9CzbwbLPQIrWg9vdVvEY6bSx4K95yN7PO7NgLzuG5r3mrUa4yDbyLixoJJnThX4FvZXhOMvQFmvuSB8QZEX0jmc7YzPaL2Xehmo6oq2cRXc4bjbutFz2KAilElitdgr2WFjQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 82d23bb3ee126e02-YUL
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=111&external_user_id=6226513512215277920&expiration=1702380145
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

usermatchredir
ssum-sec.casalemedia.com/ Frame FE41
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=ZWXNchYK0kJrlgySALH81QAAAgoAAAIB&gdpr_consent=&us_privacy=&gdpr=&gpp=&gpp_sid=
https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEI3WKFV9uqBJ2que-U2g1LM&google_cver=1

43 B
773 B

39ms
39ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEI3WKFV9uqBJ2que-U2g1LM&google_cver=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:26 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FzKVfVHp0TrLyamVM9QhdGTuWN1Dznt1OI%2BUa%2By4PZgEKGXERorIa3OEwFyDdARcBr40n7fz%2BVr3QL28wPODe3BzMIigKSXd%2FB%2Fy2kzBYtoqOhYMXhbMEpjIecJeqex9NjQ846aKWKEdlQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 82d23bad2b656e02-YUL
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:26 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ssum-sec.casalemedia.com/usermatchredir?s=184023&gdpr_consent=&gdpr=&gpp=&gpp_sid=&google_gid=CAESEI3WKFV9uqBJ2que-U2g1LM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 364
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ix-usync
router.infolinks.com/dyn/ Frame FE41 35 B
218 B 64ms
60ms Image
image/gif 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/ix-usync?uid=ZWXNchYK0kJrlgySALH81QAA%26522
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fix-usync%3Fuid%3D&s=191306&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:26 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82d23bacdff27157-YUL
content-length: 35
expires: Mon, 28 Nov 2022 11:22:26 GMT

GET
H2 200 ProfilesEngineServlet Show response
api.intentiq.com/profiles_engine/ 92 B
933 B 1138ms
43ms XHR
text/html 108.138.64.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.intentiq.com/profiles_engine/ProfilesEngineServlet?at=39&mi=10&dpi=328512134&pt=17&dpn=1&jsver=5.36&iiqidtype=2&iiqpcid=f788e283-f6bf-4d6e-8f81-54faa37eec67&iiqpciddate=1701170546670&iiqcallcount=0&iiqfailcount=0&iiqnodata=false&iiqlocalstorageenabled=true&tsrnd=967_1701170546671&fbp=3116449926&cttl=43200000&rrtt=0&dud=0&abtg=A&iiqppcc=0
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/iquid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.64.122 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-64-122.iad12.r.cloudfront.net
Software: Apache-Coyote/1.1 /
Resource Hash: 290e0b2a0facf520e51e57ad7f3a6f2f577206473aaa35ce9bd302d6a143fc4b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:27 GMT
via: 1.1 61bbe72b71f7b857c695c31fdeb7b3a6.cloudfront.net (CloudFront)
x-amz-cf-pop: IAD12-P1
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
patent: https://www.almondnet.com/ip
alt-svc: h3=":443"; ma=86400
pragma: no-cache
server: Apache-Coyote/1.1
vary: Origin
access-control-allow-methods: POST, GET
content-type: text/html
access-control-allow-origin: https://anyfile-notepad.semaan.ca
access-control-max-age: 3600
access-control-allow-credentials: true
cache-control: no-cache, no-store, must-revalidate
access-control-allow-headers: Content-Type, Accept, X-Requested-With, remember-me
x-amz-cf-id: YtWjCSEKz49IQokmAlDVznvHVgYyiAe2J3qsa7PljKegXE4UDBrHDw==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

ProfilesEngineServlet
sync1.intentiq.com/profiles_engine/
Redirect Chain

https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&secure=1&dpi=328512134&rnd=179082&iiqidtype=2&iiqpcid=f788e283-f6bf-4d6e-8f81-54faa37eec67&iiqpciddate=1701170546670&tsrn...
https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&secure=1&dpi=328512134&rnd=179082&iiqidtype=2&iiqpcid=f788e283-f6bf-4d6e-8f81-54faa37eec67&iiqpciddate=1701170546670&tsr...

43 B
1 KB

57ms
39ms

Image
image/gif

52.85.132.4
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&secure=1&dpi=328512134&rnd=179082&iiqidtype=2&iiqpcid=f788e283-f6bf-4d6e-8f81-54faa37eec67&iiqpciddate=1701170546670&tsrnd=850_1701170546671&fbp=3116449926&jsver=5.36&abtp=100&abtg=A&ckls=true&ci=BWJ4Rkc99v&nc=false&trid=2086405722
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app
Protocol: H2
Server: 52.85.132.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-132-4.iad50.r.cloudfront.net
Software: Apache-Coyote/1.1 /
Resource Hash: caa849b179befa2645a8e2c474d2e82a76777a3305315ece911013e8ee9a916c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:27 GMT
via: 1.1 6d327e3d2da66fac5e95b3d2d2e18852.cloudfront.net (CloudFront)
server: Apache-Coyote/1.1
x-amz-cf-pop: IAD50-C2
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3=":443"; ma=86400
content-length: 43
x-amz-cf-id: X3m12mEkX7tbHM-jLNRYs-zbkO_AeV0C1csEFNaAgT_rH8PDoNeKvA==
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:27 GMT
via: 1.1 6d327e3d2da66fac5e95b3d2d2e18852.cloudfront.net (CloudFront)
server: Apache-Coyote/1.1
x-amz-cf-pop: IAD50-C2
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
location: https://sync1.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&mi=10&secure=1&dpi=328512134&rnd=179082&iiqidtype=2&iiqpcid=f788e283-f6bf-4d6e-8f81-54faa37eec67&iiqpciddate=1701170546670&tsrnd=850_1701170546671&fbp=3116449926&jsver=5.36&abtp=100&abtg=A&ckls=true&ci=BWJ4Rkc99v&nc=false&trid=2086405722
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
patent: https://www.almondnet.com/ip
alt-svc: h3=":443"; ma=86400
content-length: 43
x-amz-cf-id: _5Dh32bA_KAZN9Ztn2swQdLY-DrkGnxvbiVZxuIeYeh4hGBBDuLkAg==
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 33 B
285 B 3392ms
125ms XHR
application/json 162.19.138.119
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/id5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.119 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

a0f7cc7b67a2201ff154e3e572fd1c518cc2a149209609a40798a29931c88b5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://anyfile-notepad.semaan.ca
date: Tue, 28 Nov 2023 11:22:29 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H2

200

envelope Show response
lexicon.33across.com/v1/
Redirect Chain

https://lexicon.33across.com/v1/envelope?pid=0015a0000344WLkAAM&src=ima&ver=1.2.0
https://lexicon.33across.com/v1/envelope?pid=0015a0000344WLkAAM&src=ima&ver=1.2.0&b=1&g=t8sAYDeacygjw83AYgNr7sZevo%2FaWVT6wPOc5rggc5A%3D

42 B
138 B

35ms
34ms

XHR
application/json

35.244.193.51
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0015a0000344WLkAAM&src=ima&ver=1.2.0&b=1&g=t8sAYDeacygjw83AYgNr7sZevo%2FaWVT6wPOc5rggc5A%3D
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app
Protocol: H2
Server: 35.244.193.51 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: 435b1ece4a55f4f8d06866b32c1aee3cc4661eb905265894795f15a57bf1b33d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:29 GMT
via: 1.1 google
vary: origin
content-type: application/json
access-control-allow-origin: https://anyfile-notepad.semaan.ca
cache-control: private, must-revalidate, max-age=28800
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

date: Tue, 28 Nov 2023 11:22:29 GMT
via: 1.1 google
referrer-policy: unsafe-url
vary: origin
access-control-allow-origin: https://anyfile-notepad.semaan.ca
location: https://lexicon.33across.com/v1/envelope?pid=0015a0000344WLkAAM&src=ima&ver=1.2.0&b=1&g=t8sAYDeacygjw83AYgNr7sZevo%2FaWVT6wPOc5rggc5A%3D
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, false
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2 200 rest Show response
content.googleapis.com/discovery/v1/apis/oauth2/v2/ Frame AE08 6 KB
2 KB 33ms
32ms XHR
application/json 172.253.62.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://content.googleapis.com/discovery/v1/apis/oauth2/v2/rest?fields=kind%2Cname%2Cversion%2CrootUrl%2CservicePath%2Cresources%2Cparameters%2Cmethods%2CbatchPath%2Cid&pp=0

Requested by

Host: apis.google.com
URL: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.AOzoyjtjrhQ.O/m=googleapis_proxy/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA/cb=gapi.loaded_0?le=scs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4a1d6b68a866302b8ea5ab414b02d7a847b9d9336c4a7485d395041c5e916e16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

X-Goog-Encode-Response-If-Executable: base64
X-Origin: https://anyfile-notepad.semaan.ca
X-ClientDetails: appVersion=5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F119.0.6045.159%20Safari%2F537.36&platform=Win32&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F119.0.6045.159%20Safari%2F537.36
accept-language: en-CA,en;q=0.9
Authorization: Bearer undefined
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Referer: https://content.googleapis.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.AOzoyjtjrhQ.O%2Fd%3D1%2Frs%3DAHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA%2Fm%3D__features__
X-Requested-With: XMLHttpRequest
X-JavaScript-User-Agent: google-api-javascript-client/1.1.0
X-Referer: https://anyfile-notepad.semaan.ca

Response headers

date: Tue, 28 Nov 2023 10:34:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2906
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/federated-signon-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1394
x-xss-protection: 0
last-modified: Thu, 02 Nov 2023 22:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="federated-signon-mpm-access"
vary: Accept-Encoding
report-to: {"group":"federated-signon-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/federated-signon-mpm-access"}]}
content-type: application/json; charset=UTF-8
cache-control: public, max-age=3000
accept-ranges: bytes
expires: Tue, 28 Nov 2023 11:24:00 GMT

GET
H2 200 rest Show response
content.googleapis.com/discovery/v1/apis/drive/v2/ Frame AE08 96 KB
11 KB 48ms
47ms XHR
application/json 172.253.62.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://content.googleapis.com/discovery/v1/apis/drive/v2/rest?fields=kind%2Cname%2Cversion%2CrootUrl%2CservicePath%2Cresources%2Cparameters%2Cmethods%2CbatchPath%2Cid&pp=0

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

15145cb2f12603af2aecde43aaf09917722fe86388be5dd170e373036c7e3a9b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

X-Goog-Encode-Response-If-Executable: base64
X-Origin: https://anyfile-notepad.semaan.ca
X-ClientDetails: appVersion=5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F119.0.6045.159%20Safari%2F537.36&platform=Win32&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F119.0.6045.159%20Safari%2F537.36
accept-language: en-CA,en;q=0.9
Authorization: Bearer undefined
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Referer: https://content.googleapis.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.AOzoyjtjrhQ.O%2Fd%3D1%2Frs%3DAHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA%2Fm%3D__features__
X-Requested-With: XMLHttpRequest
X-JavaScript-User-Agent: google-api-javascript-client/1.1.0
X-Referer: https://anyfile-notepad.semaan.ca

Response headers

date: Tue, 28 Nov 2023 11:22:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10936
x-xss-protection: 0

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 95AB
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=33across&endpoint=us-east&us_privacy=
https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=

281 B
555 B

134ms
36ms

Document
text/html

23.55.205.215
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.55.205.215 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-55-205-215.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 28 Nov 2023 11:22:30 GMT
ETag: "280525-119-60930cbd3cec0"
Last-Modified: Thu, 02 Nov 2023 19:57:23 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Tue, 28 Nov 2023 11:22:29 GMT
location: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
server: AkamaiGHost

GET
H2

200

user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 3819
Redirect Chain

https://ssc-cms.33across.com/ps/?us_privacy=&ts=1701170546745.6&ri=25&ru=https%3A%2F%2Fads.pubmatic.com%2FAdServer%2Fjs%2Fuser_sync.html%3F%26p%3D156423%26us_privacy%3D%24%7BUS_PRIVACY%7D%26predire...
https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D

16 KB
6 KB

355ms
26ms

Document
text/html

23.41.168.202
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.41.168.202 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-168-202.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 8e53e50181b7a9e2caa94173c37fcd9de8fa75750764a2ad8ad02fac3306d652

Request headers

Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=61878
content-encoding: gzip
content-length: 5622
content-type: text/html
date: Tue, 28 Nov 2023 11:22:30 GMT
expires: Wed, 29 Nov 2023 04:33:48 GMT
last-modified: Thu, 16 Nov 2023 09:11:44 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

Redirect headers

cache-control: no-store, no-cache, must-revalidate
content-length: 0
date: Tue, 28 Nov 2023 11:22:29 GMT
expires: Thu, 01-Jan-70 00:00:01 GMT
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
pragma: no-cache
referrer-policy: unsafe-url
server: 33XP018
x-33x-status: 40000000008200000C

GET
H2

200

match
events-ssc.33across.com/ Frame 447F
Redirect Chain

https://x.bidswitch.net/sync?ssp=the33across&us_privacy=
https://x.bidswitch.net/ul_cb/sync?ssp=the33across&us_privacy=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bidswitch&ttd_tpi=1&ttd_puid=the33across&gdpr=&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=93&user_id=2a521745-e49f-4708-b4de-95cb384f5236&expires=30&ssp=the33across&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT_21}
https://ssc-cms.33across.com/ps/?xi=10&us_privacy=&xu=19c56dd7-129e-4f1d-8528-db73c86babf1
https://events-ssc.33across.com/match?bidder_id=10&external_user_id=19c56dd7-129e-4f1d-8528-db73c86babf1&ts=1701170549&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
126 B

704ms
38ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=10&external_user_id=19c56dd7-129e-4f1d-8528-db73c86babf1&ts=1701170549&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:30 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:29 GMT
referrer-policy: unsafe-url
server: 33XP003
x-33x-status: 8000000008200000C
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=10&external_user_id=19c56dd7-129e-4f1d-8528-db73c86babf1&ts=1701170549&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

match
events-ssc.33across.com/ Frame 447F
Redirect Chain

https://ups.analytics.yahoo.com/ups/58350/sync?redir=true
https://ssc-cms.33across.com/ps/?xi=99&us_privacy=&xu=y-8Rf3vlNE2uEwkkxzBVg.Mj2Tx8JlYX.W~A
https://events-ssc.33across.com/match?bidder_id=99&external_user_id=y-8Rf3vlNE2uEwkkxzBVg.Mj2Tx8JlYX.W%7EA&ts=1701170549&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
225 B

703ms
37ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=99&external_user_id=y-8Rf3vlNE2uEwkkxzBVg.Mj2Tx8JlYX.W%7EA&ts=1701170549&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:30 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:29 GMT
referrer-policy: unsafe-url
server: 33XP020
x-33x-status: 8000000008200000C
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=99&external_user_id=y-8Rf3vlNE2uEwkkxzBVg.Mj2Tx8JlYX.W%7EA&ts=1701170549&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

match
events-ssc.33across.com/ Frame 447F
Redirect Chain

https://33across-match.dotomi.com/match/bounce/current?networkId=78390&version=1&us_privacy=
https://33across-match.dotomi.com/match/bounce/current?DotomiTest=38e314805fbf0fb6&is_secure=true&networkId=78390&version=1&us_privacy=
https://ssc-cms.33across.com/ps?xi=64&xu=AAAGTgYbyeOFYAMRSdb6AAAAAAA&expiration=1701256950&is_secure=true&us_privacy=
https://events-ssc.33across.com/match?bidder_id=64&external_user_id=AAAGTgYbyeOFYAMRSdb6AAAAAAA&ts=1701170550&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
117 B

81ms
41ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=64&external_user_id=AAAGTgYbyeOFYAMRSdb6AAAAAAA&ts=1701170550&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:30 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:30 GMT
referrer-policy: unsafe-url
server: 33XP002
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=64&external_user_id=AAAGTgYbyeOFYAMRSdb6AAAAAAA&ts=1701170550&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2

200

match
events-ssc.33across.com/ Frame 447F
Redirect Chain

https://eb2.3lift.com/getuid?gdpr=0&cmp_cs=&us_privacy=&redir=https%3A%2F%2Fssc-cms.33across.com%2Fps%2F%3Fus_privacy%3D%26xi%3D33%26xu%3D%24UID
https://ssc-cms.33across.com/ps/?us_privacy=&xi=33&xu=3640422820248028610086
https://events-ssc.33across.com/match?bidder_id=33&external_user_id=3640422820248028610086&ts=1701170549&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
126 B

703ms
38ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=33&external_user_id=3640422820248028610086&ts=1701170549&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:30 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:29 GMT
referrer-policy: unsafe-url
server: 33XP002
x-33x-status: 8000000008200000C
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=33&external_user_id=3640422820248028610086&ts=1701170549&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
H2 200 in_search.js Show response
resources.infolinks.com/js/1895.006-3.034/ 225 KB
89 KB 30ms
30ms Script
application/javascript 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/js/1895.006-3.034/in_search.js
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1895.006-3.034/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4d1b618b508d6e2c3ab4c4d98feeddfdb66e6d87d9dcfd88097f1d85480c3af0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:26 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 07 Nov 2023 17:45:04 GMT
server: cloudflare
age: 11424
etag: W/"38471-6099387db3d85"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 82d23bada8ea7157-YUL
expires: Thu, 28 Dec 2023 08:12:02 GMT

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ 365 KB
126 KB 352ms
34ms Script
text/javascript 172.253.63.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1895.006-3.034/ice.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bi-in-f95.1e100.net

Software

sffe /

Resource Hash

4b11a3cb86b8e90ee13ac577dbb1a2398373c7d7777a18066cf50b991ecae129

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 128095
x-xss-protection: 0
expires: Tue, 28 Nov 2023 11:22:27 GMT

GET
H/1.1 200
OK score.min.js Show response
js.ad-score.com/ 497 KB
154 KB 3156ms
39ms Script
application/javascript 3.162.125.9
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.ad-score.com/score.min.js?pid=1000102&tt=if&tid=infolinks-p&l1=3221959_0&l2=3&l3=Windows&l4=Chrome&l5=anyfile-notepad.semaan.ca&ref=https://anyfile-notepad.semaan.ca/app&pub_domain=anyfile-notepad.semaan.ca&utid=e618bdc4-7bca-4ade-aae1-9efce4df9aaa&uid=cuid_b503b030-0088-4396-929a-90f2529f8bc5&uip=185.193.64.134&cb=3640703962638898251
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1895.006-3.034/ice.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 3.162.125.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-162-125-9.iad61.r.cloudfront.net
Software: /
Resource Hash: fb10a128f4fa4b6e12ade04446b84528264e9fe1524c4987b98505e0f9ccc07c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Mon, 27 Nov 2023 23:00:39 GMT
Content-Encoding: br
Via: 1.1 e28efd1a65ea5d8d42e5dac75c735524.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: IAD61-P3
Age: 44510
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Last-Modified: Mon, 27 Nov 2023 23:00:39 GMT
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=86400
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Cache-Control
X-Amz-Cf-Id: 8pkQGjtOSr6SkfyDNPjuqLY2AxP8gRmGy9Um1CI9Ox8MbhqUUfxp4g==
Expires: Tue, 28 Nov 2023 23:00:39 GMT

GET
H2 200 container-3.0.html Show response
resources.infolinks.com/static/ Frame DE49 1 KB
677 B 38ms
37ms Document
text/html 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/static/container-3.0.html
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1895.006-3.034/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 71cb550e3eed0fa766ffd5596c6d7fd0460a06fca3483d762d0b0fd36731a100

Request headers

Referer: https://anyfile-notepad.semaan.ca/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 12562
cache-control: max-age=2592000
cf-cache-status: HIT
cf-ray: 82d23badb8fc7157-YUL
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 28 Nov 2023 11:22:26 GMT
expires: Thu, 28 Dec 2023 07:53:04 GMT
last-modified: Thu, 02 Nov 2023 07:15:03 GMT
server: cloudflare
vary: Accept-Encoding
via: 1.1 google

GET
H3 200 cb=gapi.loaded_1 Show response
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.AOzoyjtjrhQ.O/m=picker/exm=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA/ 86 KB
27 KB 33ms
32ms Script
text/javascript 142.251.16.102
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.AOzoyjtjrhQ.O/m=picker/exm=client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA/cb=gapi.loaded_1?le=scs

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/client.js?onload=gapi_loaded

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.16.102 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d8937d279ce40e09299ddc9023db7c815b220a3eb280844314b3e9eb46fa0bf2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 10:57:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 260688
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27759
x-xss-protection: 0
last-modified: Tue, 03 Oct 2023 15:22:58 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
vary: Accept-Encoding
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 24 Nov 2024 10:57:38 GMT

GET
H2 200 getads.htm Show response
rt3043.infolinks.com/action/ 8 KB
6 KB 479ms
478ms Script
text/html 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rt3043.infolinks.com/action/getads.htm?hks=%5B%7B%22lid%22%3A%22d_IL_INSEARCH%22%2C%22bdc%22%3A1%2C%22prod_t%22%3A%22d%22%2C%22garc%22%3A0%2C%22sdata%22%3A%22article%22%2C%22scs%22%3A%22H_Pz7jRyVW%22%7D%5D&rid=e618bdc4-7bca-4ade-aae1-9efce4df9aaa&jsv=1895.006-3.034&sr=1600X1200&rts=1701170546880&cfv=-1&cb=getAdsResponse&os=Windows&ov=10&br=Chrome&bv=119.0.6045.159&dv=p&ce=t&purl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp&tzo=-0800&c=c&strg=true&pitc=34~39parT1MiuX7K9dvnOFwupLWPJKsQark&sua=%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%2C%22uaFullVersion%22%3A%22%22%7D&rsd=-dnsMAZrcPpZDC7ne_UdykbmDAdgXvqIhNo6isEqBu3BEumbhwlDl2oKnz1qbcIdZQPpKQtCnxf8v5oo8qHcsARE6jX_c5cLxXYZnaZEA728AM9OLtD7xlm8IlLsW-o6dwQp-IZ0smHIKSdurvLhIO6FMm1kHe7e&rsk=3&rcs=yxefAL30w2z3jU_UJktyow&cuid=b503b030-0088-4396-929a-90f2529f8bc5&_pubcid=46c5863d-513a-4d75-8a95-6977a26a5eac&hbnr=false
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1895.006-3.034/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b58e878750e999c1b8eb8c36260ee9bba6c7f64d72a2a28239fa70d41beb3508

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:27 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-language: en-CA
content-type: text/html;charset=UTF-8
cache-control: no-cache,no-store
cf-ray: 82d23bae09647157-YUL
x-application-context: application:prod
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET sync
tracker.exchange.amitydigital.io/ Frame DE49 0
0

GET
H2

200

ta-usync
router.infolinks.com/dyn/ Frame DE49
Redirect Chain

https://pixel.tapad.com/idsync/ex/receive?partner_device_id=b503b030-0088-4396-929a-90f2529f8bc5=&partner_id=3337&partner_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fta-usync%3Fuid%3D%24%7BTA_DE...
https://pixel.tapad.com/idsync/ex/receive/check?partner_device_id=b503b030-0088-4396-929a-90f2529f8bc5=&partner_id=3337&partner_url=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fta-usync%3Fuid%3D%24%7...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=tapad&ttd_tpi=1&ttd_puid=6b580a86-f996-4239-8687-e0079457f069%252Chttps%25253A%25252F%25252Frouter.infolinks.com%25252Fdyn%25252Fta-usync%25253Fui...
https://pixel.tapad.com/idsync/ex/receive?partner_id=1830&partner_device_id=2a521745-e49f-4708-b4de-95cb384f5236&ttd_puid=6b580a86-f996-4239-8687-e0079457f069%2Chttps%253A%252F%252Frouter.infolinks...
https://router.infolinks.com/dyn/ta-usync?uid=6b580a86-f996-4239-8687-e0079457f069

35 B
212 B

61ms
61ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/ta-usync?uid=6b580a86-f996-4239-8687-e0079457f069
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://resources.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:27 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82d23bb0bc9d7157-YUL
content-length: 35
expires: Mon, 28 Nov 2022 11:22:27 GMT

Redirect headers

date: Tue, 28 Nov 2023 11:22:27 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: Jetty(11.0.13)
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin: *
location: https://router.infolinks.com/dyn/ta-usync?uid=6b580a86-f996-4239-8687-e0079457f069
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

152mus
router.infolinks.com/dyn/ Frame DE49
Redirect Chain

https://sync.adkernel.com/user-sync?zone=202694&t=image&r=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2F152mus%3Fuid%3D%7BUID%7D
https://ib.adnxs.com/getuid?%2F%2Fsync.adkernel.com%2Fuser-sync%3Fzone%3D202694%26dsp%3D639242%26t%3Dimage%26uid%3D%24UID
https://sync.adkernel.com/user-sync?zone=202694&dsp=639242&t=image&uid=6452867190558037403
https://router.infolinks.com/dyn/152mus?uid=A40554104771667864

35 B
209 B

65ms
65ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/152mus?uid=A40554104771667864
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://resources.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:30 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82d23bc5283a7157-YUL
content-length: 35
expires: Mon, 28 Nov 2022 11:22:30 GMT

Redirect headers

Location: https://router.infolinks.com/dyn/152mus?uid=A40554104771667864
Date: Tue, 28 Nov 2023 11:22:30 GMT
Cache-Control: no-store
Server: nginx
Connection: close
Content-Length: 0

GET
H2

200

cons-us
router.infolinks.com/dyn/ Frame DE49
Redirect Chain

https://e.serverbid.com/usersync?cspi=154&ttt=1&ru=https%3A%2F%2Frouter.infolinks.com%2Fdyn%2Fcons-us%3Fuser_id%3D%24%7BUID%7D
https://router.infolinks.com/dyn/cons-us?user_id=246553201ea6420ea553201ea6e20ebb

35 B
196 B

64ms
63ms

Image
image/gif

172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://router.infolinks.com/dyn/cons-us?user_id=246553201ea6420ea553201ea6e20ebb
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app
Protocol: H2
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16957a3bb9422d4ba380be3b630db7a310e87e65f224e2be865dd64dd0b5664d

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://resources.infolinks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:27 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
p3p: CP="NON DSP NID OUR COR"
content-type: image/gif
cache-control: no-store, no-cache, private
cf-ray: 82d23bb03c0e7157-YUL
content-length: 35
expires: Mon, 28 Nov 2022 11:22:27 GMT

Redirect headers

date: Tue, 28 Nov 2023 11:22:26 GMT
access-control-max-age: 10080
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://resources.infolinks.com
location: https://router.infolinks.com/dyn/cons-us?user_id=246553201ea6420ea553201ea6e20ebb
access-control-allow-credentials: true
access-control-allow-headers: origin, content-type, accept
content-length: 0

GET
H3 401 userinfo Show response
content.googleapis.com/oauth2/v2/ Frame AE08 304 B
251 B 64ms
64ms XHR
application/json 142.251.163.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://content.googleapis.com/oauth2/v2/userinfo

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.163.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wv-in-f95.1e100.net

Software

ESF /

Resource Hash

a9ec945a24875fc594683ac8c3e176f2c199ed1011c8e1eec897d66c392d17b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

X-Goog-Encode-Response-If-Executable: base64
X-Origin: https://anyfile-notepad.semaan.ca
X-ClientDetails: appVersion=5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F119.0.6045.159%20Safari%2F537.36&platform=Win32&userAgent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F119.0.6045.159%20Safari%2F537.36
accept-language: en-CA,en;q=0.9
Authorization: Bearer undefined
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Referer: https://content.googleapis.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.AOzoyjtjrhQ.O%2Fd%3D1%2Frs%3DAHpOoo9-fA1P7IZFa1fdRj158NoDqrnbYA%2Fm%3D__features__
X-Requested-With: XMLHttpRequest
X-JavaScript-User-Agent: google-api-javascript-client/1.1.0
X-Referer: https://anyfile-notepad.semaan.ca

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 228
x-xss-protection: 0
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 0024 6 KB
3 KB 35ms
34ms Document
text/html 172.253.62.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f132.1e100.net

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://anyfile-notepad.semaan.ca/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 28 Nov 2023 11:22:26 GMT
expires: Wed, 27 Nov 2024 11:22:26 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame C041 624 B
689 B 373ms
54ms Document
text/html 142.251.167.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNgBEMvUFxiI1tX9ATAB&v=APEucNVMBG13VpcExUP4V88vuFFEQ24_XOqEj2pFCQDgQVxbAXqhRXtcEy_1c8Dp8LSP69_gZX2hhpPqZemEI6lAZBHfYXFIYA

Requested by

Host: 05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com
URL: https://05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 28 Nov 2023 11:22:27 GMT
expires: Tue, 28 Nov 2023 11:22:27 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 0024 89 KB
31 KB 67ms
66ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com
URL: https://05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:27 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Tue, 28 Nov 2023 11:22:27 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0024 42 B
63 B 60ms
58ms Image
image/gif 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-C7sHL-b0WsbiogBtpSDSsu8PqiotPZgzQHXg86DUys-t4C5JFFHKFeCeJYyGG65XIWipQg7qAC2RomMGBuBHLQzOUP82Acsgp4rY_21JPLov_JuD4

Requested by

Host: 05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com
URL: https://05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0024 0
20 B 58ms
57ms Image
image/gif 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=15105796105926635769&x=1&ct=76

Requested by

Host: 05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com
URL: https://05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 0024 3 KB
1 KB 1237ms
63ms Script
text/javascript 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Host: 05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com
URL: https://05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 14:32:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74976
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Dec 2023 14:32:52 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 0024 20 KB
9 KB 1205ms
31ms Script
text/javascript 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com
URL: https://05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 14:32:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74975
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Dec 2023 14:32:53 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0024 195 KB
61 KB 35ms
34ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com
URL: https://05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

269ecd5384cff5988118c07b549ecf90eb9382d69477cae705ac84217405ee06

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 62503
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 28 Nov 2023 11:22:26 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0024 0
20 B 57ms
57ms Ping
image/gif 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=1382492328415&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0024 0
20 B 56ms
56ms Ping
image/gif 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=1382492328415&version=m202309260101&ct=76&x=1&cor=15105796105926636000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 0024 91 KB
38 KB 284ms
82ms Script
text/javascript 142.251.167.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BNwAbh81UdgYqo1zLPc5zgbWgZvpllk5h7lLNnlJ7Kx3A1FnsENlZmLb6n-l8AuWpy8iv5tkgzzcTCJpdH75vr6nMb-NTcWg4seJE5dDp0MxcgbkbuimTHAZpnAK8pp9MYPZ9JyyBEmCDmppYEueDhFIMFSAlf1ngrD9n0tO14bNgB8Iw&dbm_d=AKAmf-Cu-lbtzOfwrA_ZTsjzYx5Ie1DLYDV_WIz9rPRZWhLum64KU2MWCdkX1NYUoDTg7soglny-ooZfsgv4RQtMn90wVX9ZXns7UMQ_emmVwcwos2lgr6ygkyYbAUiRQc_Ic9NF-KBC1AXKb1q8EIf5Jup0fKN8jbJYH8IwHx9j2cRFBg7W41W8dHYEWk4QTQmW0SPPnGQW8UihMwloHQe2ofIe-QuC-kuMKHUYsc9YVIIql3hEVTqi1T5eR_kbH6R2prMdxPhWJxuoknllUnfYD3sD9op1ZKHugabBzkb-6YikOQu82M0B7GGld3panLyL2JRXkvIf1Hna7q9nXonwG9eyuEuDGTD-dqy1Leq6S6Z22pRwrEBZYlqU5RDqa93tXZljDBRdEKlWbBXW3IuwUWCBwgSLS0BQUVuI5idIFnFTw5VsGShWfGyUleDOcLtSQH8LprDFLB6vxtfascMHGYKccn6OB7x7JN_XHfoy_i72WzZvlJYWuEbzFy_TAjrWUU6qpPiYPNmmTIkCeLu6bIQBQamG29hv5HFQQ1QkZJPIDZ1niRF3EwLIC8wMQ2Oe5PTDJdvNzHA1UUxEj1rMtCrAN2NGTNKfWtfc6wjIRtMjBm4VVGAuHJRWbKuQ_mrWxvrvCqVBNqvuroEhgqrVfYVKzgVzfeZNKtgbr5mMMEjKO9JnggcdHTkWVdr_upKdFqnNKE_oDrUZQKWAqPPOJmwCYf6_N4O4y8k7CLpKXsVdWL3DTLTXdu9dVKmfztB8iH10Nvt9vUh0EHzyCC6PRF9ltKhLzmuC9I4JgaOC6IAIzyQQv_ykU7-2uxM8IWN3R3mwXFcFem8GBVWOynXpVB3f9u-wtEK51fJngcCopo143WEec4nHrfgO5LiikYxHFNbkzrKV46soFNGmD6As2EgIP2FFmQv9ee0G5g7i8TvsjxLzEHL-PAWIQqUyhossWUNevMxo2cT-DI7S3Qn4ZZvvsyDfK-80kT5_uQ365b0H2Y29B-uWnV0FV7Cz87RjjKX9qoWwopUcx-o0KuuRVbWAX_bMyhfUe8fZGK3_VqZQdIqcjdHgOEWDvpYNMmGRFHSq5VP13ozMj2Cbt-x5TDDtSbuqbFSRhO2u5luPG_bEsJpoZrJNixDeEgNYm9Zq-hxcQ0HqUFPHXh-Ipiee3ruwWwmsddmrbmnPrc-sqkWq6Nsg_Qgqqelfh4VDwi37IJfk7TVLKBZyn9NKQ66zYkTqUxwbs6wDl_9tdW-jUyN5D2hpx1JbslExOFEJ1McKtTuXB5rppnSpWoWI2Djvxel-M00yzLDwF78uhjq_f_oTIuyeoXTNi4Dceo7LZfLi-AxqluWOZBwYaZei3EFLF5O6VBQgqkhaE_FTEdAYrBovbJzuzn4L3gK32O7JLXaxsNvhKtmIWT4rCNMThCmuaA4FaVoTcBMI8JmCBfChdDzz7qJY_fx8ZVY2Fj1bh3ekaprPTjc3xP-xtXvDJ7UiQCfqHanr9cn2WZ-pc9dfspMgr69cIgtvMSDX9P1JnWK4aD9c3AHAC20Mt4ZJ6VgoBlabtX5LYtieV46pFIdfqlt2O5V-lLhw5gY-TMCz9D5JOT-pKlwqrfxiCyb3uPCGHYg16SUKxAP7DZDB676rN_7o71Oc-te7OCweijhG7VOJI29QXmyscGgn6VkZeQ5RoydU2ZoycNAz4Pfoq8-X8Df3owCyCq0VB6vSZoQRex6XQSVts1RH3V8D95ImtNjxCrWuTXOZ9BNGvwRorPPT_NFj6H4TBuC3OdNyiesGX2IZBOv4UYbTXW_vlEX5ojWgldrSoseJ3oGWDQWFERK5Xs3o22wQRvhL89iIGJOoQ-s9bAYDRXiPZcOVR6pwGTCIsUURWX0TX_FZ1zLv0E73UD62kW8jqTYnRTeWhOQf-YfP1iTNJJsjUQU3A5O1UtyBLr5UxlEGo1qm8DhyJCKbuUhbfRW3rGlN3x2Il-QWgumJyW-Aw3YvTjPkoAnNxs6PjlbOK3RDWwo4ozkGtybKVUGMtw5hFFTla73AzEGCdItRaDNKzTlhM0l4A6OyvD-gyy2tUiSIS2PrcNNrMs_l-iDoBz-rPcbbRkRS1C_MVDspyFS-MFgUwqmoooZfUtX_Bm9cWzr3We0bkSme9R2L7gXu6lpW8HVK8_-HT_54FzG7PtO--9nthm0yPfcvAYiDSN4j4fca6fL8unfFx9j8S6iJduQrYnLeG-K--fl3yMbCuDU5YmZ1Xn-hzGscZv2AmT7y8DaP-CFvOJ3-2Uh3gn1GVx91-oiLdSPfHGJ1s_5UPjzItt9jIUFW-F-8P_Gj2LGPsjPI6hymWd-CBqClM-_HWQNjXDD8WfZNoUcFf-XjyzelFY5C80dnwZktgADhx7yCPcMuwvObacloJoz2ZAGssw3yRP_CkjEkf3VIvWicbReCODfp-Z22oQaVfNP9MgltQkcsV8_W8sMt6YL9GlX4dLHW9XQIGbMQrAbz52NdyZZ-9TXIsgRVSmvhje4-qpPnBDQ2YRWefzeHx7y5B--tMCra6jTVFdMUIXRYfug0exoI_0pb4NJF6ICyqH1rVkFCTkKNICcN960dLsHb-IwF6ol-6KlOkIg8S6g3xcZM6g6yKSKJ8XmMMxhTVux_bW0TJ5bUsnXGvoeyI7hacfpDoCOLbjM0r_lMnf9SslsLFgxI22_nuhu-znqXqeC7c_6Uwril6Yn75upJMyoBrCE-Y5ckbbBBo_oDcXWA-obpqKCgoNds3IxbHgstbTMTVyBmucw2_naatdXyRz04kkPcoqk9C_u0TCS96_NE2-jXl03plgSz1V7pKnMyOU1j__N4bTXuojrSJ_tYOykfoUbpWwJXDsgrIvsIfqDPvWtQBmhZBevMvp5Wt-XsriO8rAI81kyW-biA0hEBs-UVh57wU4C6jR3tp6ROzkAj2W1OOa7CipSYO8CO0aLrwT_5fVGR4CtkFcOxG7beiD_x7a2fUpVVQ-CNgKshQy4mNNNlUA1tI-8182HJnCjqltIPzBikIiXSncLtK8w39_HQIsTYcA4vBDyhnKlLEUTnmMwo01OS5hLsBwv4y8Fns3KEYtvjP1DJj3FOgTPEfdgFANE7k1ewWVe2Th_-AHo-tGQOctmTTJZFRrq5qRLrYBQw_ySxZ0NvLevJG7j05x2G5kAleb-hI7jWvee-aUlhtMa2oQvupSFqYM6j1_DvVcNkXNKwApn1UEqqLRDYD0xk9tWrlXSOLqh4FWaktSv7KQKPrrT9HSiiAIUyDrdomzNoPZuVSz-24wNJqDuDwXvt8NR5bwKZiQMuR_UxGzOzwLfmYh7GoCrtCypsdrGGE0RNYlfTx2dYY18Sc1viPifmqgRlJnUtisOyv8hwCG_sklZa9_hzfnC0u7J65SZPfM3YBEaHL0Q48UuEySYlHGvDglRpfXIqNlMzPW6HEbz-Njq3AQ8Anq9TxmLACdMVCEV6I9he8UGaLJ6Kn0Mk0sBW34zMPxMsEyG1SHXVtu2HMhUKHYF3X0-69RerSHLCu1bstF0ULlSJrIo9aHi8Vjq7HnlWIC1fOaCK4Pj-sq3_fHOYgDSwJ3Wh&cid=CAQSTwDICaaNREInDCMW26deBFBc9FocBqdKQ3V3npWFtNxDpcL2W60GDt13cNBKjimW7bsCa8eZvEwxiEj3Ii5rxooHiqoMPAJ-741CpqwKNrUYAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2F&ds=l&xdt=1&iif=1&cor=15105796105926636000&adk=1964084972&idt=88&cac=0&dtd=24

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

cafe /

Resource Hash

09c3b9e2d31bc8ac2d7157bb3bb9e03c64bfe03d550dcfa461dd3c316b675367

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:27 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38772
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 vidice.js Show response
resources.infolinks.com/js/vidice/2.0/ 333 KB
86 KB 31ms
31ms Script
application/javascript 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.infolinks.com/js/vidice/2.0/vidice.js
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1895.006-3.034/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b2bdac211f43fbee9eeb4d50f8755206599f76296cd15316a97c9d2cb2050d2f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:27 GMT
via: 1.1 google
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 20 Mar 2023 11:31:12 GMT
server: cloudflare
age: 2370
etag: W/"5344d-5f75343a1bcf7"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=2592000
cf-ray: 82d23bb04c307157-YUL
expires: Thu, 28 Dec 2023 10:42:57 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame C041
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEK3ZIgaIkWQ1abG1zrV7Wb8&google_cver=1

43 B
734 B

39ms
39ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEK3ZIgaIkWQ1abG1zrV7Wb8&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNgBEMvUFxiI1tX9ATAB&v=APEucNVMBG13VpcExUP4V88vuFFEQ24_XOqEj2pFCQDgQVxbAXqhRXtcEy_1c8Dp8LSP69_gZX2hhpPqZemEI6lAZBHfYXFIYA
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:27 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wL7T%2BG3oB2YIP3le7QsXh%2FkrKfri9cKTHGvtHtDX6neQ%2FTXQFFtgTPQU%2F8Dx7Ii3KsqpXuwahqtCx1DzWgNoOczc4eLdNyxU15J4eTNjN9uN5xyqZlS3vRYwKzYfe9wcRwlG4ekqrvWRaw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 82d23bb159c56e02-YUL
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:27 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEK3ZIgaIkWQ1abG1zrV7Wb8&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame C041
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZWXNchYK0kJrlgySALH81QAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEK3ZIgaIkWQ1abG1zrV7Wb8&google_cver=1

43 B
735 B

62ms
62ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEK3ZIgaIkWQ1abG1zrV7Wb8&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNgBEMvUFxiI1tX9ATAB&v=APEucNVMBG13VpcExUP4V88vuFFEQ24_XOqEj2pFCQDgQVxbAXqhRXtcEy_1c8Dp8LSP69_gZX2hhpPqZemEI6lAZBHfYXFIYA
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:27 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PxQrlMAKJPpoc7IQo06i3X44xIf3nPkKHrKnoyaSyjIpAh%2BDOVnJvrtwETCkved1Lon%2BS%2Ff6zYCuMVJrQBQ3H1sFX%2FIRzC8MDo2GeCQ%2BxKXuyyvb1ax6jsSA7za5uOd6ehGOWImD2PKJYw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 82d23bb19a346e02-YUL
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:27 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEK3ZIgaIkWQ1abG1zrV7Wb8&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame C041
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEFFo8TQOCmsLPdrnZnzyHFE&google_cver=1

43 B
843 B

29ms
29ms

Image
image/gif

68.67.161.182
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEFFo8TQOCmsLPdrnZnzyHFE&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNgBEMvUFxiI1tX9ATAB&v=APEucNVMBG13VpcExUP4V88vuFFEQ24_XOqEj2pFCQDgQVxbAXqhRXtcEy_1c8Dp8LSP69_gZX2hhpPqZemEI6lAZBHfYXFIYA

Protocol

Server

68.67.161.182 Brooklyn, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:27 GMT
an-x-request-uuid: e871c4c1-c547-4a03-b9bb-86b232979819
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 185.193.64.134; 185.193.64.134; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:27 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEFFo8TQOCmsLPdrnZnzyHFE&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C041
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjQ1Mjg2NzE5MDU1ODAzNzQwMw%3D%3D

170 B
188 B

43ms
43ms

Image
image/png

172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjQ1Mjg2NzE5MDU1ODAzNzQwMw%3D%3D

Requested by

Protocol

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:27 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:27 GMT
an-x-request-uuid: 0ebe0b5d-d624-4f31-8bcc-edf2d31a1fc2
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NjQ1Mjg2NzE5MDU1ODAzNzQwMw%3D%3D
x-proxy-origin: 185.193.64.134; 185.193.64.134; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 adview.htm Show response
rt3043.infolinks.com/action/ 0
166 B 109ms
108ms XHR
text/html 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rt3043.infolinks.com/action/adview.htm?rid=e618bdc4-7bca-4ade-aae1-9efce4df9aaa&bdc=1&midx=0&emd=OTMzfjM5NDFfNzg4Mjc4MTV-Nzg4Mjc4MTU&rts=1701170547367&prod_t=d&jsv=1895.006-3.034&skin=sidebar&theme=nologo&sdata=article&scs=H_Pz7jRyVW&rsd=-dnsMAZrcPpZDC7ne_UdykbmDAdgXvqIhNo6isEqBu3BEumbhwlDl2oKnz1qbcIdZQPpKQtCnxf8v5oo8qHcsARE6jX_c5cLxXYZnaZEA728AM9OLtD7xlm8IlLsW-o6dwQp-IZ0smHIKSdurvLhIO6FMm1kHe7e&rsk=3&rcs=yxefAL30w2z3jU_UJktyow
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1895.006-3.034/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:27 GMT
cf-cache-status: DYNAMIC
server: cloudflare
vary: Origin
content-type: text/html;charset=UTF-8
access-control-allow-origin: https://anyfile-notepad.semaan.ca
p3p: CP="NON DSP NID OUR COR"
cache-control: no-cache,no-store
access-control-allow-credentials: true
cf-ray: 82d23bb118e56e0a-YUL
content-length: 0
x-application-context: application:prod
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 ab Show response
lax1-ib.adnxs.com/ Frame A139 19 KB
9 KB 288ms
97ms Script
application/javascript 104.254.151.36
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://lax1-ib.adnxs.com/ab?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QKxN_BMsRsAAAMA1gAFAQjymperBhCGjZPxqbanwjkYm6vwn9aQzMZZKjYJiGh0B7HTI0AR2liJeVbaIEAZAAAAIFyvQEAh2liJeVbaIEApiGgJJAQxAAUBsAhAMLGtxgg4sxlA5R5IZVCnosslWLrgfGAAaMmwRHjOggaAAQGKAQNVU0SSAQEG9IICmAHYBaABWqgBAbABALgBAsABBcgBAtABCdgBAOABAPABALICJGI1MDNiMDMwLTAwODgtNDM5Ni05MjlhLTkwZjI1MjlmOGJjNdgCpEPgAur5JeoCGWFueWZpbGUtbm90ZXBhZC5zZW1hYW4uY2HyAgwKBkhFSUdIVBICOTDyAgwKBVdJRFRIEgM3MjjyAiEKBkxPQURFUhIXcmVuZGVyX3Bvc3RfYWRzX3YxLmh0bWzyAhgKCklGUkFNRV9LRVkSCjE3NDM2OTMwMjXyAsgVCgtQUkVfU0NSSVBUUxK4FTxzY3JpcHQ-KGZ1bmN0aW9uKCl7LyoKCiBDb3B5cmlnaHQgVGhlIENsb3N1cmUgTGlicmFyeSBBdXRob3JzLgogU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjAKKi8KdmFyIGs9dGhpc3x8c2VsZjt2YXIgbD1BcnJheS5wcm90b3R5cGUuaW5kZXhPZj9mdW5jdGlvbihhLGMpe3JldHVybiBBcnJheS5wcm90b3R5cGUuaW5kZXhPZi5jYWxsKGEsYyx2b2lkIDApfTpmdW5jdGlvbihhLGMpe2lmKCJzdHJpbmciPT09dHlwZW9mIGEpcmV0dXJuInN0cmluZyIhPT10eXBlb2YgY3x8MSE9Yy5sZW5ndGg_LTE6YS5pbmRleE9mKGMsMCk7Zm9yKHZhciBlPTA7ZTxhLmxlbmd0aDtlKyspaWYoZSBpbiBhJiZhW2VdPT09YylyZXR1cm4gZTtyZXR1cm4tMX07ZnVuY3Rpb24gbShhKXttWyIgIl0oYSk7cmV0dXJuIGF9bVsiICJdPWZ1bmN0aSWVBH07MRR8IG4oYSl7YT12b2lkIDA9PT1hP2RvY3VtZW50OmE7cmUJQyQuY3JlYXRlRWxlARkYKCJpbWciKR1FSHAoYSxjLGUpe3ZhciBiPSExO2IZUoBiPyExOmI7YS5nb29nbGVfaW1hZ2VfcmVxdWVzdHN8fChaGgAQPVtdKTsBURRkPW4oYS4RlxApO2lmKA1rBGY9EcgIKCl7GRcEZz1aUwBALGg9bChnLGQpOzA8PWgmJkE6MgIkc3BsaWNlLmNhbAEnbGgsMSl9ZC5yZW1vdmVFdmVudExpc3RlbmVyJiZSFwA0KCJsb2FkIixmLCExKTtSIwBiOgAQZXJyb3INOxh9O2QuYWRkQnMAPhQAPnAAPiAAAW0-FAAAKDZqAFhiJiYoZC5hdHRyaWJ1dGlvblNyYz0iIgG-EHNyYz1jXrcBJC5wdXNoKGQpfQpZSwRxKEkBBGE9Maw0LmN1cnJlbnRTY3JpcHRNTwAoMm4CMG51bGw6YSkmJiI3NyJBgBAuZ2V0QQ2QOGUoImRhdGEtamMiKT9hOhVXPHF1ZXJ5U2VsZWN0b3IoJ1sNJQA9AUQMXScpfUU38ElyPVJlZ0V4cCgiXmh0dHBzPzovLyhcXHd8LSkrXFwuY2RuXFwuYW1wcHJvamVjdFxcLihuZXR8b3JnKShcXD98L3wkKSIpOwpmdYkABCB0FeAAawVhDGM9W10FCQRlPQHGDDtkb3tBrxhiPWE7dHJ5BQwAZEGtGGQ9ISFiJiYBJBwhPWIubG9jYSFqIC5ocmVmKWI6ewEtkG0oYi5mb28pO2Q9ITA7YnJlYWsgYn1jYXRjaChoKXt9ZD0hMX0BXghmPWQZFwBmARYMaWYoZil5AGc-XgAMO2U9YnU5BCYmGQwoLnJlZmVycmVyfHwBlyR9ZWxzZSBnPWUsDcsAYyngMG5ldyB1KGd8fCIiKSkF1RRhPWIucGEh1BmGAGEF_3h9fXdoaWxlKGEmJmIhPWEpO2I9MDtmb3IoYT1jLmxlgdZ0LTE7Yjw9YTsrK2IpY1tiXS5kZXB0aD1hLWI7Yj1rISs5HgGuNSo4YW5jZXN0b3JPcmlnaW5zbhwADWsAPR11ACkJhgwxO2E8EYpMOysrYSlnPWNbYV0sZy51cmx8fCgFCC5CATp2ABRbYS0KMV0hDBgsZy5oPSEwAeMpIgBrGash1WX_AGclFiUCBGU9MgQBIDA8PWU7LS1lKSG6RD1jW2VdLCFnJiZyLnRlc3QoZgGPICkmJihnPWYpLAUOLCYmIWYuaCl7Yj1mO0UbAH0NXQBlFeYEJiYBzAE7BDswQWUlWggmJmUFSAEbCCk7YwWtFHYoYixnKW2LGCBjLmc_Yy4F-gw6Yy5pAUAAfbFTBCB2odYcKXt0aGlzLmlB1QEJCGc9YxkiAHUdIgh1cmwRJBRoPSEhYzsFLwWIJQrdLwB3dUkgdCgpLGM9YS5p6X5AKCI_Iik7c2V0VGltZW91dCgRjA0xAGXZVhhlPy4wMTplQTVEIShNYXRoLnJhbmRvbSgpPmUpaQ8MYj1xKCGkACJl_zQ6Ly8iKyhiJiYidHJ1ZYFrAGJWawQ4LXJjZCIpPyJwYWdlYWQyzbcQc3luZGlpuSAtY24uY29tIjpmIwAFIAwpKyIvCUV4L2dlbl8yMDQ_aWQ9amNhJmpjPTc3JnZlcnNpb249IoVFDGQ9KGQBsQApobZSBAUALQ0xMCIpfHwidW5rbm93biJh41wrZCsiJnNhbXBsZT0iK2U7Yj13aW5kb3cFWABmOTQAZuGKAGYhMzRkPWIubmF2aWdhdG9yKTIOAFAudXNlckFnZW50LGQ9L0Nocm9tZS9JmyBkKSYmIS9FZGcZERw_ITA6ITE7ZGGTFVEwLnNlbmRCZWFjb24_Ch1pHRgkKGUpOnAoYixlLCJ6CAmeECl9fSwwVaAsMDw9Yz9hLnN1YnN0DloJHCgwLGMpOmF9CeAMLnJmbC4CCBqvCGhlbmNvZGVVUklDb21wb25lbnQodygpKX07fSnp20GaFCk7Cjwvc8WYbD7yAt4CCgpFWFRSQV9UQUdTEs8CPGRpdiBzdHkhUgxwb3NpobFkOiBhYnNvbHV0ZTsgbGVmdDogMHB4OyB0b3ANCmR2aXNpYmlsaXR5OiBoaWRkZW47Ij48aW1nIOFMVYdJFEpZAkE2DR4uMgIUYXdiaWQmBQbwn19iPUFLQW1mLUJSTUZuaEVFeDBRdjdsLXl3X3VBVGZVZmtydFhiaVU3d2pvUUdWWjcxZDktV0pJY0hzMng1enYtUHR0UXN0YUFxakszSDZsYmdqZENicXlTN2ZLRXlleUQ0TTRXdENfdUhJNFJPRlZ0VjFxeG9pdlJjIiBib3JkZXI9MCB3aWR0aD0xIGhlaWdodD0xIGFsdD0iIiBzdHkhL6BkaXNwbGF5Om5vbmUiPjwvZGl2PvICmgEKDFBPU1RfU0NSSVBUUxKJARovDDYdARYlClBhZHMuZy5kb3VibGVjbGljay5uZXQxGzx4YmZlX2JhY2tmaWxsLmpzAWUtyg1TLoIMJCB7cjNweCgnMTceuwwcJyk7fSkoKTtdABCaFgoQSAGeNFBPUlRfUEFSQU1TEoUWkTmKlQDgYWRmZXRjaD9hZGs9MTg1MDAxMjI3MCZhZHNhZmU9bWVkaXVtJmNsaWVudD1jYS1wdWItMzA3Njg5ASpkNzQxNDY3JmZvcm1hdD03Mjh4OTBfYXMmaXABTLAuMTkzLjY0LjEzNCZvdXRwdXQ9aHRtbCZwc2Q9VzEwJTNEJnVudmlld2VkX3BNrCBfc3RhcnQ9MSall14iDhAmc3ViXw2VAGJBsfB9ci00NzEwMTI0JmhsPWVuJmFjZWlkPU1La0RId0NNaHpRQm9JODBBWFNSTkFHUmt6UUJDNVEwQVZHVU5BRlNsVFFCajVVMEFiQ1ZOQUVJbGpRQktKWTBBWENXTkFGMGxqUUJkcFkwQVh5V05BR09salFCa1pZMEFhQ1dOQUdvARAscTVZMEFhMldOQUhEARAANAEQBGVXARAAbQEQADYBEBxmaVdOQUVCbAGAKHBjMEFUQ1hOQUU1ARAsUUpjMEFVR1hOQUZIARAAVQEQBFZPARAAZgEQAFkBEPRTCVd5WE5BRzNiRUVCUzNOQkFVMXpRUUZhUE5vQl9mY2VBamItaUFMQV9vZ0M0VG1xQWlkQ3FnSTdXcW9DbEdxcUF2NTRxZ0pVa2FvQ1c1R3FBb0NicWdLQm02b0NncHVxQXBxb3FnS2lxS29DTTd1cUFvYk5xZ0pDLUtvQ1FmdXFBclFGcXdLRUo2c0NWQ2lyQXZzcnF3TFVOcXNDSlRxckFpazZxd0l0T3FzQ2IwZXJBbXhLcXdKZ1Rxc0N1RTZyQWlCUXF3TDBVS3NDQWxHckFncFJxd0xzVjZzQ0lGeXJBamRjcXdJYWFhc0M0R3FyQWh0eHF3THhjYXNDZ0hPckFzeDBxd0lZZDZzQ0hIZXJBaUozcXdJbmQ2c0NMSGVyQWdwNXF3TFllcXNDVTRDckFwR0Jxd0tjZ2FzQ2NvZXJBdTJKcXdLZ2lxc0M3SXFyQW1pTHF3TElpNnNDOVl1ckFnQ01xd0t4aktzQ3M0eXJBcmlNcXdJdmphc0NBcENyQWxlU3F3TFJrNnNDNFpPckFsZVdxd0pjbDZzQzdwaXJBbWlkcXdMVW9hc0MtNkdyQWhDanF3THdvNnNDWktTckFrR2xxd0prcGFzQzQ2V3JBcFNtcXdJQXFhc0NMNm1yQW91cXF3TEFxNnNDeXF1ckF0dXJxd0lWcktzQ1dhMnJBck90cXdJbHJxc0NRcTZyQW91dXF3TGZycXNDTzYtckF0U3Zxd0xxcjZzQ1U3R3JBcXV4cXdMSHNhc0NZcktyQXFpenF3SVd0S3NDR3JTckFpRzBxd0lsdEtzQ0tiU3JBZ3UxcXdLaHRhc0NKcmFyQWplMnF3THJ0cXNDaExlckFnZTRxd0k2dUtzQ2pyaXJBdHE0cXdMdnVLc0NDN21yQWpxNXF3TDV1YXNDUDdxckFsRzZxd0lKdTZzQ01idXJBank3cXdKOXU2c0N4THlyQW9IdEJRUEFkU1FFMDNna0JKRmQ5d1N3WGZjRXd0aWhEdmVSLXhMVzRmc1NJZXo3RWl3T19CSmxEdndTcmhQOEVqNFZfQktiRmZ3UzdCWDhFdkFYX0JJdkdQd1NaQmo4RW5rWV9CSWpHZndTU2hyOEV1a2JfQkxUSFB3UzZoejhFZzhlX0JKYm4tb1VJY2dNRllhOF95TSZleGs9MTc0MzY5MzAyNSZhd2JpZF9jPUFLQW1mLUNSYjNQc3ljYVcydFNWMDFnS0EwQUYwdXA1WWJHVDRUbV9odkNXT3gwNGw1d0VuWXd1c1o1ZXF3emw4bnZiTVcxaGtCSnQtZUJmZ3JKZllYSnhGVTZvVXBZeU81Um5ha05UZG83bmtCaVNRTXlmY2libUJ5YU9RR2VVYjVzeWpvWnFaTlBDaFVPMWFlRWJjUUxEendDNGlaNEhKR2tQWUplMWp6dzVfdkM2WHlkR2J5SSZhd2JpZF9kPUFLQW1mLUNiR3BySVd2UTJkMkcxNENHTjBjanlvX3ZFN1hBOHRXalJ0QUtmTUwwV2tYRW1vcXFzNlI1cmFKTW5BNU0zUmJWTFpFRUhfN3NLNndzYkZjT3YwNjhoMDhMcnBfbkp3LVd4dUR6NVlSdGlZS09ySGFsOGVtUzh6NGQ4N0JCRG5ZQzljSUM2eE8wSHlXeXpWRXJldlNiZVFYR0FvRHdTankzeTBMYlFyd1lzV2s2NUQzLTFjQkhSYUY4Zk0tc1VaTmE2VkktanpyUGRNeFJFNWtOWGhBTnJJZ1A2TFFQVmF4ZVNBSmE2VjhDbXJNbWNUMmZCek84SjhEQTdjdEhMOHViN0hXNzhNdWhNTHduUEVnSDAzYUpKaFg5MEtaTTU5U3ctc0F4NlhwbnRsUzNrX2lOOHF4WWh3Zy1yMmpKRG1wSmt2aV9oZlg1MVpUSlVGUG13YVFibi1XU1hKQ1ltT2ZIejk5VFZWWHBBRkFiZGhqZDd4NFl3TC1PSDJJU3ZLUWt1Q0VCV0ttSVhGamE1TVQ4cWtKSjRXM3ZOUnVwNmNiTmZ2aTF2cGFwYmlUbDViOXV0T0VVUS1xV29nZEl6UFJiTEhtQ1pxOEdXMkRhMU1KYjNaWXhlUzA4a254TTJqMTNtLXJUVE5RTjlpeDhsSzgzY0dqVzNma3Z5bURoMDNqOTFkSHJ2VFdFdUVlVVpaQl9udkUwX0lYelh3M2hXeDJSY1F2ODNGWnAwM2NDcmdXV05BcmFKMDNtMld3RTdjRkUtU3B1by1scU1QM2RabUdxMEpSRnptam1FUlN4ai1SZ056RmZUVmVRaTZHeVV5RlFEWWo3TnBQNGlNOVIxYWxxNHNxMmNqRW5tdFpIVldTa2dRdVI0OG5zVmJvbVpMdnVpOWlfYTVRaUdBMDJvU2tLSWpMSjdTeUIxdXNBRUxMeTdFTmJCbjIwbjhJXzU0RGFGT2lEQzRzNFlhYVBCYnJpWU1XUWNudmgwSENlSUg3OGxGRXhFUXQ5bG51RVFMZUJpcWp1V0FHQnhPN1Y1V1hpMHpFZUZjcnJEMkxobXlzWElGNm5HT0hWNGVyc3dvd3FzdFdUc0FjcjJEdVBpc0MzQ1lFRmhIbmNrZGNqZHE4ZlU0SC04cXZHeUUySFlrQUV2a3VHMFdKNVBjT3RKaTJsMXpiLUFULS1sMl9KLWlGa0xRbW9qY080OWNMWWtIN2pYRnFISnRROEtHUnNmeFBfRUpZS3ZKVVBsYlFCN3ZwelJaVm9laDVDT2h4bnM5ajhVRVh3aFdUTmZxUkxHdmJnVDNGbEZPZ3Q2N3YyNHRWdW85aGtOOURpeHdIbDFlQ29aSzZZZGFjdnNtZUtEbGc5MlFnU0pfUWtXMHh2ajZYR0p1ekk3RXQ5ZTF6WGQ4OWhqSENTZ1dpcmpDOEQxUVdYYnQ3SjBFX1h0bGp4UjNqMXJELWVWb1pWakV0VFNtOWVPRHpMUjBlN2lYZ3Zjem9xVDBDOUU4UEdUSDRVcjJnTnhVd2FwLVdXSjlqZDJhaGk5SHVlV2I5NzJYdm5zXzRRdXdXSW8zckhkQWtWcXR0bG8wcjBmc09TZlQ4MjNMdmcmY2lkPUNBUVNHd0RJQ2FhTlE3M3F4b0ZJS2MzTnBVcVZFXy1IWU9jQXhaSDJ6aGdCJmFfY2lkPYADAIgDAZADAJgDFKADAaoD_AEK1AFodHRwczovL3BhZ2VhZDIuZxLdFSomD6rNDPDXQ09KbGlOcHZTQS1jSGUtanRKYnQ3RkFZcnZ2MGN1VUpGallBUjJjUUtsNDBkQUgyZGFKeWxNcHdVQjNMMXkzak9FY1R1VjNjZm9TeXVmNExEQWZwcVh5dXhLOHR2RGVFRGxBejgzX3ljY1B5LV9adVEmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoTNDE0NDYxMDk0NzU3MDY0ODcxMCIINzg4Mjc4MTUqBDM5NDHAA9gEyAMA2AMA4AMA6AMA-AMDgAQAkgQJL29wZW5ydGIymAQAogQOMTg1KrkL8G2oBACyBAwIABAAGAAgADAAOAC4BADABADIBADaBAIIAeAEAPAEp6LLJYgFAZgFAKAFvur-9_D58d0oqgUqZTYxOGJkYzQtN2JjYS00YWRlLWFhZTEtOWVmY2U0ZGY5YWFhfjkzM34xwAUAyQUAAA6eGhTwP9IFCQkBCgEBNNgFAeAFAfAF2vgw-gUEAYgokAYAmAYAuAYAwQYBITQAAPA_0AbujwHaBhYKEAkSGQEBt6DgBgHyBgIIAIAHAYgHAKAHAaoHDDEyMjkyMjIzMTc0N8gHzoIG0gcNCRE3ATUI2gcGAW2wGADgBwDqBwIIAPAHkoAIiggCEACVCAAAgD-YCAHACKRD0ggJCPP__z8QABgA&s=14107629a934f866e350bc16bbbb25426a9e3df9&pp=8.426441

Requested by

Host: blank
URL: about:blank

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.151.36 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

ac5724fc6e1ff88502066347c75ce184408d892f48ebc17e506aa269c2b11b11

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:27 GMT
content-encoding: gzip
x-creative-id: 78827815
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
x-proxy-origin: 185.193.64.134; 185.193.64.134; 897.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
x-xss-protection: 0
pragma: no-cache
an-x-request-uuid: 1cd03c32-26d4-43f0-b1fa-f53764bf70b5
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 0024 111 KB
39 KB 97ms
32ms Script
text/javascript 172.253.63.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com/
Origin: https://05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 15:15:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 72401
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 28 Nov 2023 15:15:46 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/ Frame 0024 11 KB
4 KB 34ms
34ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BNwAbh81UdgYqo1zLPc5zgbWgZvpllk5h7lLNnlJ7Kx3A1FnsENlZmLb6n-l8AuWpy8iv5tkgzzcTCJpdH75vr6nMb-NTcWg4seJE5dDp0MxcgbkbuimTHAZpnAK8pp9MYPZ9JyyBEmCDmppYEueDhFIMFSAlf1ngrD9n0tO14bNgB8Iw&dbm_d=AKAmf-Cu-lbtzOfwrA_ZTsjzYx5Ie1DLYDV_WIz9rPRZWhLum64KU2MWCdkX1NYUoDTg7soglny-ooZfsgv4RQtMn90wVX9ZXns7UMQ_emmVwcwos2lgr6ygkyYbAUiRQc_Ic9NF-KBC1AXKb1q8EIf5Jup0fKN8jbJYH8IwHx9j2cRFBg7W41W8dHYEWk4QTQmW0SPPnGQW8UihMwloHQe2ofIe-QuC-kuMKHUYsc9YVIIql3hEVTqi1T5eR_kbH6R2prMdxPhWJxuoknllUnfYD3sD9op1ZKHugabBzkb-6YikOQu82M0B7GGld3panLyL2JRXkvIf1Hna7q9nXonwG9eyuEuDGTD-dqy1Leq6S6Z22pRwrEBZYlqU5RDqa93tXZljDBRdEKlWbBXW3IuwUWCBwgSLS0BQUVuI5idIFnFTw5VsGShWfGyUleDOcLtSQH8LprDFLB6vxtfascMHGYKccn6OB7x7JN_XHfoy_i72WzZvlJYWuEbzFy_TAjrWUU6qpPiYPNmmTIkCeLu6bIQBQamG29hv5HFQQ1QkZJPIDZ1niRF3EwLIC8wMQ2Oe5PTDJdvNzHA1UUxEj1rMtCrAN2NGTNKfWtfc6wjIRtMjBm4VVGAuHJRWbKuQ_mrWxvrvCqVBNqvuroEhgqrVfYVKzgVzfeZNKtgbr5mMMEjKO9JnggcdHTkWVdr_upKdFqnNKE_oDrUZQKWAqPPOJmwCYf6_N4O4y8k7CLpKXsVdWL3DTLTXdu9dVKmfztB8iH10Nvt9vUh0EHzyCC6PRF9ltKhLzmuC9I4JgaOC6IAIzyQQv_ykU7-2uxM8IWN3R3mwXFcFem8GBVWOynXpVB3f9u-wtEK51fJngcCopo143WEec4nHrfgO5LiikYxHFNbkzrKV46soFNGmD6As2EgIP2FFmQv9ee0G5g7i8TvsjxLzEHL-PAWIQqUyhossWUNevMxo2cT-DI7S3Qn4ZZvvsyDfK-80kT5_uQ365b0H2Y29B-uWnV0FV7Cz87RjjKX9qoWwopUcx-o0KuuRVbWAX_bMyhfUe8fZGK3_VqZQdIqcjdHgOEWDvpYNMmGRFHSq5VP13ozMj2Cbt-x5TDDtSbuqbFSRhO2u5luPG_bEsJpoZrJNixDeEgNYm9Zq-hxcQ0HqUFPHXh-Ipiee3ruwWwmsddmrbmnPrc-sqkWq6Nsg_Qgqqelfh4VDwi37IJfk7TVLKBZyn9NKQ66zYkTqUxwbs6wDl_9tdW-jUyN5D2hpx1JbslExOFEJ1McKtTuXB5rppnSpWoWI2Djvxel-M00yzLDwF78uhjq_f_oTIuyeoXTNi4Dceo7LZfLi-AxqluWOZBwYaZei3EFLF5O6VBQgqkhaE_FTEdAYrBovbJzuzn4L3gK32O7JLXaxsNvhKtmIWT4rCNMThCmuaA4FaVoTcBMI8JmCBfChdDzz7qJY_fx8ZVY2Fj1bh3ekaprPTjc3xP-xtXvDJ7UiQCfqHanr9cn2WZ-pc9dfspMgr69cIgtvMSDX9P1JnWK4aD9c3AHAC20Mt4ZJ6VgoBlabtX5LYtieV46pFIdfqlt2O5V-lLhw5gY-TMCz9D5JOT-pKlwqrfxiCyb3uPCGHYg16SUKxAP7DZDB676rN_7o71Oc-te7OCweijhG7VOJI29QXmyscGgn6VkZeQ5RoydU2ZoycNAz4Pfoq8-X8Df3owCyCq0VB6vSZoQRex6XQSVts1RH3V8D95ImtNjxCrWuTXOZ9BNGvwRorPPT_NFj6H4TBuC3OdNyiesGX2IZBOv4UYbTXW_vlEX5ojWgldrSoseJ3oGWDQWFERK5Xs3o22wQRvhL89iIGJOoQ-s9bAYDRXiPZcOVR6pwGTCIsUURWX0TX_FZ1zLv0E73UD62kW8jqTYnRTeWhOQf-YfP1iTNJJsjUQU3A5O1UtyBLr5UxlEGo1qm8DhyJCKbuUhbfRW3rGlN3x2Il-QWgumJyW-Aw3YvTjPkoAnNxs6PjlbOK3RDWwo4ozkGtybKVUGMtw5hFFTla73AzEGCdItRaDNKzTlhM0l4A6OyvD-gyy2tUiSIS2PrcNNrMs_l-iDoBz-rPcbbRkRS1C_MVDspyFS-MFgUwqmoooZfUtX_Bm9cWzr3We0bkSme9R2L7gXu6lpW8HVK8_-HT_54FzG7PtO--9nthm0yPfcvAYiDSN4j4fca6fL8unfFx9j8S6iJduQrYnLeG-K--fl3yMbCuDU5YmZ1Xn-hzGscZv2AmT7y8DaP-CFvOJ3-2Uh3gn1GVx91-oiLdSPfHGJ1s_5UPjzItt9jIUFW-F-8P_Gj2LGPsjPI6hymWd-CBqClM-_HWQNjXDD8WfZNoUcFf-XjyzelFY5C80dnwZktgADhx7yCPcMuwvObacloJoz2ZAGssw3yRP_CkjEkf3VIvWicbReCODfp-Z22oQaVfNP9MgltQkcsV8_W8sMt6YL9GlX4dLHW9XQIGbMQrAbz52NdyZZ-9TXIsgRVSmvhje4-qpPnBDQ2YRWefzeHx7y5B--tMCra6jTVFdMUIXRYfug0exoI_0pb4NJF6ICyqH1rVkFCTkKNICcN960dLsHb-IwF6ol-6KlOkIg8S6g3xcZM6g6yKSKJ8XmMMxhTVux_bW0TJ5bUsnXGvoeyI7hacfpDoCOLbjM0r_lMnf9SslsLFgxI22_nuhu-znqXqeC7c_6Uwril6Yn75upJMyoBrCE-Y5ckbbBBo_oDcXWA-obpqKCgoNds3IxbHgstbTMTVyBmucw2_naatdXyRz04kkPcoqk9C_u0TCS96_NE2-jXl03plgSz1V7pKnMyOU1j__N4bTXuojrSJ_tYOykfoUbpWwJXDsgrIvsIfqDPvWtQBmhZBevMvp5Wt-XsriO8rAI81kyW-biA0hEBs-UVh57wU4C6jR3tp6ROzkAj2W1OOa7CipSYO8CO0aLrwT_5fVGR4CtkFcOxG7beiD_x7a2fUpVVQ-CNgKshQy4mNNNlUA1tI-8182HJnCjqltIPzBikIiXSncLtK8w39_HQIsTYcA4vBDyhnKlLEUTnmMwo01OS5hLsBwv4y8Fns3KEYtvjP1DJj3FOgTPEfdgFANE7k1ewWVe2Th_-AHo-tGQOctmTTJZFRrq5qRLrYBQw_ySxZ0NvLevJG7j05x2G5kAleb-hI7jWvee-aUlhtMa2oQvupSFqYM6j1_DvVcNkXNKwApn1UEqqLRDYD0xk9tWrlXSOLqh4FWaktSv7KQKPrrT9HSiiAIUyDrdomzNoPZuVSz-24wNJqDuDwXvt8NR5bwKZiQMuR_UxGzOzwLfmYh7GoCrtCypsdrGGE0RNYlfTx2dYY18Sc1viPifmqgRlJnUtisOyv8hwCG_sklZa9_hzfnC0u7J65SZPfM3YBEaHL0Q48UuEySYlHGvDglRpfXIqNlMzPW6HEbz-Njq3AQ8Anq9TxmLACdMVCEV6I9he8UGaLJ6Kn0Mk0sBW34zMPxMsEyG1SHXVtu2HMhUKHYF3X0-69RerSHLCu1bstF0ULlSJrIo9aHi8Vjq7HnlWIC1fOaCK4Pj-sq3_fHOYgDSwJ3Wh&cid=CAQSTwDICaaNREInDCMW26deBFBc9FocBqdKQ3V3npWFtNxDpcL2W60GDt13cNBKjimW7bsCa8eZvEwxiEj3Ii5rxooHiqoMPAJ-741CpqwKNrUYAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Fanyfile-notepad.semaan.ca%2F&ds=l&xdt=1&iif=1&cor=15105796105926636000&adk=1964084972&idt=88&cac=0&dtd=24

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47a0342d90a877ec7125c3a38706b2faefa9b867661ebcef4a98ec6cf3e60b40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 22:22:55 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46772
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 17947678125179771625
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Dec 2023 22:22:55 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/ Frame 0024 31 KB
12 KB 32ms
32ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

610d24f5996131b3ab98f18e05441cc246aa8674c3842df0df2b40b57ac9fd0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 02:54:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 30461
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11874
x-xss-protection: 0
server: cafe
etag: 3876053170955424897
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 02:54:46 GMT

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 0024 41 KB
14 KB 792ms
52ms Script
text/javascript 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 06:04:23 GMT
content-encoding: br
x-content-type-options: nosniff
age: 278285
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Nov 2024 06:04:23 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/6452581308981405529/ Frame 6907 10 KB
4 KB 97ms
32ms Document
text/html 172.253.63.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/6452581308981405529/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4ff1f54df617f52d8fdfcf1d1422654edaefd941a39a24063e72b5e3e9d6184e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 398872
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 3928
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Thu, 23 Nov 2023 20:34:35 GMT
expires: Fri, 22 Nov 2024 20:34:35 GMT
last-modified: Wed, 08 Nov 2023 19:30:40 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 0024 0
0 68ms
66ms Fetch
image/gif 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuiNMPNh_qqX6dXgEmXJJGzz4GYNFwGniFea74X8qs_KPbaUonHbwDxvuIMNGGDN4fPwAThXXTK5WQohMMubuML4vhVMrlIeQ0BJHN12gpiMhBsTWsLVXqGE45tlL60rjJw4pq8B3EYRXNnq-F3yQb7JhM1s5mI51lZspQmtdPl8tWwx8brEIDGuIYvWISXW48MfjEnd7kMQNfTDvDzQiuHZWqfmotbuQZBITmWlVOeHLnpYOitHVRGshmGidgw-4I7UnaTwCgrgG4fPIJ7YRNgZYlrwcqcBx3C_VeKmfPuYZrh48f-M-dbKPkHWD7YfQmhmnO8d53hd99KERc8bTtxHE_zsl4oVAhU8p-Uh5F9wYTGUK7v-EOLVM2WqX5oEy_UfBQZjh31-d4YidiwRM9D4pfhuUxGe8H3JO84yp8Lw9LOZn-eIvd1Y_4JgbOnQlH1QLnovi-RsmWTSmj4MgEdOAHqn8py44Pb2f-azE1nZnp6YEPOJAuOYAL17d10AV0crIQnAcTpm-Whyaqj-ho3hLB7trPDX5fYOo5Z9o4KajnxkXkHA8-sN2EQOKuCHDASr-yvKpbqPAm1Xns5Ml78iS6cNzRw3i3OnPRfJfHZgFjls8XtFxFKK3JFAlvuaRRLQigmHHMzFc1JRBvKg7M3zs04i18qisS6gGQsC0ANvE8v9xIrBytUGsiukc7DzXezH22zWjA3amD5E7dg1PZI7gTG1pPr8hoSPb1E5jsPoViYJ9SyYBuSpLyZ8jfIF1sKZxFe6PTeXA5RayNrF7CBEFMJa4qSkSy710BbMddTCTfaZD3l6z_BmKf0PMfkLgfRtXi5MtO69lgUAqQeqpn0EHGzsEILc74I153kKELsBiVI0EpIzKBDGtjUNoe9jY-HaItrm6cA9g_UxJ_6ykPbsE_vHIrCDIZ941-iA_jOle6bHvL1mM91fymJbRJZ0a7yedU4J23K4PEVHEds-ixRjtVZysrAsa1dNPKVSUkp7nHapqxYSlmAD6OW32i5iC6xZNIx4Ini3lN3l-6iG14Liv01wHGs_w1nRYwLl7V0aqSSOFtGjPDBKFADD1xbBAU9BiW7TtF0vKPzICooBTT9OGaXbUn0p3um71jqLc3AgNS0GkHlU2uNLK4Gew47zGWnEFGHXc7KFo_D4H8LT-6uutpwB1a6x_o3LJ2cVtsAVXESazcCuf59koxvFDoqPf98wVRjxCRoMw_dzgtqk4tnWNHGkb79i2mdq1Ry-UD8PcGu2vIbLdz8hH9bE2OWfo9-R9M79YrPaou6E7qOa0h7o6Am0CicucCgAYbwgsIzot_2asKKf58vptJXgZZIMMNb46VKdRT1LLZ6PDagYzr_AHBZDUfQMRt5zZeYDn-Go50KebMUXF1rig7Xci8jHhPjL6su-q9nckBZSbgBe_9h26xOjbc&sai=AMfl-YR9DUiqpX3oRs7ckw8ql4kn_m-3XR0P3o_s4lTD6vLZOIMz0hWRmBMBcnVQnOB0v1h4_lpCdrabIkBxa9y1YDgd-lyONmH4Cs39M8tgSbcbmC8FbijZgy9i6E_ugj4dTmCmr8bBPLjcwK59NVoabDukamIv-kE9O7Q7DfBwDKhPIF_laiC1hIwOvk2_NWQvF-z8QMBdHKgGpqlB0KTK6VszEg7T-BjdCp0wzEikq6ix1qPRXwcsoX2xQgZD7p-ZKrp0jbpjh0mj2AUiJjwox0ICOLTE4zlzyDtvTKVmv9-oeBKWLvT_YFh8GiZ6Ijql_w&sig=Cg0ArKJSzDOu5HTqd5_REAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=135&cbvp=1&cstd=132&cisv=r20231109.17075&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Tue, 28 Nov 2023 11:22:27 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 fonts_e01f9d5646d9b7b21483a71575e46d16.css
s0.2mdn.net/sadbundle/6452581308981405529/ Frame 6907 271 B
220 B 33ms
33ms Stylesheet
text/css 172.253.63.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/6452581308981405529/fonts_e01f9d5646d9b7b21483a71575e46d16.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6452581308981405529/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61de11a1fc6de68065c19018b205ae1ebb844b2449aa6a763d80463ee5d86377

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6452581308981405529/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 22 Nov 2023 04:59:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 541351
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 191
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 19:30:40 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 21 Nov 2024 04:59:56 GMT

GET
H3 200 style_71055e6be4c708830ae023e7ade881c9.css
s0.2mdn.net/sadbundle/6452581308981405529/ Frame 6907 2 KB
635 B 34ms
33ms Stylesheet
text/css 172.253.63.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/6452581308981405529/style_71055e6be4c708830ae023e7ade881c9.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6452581308981405529/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb056285f0d0d040ae3beeaa5384f6bb7bf5fd262a0e5191e4a930e01a0e052e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6452581308981405529/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 22 Nov 2023 16:36:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 499530
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 606
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 19:30:40 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 21 Nov 2024 16:36:57 GMT

GET
H3 200 style_e6c9a09c16e6e0e2811b2136693fe5b3.css
s0.2mdn.net/sadbundle/6452581308981405529/ Frame 6907 593 B
347 B 35ms
33ms Stylesheet
text/css 172.253.63.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/6452581308981405529/style_e6c9a09c16e6e0e2811b2136693fe5b3.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6452581308981405529/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

32508d11936b1f8f07256e7e147a1637617184713914bd645fc76429330ff7b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6452581308981405529/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 22 Nov 2023 04:59:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 541351
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 318
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 19:30:40 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 21 Nov 2024 04:59:56 GMT

GET
H2 200 css2
fonts.googleapis.com/ Frame 6907 5 KB
885 B 43ms
42ms Stylesheet
text/css 172.253.62.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Saira+Extra+Condensed:wght@800&family=Saira+Semi+Condensed:wght@600&family=Source+Sans+3:wght@300&display=swap

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6452581308981405529/index.html?ev=01_250

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8d37e6e0947684d4e9fdcc266e7616f24110b46ba2835c02a235b353a82558ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 28 Nov 2023 11:22:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 10:23:33 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 28 Nov 2023 11:22:27 GMT

GET
H3 200 main_18111cd7193b2e9a7dd0.js Show response
s0.2mdn.net/sadbundle/6452581308981405529/ Frame 6907 8 KB
3 KB 77ms
77ms Script
application/x-javascript 172.253.63.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/6452581308981405529/main_18111cd7193b2e9a7dd0.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6452581308981405529/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e526646cccd393fc20d41006391e7de8d31dc300404d9e42720cc7616c43c05

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6452581308981405529/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 22 Nov 2023 04:59:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 541351
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3090
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 19:30:40 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 21 Nov 2024 04:59:56 GMT

GET
H3 200 help_me_write_f16f96e39628dd631d78b54ff846235c.svg
s0.2mdn.net/sadbundle/6452581308981405529/ Frame 6907 6 KB
3 KB 35ms
34ms Image
image/svg+xml 172.253.63.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6452581308981405529/help_me_write_f16f96e39628dd631d78b54ff846235c.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6452581308981405529/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

353acc3f2767f6ca29b4ee7a93c6c3c3597863a568a989ca584d815682d9b807

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6452581308981405529/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 20:34:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 398871
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2818
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 19:30:40 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 22 Nov 2024 20:34:36 GMT

GET
H3 200 lunch_icon_8ac7579eec1a1e9a2b944cdcb9e80f7e.png
s0.2mdn.net/sadbundle/6452581308981405529/ Frame 6907 3 KB
3 KB 35ms
34ms Image
image/png 172.253.63.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6452581308981405529/lunch_icon_8ac7579eec1a1e9a2b944cdcb9e80f7e.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6452581308981405529/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a856fc7c9b26f1b984ff8fc33387c9611a69dd5b250829e272f5e98fda1d416f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6452581308981405529/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 22 Nov 2023 04:59:56 GMT
x-content-type-options: nosniff
age: 541351
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3027
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 19:30:40 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 21 Nov 2024 04:59:56 GMT

GET
H3 200 GoogleWorkspace_logo_233538bde8e0d6a67ed09b20bd585788.svg
s0.2mdn.net/sadbundle/6452581308981405529/ Frame 6907 70 KB
51 KB 34ms
33ms Image
image/svg+xml 172.253.63.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6452581308981405529/GoogleWorkspace_logo_233538bde8e0d6a67ed09b20bd585788.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6452581308981405529/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

439265e4d533b1c8f40324b4066ed6455f48e26543f03796e282c590d2ab6532

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6452581308981405529/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 22 Nov 2023 04:59:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 541351
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 52621
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 19:30:40 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 21 Nov 2024 04:59:56 GMT

GET
H3 200 gsap_3.11.5_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 6907 70 KB
27 KB 61ms
60ms Script
text/javascript 172.253.63.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.11.5_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6452581308981405529/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e5118140a15e5dbb471f19c06816bcfa44170878bd8fe0ade80c24b7a988d8ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6452581308981405529/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27946
x-xss-protection: 0
last-modified: Fri, 12 May 2023 16:06:19 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 28 Nov 2023 11:22:27 GMT

GET
H3 200 textplugin_3.11.5_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 6907 10 KB
4 KB 67ms
67ms Script
text/javascript 172.253.63.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/textplugin_3.11.5_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6452581308981405529/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

95a63f4c0b1c6071120c8fb60c6432bbe8f2602031ff9abb54c8853e9f7bfe9a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6452581308981405529/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3591
x-xss-protection: 0
last-modified: Fri, 12 May 2023 16:05:37 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 28 Nov 2023 11:22:27 GMT

GET
H2 200 if Show response
lax1-ib.adnxs.com/ Frame A7F1 9 KB
6 KB 111ms
108ms Document
text/html 104.254.151.36
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://lax1-ib.adnxs.com/if?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QKxN_BMsRsAAAMA1gAFAQjymperBhCGjZPxqbanwjkYm6vwn9aQzMZZKjYJiGh0B7HTI0AR2liJeVbaIEAZAAAAIFyvQEAh2liJeVbaIEApiGgJJAQxAAUBsAhAMLGtxgg4sxlA5R5IZVCnosslWLrgfGAAaMmwRHjOggaAAQGKAQNVU0SSAQEG9IICmAHYBaABWqgBAbABALgBAsABBcgBAtABCdgBAOABAPABALICJGI1MDNiMDMwLTAwODgtNDM5Ni05MjlhLTkwZjI1MjlmOGJjNdgCpEPgAur5JeoCGWFueWZpbGUtbm90ZXBhZC5zZW1hYW4uY2HyAgwKBkhFSUdIVBICOTDyAgwKBVdJRFRIEgM3MjjyAiEKBkxPQURFUhIXcmVuZGVyX3Bvc3RfYWRzX3YxLmh0bWzyAhgKCklGUkFNRV9LRVkSCjE3NDM2OTMwMjXyAsgVCgtQUkVfU0NSSVBUUxK4FTxzY3JpcHQ-KGZ1bmN0aW9uKCl7LyoKCiBDb3B5cmlnaHQgVGhlIENsb3N1cmUgTGlicmFyeSBBdXRob3JzLgogU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjAKKi8KdmFyIGs9dGhpc3x8c2VsZjt2YXIgbD1BcnJheS5wcm90b3R5cGUuaW5kZXhPZj9mdW5jdGlvbihhLGMpe3JldHVybiBBcnJheS5wcm90b3R5cGUuaW5kZXhPZi5jYWxsKGEsYyx2b2lkIDApfTpmdW5jdGlvbihhLGMpe2lmKCJzdHJpbmciPT09dHlwZW9mIGEpcmV0dXJuInN0cmluZyIhPT10eXBlb2YgY3x8MSE9Yy5sZW5ndGg_LTE6YS5pbmRleE9mKGMsMCk7Zm9yKHZhciBlPTA7ZTxhLmxlbmd0aDtlKyspaWYoZSBpbiBhJiZhW2VdPT09YylyZXR1cm4gZTtyZXR1cm4tMX07ZnVuY3Rpb24gbShhKXttWyIgIl0oYSk7cmV0dXJuIGF9bVsiICJdPWZ1bmN0aSWVBH07MRR8IG4oYSl7YT12b2lkIDA9PT1hP2RvY3VtZW50OmE7cmUJQyQuY3JlYXRlRWxlARkYKCJpbWciKR1FSHAoYSxjLGUpe3ZhciBiPSExO2IZUoBiPyExOmI7YS5nb29nbGVfaW1hZ2VfcmVxdWVzdHN8fChaGgAQPVtdKTsBURRkPW4oYS4RlxApO2lmKA1rBGY9EcgIKCl7GRcEZz1aUwBALGg9bChnLGQpOzA8PWgmJkE6MgIkc3BsaWNlLmNhbAEnbGgsMSl9ZC5yZW1vdmVFdmVudExpc3RlbmVyJiZSFwA0KCJsb2FkIixmLCExKTtSIwBiOgAQZXJyb3INOxh9O2QuYWRkQnMAPhQAPnAAPiAAAW0-FAAAKDZqAFhiJiYoZC5hdHRyaWJ1dGlvblNyYz0iIgG-EHNyYz1jXrcBJC5wdXNoKGQpfQpZSwRxKEkBBGE9Maw0LmN1cnJlbnRTY3JpcHRNTwAoMm4CMG51bGw6YSkmJiI3NyJBgBAuZ2V0QQ2QOGUoImRhdGEtamMiKT9hOhVXPHF1ZXJ5U2VsZWN0b3IoJ1sNJQA9AUQMXScpfUU38ElyPVJlZ0V4cCgiXmh0dHBzPzovLyhcXHd8LSkrXFwuY2RuXFwuYW1wcHJvamVjdFxcLihuZXR8b3JnKShcXD98L3wkKSIpOwpmdYkABCB0FeAAawVhDGM9W10FCQRlPQHGDDtkb3tBrxhiPWE7dHJ5BQwAZEGtGGQ9ISFiJiYBJBwhPWIubG9jYSFqIC5ocmVmKWI6ewEtkG0oYi5mb28pO2Q9ITA7YnJlYWsgYn1jYXRjaChoKXt9ZD0hMX0BXghmPWQZFwBmARYMaWYoZil5AGc-XgAMO2U9YnU5BCYmGQwoLnJlZmVycmVyfHwBlyR9ZWxzZSBnPWUsDcsAYyngMG5ldyB1KGd8fCIiKSkF1RRhPWIucGEh1BmGAGEF_3h9fXdoaWxlKGEmJmIhPWEpO2I9MDtmb3IoYT1jLmxlgdZ0LTE7Yjw9YTsrK2IpY1tiXS5kZXB0aD1hLWI7Yj1rISs5HgGuNSo4YW5jZXN0b3JPcmlnaW5zbhwADWsAPR11ACkJhgwxO2E8EYpMOysrYSlnPWNbYV0sZy51cmx8fCgFCC5CATp2ABRbYS0KMV0hDBgsZy5oPSEwAeMpIgBrGash1WX_AGclFiUCBGU9MgQBIDA8PWU7LS1lKSG6RD1jW2VdLCFnJiZyLnRlc3QoZgGPICkmJihnPWYpLAUOLCYmIWYuaCl7Yj1mO0UbAH0NXQBlFeYEJiYBzAE7BDswQWUlWggmJmUFSAEbCCk7YwWtFHYoYixnKW2LGCBjLmc_Yy4F-gw6Yy5pAUAAfbFTBCB2odYcKXt0aGlzLmlB1QEJCGc9YxkiAHUdIgh1cmwRJBRoPSEhYzsFLwWIJQrdLwB3dUkgdCgpLGM9YS5p6X5AKCI_Iik7c2V0VGltZW91dCgRjA0xAGXZVhhlPy4wMTplQTVEIShNYXRoLnJhbmRvbSgpPmUpaQ8MYj1xKCGkACJl_zQ6Ly8iKyhiJiYidHJ1ZYFrAGJWawQ4LXJjZCIpPyJwYWdlYWQyzbcQc3luZGlpuSAtY24uY29tIjpmIwAFIAwpKyIvCUV4L2dlbl8yMDQ_aWQ9amNhJmpjPTc3JnZlcnNpb249IoVFDGQ9KGQBsQApobZSBAUALQ0xMCIpfHwidW5rbm93biJh41wrZCsiJnNhbXBsZT0iK2U7Yj13aW5kb3cFWABmOTQAZuGKAGYhMzRkPWIubmF2aWdhdG9yKTIOAFAudXNlckFnZW50LGQ9L0Nocm9tZS9JmyBkKSYmIS9FZGcZERw_ITA6ITE7ZGGTFVEwLnNlbmRCZWFjb24_Ch1pHRgkKGUpOnAoYixlLCJ6CAmeECl9fSwwVaAsMDw9Yz9hLnN1YnN0DloJHCgwLGMpOmF9CeAMLnJmbC4CCBqvCGhlbmNvZGVVUklDb21wb25lbnQodygpKX07fSnp20GaFCk7Cjwvc8WYbD7yAt4CCgpFWFRSQV9UQUdTEs8CPGRpdiBzdHkhUgxwb3NpobFkOiBhYnNvbHV0ZTsgbGVmdDogMHB4OyB0b3ANCmR2aXNpYmlsaXR5OiBoaWRkZW47Ij48aW1nIOFMVYdJFEpZAkE2DR4uMgIUYXdiaWQmBQbwn19iPUFLQW1mLUJSTUZuaEVFeDBRdjdsLXl3X3VBVGZVZmtydFhiaVU3d2pvUUdWWjcxZDktV0pJY0hzMng1enYtUHR0UXN0YUFxakszSDZsYmdqZENicXlTN2ZLRXlleUQ0TTRXdENfdUhJNFJPRlZ0VjFxeG9pdlJjIiBib3JkZXI9MCB3aWR0aD0xIGhlaWdodD0xIGFsdD0iIiBzdHkhL6BkaXNwbGF5Om5vbmUiPjwvZGl2PvICmgEKDFBPU1RfU0NSSVBUUxKJARovDDYdARYlClBhZHMuZy5kb3VibGVjbGljay5uZXQxGzx4YmZlX2JhY2tmaWxsLmpzAWUtyg1TLoIMJCB7cjNweCgnMTceuwwcJyk7fSkoKTtdABCaFgoQSAGeNFBPUlRfUEFSQU1TEoUWkTmKlQDgYWRmZXRjaD9hZGs9MTg1MDAxMjI3MCZhZHNhZmU9bWVkaXVtJmNsaWVudD1jYS1wdWItMzA3Njg5ASpkNzQxNDY3JmZvcm1hdD03Mjh4OTBfYXMmaXABTLAuMTkzLjY0LjEzNCZvdXRwdXQ9aHRtbCZwc2Q9VzEwJTNEJnVudmlld2VkX3BNrCBfc3RhcnQ9MSall14iDhAmc3ViXw2VAGJBsfB9ci00NzEwMTI0JmhsPWVuJmFjZWlkPU1La0RId0NNaHpRQm9JODBBWFNSTkFHUmt6UUJDNVEwQVZHVU5BRlNsVFFCajVVMEFiQ1ZOQUVJbGpRQktKWTBBWENXTkFGMGxqUUJkcFkwQVh5V05BR09salFCa1pZMEFhQ1dOQUdvARAscTVZMEFhMldOQUhEARAANAEQBGVXARAAbQEQADYBEBxmaVdOQUVCbAGAKHBjMEFUQ1hOQUU1ARAsUUpjMEFVR1hOQUZIARAAVQEQBFZPARAAZgEQAFkBEPRTCVd5WE5BRzNiRUVCUzNOQkFVMXpRUUZhUE5vQl9mY2VBamItaUFMQV9vZ0M0VG1xQWlkQ3FnSTdXcW9DbEdxcUF2NTRxZ0pVa2FvQ1c1R3FBb0NicWdLQm02b0NncHVxQXBxb3FnS2lxS29DTTd1cUFvYk5xZ0pDLUtvQ1FmdXFBclFGcXdLRUo2c0NWQ2lyQXZzcnF3TFVOcXNDSlRxckFpazZxd0l0T3FzQ2IwZXJBbXhLcXdKZ1Rxc0N1RTZyQWlCUXF3TDBVS3NDQWxHckFncFJxd0xzVjZzQ0lGeXJBamRjcXdJYWFhc0M0R3FyQWh0eHF3THhjYXNDZ0hPckFzeDBxd0lZZDZzQ0hIZXJBaUozcXdJbmQ2c0NMSGVyQWdwNXF3TFllcXNDVTRDckFwR0Jxd0tjZ2FzQ2NvZXJBdTJKcXdLZ2lxc0M3SXFyQW1pTHF3TElpNnNDOVl1ckFnQ01xd0t4aktzQ3M0eXJBcmlNcXdJdmphc0NBcENyQWxlU3F3TFJrNnNDNFpPckFsZVdxd0pjbDZzQzdwaXJBbWlkcXdMVW9hc0MtNkdyQWhDanF3THdvNnNDWktTckFrR2xxd0prcGFzQzQ2V3JBcFNtcXdJQXFhc0NMNm1yQW91cXF3TEFxNnNDeXF1ckF0dXJxd0lWcktzQ1dhMnJBck90cXdJbHJxc0NRcTZyQW91dXF3TGZycXNDTzYtckF0U3Zxd0xxcjZzQ1U3R3JBcXV4cXdMSHNhc0NZcktyQXFpenF3SVd0S3NDR3JTckFpRzBxd0lsdEtzQ0tiU3JBZ3UxcXdLaHRhc0NKcmFyQWplMnF3THJ0cXNDaExlckFnZTRxd0k2dUtzQ2pyaXJBdHE0cXdMdnVLc0NDN21yQWpxNXF3TDV1YXNDUDdxckFsRzZxd0lKdTZzQ01idXJBank3cXdKOXU2c0N4THlyQW9IdEJRUEFkU1FFMDNna0JKRmQ5d1N3WGZjRXd0aWhEdmVSLXhMVzRmc1NJZXo3RWl3T19CSmxEdndTcmhQOEVqNFZfQktiRmZ3UzdCWDhFdkFYX0JJdkdQd1NaQmo4RW5rWV9CSWpHZndTU2hyOEV1a2JfQkxUSFB3UzZoejhFZzhlX0JKYm4tb1VJY2dNRllhOF95TSZleGs9MTc0MzY5MzAyNSZhd2JpZF9jPUFLQW1mLUNSYjNQc3ljYVcydFNWMDFnS0EwQUYwdXA1WWJHVDRUbV9odkNXT3gwNGw1d0VuWXd1c1o1ZXF3emw4bnZiTVcxaGtCSnQtZUJmZ3JKZllYSnhGVTZvVXBZeU81Um5ha05UZG83bmtCaVNRTXlmY2libUJ5YU9RR2VVYjVzeWpvWnFaTlBDaFVPMWFlRWJjUUxEendDNGlaNEhKR2tQWUplMWp6dzVfdkM2WHlkR2J5SSZhd2JpZF9kPUFLQW1mLUNiR3BySVd2UTJkMkcxNENHTjBjanlvX3ZFN1hBOHRXalJ0QUtmTUwwV2tYRW1vcXFzNlI1cmFKTW5BNU0zUmJWTFpFRUhfN3NLNndzYkZjT3YwNjhoMDhMcnBfbkp3LVd4dUR6NVlSdGlZS09ySGFsOGVtUzh6NGQ4N0JCRG5ZQzljSUM2eE8wSHlXeXpWRXJldlNiZVFYR0FvRHdTankzeTBMYlFyd1lzV2s2NUQzLTFjQkhSYUY4Zk0tc1VaTmE2VkktanpyUGRNeFJFNWtOWGhBTnJJZ1A2TFFQVmF4ZVNBSmE2VjhDbXJNbWNUMmZCek84SjhEQTdjdEhMOHViN0hXNzhNdWhNTHduUEVnSDAzYUpKaFg5MEtaTTU5U3ctc0F4NlhwbnRsUzNrX2lOOHF4WWh3Zy1yMmpKRG1wSmt2aV9oZlg1MVpUSlVGUG13YVFibi1XU1hKQ1ltT2ZIejk5VFZWWHBBRkFiZGhqZDd4NFl3TC1PSDJJU3ZLUWt1Q0VCV0ttSVhGamE1TVQ4cWtKSjRXM3ZOUnVwNmNiTmZ2aTF2cGFwYmlUbDViOXV0T0VVUS1xV29nZEl6UFJiTEhtQ1pxOEdXMkRhMU1KYjNaWXhlUzA4a254TTJqMTNtLXJUVE5RTjlpeDhsSzgzY0dqVzNma3Z5bURoMDNqOTFkSHJ2VFdFdUVlVVpaQl9udkUwX0lYelh3M2hXeDJSY1F2ODNGWnAwM2NDcmdXV05BcmFKMDNtMld3RTdjRkUtU3B1by1scU1QM2RabUdxMEpSRnptam1FUlN4ai1SZ056RmZUVmVRaTZHeVV5RlFEWWo3TnBQNGlNOVIxYWxxNHNxMmNqRW5tdFpIVldTa2dRdVI0OG5zVmJvbVpMdnVpOWlfYTVRaUdBMDJvU2tLSWpMSjdTeUIxdXNBRUxMeTdFTmJCbjIwbjhJXzU0RGFGT2lEQzRzNFlhYVBCYnJpWU1XUWNudmgwSENlSUg3OGxGRXhFUXQ5bG51RVFMZUJpcWp1V0FHQnhPN1Y1V1hpMHpFZUZjcnJEMkxobXlzWElGNm5HT0hWNGVyc3dvd3FzdFdUc0FjcjJEdVBpc0MzQ1lFRmhIbmNrZGNqZHE4ZlU0SC04cXZHeUUySFlrQUV2a3VHMFdKNVBjT3RKaTJsMXpiLUFULS1sMl9KLWlGa0xRbW9qY080OWNMWWtIN2pYRnFISnRROEtHUnNmeFBfRUpZS3ZKVVBsYlFCN3ZwelJaVm9laDVDT2h4bnM5ajhVRVh3aFdUTmZxUkxHdmJnVDNGbEZPZ3Q2N3YyNHRWdW85aGtOOURpeHdIbDFlQ29aSzZZZGFjdnNtZUtEbGc5MlFnU0pfUWtXMHh2ajZYR0p1ekk3RXQ5ZTF6WGQ4OWhqSENTZ1dpcmpDOEQxUVdYYnQ3SjBFX1h0bGp4UjNqMXJELWVWb1pWakV0VFNtOWVPRHpMUjBlN2lYZ3Zjem9xVDBDOUU4UEdUSDRVcjJnTnhVd2FwLVdXSjlqZDJhaGk5SHVlV2I5NzJYdm5zXzRRdXdXSW8zckhkQWtWcXR0bG8wcjBmc09TZlQ4MjNMdmcmY2lkPUNBUVNHd0RJQ2FhTlE3M3F4b0ZJS2MzTnBVcVZFXy1IWU9jQXhaSDJ6aGdCJmFfY2lkPYADAIgDAZADAJgDFKADAaoD_AEK1AFodHRwczovL3BhZ2VhZDIuZxLdFSomD6rNDPDXQ09KbGlOcHZTQS1jSGUtanRKYnQ3RkFZcnZ2MGN1VUpGallBUjJjUUtsNDBkQUgyZGFKeWxNcHdVQjNMMXkzak9FY1R1VjNjZm9TeXVmNExEQWZwcVh5dXhLOHR2RGVFRGxBejgzX3ljY1B5LV9adVEmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoTNDE0NDYxMDk0NzU3MDY0ODcxMCIINzg4Mjc4MTUqBDM5NDHAA9gEyAMA2AMA4AMA6AMA-AMDgAQAkgQJL29wZW5ydGIymAQAogQOMTg1KrkL8G2oBACyBAwIABAAGAAgADAAOAK4BADABADIBADaBAIIAeAEAPAEp6LLJYgFAZgFAKAFvur-9_D58d0oqgUqZTYxOGJkYzQtN2JjYS00YWRlLWFhZTEtOWVmY2U0ZGY5YWFhfjkzM34xwAUAyQUAAA6eGhTwP9IFCQkBCgEBNNgFAeAFAfAF2vgw-gUEAYgokAYAmAYAuAYAwQYBITQAAPA_0AbujwHaBhYKEAkSGQEBt6DgBgHyBgIIAIAHAYgHAKAHAaoHDDEyMjkyMjIzMTc0N8gHzoIG0gcNCRE3ATUI2gcGAW2wGADgBwDqBwIIAPAHkoAIiggCEACVCAAAgD-YCAHACKRD0ggJCPP__z8QABgA&s=fbea6d2d622b67e49fa4da28ac4cbaa94b7b5cd2

Requested by

Host: lax1-ib.adnxs.com
URL: https://lax1-ib.adnxs.com/ab?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QKxN_BMsRsAAAMA1gAFAQjymperBhCGjZPxqbanwjkYm6vwn9aQzMZZKjYJiGh0B7HTI0AR2liJeVbaIEAZAAAAIFyvQEAh2liJeVbaIEApiGgJJAQxAAUBsAhAMLGtxgg4sxlA5R5IZVCnosslWLrgfGAAaMmwRHjOggaAAQGKAQNVU0SSAQEG9IICmAHYBaABWqgBAbABALgBAsABBcgBAtABCdgBAOABAPABALICJGI1MDNiMDMwLTAwODgtNDM5Ni05MjlhLTkwZjI1MjlmOGJjNdgCpEPgAur5JeoCGWFueWZpbGUtbm90ZXBhZC5zZW1hYW4uY2HyAgwKBkhFSUdIVBICOTDyAgwKBVdJRFRIEgM3MjjyAiEKBkxPQURFUhIXcmVuZGVyX3Bvc3RfYWRzX3YxLmh0bWzyAhgKCklGUkFNRV9LRVkSCjE3NDM2OTMwMjXyAsgVCgtQUkVfU0NSSVBUUxK4FTxzY3JpcHQ-KGZ1bmN0aW9uKCl7LyoKCiBDb3B5cmlnaHQgVGhlIENsb3N1cmUgTGlicmFyeSBBdXRob3JzLgogU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjAKKi8KdmFyIGs9dGhpc3x8c2VsZjt2YXIgbD1BcnJheS5wcm90b3R5cGUuaW5kZXhPZj9mdW5jdGlvbihhLGMpe3JldHVybiBBcnJheS5wcm90b3R5cGUuaW5kZXhPZi5jYWxsKGEsYyx2b2lkIDApfTpmdW5jdGlvbihhLGMpe2lmKCJzdHJpbmciPT09dHlwZW9mIGEpcmV0dXJuInN0cmluZyIhPT10eXBlb2YgY3x8MSE9Yy5sZW5ndGg_LTE6YS5pbmRleE9mKGMsMCk7Zm9yKHZhciBlPTA7ZTxhLmxlbmd0aDtlKyspaWYoZSBpbiBhJiZhW2VdPT09YylyZXR1cm4gZTtyZXR1cm4tMX07ZnVuY3Rpb24gbShhKXttWyIgIl0oYSk7cmV0dXJuIGF9bVsiICJdPWZ1bmN0aSWVBH07MRR8IG4oYSl7YT12b2lkIDA9PT1hP2RvY3VtZW50OmE7cmUJQyQuY3JlYXRlRWxlARkYKCJpbWciKR1FSHAoYSxjLGUpe3ZhciBiPSExO2IZUoBiPyExOmI7YS5nb29nbGVfaW1hZ2VfcmVxdWVzdHN8fChaGgAQPVtdKTsBURRkPW4oYS4RlxApO2lmKA1rBGY9EcgIKCl7GRcEZz1aUwBALGg9bChnLGQpOzA8PWgmJkE6MgIkc3BsaWNlLmNhbAEnbGgsMSl9ZC5yZW1vdmVFdmVudExpc3RlbmVyJiZSFwA0KCJsb2FkIixmLCExKTtSIwBiOgAQZXJyb3INOxh9O2QuYWRkQnMAPhQAPnAAPiAAAW0-FAAAKDZqAFhiJiYoZC5hdHRyaWJ1dGlvblNyYz0iIgG-EHNyYz1jXrcBJC5wdXNoKGQpfQpZSwRxKEkBBGE9Maw0LmN1cnJlbnRTY3JpcHRNTwAoMm4CMG51bGw6YSkmJiI3NyJBgBAuZ2V0QQ2QOGUoImRhdGEtamMiKT9hOhVXPHF1ZXJ5U2VsZWN0b3IoJ1sNJQA9AUQMXScpfUU38ElyPVJlZ0V4cCgiXmh0dHBzPzovLyhcXHd8LSkrXFwuY2RuXFwuYW1wcHJvamVjdFxcLihuZXR8b3JnKShcXD98L3wkKSIpOwpmdYkABCB0FeAAawVhDGM9W10FCQRlPQHGDDtkb3tBrxhiPWE7dHJ5BQwAZEGtGGQ9ISFiJiYBJBwhPWIubG9jYSFqIC5ocmVmKWI6ewEtkG0oYi5mb28pO2Q9ITA7YnJlYWsgYn1jYXRjaChoKXt9ZD0hMX0BXghmPWQZFwBmARYMaWYoZil5AGc-XgAMO2U9YnU5BCYmGQwoLnJlZmVycmVyfHwBlyR9ZWxzZSBnPWUsDcsAYyngMG5ldyB1KGd8fCIiKSkF1RRhPWIucGEh1BmGAGEF_3h9fXdoaWxlKGEmJmIhPWEpO2I9MDtmb3IoYT1jLmxlgdZ0LTE7Yjw9YTsrK2IpY1tiXS5kZXB0aD1hLWI7Yj1rISs5HgGuNSo4YW5jZXN0b3JPcmlnaW5zbhwADWsAPR11ACkJhgwxO2E8EYpMOysrYSlnPWNbYV0sZy51cmx8fCgFCC5CATp2ABRbYS0KMV0hDBgsZy5oPSEwAeMpIgBrGash1WX_AGclFiUCBGU9MgQBIDA8PWU7LS1lKSG6RD1jW2VdLCFnJiZyLnRlc3QoZgGPICkmJihnPWYpLAUOLCYmIWYuaCl7Yj1mO0UbAH0NXQBlFeYEJiYBzAE7BDswQWUlWggmJmUFSAEbCCk7YwWtFHYoYixnKW2LGCBjLmc_Yy4F-gw6Yy5pAUAAfbFTBCB2odYcKXt0aGlzLmlB1QEJCGc9YxkiAHUdIgh1cmwRJBRoPSEhYzsFLwWIJQrdLwB3dUkgdCgpLGM9YS5p6X5AKCI_Iik7c2V0VGltZW91dCgRjA0xAGXZVhhlPy4wMTplQTVEIShNYXRoLnJhbmRvbSgpPmUpaQ8MYj1xKCGkACJl_zQ6Ly8iKyhiJiYidHJ1ZYFrAGJWawQ4LXJjZCIpPyJwYWdlYWQyzbcQc3luZGlpuSAtY24uY29tIjpmIwAFIAwpKyIvCUV4L2dlbl8yMDQ_aWQ9amNhJmpjPTc3JnZlcnNpb249IoVFDGQ9KGQBsQApobZSBAUALQ0xMCIpfHwidW5rbm93biJh41wrZCsiJnNhbXBsZT0iK2U7Yj13aW5kb3cFWABmOTQAZuGKAGYhMzRkPWIubmF2aWdhdG9yKTIOAFAudXNlckFnZW50LGQ9L0Nocm9tZS9JmyBkKSYmIS9FZGcZERw_ITA6ITE7ZGGTFVEwLnNlbmRCZWFjb24_Ch1pHRgkKGUpOnAoYixlLCJ6CAmeECl9fSwwVaAsMDw9Yz9hLnN1YnN0DloJHCgwLGMpOmF9CeAMLnJmbC4CCBqvCGhlbmNvZGVVUklDb21wb25lbnQodygpKX07fSnp20GaFCk7Cjwvc8WYbD7yAt4CCgpFWFRSQV9UQUdTEs8CPGRpdiBzdHkhUgxwb3NpobFkOiBhYnNvbHV0ZTsgbGVmdDogMHB4OyB0b3ANCmR2aXNpYmlsaXR5OiBoaWRkZW47Ij48aW1nIOFMVYdJFEpZAkE2DR4uMgIUYXdiaWQmBQbwn19iPUFLQW1mLUJSTUZuaEVFeDBRdjdsLXl3X3VBVGZVZmtydFhiaVU3d2pvUUdWWjcxZDktV0pJY0hzMng1enYtUHR0UXN0YUFxakszSDZsYmdqZENicXlTN2ZLRXlleUQ0TTRXdENfdUhJNFJPRlZ0VjFxeG9pdlJjIiBib3JkZXI9MCB3aWR0aD0xIGhlaWdodD0xIGFsdD0iIiBzdHkhL6BkaXNwbGF5Om5vbmUiPjwvZGl2PvICmgEKDFBPU1RfU0NSSVBUUxKJARovDDYdARYlClBhZHMuZy5kb3VibGVjbGljay5uZXQxGzx4YmZlX2JhY2tmaWxsLmpzAWUtyg1TLoIMJCB7cjNweCgnMTceuwwcJyk7fSkoKTtdABCaFgoQSAGeNFBPUlRfUEFSQU1TEoUWkTmKlQDgYWRmZXRjaD9hZGs9MTg1MDAxMjI3MCZhZHNhZmU9bWVkaXVtJmNsaWVudD1jYS1wdWItMzA3Njg5ASpkNzQxNDY3JmZvcm1hdD03Mjh4OTBfYXMmaXABTLAuMTkzLjY0LjEzNCZvdXRwdXQ9aHRtbCZwc2Q9VzEwJTNEJnVudmlld2VkX3BNrCBfc3RhcnQ9MSall14iDhAmc3ViXw2VAGJBsfB9ci00NzEwMTI0JmhsPWVuJmFjZWlkPU1La0RId0NNaHpRQm9JODBBWFNSTkFHUmt6UUJDNVEwQVZHVU5BRlNsVFFCajVVMEFiQ1ZOQUVJbGpRQktKWTBBWENXTkFGMGxqUUJkcFkwQVh5V05BR09salFCa1pZMEFhQ1dOQUdvARAscTVZMEFhMldOQUhEARAANAEQBGVXARAAbQEQADYBEBxmaVdOQUVCbAGAKHBjMEFUQ1hOQUU1ARAsUUpjMEFVR1hOQUZIARAAVQEQBFZPARAAZgEQAFkBEPRTCVd5WE5BRzNiRUVCUzNOQkFVMXpRUUZhUE5vQl9mY2VBamItaUFMQV9vZ0M0VG1xQWlkQ3FnSTdXcW9DbEdxcUF2NTRxZ0pVa2FvQ1c1R3FBb0NicWdLQm02b0NncHVxQXBxb3FnS2lxS29DTTd1cUFvYk5xZ0pDLUtvQ1FmdXFBclFGcXdLRUo2c0NWQ2lyQXZzcnF3TFVOcXNDSlRxckFpazZxd0l0T3FzQ2IwZXJBbXhLcXdKZ1Rxc0N1RTZyQWlCUXF3TDBVS3NDQWxHckFncFJxd0xzVjZzQ0lGeXJBamRjcXdJYWFhc0M0R3FyQWh0eHF3THhjYXNDZ0hPckFzeDBxd0lZZDZzQ0hIZXJBaUozcXdJbmQ2c0NMSGVyQWdwNXF3TFllcXNDVTRDckFwR0Jxd0tjZ2FzQ2NvZXJBdTJKcXdLZ2lxc0M3SXFyQW1pTHF3TElpNnNDOVl1ckFnQ01xd0t4aktzQ3M0eXJBcmlNcXdJdmphc0NBcENyQWxlU3F3TFJrNnNDNFpPckFsZVdxd0pjbDZzQzdwaXJBbWlkcXdMVW9hc0MtNkdyQWhDanF3THdvNnNDWktTckFrR2xxd0prcGFzQzQ2V3JBcFNtcXdJQXFhc0NMNm1yQW91cXF3TEFxNnNDeXF1ckF0dXJxd0lWcktzQ1dhMnJBck90cXdJbHJxc0NRcTZyQW91dXF3TGZycXNDTzYtckF0U3Zxd0xxcjZzQ1U3R3JBcXV4cXdMSHNhc0NZcktyQXFpenF3SVd0S3NDR3JTckFpRzBxd0lsdEtzQ0tiU3JBZ3UxcXdLaHRhc0NKcmFyQWplMnF3THJ0cXNDaExlckFnZTRxd0k2dUtzQ2pyaXJBdHE0cXdMdnVLc0NDN21yQWpxNXF3TDV1YXNDUDdxckFsRzZxd0lKdTZzQ01idXJBank3cXdKOXU2c0N4THlyQW9IdEJRUEFkU1FFMDNna0JKRmQ5d1N3WGZjRXd0aWhEdmVSLXhMVzRmc1NJZXo3RWl3T19CSmxEdndTcmhQOEVqNFZfQktiRmZ3UzdCWDhFdkFYX0JJdkdQd1NaQmo4RW5rWV9CSWpHZndTU2hyOEV1a2JfQkxUSFB3UzZoejhFZzhlX0JKYm4tb1VJY2dNRllhOF95TSZleGs9MTc0MzY5MzAyNSZhd2JpZF9jPUFLQW1mLUNSYjNQc3ljYVcydFNWMDFnS0EwQUYwdXA1WWJHVDRUbV9odkNXT3gwNGw1d0VuWXd1c1o1ZXF3emw4bnZiTVcxaGtCSnQtZUJmZ3JKZllYSnhGVTZvVXBZeU81Um5ha05UZG83bmtCaVNRTXlmY2libUJ5YU9RR2VVYjVzeWpvWnFaTlBDaFVPMWFlRWJjUUxEendDNGlaNEhKR2tQWUplMWp6dzVfdkM2WHlkR2J5SSZhd2JpZF9kPUFLQW1mLUNiR3BySVd2UTJkMkcxNENHTjBjanlvX3ZFN1hBOHRXalJ0QUtmTUwwV2tYRW1vcXFzNlI1cmFKTW5BNU0zUmJWTFpFRUhfN3NLNndzYkZjT3YwNjhoMDhMcnBfbkp3LVd4dUR6NVlSdGlZS09ySGFsOGVtUzh6NGQ4N0JCRG5ZQzljSUM2eE8wSHlXeXpWRXJldlNiZVFYR0FvRHdTankzeTBMYlFyd1lzV2s2NUQzLTFjQkhSYUY4Zk0tc1VaTmE2VkktanpyUGRNeFJFNWtOWGhBTnJJZ1A2TFFQVmF4ZVNBSmE2VjhDbXJNbWNUMmZCek84SjhEQTdjdEhMOHViN0hXNzhNdWhNTHduUEVnSDAzYUpKaFg5MEtaTTU5U3ctc0F4NlhwbnRsUzNrX2lOOHF4WWh3Zy1yMmpKRG1wSmt2aV9oZlg1MVpUSlVGUG13YVFibi1XU1hKQ1ltT2ZIejk5VFZWWHBBRkFiZGhqZDd4NFl3TC1PSDJJU3ZLUWt1Q0VCV0ttSVhGamE1TVQ4cWtKSjRXM3ZOUnVwNmNiTmZ2aTF2cGFwYmlUbDViOXV0T0VVUS1xV29nZEl6UFJiTEhtQ1pxOEdXMkRhMU1KYjNaWXhlUzA4a254TTJqMTNtLXJUVE5RTjlpeDhsSzgzY0dqVzNma3Z5bURoMDNqOTFkSHJ2VFdFdUVlVVpaQl9udkUwX0lYelh3M2hXeDJSY1F2ODNGWnAwM2NDcmdXV05BcmFKMDNtMld3RTdjRkUtU3B1by1scU1QM2RabUdxMEpSRnptam1FUlN4ai1SZ056RmZUVmVRaTZHeVV5RlFEWWo3TnBQNGlNOVIxYWxxNHNxMmNqRW5tdFpIVldTa2dRdVI0OG5zVmJvbVpMdnVpOWlfYTVRaUdBMDJvU2tLSWpMSjdTeUIxdXNBRUxMeTdFTmJCbjIwbjhJXzU0RGFGT2lEQzRzNFlhYVBCYnJpWU1XUWNudmgwSENlSUg3OGxGRXhFUXQ5bG51RVFMZUJpcWp1V0FHQnhPN1Y1V1hpMHpFZUZjcnJEMkxobXlzWElGNm5HT0hWNGVyc3dvd3FzdFdUc0FjcjJEdVBpc0MzQ1lFRmhIbmNrZGNqZHE4ZlU0SC04cXZHeUUySFlrQUV2a3VHMFdKNVBjT3RKaTJsMXpiLUFULS1sMl9KLWlGa0xRbW9qY080OWNMWWtIN2pYRnFISnRROEtHUnNmeFBfRUpZS3ZKVVBsYlFCN3ZwelJaVm9laDVDT2h4bnM5ajhVRVh3aFdUTmZxUkxHdmJnVDNGbEZPZ3Q2N3YyNHRWdW85aGtOOURpeHdIbDFlQ29aSzZZZGFjdnNtZUtEbGc5MlFnU0pfUWtXMHh2ajZYR0p1ekk3RXQ5ZTF6WGQ4OWhqSENTZ1dpcmpDOEQxUVdYYnQ3SjBFX1h0bGp4UjNqMXJELWVWb1pWakV0VFNtOWVPRHpMUjBlN2lYZ3Zjem9xVDBDOUU4UEdUSDRVcjJnTnhVd2FwLVdXSjlqZDJhaGk5SHVlV2I5NzJYdm5zXzRRdXdXSW8zckhkQWtWcXR0bG8wcjBmc09TZlQ4MjNMdmcmY2lkPUNBUVNHd0RJQ2FhTlE3M3F4b0ZJS2MzTnBVcVZFXy1IWU9jQXhaSDJ6aGdCJmFfY2lkPYADAIgDAZADAJgDFKADAaoD_AEK1AFodHRwczovL3BhZ2VhZDIuZxLdFSomD6rNDPDXQ09KbGlOcHZTQS1jSGUtanRKYnQ3RkFZcnZ2MGN1VUpGallBUjJjUUtsNDBkQUgyZGFKeWxNcHdVQjNMMXkzak9FY1R1VjNjZm9TeXVmNExEQWZwcVh5dXhLOHR2RGVFRGxBejgzX3ljY1B5LV9adVEmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoTNDE0NDYxMDk0NzU3MDY0ODcxMCIINzg4Mjc4MTUqBDM5NDHAA9gEyAMA2AMA4AMA6AMA-AMDgAQAkgQJL29wZW5ydGIymAQAogQOMTg1KrkL8G2oBACyBAwIABAAGAAgADAAOAC4BADABADIBADaBAIIAeAEAPAEp6LLJYgFAZgFAKAFvur-9_D58d0oqgUqZTYxOGJkYzQtN2JjYS00YWRlLWFhZTEtOWVmY2U0ZGY5YWFhfjkzM34xwAUAyQUAAA6eGhTwP9IFCQkBCgEBNNgFAeAFAfAF2vgw-gUEAYgokAYAmAYAuAYAwQYBITQAAPA_0AbujwHaBhYKEAkSGQEBt6DgBgHyBgIIAIAHAYgHAKAHAaoHDDEyMjkyMjIzMTc0N8gHzoIG0gcNCRE3ATUI2gcGAW2wGADgBwDqBwIIAPAHkoAIiggCEACVCAAAgD-YCAHACKRD0ggJCPP__z8QABgA&s=14107629a934f866e350bc16bbbb25426a9e3df9&pp=8.426441

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.151.36 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

7334542577474a6727c5e5516889f3ec6a3a3f7b223775693610131da3fda369

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials: true
access-control-allow-origin: *
an-x-request-uuid: 29196149-1ce6-45fe-9ec5-fb3090a4c786
cache-control: no-store, no-cache, private
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Tue, 28 Nov 2023 11:22:27 GMT
expires: Sat, 15 Nov 2008 16:00:00 GMT
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
pragma: no-cache
server: nginx/1.21.3
vary: Accept-Encoding
x-creative-id: 78827815
x-proxy-origin: 185.193.64.134; 185.193.64.134; 897.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
x-xss-protection: 0

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame A7A2 52 KB
17 KB 58ms
17ms Document
text/html 151.101.65.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=3251&pub_id=1623654
Requested by: Host: lax1-ib.adnxs.com
URL: https://lax1-ib.adnxs.com/ab?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QKxN_BMsRsAAAMA1gAFAQjymperBhCGjZPxqbanwjkYm6vwn9aQzMZZKjYJiGh0B7HTI0AR2liJeVbaIEAZAAAAIFyvQEAh2liJeVbaIEApiGgJJAQxAAUBsAhAMLGtxgg4sxlA5R5IZVCnosslWLrgfGAAaMmwRHjOggaAAQGKAQNVU0SSAQEG9IICmAHYBaABWqgBAbABALgBAsABBcgBAtABCdgBAOABAPABALICJGI1MDNiMDMwLTAwODgtNDM5Ni05MjlhLTkwZjI1MjlmOGJjNdgCpEPgAur5JeoCGWFueWZpbGUtbm90ZXBhZC5zZW1hYW4uY2HyAgwKBkhFSUdIVBICOTDyAgwKBVdJRFRIEgM3MjjyAiEKBkxPQURFUhIXcmVuZGVyX3Bvc3RfYWRzX3YxLmh0bWzyAhgKCklGUkFNRV9LRVkSCjE3NDM2OTMwMjXyAsgVCgtQUkVfU0NSSVBUUxK4FTxzY3JpcHQ-KGZ1bmN0aW9uKCl7LyoKCiBDb3B5cmlnaHQgVGhlIENsb3N1cmUgTGlicmFyeSBBdXRob3JzLgogU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjAKKi8KdmFyIGs9dGhpc3x8c2VsZjt2YXIgbD1BcnJheS5wcm90b3R5cGUuaW5kZXhPZj9mdW5jdGlvbihhLGMpe3JldHVybiBBcnJheS5wcm90b3R5cGUuaW5kZXhPZi5jYWxsKGEsYyx2b2lkIDApfTpmdW5jdGlvbihhLGMpe2lmKCJzdHJpbmciPT09dHlwZW9mIGEpcmV0dXJuInN0cmluZyIhPT10eXBlb2YgY3x8MSE9Yy5sZW5ndGg_LTE6YS5pbmRleE9mKGMsMCk7Zm9yKHZhciBlPTA7ZTxhLmxlbmd0aDtlKyspaWYoZSBpbiBhJiZhW2VdPT09YylyZXR1cm4gZTtyZXR1cm4tMX07ZnVuY3Rpb24gbShhKXttWyIgIl0oYSk7cmV0dXJuIGF9bVsiICJdPWZ1bmN0aSWVBH07MRR8IG4oYSl7YT12b2lkIDA9PT1hP2RvY3VtZW50OmE7cmUJQyQuY3JlYXRlRWxlARkYKCJpbWciKR1FSHAoYSxjLGUpe3ZhciBiPSExO2IZUoBiPyExOmI7YS5nb29nbGVfaW1hZ2VfcmVxdWVzdHN8fChaGgAQPVtdKTsBURRkPW4oYS4RlxApO2lmKA1rBGY9EcgIKCl7GRcEZz1aUwBALGg9bChnLGQpOzA8PWgmJkE6MgIkc3BsaWNlLmNhbAEnbGgsMSl9ZC5yZW1vdmVFdmVudExpc3RlbmVyJiZSFwA0KCJsb2FkIixmLCExKTtSIwBiOgAQZXJyb3INOxh9O2QuYWRkQnMAPhQAPnAAPiAAAW0-FAAAKDZqAFhiJiYoZC5hdHRyaWJ1dGlvblNyYz0iIgG-EHNyYz1jXrcBJC5wdXNoKGQpfQpZSwRxKEkBBGE9Maw0LmN1cnJlbnRTY3JpcHRNTwAoMm4CMG51bGw6YSkmJiI3NyJBgBAuZ2V0QQ2QOGUoImRhdGEtamMiKT9hOhVXPHF1ZXJ5U2VsZWN0b3IoJ1sNJQA9AUQMXScpfUU38ElyPVJlZ0V4cCgiXmh0dHBzPzovLyhcXHd8LSkrXFwuY2RuXFwuYW1wcHJvamVjdFxcLihuZXR8b3JnKShcXD98L3wkKSIpOwpmdYkABCB0FeAAawVhDGM9W10FCQRlPQHGDDtkb3tBrxhiPWE7dHJ5BQwAZEGtGGQ9ISFiJiYBJBwhPWIubG9jYSFqIC5ocmVmKWI6ewEtkG0oYi5mb28pO2Q9ITA7YnJlYWsgYn1jYXRjaChoKXt9ZD0hMX0BXghmPWQZFwBmARYMaWYoZil5AGc-XgAMO2U9YnU5BCYmGQwoLnJlZmVycmVyfHwBlyR9ZWxzZSBnPWUsDcsAYyngMG5ldyB1KGd8fCIiKSkF1RRhPWIucGEh1BmGAGEF_3h9fXdoaWxlKGEmJmIhPWEpO2I9MDtmb3IoYT1jLmxlgdZ0LTE7Yjw9YTsrK2IpY1tiXS5kZXB0aD1hLWI7Yj1rISs5HgGuNSo4YW5jZXN0b3JPcmlnaW5zbhwADWsAPR11ACkJhgwxO2E8EYpMOysrYSlnPWNbYV0sZy51cmx8fCgFCC5CATp2ABRbYS0KMV0hDBgsZy5oPSEwAeMpIgBrGash1WX_AGclFiUCBGU9MgQBIDA8PWU7LS1lKSG6RD1jW2VdLCFnJiZyLnRlc3QoZgGPICkmJihnPWYpLAUOLCYmIWYuaCl7Yj1mO0UbAH0NXQBlFeYEJiYBzAE7BDswQWUlWggmJmUFSAEbCCk7YwWtFHYoYixnKW2LGCBjLmc_Yy4F-gw6Yy5pAUAAfbFTBCB2odYcKXt0aGlzLmlB1QEJCGc9YxkiAHUdIgh1cmwRJBRoPSEhYzsFLwWIJQrdLwB3dUkgdCgpLGM9YS5p6X5AKCI_Iik7c2V0VGltZW91dCgRjA0xAGXZVhhlPy4wMTplQTVEIShNYXRoLnJhbmRvbSgpPmUpaQ8MYj1xKCGkACJl_zQ6Ly8iKyhiJiYidHJ1ZYFrAGJWawQ4LXJjZCIpPyJwYWdlYWQyzbcQc3luZGlpuSAtY24uY29tIjpmIwAFIAwpKyIvCUV4L2dlbl8yMDQ_aWQ9amNhJmpjPTc3JnZlcnNpb249IoVFDGQ9KGQBsQApobZSBAUALQ0xMCIpfHwidW5rbm93biJh41wrZCsiJnNhbXBsZT0iK2U7Yj13aW5kb3cFWABmOTQAZuGKAGYhMzRkPWIubmF2aWdhdG9yKTIOAFAudXNlckFnZW50LGQ9L0Nocm9tZS9JmyBkKSYmIS9FZGcZERw_ITA6ITE7ZGGTFVEwLnNlbmRCZWFjb24_Ch1pHRgkKGUpOnAoYixlLCJ6CAmeECl9fSwwVaAsMDw9Yz9hLnN1YnN0DloJHCgwLGMpOmF9CeAMLnJmbC4CCBqvCGhlbmNvZGVVUklDb21wb25lbnQodygpKX07fSnp20GaFCk7Cjwvc8WYbD7yAt4CCgpFWFRSQV9UQUdTEs8CPGRpdiBzdHkhUgxwb3NpobFkOiBhYnNvbHV0ZTsgbGVmdDogMHB4OyB0b3ANCmR2aXNpYmlsaXR5OiBoaWRkZW47Ij48aW1nIOFMVYdJFEpZAkE2DR4uMgIUYXdiaWQmBQbwn19iPUFLQW1mLUJSTUZuaEVFeDBRdjdsLXl3X3VBVGZVZmtydFhiaVU3d2pvUUdWWjcxZDktV0pJY0hzMng1enYtUHR0UXN0YUFxakszSDZsYmdqZENicXlTN2ZLRXlleUQ0TTRXdENfdUhJNFJPRlZ0VjFxeG9pdlJjIiBib3JkZXI9MCB3aWR0aD0xIGhlaWdodD0xIGFsdD0iIiBzdHkhL6BkaXNwbGF5Om5vbmUiPjwvZGl2PvICmgEKDFBPU1RfU0NSSVBUUxKJARovDDYdARYlClBhZHMuZy5kb3VibGVjbGljay5uZXQxGzx4YmZlX2JhY2tmaWxsLmpzAWUtyg1TLoIMJCB7cjNweCgnMTceuwwcJyk7fSkoKTtdABCaFgoQSAGeNFBPUlRfUEFSQU1TEoUWkTmKlQDgYWRmZXRjaD9hZGs9MTg1MDAxMjI3MCZhZHNhZmU9bWVkaXVtJmNsaWVudD1jYS1wdWItMzA3Njg5ASpkNzQxNDY3JmZvcm1hdD03Mjh4OTBfYXMmaXABTLAuMTkzLjY0LjEzNCZvdXRwdXQ9aHRtbCZwc2Q9VzEwJTNEJnVudmlld2VkX3BNrCBfc3RhcnQ9MSall14iDhAmc3ViXw2VAGJBsfB9ci00NzEwMTI0JmhsPWVuJmFjZWlkPU1La0RId0NNaHpRQm9JODBBWFNSTkFHUmt6UUJDNVEwQVZHVU5BRlNsVFFCajVVMEFiQ1ZOQUVJbGpRQktKWTBBWENXTkFGMGxqUUJkcFkwQVh5V05BR09salFCa1pZMEFhQ1dOQUdvARAscTVZMEFhMldOQUhEARAANAEQBGVXARAAbQEQADYBEBxmaVdOQUVCbAGAKHBjMEFUQ1hOQUU1ARAsUUpjMEFVR1hOQUZIARAAVQEQBFZPARAAZgEQAFkBEPRTCVd5WE5BRzNiRUVCUzNOQkFVMXpRUUZhUE5vQl9mY2VBamItaUFMQV9vZ0M0VG1xQWlkQ3FnSTdXcW9DbEdxcUF2NTRxZ0pVa2FvQ1c1R3FBb0NicWdLQm02b0NncHVxQXBxb3FnS2lxS29DTTd1cUFvYk5xZ0pDLUtvQ1FmdXFBclFGcXdLRUo2c0NWQ2lyQXZzcnF3TFVOcXNDSlRxckFpazZxd0l0T3FzQ2IwZXJBbXhLcXdKZ1Rxc0N1RTZyQWlCUXF3TDBVS3NDQWxHckFncFJxd0xzVjZzQ0lGeXJBamRjcXdJYWFhc0M0R3FyQWh0eHF3THhjYXNDZ0hPckFzeDBxd0lZZDZzQ0hIZXJBaUozcXdJbmQ2c0NMSGVyQWdwNXF3TFllcXNDVTRDckFwR0Jxd0tjZ2FzQ2NvZXJBdTJKcXdLZ2lxc0M3SXFyQW1pTHF3TElpNnNDOVl1ckFnQ01xd0t4aktzQ3M0eXJBcmlNcXdJdmphc0NBcENyQWxlU3F3TFJrNnNDNFpPckFsZVdxd0pjbDZzQzdwaXJBbWlkcXdMVW9hc0MtNkdyQWhDanF3THdvNnNDWktTckFrR2xxd0prcGFzQzQ2V3JBcFNtcXdJQXFhc0NMNm1yQW91cXF3TEFxNnNDeXF1ckF0dXJxd0lWcktzQ1dhMnJBck90cXdJbHJxc0NRcTZyQW91dXF3TGZycXNDTzYtckF0U3Zxd0xxcjZzQ1U3R3JBcXV4cXdMSHNhc0NZcktyQXFpenF3SVd0S3NDR3JTckFpRzBxd0lsdEtzQ0tiU3JBZ3UxcXdLaHRhc0NKcmFyQWplMnF3THJ0cXNDaExlckFnZTRxd0k2dUtzQ2pyaXJBdHE0cXdMdnVLc0NDN21yQWpxNXF3TDV1YXNDUDdxckFsRzZxd0lKdTZzQ01idXJBank3cXdKOXU2c0N4THlyQW9IdEJRUEFkU1FFMDNna0JKRmQ5d1N3WGZjRXd0aWhEdmVSLXhMVzRmc1NJZXo3RWl3T19CSmxEdndTcmhQOEVqNFZfQktiRmZ3UzdCWDhFdkFYX0JJdkdQd1NaQmo4RW5rWV9CSWpHZndTU2hyOEV1a2JfQkxUSFB3UzZoejhFZzhlX0JKYm4tb1VJY2dNRllhOF95TSZleGs9MTc0MzY5MzAyNSZhd2JpZF9jPUFLQW1mLUNSYjNQc3ljYVcydFNWMDFnS0EwQUYwdXA1WWJHVDRUbV9odkNXT3gwNGw1d0VuWXd1c1o1ZXF3emw4bnZiTVcxaGtCSnQtZUJmZ3JKZllYSnhGVTZvVXBZeU81Um5ha05UZG83bmtCaVNRTXlmY2libUJ5YU9RR2VVYjVzeWpvWnFaTlBDaFVPMWFlRWJjUUxEendDNGlaNEhKR2tQWUplMWp6dzVfdkM2WHlkR2J5SSZhd2JpZF9kPUFLQW1mLUNiR3BySVd2UTJkMkcxNENHTjBjanlvX3ZFN1hBOHRXalJ0QUtmTUwwV2tYRW1vcXFzNlI1cmFKTW5BNU0zUmJWTFpFRUhfN3NLNndzYkZjT3YwNjhoMDhMcnBfbkp3LVd4dUR6NVlSdGlZS09ySGFsOGVtUzh6NGQ4N0JCRG5ZQzljSUM2eE8wSHlXeXpWRXJldlNiZVFYR0FvRHdTankzeTBMYlFyd1lzV2s2NUQzLTFjQkhSYUY4Zk0tc1VaTmE2VkktanpyUGRNeFJFNWtOWGhBTnJJZ1A2TFFQVmF4ZVNBSmE2VjhDbXJNbWNUMmZCek84SjhEQTdjdEhMOHViN0hXNzhNdWhNTHduUEVnSDAzYUpKaFg5MEtaTTU5U3ctc0F4NlhwbnRsUzNrX2lOOHF4WWh3Zy1yMmpKRG1wSmt2aV9oZlg1MVpUSlVGUG13YVFibi1XU1hKQ1ltT2ZIejk5VFZWWHBBRkFiZGhqZDd4NFl3TC1PSDJJU3ZLUWt1Q0VCV0ttSVhGamE1TVQ4cWtKSjRXM3ZOUnVwNmNiTmZ2aTF2cGFwYmlUbDViOXV0T0VVUS1xV29nZEl6UFJiTEhtQ1pxOEdXMkRhMU1KYjNaWXhlUzA4a254TTJqMTNtLXJUVE5RTjlpeDhsSzgzY0dqVzNma3Z5bURoMDNqOTFkSHJ2VFdFdUVlVVpaQl9udkUwX0lYelh3M2hXeDJSY1F2ODNGWnAwM2NDcmdXV05BcmFKMDNtMld3RTdjRkUtU3B1by1scU1QM2RabUdxMEpSRnptam1FUlN4ai1SZ056RmZUVmVRaTZHeVV5RlFEWWo3TnBQNGlNOVIxYWxxNHNxMmNqRW5tdFpIVldTa2dRdVI0OG5zVmJvbVpMdnVpOWlfYTVRaUdBMDJvU2tLSWpMSjdTeUIxdXNBRUxMeTdFTmJCbjIwbjhJXzU0RGFGT2lEQzRzNFlhYVBCYnJpWU1XUWNudmgwSENlSUg3OGxGRXhFUXQ5bG51RVFMZUJpcWp1V0FHQnhPN1Y1V1hpMHpFZUZjcnJEMkxobXlzWElGNm5HT0hWNGVyc3dvd3FzdFdUc0FjcjJEdVBpc0MzQ1lFRmhIbmNrZGNqZHE4ZlU0SC04cXZHeUUySFlrQUV2a3VHMFdKNVBjT3RKaTJsMXpiLUFULS1sMl9KLWlGa0xRbW9qY080OWNMWWtIN2pYRnFISnRROEtHUnNmeFBfRUpZS3ZKVVBsYlFCN3ZwelJaVm9laDVDT2h4bnM5ajhVRVh3aFdUTmZxUkxHdmJnVDNGbEZPZ3Q2N3YyNHRWdW85aGtOOURpeHdIbDFlQ29aSzZZZGFjdnNtZUtEbGc5MlFnU0pfUWtXMHh2ajZYR0p1ekk3RXQ5ZTF6WGQ4OWhqSENTZ1dpcmpDOEQxUVdYYnQ3SjBFX1h0bGp4UjNqMXJELWVWb1pWakV0VFNtOWVPRHpMUjBlN2lYZ3Zjem9xVDBDOUU4UEdUSDRVcjJnTnhVd2FwLVdXSjlqZDJhaGk5SHVlV2I5NzJYdm5zXzRRdXdXSW8zckhkQWtWcXR0bG8wcjBmc09TZlQ4MjNMdmcmY2lkPUNBUVNHd0RJQ2FhTlE3M3F4b0ZJS2MzTnBVcVZFXy1IWU9jQXhaSDJ6aGdCJmFfY2lkPYADAIgDAZADAJgDFKADAaoD_AEK1AFodHRwczovL3BhZ2VhZDIuZxLdFSomD6rNDPDXQ09KbGlOcHZTQS1jSGUtanRKYnQ3RkFZcnZ2MGN1VUpGallBUjJjUUtsNDBkQUgyZGFKeWxNcHdVQjNMMXkzak9FY1R1VjNjZm9TeXVmNExEQWZwcVh5dXhLOHR2RGVFRGxBejgzX3ljY1B5LV9adVEmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoTNDE0NDYxMDk0NzU3MDY0ODcxMCIINzg4Mjc4MTUqBDM5NDHAA9gEyAMA2AMA4AMA6AMA-AMDgAQAkgQJL29wZW5ydGIymAQAogQOMTg1KrkL8G2oBACyBAwIABAAGAAgADAAOAC4BADABADIBADaBAIIAeAEAPAEp6LLJYgFAZgFAKAFvur-9_D58d0oqgUqZTYxOGJkYzQtN2JjYS00YWRlLWFhZTEtOWVmY2U0ZGY5YWFhfjkzM34xwAUAyQUAAA6eGhTwP9IFCQkBCgEBNNgFAeAFAfAF2vgw-gUEAYgokAYAmAYAuAYAwQYBITQAAPA_0AbujwHaBhYKEAkSGQEBt6DgBgHyBgIIAIAHAYgHAKAHAaoHDDEyMjkyMjIzMTc0N8gHzoIG0gcNCRE3ATUI2gcGAW2wGADgBwDqBwIIAPAHkoAIiggCEACVCAAAgD-YCAHACKRD0ggJCPP__z8QABgA&s=14107629a934f866e350bc16bbbb25426a9e3df9&pp=8.426441
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 9869
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Tue, 28 Nov 2023 11:22:27 GMT
ETag: W/"623de86a-cf34"
Expires: Thu, 16 Nov 2023 08:37:34 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 3647, 30307
X-Served-By: cache-lga13626-LGA, cache-yul12827-YUL
X-Timer: S1701170548.731893,VS0,VE0

GET
H2 200 rd_log Show response
lax1-ib.adnxs.com/ Frame A139 0
648 B 119ms
117ms Script
text/html 104.254.151.36
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://lax1-ib.adnxs.com/rd_log?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QK0NfBMtBoAAAMA1gAFAQjymperBhCGjZPxqbanwjkYm6vwn9aQzMZZKjYJiGh0B7HTI0AR2liJeVbaIEAZAAAAIFyvQEAh2liJeVbaIEApiGgJJAQxAAUBsAhAMLGtxgg4sxlA5R5IZVCnosslWLrgfGAAaMmwRHjOggaAAQGKAQNVU0SSAQEG9IICmAHYBaABWqgBAbABALgBAsABBcgBAtABCdgBAOABAPABALICJGI1MDNiMDMwLTAwODgtNDM5Ni05MjlhLTkwZjI1MjlmOGJjNdgCpEPgAur5JeoCGWFueWZpbGUtbm90ZXBhZC5zZW1hYW4uY2HyAgwKBkhFSUdIVBICOTDyAgwKBVdJRFRIEgM3MjjyAiEKBkxPQURFUhIXcmVuZGVyX3Bvc3RfYWRzX3YxLmh0bWzyAhgKCklGUkFNRV9LRVkSCjE3NDM2OTMwMjXyAsgVCgtQUkVfU0NSSVBUUxK4FTxzY3JpcHQ-KGZ1bmN0aW9uKCl7LyoKCiBDb3B5cmlnaHQgVGhlIENsb3N1cmUgTGlicmFyeSBBdXRob3JzLgogU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjAKKi8KdmFyIGs9dGhpc3x8c2VsZjt2YXIgbD1BcnJheS5wcm90b3R5cGUuaW5kZXhPZj9mdW5jdGlvbihhLGMpe3JldHVybiBBcnJheS5wcm90b3R5cGUuaW5kZXhPZi5jYWxsKGEsYyx2b2lkIDApfTpmdW5jdGlvbihhLGMpe2lmKCJzdHJpbmciPT09dHlwZW9mIGEpcmV0dXJuInN0cmluZyIhPT10eXBlb2YgY3x8MSE9Yy5sZW5ndGg_LTE6YS5pbmRleE9mKGMsMCk7Zm9yKHZhciBlPTA7ZTxhLmxlbmd0aDtlKyspaWYoZSBpbiBhJiZhW2VdPT09YylyZXR1cm4gZTtyZXR1cm4tMX07ZnVuY3Rpb24gbShhKXttWyIgIl0oYSk7cmV0dXJuIGF9bVsiICJdPWZ1bmN0aSWVBH07MRR8IG4oYSl7YT12b2lkIDA9PT1hP2RvY3VtZW50OmE7cmUJQyQuY3JlYXRlRWxlARkYKCJpbWciKR1FSHAoYSxjLGUpe3ZhciBiPSExO2IZUoBiPyExOmI7YS5nb29nbGVfaW1hZ2VfcmVxdWVzdHN8fChaGgAQPVtdKTsBURRkPW4oYS4RlxApO2lmKA1rBGY9EcgIKCl7GRcEZz1aUwBALGg9bChnLGQpOzA8PWgmJkE6MgIkc3BsaWNlLmNhbAEnbGgsMSl9ZC5yZW1vdmVFdmVudExpc3RlbmVyJiZSFwA0KCJsb2FkIixmLCExKTtSIwBiOgAQZXJyb3INOxh9O2QuYWRkQnMAPhQAPnAAPiAAAW0-FAAAKDZqAFhiJiYoZC5hdHRyaWJ1dGlvblNyYz0iIgG-EHNyYz1jXrcBJC5wdXNoKGQpfQpZSwRxKEkBBGE9Maw0LmN1cnJlbnRTY3JpcHRNTwAoMm4CMG51bGw6YSkmJiI3NyJBgBAuZ2V0QQ2QOGUoImRhdGEtamMiKT9hOhVXPHF1ZXJ5U2VsZWN0b3IoJ1sNJQA9AUQMXScpfUU38ElyPVJlZ0V4cCgiXmh0dHBzPzovLyhcXHd8LSkrXFwuY2RuXFwuYW1wcHJvamVjdFxcLihuZXR8b3JnKShcXD98L3wkKSIpOwpmdYkABCB0FeAAawVhDGM9W10FCQRlPQHGDDtkb3tBrxhiPWE7dHJ5BQwAZEGtGGQ9ISFiJiYBJBwhPWIubG9jYSFqIC5ocmVmKWI6ewEtkG0oYi5mb28pO2Q9ITA7YnJlYWsgYn1jYXRjaChoKXt9ZD0hMX0BXghmPWQZFwBmARYMaWYoZil5AGc-XgAMO2U9YnU5BCYmGQwoLnJlZmVycmVyfHwBlyR9ZWxzZSBnPWUsDcsAYyngMG5ldyB1KGd8fCIiKSkF1RRhPWIucGEh1BmGAGEF_3h9fXdoaWxlKGEmJmIhPWEpO2I9MDtmb3IoYT1jLmxlgdZ0LTE7Yjw9YTsrK2IpY1tiXS5kZXB0aD1hLWI7Yj1rISs5HgGuNSo4YW5jZXN0b3JPcmlnaW5zbhwADWsAPR11ACkJhgwxO2E8EYpMOysrYSlnPWNbYV0sZy51cmx8fCgFCC5CATp2ABRbYS0KMV0hDBgsZy5oPSEwAeMpIgBrGash1WX_AGclFiUCBGU9MgQBIDA8PWU7LS1lKSG6RD1jW2VdLCFnJiZyLnRlc3QoZgGPICkmJihnPWYpLAUOLCYmIWYuaCl7Yj1mO0UbAH0NXQBlFeYEJiYBzAE7BDswQWUlWggmJmUFSAEbCCk7YwWtFHYoYixnKW2LGCBjLmc_Yy4F-gw6Yy5pAUAAfbFTBCB2odYcKXt0aGlzLmlB1QEJCGc9YxkiAHUdIgh1cmwRJBRoPSEhYzsFLwWIJQrdLwB3dUkgdCgpLGM9YS5p6X5AKCI_Iik7c2V0VGltZW91dCgRjA0xAGXZVhhlPy4wMTplQTVEIShNYXRoLnJhbmRvbSgpPmUpaQ8MYj1xKCGkACJl_zQ6Ly8iKyhiJiYidHJ1ZYFrAGJWawQ4LXJjZCIpPyJwYWdlYWQyzbcQc3luZGlpuSAtY24uY29tIjpmIwAFIAwpKyIvCUV4L2dlbl8yMDQ_aWQ9amNhJmpjPTc3JnZlcnNpb249IoVFDGQ9KGQBsQApobZSBAUALQ0xMCIpfHwidW5rbm93biJh41wrZCsiJnNhbXBsZT0iK2U7Yj13aW5kb3cFWABmOTQAZuGKAGYhMzRkPWIubmF2aWdhdG9yKTIOAFAudXNlckFnZW50LGQ9L0Nocm9tZS9JmyBkKSYmIS9FZGcZERw_ITA6ITE7ZGGTFVEwLnNlbmRCZWFjb24_Ch1pHRgkKGUpOnAoYixlLCJ6CAmeECl9fSwwVaAsMDw9Yz9hLnN1YnN0DloJHCgwLGMpOmF9CeAMLnJmbC4CCBqvCGhlbmNvZGVVUklDb21wb25lbnQodygpKX07fSnp20GaFCk7Cjwvc8WYbD7yAt4CCgpFWFRSQV9UQUdTEs8CPGRpdiBzdHkhUgxwb3NpobFkOiBhYnNvbHV0ZTsgbGVmdDogMHB4OyB0b3ANCmR2aXNpYmlsaXR5OiBoaWRkZW47Ij48aW1nIOFMVYdJFEpZAkE2DR4uMgIUYXdiaWQmBQbwn19iPUFLQW1mLUJSTUZuaEVFeDBRdjdsLXl3X3VBVGZVZmtydFhiaVU3d2pvUUdWWjcxZDktV0pJY0hzMng1enYtUHR0UXN0YUFxakszSDZsYmdqZENicXlTN2ZLRXlleUQ0TTRXdENfdUhJNFJPRlZ0VjFxeG9pdlJjIiBib3JkZXI9MCB3aWR0aD0xIGhlaWdodD0xIGFsdD0iIiBzdHkhL6BkaXNwbGF5Om5vbmUiPjwvZGl2PvICmgEKDFBPU1RfU0NSSVBUUxKJARovDDYdARYlClBhZHMuZy5kb3VibGVjbGljay5uZXQxGzx4YmZlX2JhY2tmaWxsLmpzAWUtyg1TLoIMJCB7cjNweCgnMTceuwwcJyk7fSkoKTtdABCaFgoQSAGeNFBPUlRfUEFSQU1TEoUWkTmKlQDgYWRmZXRjaD9hZGs9MTg1MDAxMjI3MCZhZHNhZmU9bWVkaXVtJmNsaWVudD1jYS1wdWItMzA3Njg5ASpkNzQxNDY3JmZvcm1hdD03Mjh4OTBfYXMmaXABTLAuMTkzLjY0LjEzNCZvdXRwdXQ9aHRtbCZwc2Q9VzEwJTNEJnVudmlld2VkX3BNrCBfc3RhcnQ9MSall14iDhAmc3ViXw2VAGJBsfB9ci00NzEwMTI0JmhsPWVuJmFjZWlkPU1La0RId0NNaHpRQm9JODBBWFNSTkFHUmt6UUJDNVEwQVZHVU5BRlNsVFFCajVVMEFiQ1ZOQUVJbGpRQktKWTBBWENXTkFGMGxqUUJkcFkwQVh5V05BR09salFCa1pZMEFhQ1dOQUdvARAscTVZMEFhMldOQUhEARAANAEQBGVXARAAbQEQADYBEBxmaVdOQUVCbAGAKHBjMEFUQ1hOQUU1ARAsUUpjMEFVR1hOQUZIARAAVQEQBFZPARAAZgEQAFkBEPSgCld5WE5BRzNiRUVCUzNOQkFVMXpRUUZhUE5vQl9mY2VBamItaUFMQV9vZ0M0VG1xQWlkQ3FnSTdXcW9DbEdxcUF2NTRxZ0pVa2FvQ1c1R3FBb0NicWdLQm02b0NncHVxQXBxb3FnS2lxS29DTTd1cUFvYk5xZ0pDLUtvQ1FmdXFBclFGcXdLRUo2c0NWQ2lyQXZzcnF3TFVOcXNDSlRxckFpazZxd0l0T3FzQ2IwZXJBbXhLcXdKZ1Rxc0N1RTZyQWlCUXF3TDBVS3NDQWxHckFncFJxd0xzVjZzQ0lGeXJBamRjcXdJYWFhc0M0R3FyQWh0eHF3THhjYXNDZ0hPckFzeDBxd0lZZDZzQ0hIZXJBaUozcXdJbmQ2c0NMSGVyQWdwNXF3TFllcXNDVTRDckFwR0Jxd0tjZ2FzQ2NvZXJBdTJKcXdLZ2lxc0M3SXFyQW1pTHF3TElpNnNDOVl1ckFnQ01xd0t4aktzQ3M0eXJBcmlNcXdJdmphc0NBcENyQWxlU3F3TFJrNnNDNFpPckFsZVdxd0pjbDZzQzdwaXJBbWlkcXdMVW9hc0MtNkdyQWhDanF3THdvNnNDWktTckFrR2xxd0prcGFzQzQ2V3JBcFNtcXdJQXFhc0NMNm1yQW91cXF3TEFxNnNDeXF1ckF0dXJxd0lWcktzQ1dhMnJBck90cXdJbHJxc0NRcTZyQW91dXF3TGZycXNDTzYtckF0U3Zxd0xxcjZzQ1U3R3JBcXV4cXdMSHNhc0NZcktyQXFpenF3SVd0S3NDR3JTckFpRzBxd0lsdEtzQ0tiU3JBZ3UxcXdLaHRhc0NKcmFyQWplMnF3THJ0cXNDaExlckFnZTRxd0k2dUtzQ2pyaXJBdHE0cXdMdnVLc0NDN21yQWpxNXF3TDV1YXNDUDdxckFsRzZxd0lKdTZzQ01idXJBank3cXdKOXU2c0N4THlyQW9IdEJRUEFkU1FFMDNna0JKRmQ5d1N3WGZjRXd0aWhEdmVSLXhMVzRmc1NJZXo3RWl3T19CSmxEdndTcmhQOEVqNFZfQktiRmZ3UzdCWDhFdkFYX0JJdkdQd1NaQmo4RW5rWV9CSWpHZndTU2hyOEV1a2JfQkxUSFB3UzZoejhFZzhlX0JKYm4tb1VJY2dNRllhOF95TSZleGs9MTc0MzY5MzAyNSZhd2JpZF9jPUFLQW1mLUNSYjNQc3ljYVcydFNWMDFnS0EwQUYwdXA1WWJHVDRUbV9odkNXT3gwNGw1d0VuWXd1c1o1ZXF3emw4bnZiTVcxaGtCSnQtZUJmZ3JKZllYSnhGVTZvVXBZeU81Um5ha05UZG83bmtCaVNRTXlmY2libUJ5YU9RR2VVYjVzeWpvWnFaTlBDaFVPMWFlRWJjUUxEendDNGlaNEhKR2tQWUplMWp6dzVfdkM2WHlkR2J5SSZhd2JpZF9kPUFLQW1mLUNiR3BySVd2UTJkMkcxNENHTjBjanlvX3ZFN1hBOHRXalJ0QUtmTUwwV2tYRW1vcXFzNlI1cmFKTW5BNU0zUmJWTFpFRUhfN3NLNndzYkZjT3YwNjhoMDhMcnBfbkp3LVd4dUR6NVlSdGlZS09ySGFsOGVtUzh6NGQ4N0JCRG5ZQzljSUM2eE8wSHlXeXpWRXJldlNiZVFYR0FvRHdTankzeTBMYlFyd1lzV2s2NUQzLTFjQkhSYUY4Zk0tc1VaTmE2VkktanpyUGRNeFJFNWtOWGhBTnJJZ1A2TFFQVmF4ZVNBSmE2VjhDbXJNbWNUMmZCek84SjhEQTdjdEhMOHViN0hXNzhNdWhNTHduUEVnSDAzYUpKaFg5MEtaTTU5U3ctc0F4NlhwbnRsUzNrX2lOOHF4WWh3Zy1yMmpKRG1wSmt2aV9oZlg1MVpUSlVGUG13YVFibi1XU1hKQ1ltT2ZIejk5VFZWWHBBRkFiZGhqZDd4NFl3TC1PSDJJU3ZLUWt1Q0VCV0ttSVhGamE1TVQ4cWtKSjRXM3ZOUnVwNmNiTmZ2aTF2cGFwYmlUbDViOXV0T0VVUS1xV29nZEl6UFJiTEhtQ1pxOEdXMkRhMU1KYjNaWXhlUzA4a254TTJqMTNtLXJUVE5RTjlpeDhsSzgzY0dqVzNma3Z5bURoMDNqOTFkSHJ2VFdFdUVlVVpaQl9udkUwX0lYelh3M2hXeDJSY1F2ODNGWnAwM2NDcmdXV05BcmFKMDNtMld3RTdjRkUtU3B1by1scU1QM2RabUdxMEpSRnptam1FUlN4ai1SZ056RmZUVmVRaTZHeVV5RlFEWWo3TnBQNGlNOVIxYWxxNHNxMmNqRW5tdFpIVldTa2dRdVI0OG5zVmJvbVpMdnVpOWlfYTVRaUdBMDJvU2tLSWpMSjdTeUIxdXNBRUxMeTdFTmJCbjIwbjhJXzU0RGFGT2lEQzRzNFlhYVBCYnJpWU1XUWNudmgwSENlSUg3OGxGRXhFUXQ5bG51RVFMZUJpcWp1V0FHQnhPN1Y1V1hpMHpFZUZjcnJEMkxobXlzWElGNm5HT0hWNGVyc3dvd3FzdFdUc0FjcjJEdVBpc0MzQ1lFRmhIbmNrZGNqZHE4ZlU0SC04cXZHeUUySFlrQUV2a3VHMFdKNVBjT3RKaTJsMXpiLUFULS1sMl9KLWlGa0xRbW9qY080OWNMWWtIN2pYRnFISnRROEtHUnNmeFBfRUpZS3ZKVVBsYlFCN3ZwelJaVm9laDVDT2h4bnM5ajhVRVh3aFdUTmZxUkxHdmJnVDNGbEZPZ3Q2N3YyNHRWdW85aGtOOURpeHdIbDFlQ29aSzZZZGFjdnNtZUtEbGc5MlFnU0pfUWtXMHh2ajZYR0p1ekk3RXQ5ZTF6WGQ4OWhqSENTZ1dpcmpDOEQxUVdYYnQ3SjBFX1h0bGp4UjNqMXJELWVWb1pWakV0VFNtOWVPRHpMUjBlN2lYZ3Zjem9xVDBDOUU4UEdUSDRVcjJnTnhVd2FwLVdXSjlqZDJhaGk5SHVlV2I5NzJYdm5zXzRRdXdXSW8zckhkQWtWcXR0bG8wcjBmc09TZlQ4MjNMdmcmY2lkPUNBUVNHd0RJQ2FhTlE3M3F4b0ZJS2MzTnBVcVZFXy1IWU9jQXhaSDJ6aGdCJmFfY2lkPYADAIgDAZADAJgDFKADAaoDAMAD2ATIAwDYAwDgAwDoAwD4AwOABACSBAkvb3BlbnJ0YjKYBACiBA4xODUuMTkzLjY0LjEzNKgEALIEDAgAEAAYACAAMAA4ArgEAMAEAMgEANoEAggB4AQA8ASnossliAUBmAUAoAW-6v738Pnx3SiqBSplNjE4YmRjNC03YmNhLTRhZGUtYWFlMS05ZWZjZTRkZjlhYWF-OTMzfjHABQDJBQAAAAAAAPA_0gUJCQAAAAAAAAAA2AUB4AUB8AXa-DD6BQQIABAAkAYAmAYAuAYAwQYAAAAAAADwP9AG7o8B2gYWChAAAAAAAAAAAAAAAAAAAAAAEAAYAOAGAfIGAggAgAcBiAcAoAcBqgcMMTIyOTIyMjMxNzQ3yAfOggbSBw0JAAAAAAAAAAAQABgA2gcGCAAQABgA4AcA6gcCCADwB5KACIoIAhAAlQgAAIA_mAgBwAikQ9IICQjz__8_EAAYAA..&s=b9681c499268c1eea6757831522fc9b4b679af7c&bdref=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fanyfile-notepad.semaan.ca%2Fapp,about%3Ablank&

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.151.36 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:27 GMT
an-x-request-uuid: 3fc83dba-24cc-4e82-a892-9f42b01942af
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 185.193.64.134; 185.193.64.134; 897.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 nwpBtKy2OAdR1K-IwhWudF-R9QMylBJAV3Bo8Kzm62EK9Cs.woff2
fonts.gstatic.com/s/sourcesans3/v15/ Frame 6907 15 KB
16 KB 348ms
32ms Font
font/woff2 172.253.122.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesans3/v15/nwpBtKy2OAdR1K-IwhWudF-R9QMylBJAV3Bo8Kzm62EK9Cs.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Saira+Extra+Condensed:wght@800&family=Saira+Semi+Condensed:wght@600&family=Source+Sans+3:wght@300&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f94.1e100.net

Software

sffe /

Resource Hash

e726898e2fa171f2f6a4a9101809949cc803379057c4ba5ea1ab4d39aaf90c84

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://s0.2mdn.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 20:04:18 GMT
x-content-type-options: nosniff
age: 55090
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15476
x-xss-protection: 0
last-modified: Tue, 24 Oct 2023 01:41:25 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 26 Nov 2024 20:04:18 GMT

GET
H3 200 GoogleSansText-Medium_94d9b4c00ce6f3b61568cad8f620beaf.woff
s0.2mdn.net/sadbundle/6452581308981405529/ Frame 6907 5 KB
5 KB 35ms
34ms Font
font/woff 172.253.63.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/6452581308981405529/GoogleSansText-Medium_94d9b4c00ce6f3b61568cad8f620beaf.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6452581308981405529/fonts_e01f9d5646d9b7b21483a71575e46d16.css

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.149 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

sffe /

Resource Hash

becbb363396fb6c52c2db7dca4e886676d706eb9bca0d80ceaeda864293dc85a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/6452581308981405529/fonts_e01f9d5646d9b7b21483a71575e46d16.css
Origin: https://s0.2mdn.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 22 Nov 2023 16:36:57 GMT
x-content-type-options: nosniff
age: 499530
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4640
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 19:30:40 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 21 Nov 2024 16:36:57 GMT

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame A7A2 0
597 B 29ms
29ms Script
text/html 68.67.161.182
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=3251&pub_id=1623654&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=3251&pub_id=1623654

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.161.182 Brooklyn, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:27 GMT
an-x-request-uuid: 954a3a7a-8626-45ac-bb14-574d98965630
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
cache-control: no-store, no-cache, private
x-proxy-origin: 185.193.64.134; 185.193.64.134; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A7F1 0
20 B 57ms
56ms Image
image/gif 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=awbid&awbid_b=AKAmf-BRMFnhEEx0Qv7l-yw_uATfUfkrtXbiU7wjoQGVZ71d9-WJIcHs2x5zv-PttQstaAqjK3H6lbgjdCbqyS7fKEyeyD4M4WtC_uHI4ROFVtV1qxoivRc

Requested by

Host: lax1-ib.adnxs.com
URL: https://lax1-ib.adnxs.com/if?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QKxN_BMsRsAAAMA1gAFAQjymperBhCGjZPxqbanwjkYm6vwn9aQzMZZKjYJiGh0B7HTI0AR2liJeVbaIEAZAAAAIFyvQEAh2liJeVbaIEApiGgJJAQxAAUBsAhAMLGtxgg4sxlA5R5IZVCnosslWLrgfGAAaMmwRHjOggaAAQGKAQNVU0SSAQEG9IICmAHYBaABWqgBAbABALgBAsABBcgBAtABCdgBAOABAPABALICJGI1MDNiMDMwLTAwODgtNDM5Ni05MjlhLTkwZjI1MjlmOGJjNdgCpEPgAur5JeoCGWFueWZpbGUtbm90ZXBhZC5zZW1hYW4uY2HyAgwKBkhFSUdIVBICOTDyAgwKBVdJRFRIEgM3MjjyAiEKBkxPQURFUhIXcmVuZGVyX3Bvc3RfYWRzX3YxLmh0bWzyAhgKCklGUkFNRV9LRVkSCjE3NDM2OTMwMjXyAsgVCgtQUkVfU0NSSVBUUxK4FTxzY3JpcHQ-KGZ1bmN0aW9uKCl7LyoKCiBDb3B5cmlnaHQgVGhlIENsb3N1cmUgTGlicmFyeSBBdXRob3JzLgogU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjAKKi8KdmFyIGs9dGhpc3x8c2VsZjt2YXIgbD1BcnJheS5wcm90b3R5cGUuaW5kZXhPZj9mdW5jdGlvbihhLGMpe3JldHVybiBBcnJheS5wcm90b3R5cGUuaW5kZXhPZi5jYWxsKGEsYyx2b2lkIDApfTpmdW5jdGlvbihhLGMpe2lmKCJzdHJpbmciPT09dHlwZW9mIGEpcmV0dXJuInN0cmluZyIhPT10eXBlb2YgY3x8MSE9Yy5sZW5ndGg_LTE6YS5pbmRleE9mKGMsMCk7Zm9yKHZhciBlPTA7ZTxhLmxlbmd0aDtlKyspaWYoZSBpbiBhJiZhW2VdPT09YylyZXR1cm4gZTtyZXR1cm4tMX07ZnVuY3Rpb24gbShhKXttWyIgIl0oYSk7cmV0dXJuIGF9bVsiICJdPWZ1bmN0aSWVBH07MRR8IG4oYSl7YT12b2lkIDA9PT1hP2RvY3VtZW50OmE7cmUJQyQuY3JlYXRlRWxlARkYKCJpbWciKR1FSHAoYSxjLGUpe3ZhciBiPSExO2IZUoBiPyExOmI7YS5nb29nbGVfaW1hZ2VfcmVxdWVzdHN8fChaGgAQPVtdKTsBURRkPW4oYS4RlxApO2lmKA1rBGY9EcgIKCl7GRcEZz1aUwBALGg9bChnLGQpOzA8PWgmJkE6MgIkc3BsaWNlLmNhbAEnbGgsMSl9ZC5yZW1vdmVFdmVudExpc3RlbmVyJiZSFwA0KCJsb2FkIixmLCExKTtSIwBiOgAQZXJyb3INOxh9O2QuYWRkQnMAPhQAPnAAPiAAAW0-FAAAKDZqAFhiJiYoZC5hdHRyaWJ1dGlvblNyYz0iIgG-EHNyYz1jXrcBJC5wdXNoKGQpfQpZSwRxKEkBBGE9Maw0LmN1cnJlbnRTY3JpcHRNTwAoMm4CMG51bGw6YSkmJiI3NyJBgBAuZ2V0QQ2QOGUoImRhdGEtamMiKT9hOhVXPHF1ZXJ5U2VsZWN0b3IoJ1sNJQA9AUQMXScpfUU38ElyPVJlZ0V4cCgiXmh0dHBzPzovLyhcXHd8LSkrXFwuY2RuXFwuYW1wcHJvamVjdFxcLihuZXR8b3JnKShcXD98L3wkKSIpOwpmdYkABCB0FeAAawVhDGM9W10FCQRlPQHGDDtkb3tBrxhiPWE7dHJ5BQwAZEGtGGQ9ISFiJiYBJBwhPWIubG9jYSFqIC5ocmVmKWI6ewEtkG0oYi5mb28pO2Q9ITA7YnJlYWsgYn1jYXRjaChoKXt9ZD0hMX0BXghmPWQZFwBmARYMaWYoZil5AGc-XgAMO2U9YnU5BCYmGQwoLnJlZmVycmVyfHwBlyR9ZWxzZSBnPWUsDcsAYyngMG5ldyB1KGd8fCIiKSkF1RRhPWIucGEh1BmGAGEF_3h9fXdoaWxlKGEmJmIhPWEpO2I9MDtmb3IoYT1jLmxlgdZ0LTE7Yjw9YTsrK2IpY1tiXS5kZXB0aD1hLWI7Yj1rISs5HgGuNSo4YW5jZXN0b3JPcmlnaW5zbhwADWsAPR11ACkJhgwxO2E8EYpMOysrYSlnPWNbYV0sZy51cmx8fCgFCC5CATp2ABRbYS0KMV0hDBgsZy5oPSEwAeMpIgBrGash1WX_AGclFiUCBGU9MgQBIDA8PWU7LS1lKSG6RD1jW2VdLCFnJiZyLnRlc3QoZgGPICkmJihnPWYpLAUOLCYmIWYuaCl7Yj1mO0UbAH0NXQBlFeYEJiYBzAE7BDswQWUlWggmJmUFSAEbCCk7YwWtFHYoYixnKW2LGCBjLmc_Yy4F-gw6Yy5pAUAAfbFTBCB2odYcKXt0aGlzLmlB1QEJCGc9YxkiAHUdIgh1cmwRJBRoPSEhYzsFLwWIJQrdLwB3dUkgdCgpLGM9YS5p6X5AKCI_Iik7c2V0VGltZW91dCgRjA0xAGXZVhhlPy4wMTplQTVEIShNYXRoLnJhbmRvbSgpPmUpaQ8MYj1xKCGkACJl_zQ6Ly8iKyhiJiYidHJ1ZYFrAGJWawQ4LXJjZCIpPyJwYWdlYWQyzbcQc3luZGlpuSAtY24uY29tIjpmIwAFIAwpKyIvCUV4L2dlbl8yMDQ_aWQ9amNhJmpjPTc3JnZlcnNpb249IoVFDGQ9KGQBsQApobZSBAUALQ0xMCIpfHwidW5rbm93biJh41wrZCsiJnNhbXBsZT0iK2U7Yj13aW5kb3cFWABmOTQAZuGKAGYhMzRkPWIubmF2aWdhdG9yKTIOAFAudXNlckFnZW50LGQ9L0Nocm9tZS9JmyBkKSYmIS9FZGcZERw_ITA6ITE7ZGGTFVEwLnNlbmRCZWFjb24_Ch1pHRgkKGUpOnAoYixlLCJ6CAmeECl9fSwwVaAsMDw9Yz9hLnN1YnN0DloJHCgwLGMpOmF9CeAMLnJmbC4CCBqvCGhlbmNvZGVVUklDb21wb25lbnQodygpKX07fSnp20GaFCk7Cjwvc8WYbD7yAt4CCgpFWFRSQV9UQUdTEs8CPGRpdiBzdHkhUgxwb3NpobFkOiBhYnNvbHV0ZTsgbGVmdDogMHB4OyB0b3ANCmR2aXNpYmlsaXR5OiBoaWRkZW47Ij48aW1nIOFMVYdJFEpZAkE2DR4uMgIUYXdiaWQmBQbwn19iPUFLQW1mLUJSTUZuaEVFeDBRdjdsLXl3X3VBVGZVZmtydFhiaVU3d2pvUUdWWjcxZDktV0pJY0hzMng1enYtUHR0UXN0YUFxakszSDZsYmdqZENicXlTN2ZLRXlleUQ0TTRXdENfdUhJNFJPRlZ0VjFxeG9pdlJjIiBib3JkZXI9MCB3aWR0aD0xIGhlaWdodD0xIGFsdD0iIiBzdHkhL6BkaXNwbGF5Om5vbmUiPjwvZGl2PvICmgEKDFBPU1RfU0NSSVBUUxKJARovDDYdARYlClBhZHMuZy5kb3VibGVjbGljay5uZXQxGzx4YmZlX2JhY2tmaWxsLmpzAWUtyg1TLoIMJCB7cjNweCgnMTceuwwcJyk7fSkoKTtdABCaFgoQSAGeNFBPUlRfUEFSQU1TEoUWkTmKlQDgYWRmZXRjaD9hZGs9MTg1MDAxMjI3MCZhZHNhZmU9bWVkaXVtJmNsaWVudD1jYS1wdWItMzA3Njg5ASpkNzQxNDY3JmZvcm1hdD03Mjh4OTBfYXMmaXABTLAuMTkzLjY0LjEzNCZvdXRwdXQ9aHRtbCZwc2Q9VzEwJTNEJnVudmlld2VkX3BNrCBfc3RhcnQ9MSall14iDhAmc3ViXw2VAGJBsfB9ci00NzEwMTI0JmhsPWVuJmFjZWlkPU1La0RId0NNaHpRQm9JODBBWFNSTkFHUmt6UUJDNVEwQVZHVU5BRlNsVFFCajVVMEFiQ1ZOQUVJbGpRQktKWTBBWENXTkFGMGxqUUJkcFkwQVh5V05BR09salFCa1pZMEFhQ1dOQUdvARAscTVZMEFhMldOQUhEARAANAEQBGVXARAAbQEQADYBEBxmaVdOQUVCbAGAKHBjMEFUQ1hOQUU1ARAsUUpjMEFVR1hOQUZIARAAVQEQBFZPARAAZgEQAFkBEPRTCVd5WE5BRzNiRUVCUzNOQkFVMXpRUUZhUE5vQl9mY2VBamItaUFMQV9vZ0M0VG1xQWlkQ3FnSTdXcW9DbEdxcUF2NTRxZ0pVa2FvQ1c1R3FBb0NicWdLQm02b0NncHVxQXBxb3FnS2lxS29DTTd1cUFvYk5xZ0pDLUtvQ1FmdXFBclFGcXdLRUo2c0NWQ2lyQXZzcnF3TFVOcXNDSlRxckFpazZxd0l0T3FzQ2IwZXJBbXhLcXdKZ1Rxc0N1RTZyQWlCUXF3TDBVS3NDQWxHckFncFJxd0xzVjZzQ0lGeXJBamRjcXdJYWFhc0M0R3FyQWh0eHF3THhjYXNDZ0hPckFzeDBxd0lZZDZzQ0hIZXJBaUozcXdJbmQ2c0NMSGVyQWdwNXF3TFllcXNDVTRDckFwR0Jxd0tjZ2FzQ2NvZXJBdTJKcXdLZ2lxc0M3SXFyQW1pTHF3TElpNnNDOVl1ckFnQ01xd0t4aktzQ3M0eXJBcmlNcXdJdmphc0NBcENyQWxlU3F3TFJrNnNDNFpPckFsZVdxd0pjbDZzQzdwaXJBbWlkcXdMVW9hc0MtNkdyQWhDanF3THdvNnNDWktTckFrR2xxd0prcGFzQzQ2V3JBcFNtcXdJQXFhc0NMNm1yQW91cXF3TEFxNnNDeXF1ckF0dXJxd0lWcktzQ1dhMnJBck90cXdJbHJxc0NRcTZyQW91dXF3TGZycXNDTzYtckF0U3Zxd0xxcjZzQ1U3R3JBcXV4cXdMSHNhc0NZcktyQXFpenF3SVd0S3NDR3JTckFpRzBxd0lsdEtzQ0tiU3JBZ3UxcXdLaHRhc0NKcmFyQWplMnF3THJ0cXNDaExlckFnZTRxd0k2dUtzQ2pyaXJBdHE0cXdMdnVLc0NDN21yQWpxNXF3TDV1YXNDUDdxckFsRzZxd0lKdTZzQ01idXJBank3cXdKOXU2c0N4THlyQW9IdEJRUEFkU1FFMDNna0JKRmQ5d1N3WGZjRXd0aWhEdmVSLXhMVzRmc1NJZXo3RWl3T19CSmxEdndTcmhQOEVqNFZfQktiRmZ3UzdCWDhFdkFYX0JJdkdQd1NaQmo4RW5rWV9CSWpHZndTU2hyOEV1a2JfQkxUSFB3UzZoejhFZzhlX0JKYm4tb1VJY2dNRllhOF95TSZleGs9MTc0MzY5MzAyNSZhd2JpZF9jPUFLQW1mLUNSYjNQc3ljYVcydFNWMDFnS0EwQUYwdXA1WWJHVDRUbV9odkNXT3gwNGw1d0VuWXd1c1o1ZXF3emw4bnZiTVcxaGtCSnQtZUJmZ3JKZllYSnhGVTZvVXBZeU81Um5ha05UZG83bmtCaVNRTXlmY2libUJ5YU9RR2VVYjVzeWpvWnFaTlBDaFVPMWFlRWJjUUxEendDNGlaNEhKR2tQWUplMWp6dzVfdkM2WHlkR2J5SSZhd2JpZF9kPUFLQW1mLUNiR3BySVd2UTJkMkcxNENHTjBjanlvX3ZFN1hBOHRXalJ0QUtmTUwwV2tYRW1vcXFzNlI1cmFKTW5BNU0zUmJWTFpFRUhfN3NLNndzYkZjT3YwNjhoMDhMcnBfbkp3LVd4dUR6NVlSdGlZS09ySGFsOGVtUzh6NGQ4N0JCRG5ZQzljSUM2eE8wSHlXeXpWRXJldlNiZVFYR0FvRHdTankzeTBMYlFyd1lzV2s2NUQzLTFjQkhSYUY4Zk0tc1VaTmE2VkktanpyUGRNeFJFNWtOWGhBTnJJZ1A2TFFQVmF4ZVNBSmE2VjhDbXJNbWNUMmZCek84SjhEQTdjdEhMOHViN0hXNzhNdWhNTHduUEVnSDAzYUpKaFg5MEtaTTU5U3ctc0F4NlhwbnRsUzNrX2lOOHF4WWh3Zy1yMmpKRG1wSmt2aV9oZlg1MVpUSlVGUG13YVFibi1XU1hKQ1ltT2ZIejk5VFZWWHBBRkFiZGhqZDd4NFl3TC1PSDJJU3ZLUWt1Q0VCV0ttSVhGamE1TVQ4cWtKSjRXM3ZOUnVwNmNiTmZ2aTF2cGFwYmlUbDViOXV0T0VVUS1xV29nZEl6UFJiTEhtQ1pxOEdXMkRhMU1KYjNaWXhlUzA4a254TTJqMTNtLXJUVE5RTjlpeDhsSzgzY0dqVzNma3Z5bURoMDNqOTFkSHJ2VFdFdUVlVVpaQl9udkUwX0lYelh3M2hXeDJSY1F2ODNGWnAwM2NDcmdXV05BcmFKMDNtMld3RTdjRkUtU3B1by1scU1QM2RabUdxMEpSRnptam1FUlN4ai1SZ056RmZUVmVRaTZHeVV5RlFEWWo3TnBQNGlNOVIxYWxxNHNxMmNqRW5tdFpIVldTa2dRdVI0OG5zVmJvbVpMdnVpOWlfYTVRaUdBMDJvU2tLSWpMSjdTeUIxdXNBRUxMeTdFTmJCbjIwbjhJXzU0RGFGT2lEQzRzNFlhYVBCYnJpWU1XUWNudmgwSENlSUg3OGxGRXhFUXQ5bG51RVFMZUJpcWp1V0FHQnhPN1Y1V1hpMHpFZUZjcnJEMkxobXlzWElGNm5HT0hWNGVyc3dvd3FzdFdUc0FjcjJEdVBpc0MzQ1lFRmhIbmNrZGNqZHE4ZlU0SC04cXZHeUUySFlrQUV2a3VHMFdKNVBjT3RKaTJsMXpiLUFULS1sMl9KLWlGa0xRbW9qY080OWNMWWtIN2pYRnFISnRROEtHUnNmeFBfRUpZS3ZKVVBsYlFCN3ZwelJaVm9laDVDT2h4bnM5ajhVRVh3aFdUTmZxUkxHdmJnVDNGbEZPZ3Q2N3YyNHRWdW85aGtOOURpeHdIbDFlQ29aSzZZZGFjdnNtZUtEbGc5MlFnU0pfUWtXMHh2ajZYR0p1ekk3RXQ5ZTF6WGQ4OWhqSENTZ1dpcmpDOEQxUVdYYnQ3SjBFX1h0bGp4UjNqMXJELWVWb1pWakV0VFNtOWVPRHpMUjBlN2lYZ3Zjem9xVDBDOUU4UEdUSDRVcjJnTnhVd2FwLVdXSjlqZDJhaGk5SHVlV2I5NzJYdm5zXzRRdXdXSW8zckhkQWtWcXR0bG8wcjBmc09TZlQ4MjNMdmcmY2lkPUNBUVNHd0RJQ2FhTlE3M3F4b0ZJS2MzTnBVcVZFXy1IWU9jQXhaSDJ6aGdCJmFfY2lkPYADAIgDAZADAJgDFKADAaoD_AEK1AFodHRwczovL3BhZ2VhZDIuZxLdFSomD6rNDPDXQ09KbGlOcHZTQS1jSGUtanRKYnQ3RkFZcnZ2MGN1VUpGallBUjJjUUtsNDBkQUgyZGFKeWxNcHdVQjNMMXkzak9FY1R1VjNjZm9TeXVmNExEQWZwcVh5dXhLOHR2RGVFRGxBejgzX3ljY1B5LV9adVEmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoTNDE0NDYxMDk0NzU3MDY0ODcxMCIINzg4Mjc4MTUqBDM5NDHAA9gEyAMA2AMA4AMA6AMA-AMDgAQAkgQJL29wZW5ydGIymAQAogQOMTg1KrkL8G2oBACyBAwIABAAGAAgADAAOAK4BADABADIBADaBAIIAeAEAPAEp6LLJYgFAZgFAKAFvur-9_D58d0oqgUqZTYxOGJkYzQtN2JjYS00YWRlLWFhZTEtOWVmY2U0ZGY5YWFhfjkzM34xwAUAyQUAAA6eGhTwP9IFCQkBCgEBNNgFAeAFAfAF2vgw-gUEAYgokAYAmAYAuAYAwQYBITQAAPA_0AbujwHaBhYKEAkSGQEBt6DgBgHyBgIIAIAHAYgHAKAHAaoHDDEyMjkyMjIzMTc0N8gHzoIG0gcNCRE3ATUI2gcGAW2wGADgBwDqBwIIAPAHkoAIiggCEACVCAAAgD-YCAHACKRD0ggJCPP__z8QABgA&s=fbea6d2d622b67e49fa4da28ac4cbaa94b7b5cd2

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://lax1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:27 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 xbfe_backfill.js Show response
googleads.g.doubleclick.net/pagead/ Frame A7F1 7 KB
3 KB 33ms
32ms Script
text/javascript 142.251.167.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/xbfe_backfill.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6cf4189247ceccbc67687e6bbc383d0ca3d9739c8b8429296c03909b1933777a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://lax1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 10:29:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3185
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3343
x-xss-protection: 0
server: cafe
etag: 3680861016058904691
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Tue, 28 Nov 2023 11:29:22 GMT

GET
H2 200 it
lax1-ib.adnxs.com/ Frame A7F1 0
648 B 131ms
131ms Image
text/html 104.254.151.36
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lax1-ib.adnxs.com/it?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QLqBvBMagMAAAMA1gAFAQjymperBhCGjZPxqbanwjkYm6vwn9aQzMZZKjYJiGh0B7HTI0AR2liJeVbaIEAZAAAAIFyvQEAh2liJeVbaIEApiGgJJAQxAAUBsAhAMLGtxgg4sxlA5R5IZVCnosslWLrgfGAAaMmwRHjOggaAAQGKAQNVU0SSAQEG8MKYAdgFoAFaqAEDsAEAuAEBwAEFyAEC0AEJ2AEA4AEA8AEAsgIkYjUwM2IwMzAtMDA4OC00Mzk2LTkyOWEtOTBmMjUyOWY4YmM12AKkQ-AC6vkl6gIZYW55ZmlsZS1ub3RlcGFkLnNlbWFhbi5jYYADAIgDAZADAJgDFKADAaoD_AEK1AFodHRwczovL3BhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24uY29tL3BhZ2VhZC9nZW5fMjA0P2lkPWF3YmlkJmEBBvSbAV9iPUFLQW1mLUNPSmxpTnB2U0EtY0hlLWp0SmJ0N0ZBWXJ2djBjdVVKRmpZQVIyY1FLbDQwZEFIMmRhSnlsTXB3VUIzTDF5M2pPRWNUdVYzY2ZvU3l1ZjRMREFmcHFYeXV4Szh0dkRlRURsQXo4M195Y2NQeS1fWnVRJnByPTEwOiR7QVVDVElPTl9QUklDRX0aEzQxNDQ2MTA5NDc1NzA2NDg3MTAiCDc4ODI3ODE1KgQzOTQxwAPYBMgDANgDAOADAOgDAPgDA4AEAJIECS9vcGVucnRiMpgEAKIEDjE4NS4xOTMuNjQuMTM0qAQAsgQMCAAQABgAIAAwADgCuAQAwAQAyAQA2gQCCAHgBADwBKeiyyWIBQGYBQCgBb7q_vfw-fHdKKoFKmU2MThiZGM0LTdiY2EtNGFkZS1hYWUxLTllZmNlNGRmOWFhYX45MzN-McAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBdr4MPoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEABFmRkBsBAAGADgBgHyBgIIAIAHAYgHAKAHAaoHDDEyMjkyMjIzMTc0N8gHzoIG0gcNCRE3ATUM2gcGCAUJqOAHAOoHAggA8AeSgAiKCAIQAJUIAACAP5gIAcAIpEPSCAkI8___PxAAGAA.&s=d2968e9f74da12adb30ab677b5a905cf161b7fff

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.151.36 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://lax1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:27 GMT
an-x-request-uuid: 53f4d471-056c-46f3-af00-9a40259ceb68
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 185.193.64.134; 185.193.64.134; 897.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK trk.js Show response
cdn.adnxs.com/v/s/240/ Frame A7F1 80 KB
27 KB 111ms
43ms Script
application/x-javascript 23.41.168.189
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adnxs.com/v/s/240/trk.js
Requested by: Host: lax1-ib.adnxs.com
URL: https://lax1-ib.adnxs.com/if?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QKxN_BMsRsAAAMA1gAFAQjymperBhCGjZPxqbanwjkYm6vwn9aQzMZZKjYJiGh0B7HTI0AR2liJeVbaIEAZAAAAIFyvQEAh2liJeVbaIEApiGgJJAQxAAUBsAhAMLGtxgg4sxlA5R5IZVCnosslWLrgfGAAaMmwRHjOggaAAQGKAQNVU0SSAQEG9IICmAHYBaABWqgBAbABALgBAsABBcgBAtABCdgBAOABAPABALICJGI1MDNiMDMwLTAwODgtNDM5Ni05MjlhLTkwZjI1MjlmOGJjNdgCpEPgAur5JeoCGWFueWZpbGUtbm90ZXBhZC5zZW1hYW4uY2HyAgwKBkhFSUdIVBICOTDyAgwKBVdJRFRIEgM3MjjyAiEKBkxPQURFUhIXcmVuZGVyX3Bvc3RfYWRzX3YxLmh0bWzyAhgKCklGUkFNRV9LRVkSCjE3NDM2OTMwMjXyAsgVCgtQUkVfU0NSSVBUUxK4FTxzY3JpcHQ-KGZ1bmN0aW9uKCl7LyoKCiBDb3B5cmlnaHQgVGhlIENsb3N1cmUgTGlicmFyeSBBdXRob3JzLgogU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjAKKi8KdmFyIGs9dGhpc3x8c2VsZjt2YXIgbD1BcnJheS5wcm90b3R5cGUuaW5kZXhPZj9mdW5jdGlvbihhLGMpe3JldHVybiBBcnJheS5wcm90b3R5cGUuaW5kZXhPZi5jYWxsKGEsYyx2b2lkIDApfTpmdW5jdGlvbihhLGMpe2lmKCJzdHJpbmciPT09dHlwZW9mIGEpcmV0dXJuInN0cmluZyIhPT10eXBlb2YgY3x8MSE9Yy5sZW5ndGg_LTE6YS5pbmRleE9mKGMsMCk7Zm9yKHZhciBlPTA7ZTxhLmxlbmd0aDtlKyspaWYoZSBpbiBhJiZhW2VdPT09YylyZXR1cm4gZTtyZXR1cm4tMX07ZnVuY3Rpb24gbShhKXttWyIgIl0oYSk7cmV0dXJuIGF9bVsiICJdPWZ1bmN0aSWVBH07MRR8IG4oYSl7YT12b2lkIDA9PT1hP2RvY3VtZW50OmE7cmUJQyQuY3JlYXRlRWxlARkYKCJpbWciKR1FSHAoYSxjLGUpe3ZhciBiPSExO2IZUoBiPyExOmI7YS5nb29nbGVfaW1hZ2VfcmVxdWVzdHN8fChaGgAQPVtdKTsBURRkPW4oYS4RlxApO2lmKA1rBGY9EcgIKCl7GRcEZz1aUwBALGg9bChnLGQpOzA8PWgmJkE6MgIkc3BsaWNlLmNhbAEnbGgsMSl9ZC5yZW1vdmVFdmVudExpc3RlbmVyJiZSFwA0KCJsb2FkIixmLCExKTtSIwBiOgAQZXJyb3INOxh9O2QuYWRkQnMAPhQAPnAAPiAAAW0-FAAAKDZqAFhiJiYoZC5hdHRyaWJ1dGlvblNyYz0iIgG-EHNyYz1jXrcBJC5wdXNoKGQpfQpZSwRxKEkBBGE9Maw0LmN1cnJlbnRTY3JpcHRNTwAoMm4CMG51bGw6YSkmJiI3NyJBgBAuZ2V0QQ2QOGUoImRhdGEtamMiKT9hOhVXPHF1ZXJ5U2VsZWN0b3IoJ1sNJQA9AUQMXScpfUU38ElyPVJlZ0V4cCgiXmh0dHBzPzovLyhcXHd8LSkrXFwuY2RuXFwuYW1wcHJvamVjdFxcLihuZXR8b3JnKShcXD98L3wkKSIpOwpmdYkABCB0FeAAawVhDGM9W10FCQRlPQHGDDtkb3tBrxhiPWE7dHJ5BQwAZEGtGGQ9ISFiJiYBJBwhPWIubG9jYSFqIC5ocmVmKWI6ewEtkG0oYi5mb28pO2Q9ITA7YnJlYWsgYn1jYXRjaChoKXt9ZD0hMX0BXghmPWQZFwBmARYMaWYoZil5AGc-XgAMO2U9YnU5BCYmGQwoLnJlZmVycmVyfHwBlyR9ZWxzZSBnPWUsDcsAYyngMG5ldyB1KGd8fCIiKSkF1RRhPWIucGEh1BmGAGEF_3h9fXdoaWxlKGEmJmIhPWEpO2I9MDtmb3IoYT1jLmxlgdZ0LTE7Yjw9YTsrK2IpY1tiXS5kZXB0aD1hLWI7Yj1rISs5HgGuNSo4YW5jZXN0b3JPcmlnaW5zbhwADWsAPR11ACkJhgwxO2E8EYpMOysrYSlnPWNbYV0sZy51cmx8fCgFCC5CATp2ABRbYS0KMV0hDBgsZy5oPSEwAeMpIgBrGash1WX_AGclFiUCBGU9MgQBIDA8PWU7LS1lKSG6RD1jW2VdLCFnJiZyLnRlc3QoZgGPICkmJihnPWYpLAUOLCYmIWYuaCl7Yj1mO0UbAH0NXQBlFeYEJiYBzAE7BDswQWUlWggmJmUFSAEbCCk7YwWtFHYoYixnKW2LGCBjLmc_Yy4F-gw6Yy5pAUAAfbFTBCB2odYcKXt0aGlzLmlB1QEJCGc9YxkiAHUdIgh1cmwRJBRoPSEhYzsFLwWIJQrdLwB3dUkgdCgpLGM9YS5p6X5AKCI_Iik7c2V0VGltZW91dCgRjA0xAGXZVhhlPy4wMTplQTVEIShNYXRoLnJhbmRvbSgpPmUpaQ8MYj1xKCGkACJl_zQ6Ly8iKyhiJiYidHJ1ZYFrAGJWawQ4LXJjZCIpPyJwYWdlYWQyzbcQc3luZGlpuSAtY24uY29tIjpmIwAFIAwpKyIvCUV4L2dlbl8yMDQ_aWQ9amNhJmpjPTc3JnZlcnNpb249IoVFDGQ9KGQBsQApobZSBAUALQ0xMCIpfHwidW5rbm93biJh41wrZCsiJnNhbXBsZT0iK2U7Yj13aW5kb3cFWABmOTQAZuGKAGYhMzRkPWIubmF2aWdhdG9yKTIOAFAudXNlckFnZW50LGQ9L0Nocm9tZS9JmyBkKSYmIS9FZGcZERw_ITA6ITE7ZGGTFVEwLnNlbmRCZWFjb24_Ch1pHRgkKGUpOnAoYixlLCJ6CAmeECl9fSwwVaAsMDw9Yz9hLnN1YnN0DloJHCgwLGMpOmF9CeAMLnJmbC4CCBqvCGhlbmNvZGVVUklDb21wb25lbnQodygpKX07fSnp20GaFCk7Cjwvc8WYbD7yAt4CCgpFWFRSQV9UQUdTEs8CPGRpdiBzdHkhUgxwb3NpobFkOiBhYnNvbHV0ZTsgbGVmdDogMHB4OyB0b3ANCmR2aXNpYmlsaXR5OiBoaWRkZW47Ij48aW1nIOFMVYdJFEpZAkE2DR4uMgIUYXdiaWQmBQbwn19iPUFLQW1mLUJSTUZuaEVFeDBRdjdsLXl3X3VBVGZVZmtydFhiaVU3d2pvUUdWWjcxZDktV0pJY0hzMng1enYtUHR0UXN0YUFxakszSDZsYmdqZENicXlTN2ZLRXlleUQ0TTRXdENfdUhJNFJPRlZ0VjFxeG9pdlJjIiBib3JkZXI9MCB3aWR0aD0xIGhlaWdodD0xIGFsdD0iIiBzdHkhL6BkaXNwbGF5Om5vbmUiPjwvZGl2PvICmgEKDFBPU1RfU0NSSVBUUxKJARovDDYdARYlClBhZHMuZy5kb3VibGVjbGljay5uZXQxGzx4YmZlX2JhY2tmaWxsLmpzAWUtyg1TLoIMJCB7cjNweCgnMTceuwwcJyk7fSkoKTtdABCaFgoQSAGeNFBPUlRfUEFSQU1TEoUWkTmKlQDgYWRmZXRjaD9hZGs9MTg1MDAxMjI3MCZhZHNhZmU9bWVkaXVtJmNsaWVudD1jYS1wdWItMzA3Njg5ASpkNzQxNDY3JmZvcm1hdD03Mjh4OTBfYXMmaXABTLAuMTkzLjY0LjEzNCZvdXRwdXQ9aHRtbCZwc2Q9VzEwJTNEJnVudmlld2VkX3BNrCBfc3RhcnQ9MSall14iDhAmc3ViXw2VAGJBsfB9ci00NzEwMTI0JmhsPWVuJmFjZWlkPU1La0RId0NNaHpRQm9JODBBWFNSTkFHUmt6UUJDNVEwQVZHVU5BRlNsVFFCajVVMEFiQ1ZOQUVJbGpRQktKWTBBWENXTkFGMGxqUUJkcFkwQVh5V05BR09salFCa1pZMEFhQ1dOQUdvARAscTVZMEFhMldOQUhEARAANAEQBGVXARAAbQEQADYBEBxmaVdOQUVCbAGAKHBjMEFUQ1hOQUU1ARAsUUpjMEFVR1hOQUZIARAAVQEQBFZPARAAZgEQAFkBEPRTCVd5WE5BRzNiRUVCUzNOQkFVMXpRUUZhUE5vQl9mY2VBamItaUFMQV9vZ0M0VG1xQWlkQ3FnSTdXcW9DbEdxcUF2NTRxZ0pVa2FvQ1c1R3FBb0NicWdLQm02b0NncHVxQXBxb3FnS2lxS29DTTd1cUFvYk5xZ0pDLUtvQ1FmdXFBclFGcXdLRUo2c0NWQ2lyQXZzcnF3TFVOcXNDSlRxckFpazZxd0l0T3FzQ2IwZXJBbXhLcXdKZ1Rxc0N1RTZyQWlCUXF3TDBVS3NDQWxHckFncFJxd0xzVjZzQ0lGeXJBamRjcXdJYWFhc0M0R3FyQWh0eHF3THhjYXNDZ0hPckFzeDBxd0lZZDZzQ0hIZXJBaUozcXdJbmQ2c0NMSGVyQWdwNXF3TFllcXNDVTRDckFwR0Jxd0tjZ2FzQ2NvZXJBdTJKcXdLZ2lxc0M3SXFyQW1pTHF3TElpNnNDOVl1ckFnQ01xd0t4aktzQ3M0eXJBcmlNcXdJdmphc0NBcENyQWxlU3F3TFJrNnNDNFpPckFsZVdxd0pjbDZzQzdwaXJBbWlkcXdMVW9hc0MtNkdyQWhDanF3THdvNnNDWktTckFrR2xxd0prcGFzQzQ2V3JBcFNtcXdJQXFhc0NMNm1yQW91cXF3TEFxNnNDeXF1ckF0dXJxd0lWcktzQ1dhMnJBck90cXdJbHJxc0NRcTZyQW91dXF3TGZycXNDTzYtckF0U3Zxd0xxcjZzQ1U3R3JBcXV4cXdMSHNhc0NZcktyQXFpenF3SVd0S3NDR3JTckFpRzBxd0lsdEtzQ0tiU3JBZ3UxcXdLaHRhc0NKcmFyQWplMnF3THJ0cXNDaExlckFnZTRxd0k2dUtzQ2pyaXJBdHE0cXdMdnVLc0NDN21yQWpxNXF3TDV1YXNDUDdxckFsRzZxd0lKdTZzQ01idXJBank3cXdKOXU2c0N4THlyQW9IdEJRUEFkU1FFMDNna0JKRmQ5d1N3WGZjRXd0aWhEdmVSLXhMVzRmc1NJZXo3RWl3T19CSmxEdndTcmhQOEVqNFZfQktiRmZ3UzdCWDhFdkFYX0JJdkdQd1NaQmo4RW5rWV9CSWpHZndTU2hyOEV1a2JfQkxUSFB3UzZoejhFZzhlX0JKYm4tb1VJY2dNRllhOF95TSZleGs9MTc0MzY5MzAyNSZhd2JpZF9jPUFLQW1mLUNSYjNQc3ljYVcydFNWMDFnS0EwQUYwdXA1WWJHVDRUbV9odkNXT3gwNGw1d0VuWXd1c1o1ZXF3emw4bnZiTVcxaGtCSnQtZUJmZ3JKZllYSnhGVTZvVXBZeU81Um5ha05UZG83bmtCaVNRTXlmY2libUJ5YU9RR2VVYjVzeWpvWnFaTlBDaFVPMWFlRWJjUUxEendDNGlaNEhKR2tQWUplMWp6dzVfdkM2WHlkR2J5SSZhd2JpZF9kPUFLQW1mLUNiR3BySVd2UTJkMkcxNENHTjBjanlvX3ZFN1hBOHRXalJ0QUtmTUwwV2tYRW1vcXFzNlI1cmFKTW5BNU0zUmJWTFpFRUhfN3NLNndzYkZjT3YwNjhoMDhMcnBfbkp3LVd4dUR6NVlSdGlZS09ySGFsOGVtUzh6NGQ4N0JCRG5ZQzljSUM2eE8wSHlXeXpWRXJldlNiZVFYR0FvRHdTankzeTBMYlFyd1lzV2s2NUQzLTFjQkhSYUY4Zk0tc1VaTmE2VkktanpyUGRNeFJFNWtOWGhBTnJJZ1A2TFFQVmF4ZVNBSmE2VjhDbXJNbWNUMmZCek84SjhEQTdjdEhMOHViN0hXNzhNdWhNTHduUEVnSDAzYUpKaFg5MEtaTTU5U3ctc0F4NlhwbnRsUzNrX2lOOHF4WWh3Zy1yMmpKRG1wSmt2aV9oZlg1MVpUSlVGUG13YVFibi1XU1hKQ1ltT2ZIejk5VFZWWHBBRkFiZGhqZDd4NFl3TC1PSDJJU3ZLUWt1Q0VCV0ttSVhGamE1TVQ4cWtKSjRXM3ZOUnVwNmNiTmZ2aTF2cGFwYmlUbDViOXV0T0VVUS1xV29nZEl6UFJiTEhtQ1pxOEdXMkRhMU1KYjNaWXhlUzA4a254TTJqMTNtLXJUVE5RTjlpeDhsSzgzY0dqVzNma3Z5bURoMDNqOTFkSHJ2VFdFdUVlVVpaQl9udkUwX0lYelh3M2hXeDJSY1F2ODNGWnAwM2NDcmdXV05BcmFKMDNtMld3RTdjRkUtU3B1by1scU1QM2RabUdxMEpSRnptam1FUlN4ai1SZ056RmZUVmVRaTZHeVV5RlFEWWo3TnBQNGlNOVIxYWxxNHNxMmNqRW5tdFpIVldTa2dRdVI0OG5zVmJvbVpMdnVpOWlfYTVRaUdBMDJvU2tLSWpMSjdTeUIxdXNBRUxMeTdFTmJCbjIwbjhJXzU0RGFGT2lEQzRzNFlhYVBCYnJpWU1XUWNudmgwSENlSUg3OGxGRXhFUXQ5bG51RVFMZUJpcWp1V0FHQnhPN1Y1V1hpMHpFZUZjcnJEMkxobXlzWElGNm5HT0hWNGVyc3dvd3FzdFdUc0FjcjJEdVBpc0MzQ1lFRmhIbmNrZGNqZHE4ZlU0SC04cXZHeUUySFlrQUV2a3VHMFdKNVBjT3RKaTJsMXpiLUFULS1sMl9KLWlGa0xRbW9qY080OWNMWWtIN2pYRnFISnRROEtHUnNmeFBfRUpZS3ZKVVBsYlFCN3ZwelJaVm9laDVDT2h4bnM5ajhVRVh3aFdUTmZxUkxHdmJnVDNGbEZPZ3Q2N3YyNHRWdW85aGtOOURpeHdIbDFlQ29aSzZZZGFjdnNtZUtEbGc5MlFnU0pfUWtXMHh2ajZYR0p1ekk3RXQ5ZTF6WGQ4OWhqSENTZ1dpcmpDOEQxUVdYYnQ3SjBFX1h0bGp4UjNqMXJELWVWb1pWakV0VFNtOWVPRHpMUjBlN2lYZ3Zjem9xVDBDOUU4UEdUSDRVcjJnTnhVd2FwLVdXSjlqZDJhaGk5SHVlV2I5NzJYdm5zXzRRdXdXSW8zckhkQWtWcXR0bG8wcjBmc09TZlQ4MjNMdmcmY2lkPUNBUVNHd0RJQ2FhTlE3M3F4b0ZJS2MzTnBVcVZFXy1IWU9jQXhaSDJ6aGdCJmFfY2lkPYADAIgDAZADAJgDFKADAaoD_AEK1AFodHRwczovL3BhZ2VhZDIuZxLdFSomD6rNDPDXQ09KbGlOcHZTQS1jSGUtanRKYnQ3RkFZcnZ2MGN1VUpGallBUjJjUUtsNDBkQUgyZGFKeWxNcHdVQjNMMXkzak9FY1R1VjNjZm9TeXVmNExEQWZwcVh5dXhLOHR2RGVFRGxBejgzX3ljY1B5LV9adVEmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoTNDE0NDYxMDk0NzU3MDY0ODcxMCIINzg4Mjc4MTUqBDM5NDHAA9gEyAMA2AMA4AMA6AMA-AMDgAQAkgQJL29wZW5ydGIymAQAogQOMTg1KrkL8G2oBACyBAwIABAAGAAgADAAOAK4BADABADIBADaBAIIAeAEAPAEp6LLJYgFAZgFAKAFvur-9_D58d0oqgUqZTYxOGJkYzQtN2JjYS00YWRlLWFhZTEtOWVmY2U0ZGY5YWFhfjkzM34xwAUAyQUAAA6eGhTwP9IFCQkBCgEBNNgFAeAFAfAF2vgw-gUEAYgokAYAmAYAuAYAwQYBITQAAPA_0AbujwHaBhYKEAkSGQEBt6DgBgHyBgIIAIAHAYgHAKAHAaoHDDEyMjkyMjIzMTc0N8gHzoIG0gcNCRE3ATUI2gcGAW2wGADgBwDqBwIIAPAHkoAIiggCEACVCAAAgD-YCAHACKRD0ggJCPP__z8QABgA&s=fbea6d2d622b67e49fa4da28ac4cbaa94b7b5cd2
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.41.168.189 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-41-168-189.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 519e50788224b3422c6e6b1cce48d5decb83eece248558b54e48f88491e48aa4

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://lax1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 28 Nov 2023 11:22:27 GMT
Content-Encoding: gzip
Last-Modified: Wed, 15 Nov 2023 14:06:46 GMT
Server: AkamaiNetStorage
ETag: "ccac3ab7f323b8743d099010fcce15a4:1700057206.383562"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 27680
Expires: Wed, 27 Nov 2024 11:22:27 GMT

GET
H2 200 render_post_ads_v1.html Show response
googleads.g.doubleclick.net/pagead/ Frame E1C7 13 KB
5 KB 33ms
32ms Document
text/html 142.251.167.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

04f5d63c75f9fabede423b3d013e6efd9a448190898a34499a4010a59014a8d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://lax1-ib.adnxs.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 11771
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 4767
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 28 Nov 2023 08:06:16 GMT
etag: 12223946614886178233
expires: Wed, 29 Nov 2023 08:06:16 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 adfetch Show response
googleads.g.doubleclick.net/pagead/ Frame E1C7 142 KB
43 KB 215ms
215ms XHR
text/html 142.251.167.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adfetch

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.167.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

22964b3b937598823b708a21040c61a103ff9cb9538b093415abcae19889750b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Tue, 28 Nov 2023 11:22:28 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43832
x-xss-protection: 0

POST
H2 200 vevent
lax1-ib.adnxs.com/ Frame A7F1 0
665 B 115ms
114ms Ping
text/html 104.254.151.36
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://lax1-ib.adnxs.com/vevent?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QLqBvBMagMAAAMA1gAFAQjymperBhCGjZPxqbanwjkYm6vwn9aQzMZZKjYJiGh0B7HTI0AR2liJeVbaIEAZAAAAIFyvQEAh2liJeVbaIEApiGgJJAQxAAUBsAhAMLGtxgg4sxlA5R5IZVCnosslWLrgfGAAaMmwRHjOggaAAQGKAQNVU0SSAQEG8MKYAdgFoAFaqAEDsAEAuAEBwAEFyAEC0AEJ2AEA4AEA8AEAsgIkYjUwM2IwMzAtMDA4OC00Mzk2LTkyOWEtOTBmMjUyOWY4YmM12AKkQ-AC6vkl6gIZYW55ZmlsZS1ub3RlcGFkLnNlbWFhbi5jYYADAIgDAZADAJgDFKADAaoD_AEK1AFodHRwczovL3BhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24uY29tL3BhZ2VhZC9nZW5fMjA0P2lkPWF3YmlkJmEBBvSbAV9iPUFLQW1mLUNPSmxpTnB2U0EtY0hlLWp0SmJ0N0ZBWXJ2djBjdVVKRmpZQVIyY1FLbDQwZEFIMmRhSnlsTXB3VUIzTDF5M2pPRWNUdVYzY2ZvU3l1ZjRMREFmcHFYeXV4Szh0dkRlRURsQXo4M195Y2NQeS1fWnVRJnByPTEwOiR7QVVDVElPTl9QUklDRX0aEzQxNDQ2MTA5NDc1NzA2NDg3MTAiCDc4ODI3ODE1KgQzOTQxwAPYBMgDANgDAOADAOgDAPgDA4AEAJIECS9vcGVucnRiMpgEAKIEDjE4NS4xOTMuNjQuMTM0qAQAsgQMCAAQABgAIAAwADgCuAQAwAQAyAQA2gQCCAHgBADwBKeiyyWIBQGYBQCgBb7q_vfw-fHdKKoFKmU2MThiZGM0LTdiY2EtNGFkZS1hYWUxLTllZmNlNGRmOWFhYX45MzN-McAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBdr4MPoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEABFmRkBsBAAGADgBgHyBgIIAIAHAYgHAKAHAaoHDDEyMjkyMjIzMTc0N8gHzoIG0gcNCRE3ATUM2gcGCAUJqOAHAOoHAggA8AeSgAiKCAIQAJUIAACAP5gIAcAIpEPSCAkI8___PxAAGAA.&s=d2968e9f74da12adb30ab677b5a905cf161b7fff&type=nv&nvt=5&jm=1003&px=0&py=0&bw=728&bh=90&sid=7113716451621862871&vd=ct~0|rr~0&sv=240&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=17929905&sw=1600&sh=1200&pw=728&ph=90&ww=728&wh=90&ft=3

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/240/trk.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.151.36 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://lax1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:28 GMT
an-x-request-uuid: ccf47ec1-f707-4181-8d9b-ff9e63771eca
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: https://lax1-ib.adnxs.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 185.193.64.134; 185.193.64.134; 897.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 0024 0
0 61ms
60ms Fetch
image/gif 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuiNMPNh_qqX6dXgEmXJJGzz4GYNFwGniFea74X8qs_KPbaUonHbwDxvuIMNGGDN4fPwAThXXTK5WQohMMubuML4vhVMrlIeQ0BJHN12gpiMhBsTWsLVXqGE45tlL60rjJw4pq8B3EYRXNnq-F3yQb7JhM1s5mI51lZspQmtdPl8tWwx8brEIDGuIYvWISXW48MfjEnd7kMQNfTDvDzQiuHZWqfmotbuQZBITmWlVOeHLnpYOitHVRGshmGidgw-4I7UnaTwCgrgG4fPIJ7YRNgZYlrwcqcBx3C_VeKmfPuYZrh48f-M-dbKPkHWD7YfQmhmnO8d53hd99KERc8bTtxHE_zsl4oVAhU8p-Uh5F9wYTGUK7v-EOLVM2WqX5oEy_UfBQZjh31-d4YidiwRM9D4pfhuUxGe8H3JO84yp8Lw9LOZn-eIvd1Y_4JgbOnQlH1QLnovi-RsmWTSmj4MgEdOAHqn8py44Pb2f-azE1nZnp6YEPOJAuOYAL17d10AV0crIQnAcTpm-Whyaqj-ho3hLB7trPDX5fYOo5Z9o4KajnxkXkHA8-sN2EQOKuCHDASr-yvKpbqPAm1Xns5Ml78iS6cNzRw3i3OnPRfJfHZgFjls8XtFxFKK3JFAlvuaRRLQigmHHMzFc1JRBvKg7M3zs04i18qisS6gGQsC0ANvE8v9xIrBytUGsiukc7DzXezH22zWjA3amD5E7dg1PZI7gTG1pPr8hoSPb1E5jsPoViYJ9SyYBuSpLyZ8jfIF1sKZxFe6PTeXA5RayNrF7CBEFMJa4qSkSy710BbMddTCTfaZD3l6z_BmKf0PMfkLgfRtXi5MtO69lgUAqQeqpn0EHGzsEILc74I153kKELsBiVI0EpIzKBDGtjUNoe9jY-HaItrm6cA9g_UxJ_6ykPbsE_vHIrCDIZ941-iA_jOle6bHvL1mM91fymJbRJZ0a7yedU4J23K4PEVHEds-ixRjtVZysrAsa1dNPKVSUkp7nHapqxYSlmAD6OW32i5iC6xZNIx4Ini3lN3l-6iG14Liv01wHGs_w1nRYwLl7V0aqSSOFtGjPDBKFADD1xbBAU9BiW7TtF0vKPzICooBTT9OGaXbUn0p3um71jqLc3AgNS0GkHlU2uNLK4Gew47zGWnEFGHXc7KFo_D4H8LT-6uutpwB1a6x_o3LJ2cVtsAVXESazcCuf59koxvFDoqPf98wVRjxCRoMw_dzgtqk4tnWNHGkb79i2mdq1Ry-UD8PcGu2vIbLdz8hH9bE2OWfo9-R9M79YrPaou6E7qOa0h7o6Am0CicucCgAYbwgsIzot_2asKKf58vptJXgZZIMMNb46VKdRT1LLZ6PDagYzr_AHBZDUfQMRt5zZeYDn-Go50KebMUXF1rig7Xci8jHhPjL6su-q9nckBZSbgBe_9h26xOjbc&sai=AMfl-YR9DUiqpX3oRs7ckw8ql4kn_m-3XR0P3o_s4lTD6vLZOIMz0hWRmBMBcnVQnOB0v1h4_lpCdrabIkBxa9y1YDgd-lyONmH4Cs39M8tgSbcbmC8FbijZgy9i6E_ugj4dTmCmr8bBPLjcwK59NVoabDukamIv-kE9O7Q7DfBwDKhPIF_laiC1hIwOvk2_NWQvF-z8QMBdHKgGpqlB0KTK6VszEg7T-BjdCp0wzEikq6ix1qPRXwcsoX2xQgZD7p-ZKrp0jbpjh0mj2AUiJjwox0ICOLTE4zlzyDtvTKVmv9-oeBKWLvT_YFh8GiZ6Ijql_w&sig=Cg0ArKJSzDOu5HTqd5_REAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=652&vt=11&dtpt=517&dett=3&cstd=132&cisv=r20231109.17075&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:28 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 css
fonts.googleapis.com/ Frame E1C7 14 KB
1 KB 42ms
42ms Stylesheet
text/css 172.253.62.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.62.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 28 Nov 2023 11:22:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 10:20:31 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 28 Nov 2023 11:22:28 GMT

GET
H2 200 load_preloaded_resource.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame E1C7 3 KB
1 KB 123ms
57ms Script
text/javascript 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/load_preloaded_resource.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cdbe9b84c30a00229826b0b1e354c94d36dd6bf16e6580bbef43877689c8f5bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 18:04:23 GMT
content-encoding: br
x-content-type-options: nosniff
age: 62285
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1182
x-xss-protection: 0
server: cafe
etag: 16216481440669322801
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Dec 2023 18:04:23 GMT

GET
H2 200 abg_lite.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/ Frame E1C7 31 KB
12 KB 122ms
58ms Script
text/javascript 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

610d24f5996131b3ab98f18e05441cc246aa8674c3842df0df2b40b57ac9fd0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 09:22:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 7211
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11874
x-xss-protection: 0
server: cafe
etag: 3876053170955424897
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 09:22:17 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 416C 143 B
166 B 34ms
33ms Document
text/html 142.251.167.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

age: 2257
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 28 Nov 2023 10:44:51 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 window_focus.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame E1C7 3 KB
1 KB 113ms
51ms Script
text/javascript 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

88a577b7767cbe34315ff67366be5530949df573931dd9c762c2c2e0434c5b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 00:51:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 37838
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1307
x-xss-protection: 0
server: cafe
etag: 18393213423120915576
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 00:51:50 GMT

GET
H2 200 qs_click_protection.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame E1C7 30 KB
12 KB 97ms
35ms Script
text/javascript 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

08c05eef46cc157c6a54a58314c54f49f00911af49a3971c5ad96a65a9896acd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 19:39:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56581
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11767
x-xss-protection: 0
server: cafe
etag: 15139768082260502484
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 11 Dec 2023 19:39:27 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame E1C7 202 KB
64 KB 36ms
34ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 28 Nov 2023 11:22:28 GMT

GET
H2 200 be31b2ab706a93d748cb1e74ae2e5fe5.js Show response
www.gstatic.com/mysidia/ Frame E1C7 54 KB
21 KB 352ms
33ms Script
text/javascript 172.253.122.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/be31b2ab706a93d748cb1e74ae2e5fe5.js?tag=mysidia_one_click_handler_one_afma

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f94.1e100.net

Software

sffe /

Resource Hash

2faf349343cf89d32efa31d1f703aec42c00ef6fd1fc7ff3f6aefc9849957488

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 10:48:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 174832
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20533
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 14:10:21 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sat, 24 Feb 2024 10:48:36 GMT

GET
DATA 200
OK truncated
/ Frame E1C7 161 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 29e4c24a2fa1b6c2218b217e252a8d838cb65819a3b959a73c1a3565067ec0d9

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 416C
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

42ms
41ms

Document
text/html

142.251.167.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.167.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 28 Nov 2023 11:22:28 GMT
expires: Tue, 28 Nov 2023 11:22:28 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 28 Nov 2023 11:22:28 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 0024 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 697385a6d2db7328065b8203e37fe465ee99fb3fb422407f82fc376038499a3e

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame E1C7 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ec817d8bfc3e16b929d79e208c15b7b830983303accbca45b3c97b5339910f68

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame A7E9 38 KB
13 KB 34ms
32ms Document
text/html 172.253.63.132
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.63.132 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

accept-ranges: bytes
age: 306924
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 24 Nov 2023 22:07:04 GMT
expires: Sat, 23 Nov 2024 22:07:04 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v58/ Frame E1C7 33 KB
33 KB 33ms
32ms Font
font/woff2 172.253.122.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.122.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bh-in-f94.1e100.net

Software

sffe /

Resource Hash

65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 02:48:03 GMT
x-content-type-options: nosniff
age: 462865
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34108
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 22 Nov 2024 02:48:03 GMT

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame A7E9 39 KB
15 KB 33ms
32ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 06:10:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 18728
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 27 Nov 2024 06:10:20 GMT

GET
H3 200 rum.js Show response
securepubads.g.doubleclick.net/pagead/js/ Frame 0024 64 KB
24 KB 33ms
33ms Script
text/javascript 172.253.63.154
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/js/rum.js

Requested by

Host: 05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com
URL: https://05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.63.154 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

25679e64b105c0acb0da7fe3cf9f7988027e9511a28c536f5ea322ac08e642dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 10:51:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1870
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24357
x-xss-protection: 0
server: cafe
etag: 17020722232796629264
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Tue, 28 Nov 2023 11:51:18 GMT

GET
H2 200 dcl.htm Show response
rt3043.infolinks.com/action/ 0
62 B 105ms
104ms Script
text/html 172.66.41.9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rt3043.infolinks.com/action/dcl.htm?rid=e618bdc4-7bca-4ade-aae1-9efce4df9aaa&prod_t=d&sdata=article&bdc=1&midx=0&capara=%7B%22ve%22%3A%22mrc50%22%7D
Requested by: Host: resources.infolinks.com
URL: https://resources.infolinks.com/js/1895.006-3.034/ice.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 172.66.41.9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:28 GMT
cf-cache-status: DYNAMIC
server: cloudflare
content-type: text/html;charset=UTF-8
cache-control: no-cache,no-store
cf-ray: 82d23bb78de07157-YUL
content-length: 0
x-application-context: application:prod
expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 0024 0
234 B 275ms
93ms Ping
image/gif 142.250.68.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=pagead&action=csi_pagead&dmc=8&puid=1~lpi90rzm&chm=1&c=3291251754408132&ctx=2&qqid=CJiLiJHK5oIDFXWdgwgdlE8JrQ&met.4=fb.19~lb.z3~ol.138~idt.13l~dt.-at&met.3=733.z9~748.100~749.103~742.z9_10~736.10a~735.11d_1~740.11i_1~739.11j~374.120~738.138~113.14v_5~112.14u_6&met.1=1.lpi90qus~6.0~7.0~8.0~9.0~10.0~12.3~13.11~14.12~15.13~16.11j~17.11j~18.11j~19.136~20.137~21.138~22.ho~23.ho&met.7=CBsQCBgBMCY4hAtoA3AleIkXgAHdFIgBkjCwAQG4AQM~CCgQBRgBIC8oLzCmAzj3AmjwAnCmA3iKBIAB3gGIAfAEsAEBuAED~CBwQChgBIC8oLzCHAThYaDBwcnip-AGAAf31AYgBhccFsAEBuAED~CBwQBhgBIDAoMDBtOD1oM3BseNYCgAEqiAEqsAEBuAED~CBwQBhgBIDAoMDBsODxoM3BreKwCsAEBuAED~CB4QChgBIDAoMDCHCjjXCWjICXCHCniADIAB1AmIAYEVsAEBuAED~CBwQChgBIDEoMTDrCTi6CVCGCVjHCWCXCWjHCXDnCXiJRYAB3UKIAfChAbABAbgBAw~CE0QChgBIDEoMTB6OEpoM3BVeNPqA4ABp-gDiAHBlAywAQG4AQM~CBwQARgBIIsBKIsBMMUBODpojAFwxAF4rAKwAQG4AQM~CBwQARgBIJABKJABMMgBODlokAFwyAF4rAKwAQG4AQM~CCgQChgBIKUBKKUBMNoDOLUCUK4CWO8CYL8CaPACcMIDeKCxAoAB9K4CiAH61wWwAQG4AQM~CCkQChgBIN0DKN0DMNoEOH1Q3wNYngRg7wNongRwvgR4qrkCgAH-tgKIAbH1BrABAbgBAw~CBwQChgBIN4DKN4DMIEEOCNo3wNwgAR4miOAAe4giAGAWLABAbgBAw~CAkQChgBIOIDKOIDMIoEOCho4wNwggR4jl-AAeJciAH2-AGwAQG4AQM~CCcQChgBIOMDKOMDMIEKOJ4GaMcJcPsJeJ1vgAHxbIgB6ckCsAEBuAED~CB8QBRgBIOcEKOcEMMkFOGJQ6ARYqAVg6ARoqAVwyAV4hCGAAdgeiAGRULABAbgBAw~CCIQBBgBIOkEKOkEMK0FOEVo6wRwrQV4rAKwAQG4AQM~CCIQBBgBIO0IKO0IMKsJOD1o7ghwqgl4rAKwAQG4AQM~CCcQBRgBIM4KKM4KMPUKOCdo0gpw8gp4oWiAAfVliAH-sAKwAQG4AQM~CCgQChgBIIYLKIYLMKoLOCRohwtwqAt40cABgAGlvgGIAf_-A7ABAbgBAw
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/js/rum.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.68.67 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS: lax31s11-in-f3.1e100.net
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:28 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame E1C7
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CKFXOc81lZeiNAePL998PxKmV0AzX5pKwdImlttKlEY-esO3WMBABIOaX1iVg_eiigfADoAGr1bS7AsgBAagDAcgDywSqBNsBT9CfgMRQtatFAd7b3Fo4DviMasHqiwjwPcE1ETe8Zz-gwbT...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xe0b53a9ca90e838a0000000000000000%22,%222%22:%220xb976d4f35cb20c660000000000000000%22,%223%22:%220xe54937...

0
0

123ms
57ms

Fetch
text/css

172.253.115.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220xe0b53a9ca90e838a0000000000000000%22,%222%22:%220xb976d4f35cb20c660000000000000000%22,%223%22:%220xe54937a64aeed38e0000000000000000%22,%224%22:%220x9a80268a247997e90000000000000000%22,%225%22:%220x4e90efa2c0e60290000000000000000%22},%22debug_key%22:%225425787395680644404%22,%22debug_reporting%22:true,%22destination%22:%22https://globalization-partners.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22661465771%22],%224%22:[%2211-28%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%221616157025916951537%22}&andc=true

Requested by

Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app

Protocol

Server

172.253.115.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f156.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:28 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"1":"0xe0b53a9ca90e838a0000000000000000","2":"0xb976d4f35cb20c660000000000000000","3":"0xe54937a64aeed38e0000000000000000","4":"0x9a80268a247997e90000000000000000","5":"0x4e90efa2c0e60290000000000000000"},"debug_key":"5425787395680644404","debug_reporting":true,"destination":"https://globalization-partners.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["661465771"],"4":["11-28"],"6":["true"]},"priority":"500","source_event_id":"1616157025916951537"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Tue, 28 Nov 2023 11:22:28 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Tue, 28 Nov 2023 11:22:28 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"aggregation_keys":{"1":"0xe0b53a9ca90e838a0000000000000000","2":"0xb976d4f35cb20c660000000000000000","3":"0xe54937a64aeed38e0000000000000000","4":"0x9a80268a247997e90000000000000000","5":"0x4e90efa2c0e60290000000000000000"},"debug_key":"5425787395680644404","debug_reporting":true,"destination":"https://globalization-partners.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["661465771"],"4":["11-28"],"6":["true"]},"priority":"500","source_event_id":"1616157025916951537"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 Yf5BzeG23wDzTlqXlXQekm6IYbjoDTlv95nUi6zaUwA.js Show response
pagead2.googlesyndication.com/bg/ Frame F590 38 KB
15 KB 32ms
32ms Script
text/javascript 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Yf5BzeG23wDzTlqXlXQekm6IYbjoDTlv95nUi6zaUwA.js

Requested by

Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61fe41cde1b6df00f34e5a9795741e926e8861b8e80d396ff799d48bacda5300

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 02:54:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 462465
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14900
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 22 Nov 2024 02:54:43 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A7E9 0
20 B 58ms
58ms Image
image/gif 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BbCVNc81lZbjrE9ncoPwPobuM6AEAAAAAOAHgBAI&bg=!NDelN3jNAAZxrfrxUa07ADQBe5WfOO66IHM_sz0J6o2dNLbhHGm61vwRGc7h08j0vDAT_PpR8-sskBGaAa5G3bZ_myAqAgAAAGZSAAAAAmgBBwoAJZOgO4BX5tJvCvJmakcU8WFJrrI10UthTEsxoPpTrznmRqgxGHmZAv8xmwVjzXz1P6t75-fMNrcQVONfnw092zrd_3E2A5n_pT3IQ2nF8eCvZhu8EujvblZG_xosSQtUOG8Cei2_RvIl9Zaxmr6jiiNJ7CfG9fLII3OkxqBxdBUHXFk2SNhN9FAsKi4zezfAjOlxmgLul_P9f3JXi2E-m_-c46xwt4-zbysdfTq3dAvJJHXE4lTpJB1hiKNQzgWXo6EU7iArcQpHMC3iruIwK54CDEZ0Q77a7anK5KuDC70KyJTkhgfbYKZRaCLp3WjwDhy8sUhbBsVqAuQkZCJ1XfdwlqNpRXxCUHljzdlRAGtslVuYXhSdH0bcz8KtlizK8EcB-zj4IMVtR7RdrWm2lfCLTW10tMkPQb2oxAb0vS9feNnc6SkTa26SO3dIeyrJJy6z_uFrhhP7_vBVSN9Lu67hsFAeOTXjUFuYR3fEEz7V5mi6BNaRYlGluo9FD_0YGT426h532QIo73Xo5FB37pCoihQB-o1Vl9aD3gjm6AwFY_206HdeyWcVL1DKxdnQFhrduDh707jCbHKF8MPaoDGPqWIayQKBSgWdxXbAolTGfmifVTpFv_13MOr4tqTp2qj4c_wBZWF9aAXpoVV0EcaNnK0qcvlGj3fQxxev3bX9fGLEquTC54fuhH5dP2QTEhXQ0MUH8g6jyxoRh_GgQgziVAUEF-vfUNoVhHBFPGLZymNNownxmrjfWrzIiFfT2VXGBYBQlOiTvIyEYuMANf9lveMAXDYU8UnP68XArFOddpuacFMzhgloWQJCxcgEWB6sF7-h3FceT2Pxn8wQdZts2x8I1_eiafUTxOSje3mf0GAwgWuDV2d9Mlu4LFkfkNTg1sxKw4XaZ0F30Lt9l4dhjjie3ikwinXb-4DqvOLwCkl-Ke_O-NGfFnLqckELFsYXCuIiz_r5ix9Q2WMFdkl8ZHUhVXWD8gd9BEm9NCqWsyb2NAyVJkaT6mI-FcEf-zYn0EJVXUZr_kgF5p025bhPwyDv60d67ekRHCGptaipZuA_A5z7gQ

Requested by

Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:28 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 122ms
56ms Preflight
text/html 172.253.115.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.115.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bg-in-f156.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 28 Nov 2023 11:22:28 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 async_usersync Show response
ib.adnxs.com/ Frame A7A2 0
597 B 43ms
42ms Script
text/html 68.67.161.182
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=3251&pub_id=1623654&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=3251&pub_id=1623654

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

68.67.161.182 Brooklyn, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:28 GMT
an-x-request-uuid: 84a42135-de66-47b3-81c3-f7f7cd9a9938
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
cache-control: no-store, no-cache, private
x-proxy-origin: 185.193.64.134; 185.193.64.134; 797.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 vevent
lax1-ib.adnxs.com/ Frame A7F1 0
665 B 94ms
94ms Ping
text/html 104.254.151.36
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://lax1-ib.adnxs.com/vevent?an_audit=0&referrer=anyfile-notepad.semaan.ca&e=wqT_3QLqBvBMagMAAAMA1gAFAQjymperBhCGjZPxqbanwjkYm6vwn9aQzMZZKjYJiGh0B7HTI0AR2liJeVbaIEAZAAAAIFyvQEAh2liJeVbaIEApiGgJJAQxAAUBsAhAMLGtxgg4sxlA5R5IZVCnosslWLrgfGAAaMmwRHjOggaAAQGKAQNVU0SSAQEG8MKYAdgFoAFaqAEDsAEAuAEBwAEFyAEC0AEJ2AEA4AEA8AEAsgIkYjUwM2IwMzAtMDA4OC00Mzk2LTkyOWEtOTBmMjUyOWY4YmM12AKkQ-AC6vkl6gIZYW55ZmlsZS1ub3RlcGFkLnNlbWFhbi5jYYADAIgDAZADAJgDFKADAaoD_AEK1AFodHRwczovL3BhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24uY29tL3BhZ2VhZC9nZW5fMjA0P2lkPWF3YmlkJmEBBvSbAV9iPUFLQW1mLUNPSmxpTnB2U0EtY0hlLWp0SmJ0N0ZBWXJ2djBjdVVKRmpZQVIyY1FLbDQwZEFIMmRhSnlsTXB3VUIzTDF5M2pPRWNUdVYzY2ZvU3l1ZjRMREFmcHFYeXV4Szh0dkRlRURsQXo4M195Y2NQeS1fWnVRJnByPTEwOiR7QVVDVElPTl9QUklDRX0aEzQxNDQ2MTA5NDc1NzA2NDg3MTAiCDc4ODI3ODE1KgQzOTQxwAPYBMgDANgDAOADAOgDAPgDA4AEAJIECS9vcGVucnRiMpgEAKIEDjE4NS4xOTMuNjQuMTM0qAQAsgQMCAAQABgAIAAwADgCuAQAwAQAyAQA2gQCCAHgBADwBKeiyyWIBQGYBQCgBb7q_vfw-fHdKKoFKmU2MThiZGM0LTdiY2EtNGFkZS1hYWUxLTllZmNlNGRmOWFhYX45MzN-McAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBdr4MPoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEABFmRkBsBAAGADgBgHyBgIIAIAHAYgHAKAHAaoHDDEyMjkyMjIzMTc0N8gHzoIG0gcNCRE3ATUM2gcGCAUJqOAHAOoHAggA8AeSgAiKCAIQAJUIAACAP5gIAcAIpEPSCAkI8___PxAAGAA.&s=d2968e9f74da12adb30ab677b5a905cf161b7fff&type=pv&jm=1003&px=0&py=0&bw=728&bh=90&sf=1&sid=7113716451621862871&vd=ct~0|rr~5&sv=240&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=17929905&ft=3

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/240/trk.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.254.151.36 Los Angeles, United States, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://lax1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:28 GMT
an-x-request-uuid: 5f9d80c3-dd03-4aa9-befd-25525048c81e
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: https://lax1-ib.adnxs.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 185.193.64.134; 185.193.64.134; 897.bm-nginx-loadbalancer.mgmt.lax1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 0024 42 B
64 B 122ms
59ms Fetch
image/gif 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvbNeRniF14Aqd94Y9RvEZGYX6hT3p5RpEAZDRRkxKPvdzR5-q8iotcSet_JdO7QwwihQ8xR62MLByoYQYeckjzyott_qsH2mLGHyfgGCJtdd3_huQXYuuHtKRwMjs3742HlMwpLqImzA&sai=AMfl-YRy6DNYUD3oBpJmn1hITZKApvkGq2czUVSXiXnFG2ZbL1nbhK8bdobfN3z74dx9aTZFKW-Iy_OvkToIZ65mzIMfmS4JniTE1LR7ne_uUHDLIZA1kMi_u4F3RjoVN4li_zklr6wx0gd_2d-MIlmEjQ&sig=Cg0ArKJSzBsYAggL1XG4EAE&cid=CAQSTwDICaaNREInDCMW26deBFBc9FocBqdKQ3V3npWFtNxDpcL2W60GDt13cNBKjimW7bsCa8eZvEwxiEj3Ii5rxooHiqoMPAJ-741CpqwKNrUYAQ&id=lidar2&mcvt=1004&p=65,1440,665,1600&mtos=1004,1004,1004,1004,1004&tos=1004,0,0,0,0&v=20231116&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=450036033&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1701170546932&rpt=1299&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:29 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0024 0
20 B 58ms
57ms Ping
image/gif 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=1382492328415&version=m202309260101&ct=76&x=1&cor=15105796105926636000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://05c0ce105d3920ab8d6a1b2897953124.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:29 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame E1C7 42 B
64 B 64ms
64ms Fetch
image/gif 172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv1GRZB8UvJo6NC-CYHNr-J5QKaJnsl8monz9IpAi38vU8-dwl1Icy6X1qqdX4sV58Hdm8luA_7yFi_JsfjkjDTeyoaGZ0HtAOlPhKG_zRLeEIZf_Y89botylFKV_ZpAuVlVDRzW_S_zA&sai=AMfl-YSrwOOSFkX8u3jsNvRPzwNIBErn0negrdfjG5u5hmQ22VKikPYt6XFR4xTemWcO9rGS5mOq92z8JrPndiJ7pYdzHdKa0fxvmJJDs2nOCVrk6iHHTA&sig=Cg0ArKJSzATWbx1RRGgFEAE&cid=CAQSKQDICaaNKd7iBZ-rRnFh0WiQs33ybPKlqMf0NGZPbR6JtRFzO_Sbpt-LGAE&id=lidar2&mcvt=1002&p=0,0,90,728&mtos=1002,1002,1002,1002,1002&tos=1002,0,0,0,0&v=20231116&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=1850012270&rs=5&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1701170547805&rpt=676&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns31533571.ip-162-19-138.eu

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:29 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

rtset
bh.contextweb.com/bh/
Redirect Chain

https://bh.contextweb.com/visitormatch/prebid
https://cm.g.doubleclick.net/pixel?google_nid=contextweb&google_cm&google_sc&google_hm=%%ENCRYPTED_VGUID_B64%%&gdpr=%%GDPR_IN_EFFECT%%&gdpr_consent=%%GDPR_CONSENT%%
https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=%%GDPR_IN_EFFECT%%&gdpr_consent=%%GDPR_CONSENT%%&google_hm=2&ev=CAESEL3ZsFI8W9S-DLK69pw9CHU&google_cver=1

49 B
788 B

26ms
25ms

Image
image/gif

198.148.27.131
PULSEPOINT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=%%GDPR_IN_EFFECT%%&gdpr_consent=%%GDPR_CONSENT%%&google_hm=2&ev=CAESEL3ZsFI8W9S-DLK69pw9CHU&google_cver=1

Requested by

Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app

Protocol

Server

198.148.27.131 New York, United States, ASN19189 (PULSEPOINT, US),

Reverse DNS

Software

Jetty(10.0.14) /

Resource Hash

d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=15768000
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Platform-Version
server: Jetty(10.0.14)
content-language: en-CA
content-type: image/gif;charset=iso-8859-1
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-74c7cffc45-6bgmq
expires: -1

Redirect headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:29 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://bh.contextweb.com/bh/rtset?do=add&pid=547259&gdpr=%%GDPR_IN_EFFECT%%&gdpr_consent=%%GDPR_CONSENT%%&google_hm=2&ev=CAESEL3ZsFI8W9S-DLK69pw9CHU&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 384
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK cors Show response
data.ad-score.com/data/ 65 B
621 B 272ms
84ms Fetch
text/plain 130.211.115.4
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://data.ad-score.com/data/cors?pm_st=JEmnNkABsfRUQfWXVEMHtTIxoczhFklH-FE7fPshldVTkKD8Z33LPFknH-E03BPcxlbVLhPw==&pm_ct=4864390c1c4fd2a32daf1996&pm_pl=1701170550072&pm_td=16&pid=1000102&en=1.1&callback=__pm_glbl_imyFw1nSi74zXz7Z80ZZIPvP._gc1&tt=if&v=a6bb4ea
Requested by: Host: js.ad-score.com
URL: https://js.ad-score.com/score.min.js?pid=1000102&tt=if&tid=infolinks-p&l1=3221959_0&l2=3&l3=Windows&l4=Chrome&l5=anyfile-notepad.semaan.ca&ref=https://anyfile-notepad.semaan.ca/app&pub_domain=anyfile-notepad.semaan.ca&utid=e618bdc4-7bca-4ade-aae1-9efce4df9aaa&uid=cuid_b503b030-0088-4396-929a-90f2529f8bc5&uip=185.193.64.134&cb=3640703962638898251
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 130.211.115.4 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 4.115.211.130.bc.googleusercontent.com
Software: /
Resource Hash: baaeb303d6c2f7fec5d5baf5d2525f5282a5dc7080554500456cd2b05d0febff

Request headers

Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 28 Nov 2023 11:22:30 GMT
Age: 0
Access-Control-Allow-Methods: POST
P3p: CP="CURa ADMa DEVa TAIi PSAi PSDi IVAi IVDi CONi HISa TELi OUR IND DSP CAO COR"
Access-Control-Allow-Origin: https://anyfile-notepad.semaan.ca
Content-Type: text/plain; charset=utf-8
Cache-Control: post-check=0, pre-check=0, false, proxy-revalidate, no-cache, no-cache=Set-Cookie, no-store, must-revalidate, max-age=0, s-maxage=0
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 65

GET
H/1.1 200
OK x.html Show response
js.ad-score.com/ Frame 1897 73 KB
25 KB 34ms
33ms Document
text/html 3.162.125.9
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.ad-score.com/x.html?v=a6bb4ea&pid=1000102
Requested by: Host: js.ad-score.com
URL: https://js.ad-score.com/score.min.js?pid=1000102&tt=if&tid=infolinks-p&l1=3221959_0&l2=3&l3=Windows&l4=Chrome&l5=anyfile-notepad.semaan.ca&ref=https://anyfile-notepad.semaan.ca/app&pub_domain=anyfile-notepad.semaan.ca&utid=e618bdc4-7bca-4ade-aae1-9efce4df9aaa&uid=cuid_b503b030-0088-4396-929a-90f2529f8bc5&uip=185.193.64.134&cb=3640703962638898251
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 3.162.125.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-162-125-9.iad61.r.cloudfront.net
Software: /
Resource Hash: 87d8ff0b942b3562188d50a37a892f957dd7321b75e6d2832f027d599a375736

Request headers

Referer: https://anyfile-notepad.semaan.ca/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 44510
Cache-Control: public, max-age=86400
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
Date: Mon, 27 Nov 2023 23:00:40 GMT
Last-Modified: Mon, 27 Nov 2023 22:17:45 GMT
Transfer-Encoding: chunked
Via: 1.1 e28efd1a65ea5d8d42e5dac75c735524.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 5jw09Q00nwsueZkf6E7SqbfCLHa1iN4b_XIWdYowPE7O5_HWx84dAg==
X-Amz-Cf-Pop: IAD61-P3
X-Cache: Hit from cloudfront

GET
DATA 200
OK truncated
/ Frame A1B3 266 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 662294921ca6240beb0f2aecb7f7ac23dd085b782bbe52a369b20226d26afe33

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 68 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5e89733d8a8e055100cda68bf7a712ab0e1b24fefee7e39792b47cb5ff7c3cb1

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 95AB 46 KB
13 KB 35ms
35ms Script
text/html 23.55.205.215
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.55.205.215 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-55-205-215.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 4959aaa1da6fe43ff9a56f7d783f1de1212376c1a2090ae5291698423ae17219

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=33across&endpoint=us-east&us_privacy=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 28 Nov 2023 11:22:30 GMT
Content-Encoding: gzip
Last-Modified: Tue, 28 Nov 2023 06:10:58 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=67684
Connection: keep-alive
Content-Length: 13229
Expires: Wed, 29 Nov 2023 06:10:34 GMT

POST
H2 200 535.json Show response
id5-sync.com/g/v2/ 625 B
1 KB 336ms
111ms XHR
application/json 162.19.138.120
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/535.json

Requested by

Host: resources.infolinks.com
URL: https://resources.infolinks.com/static/id5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.120 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

3c9a669afa2e64a440a1095fa41c26d633f91c693e6a15fc641af0e5979d40d0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://anyfile-notepad.semaan.ca
date: Tue, 28 Nov 2023 11:22:30 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
p3p: CP="CAO PSA OUR"
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
BLOB 200
OK e470e4b9-19bb-4ddf-b108-6422255a0f02
https://anyfile-notepad.semaan.ca/ 11 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://anyfile-notepad.semaan.ca/e470e4b9-19bb-4ddf-b108-6422255a0f02
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 831f84c2e1956cac7cee876abf7774df3bc8d26a308e2d7994248a8899ffc361

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Length: 10947
Content-Type: text/javascript

GET
BLOB 200
OK 891fff11-ae85-493f-b14f-650c509d0298
https://anyfile-notepad.semaan.ca/ 720 B
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://anyfile-notepad.semaan.ca/891fff11-ae85-493f-b14f-650c509d0298
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d2ec07a6e77bc3abc56f801e141e9889c018ca8e96dfbe4042f49378699ee85f

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Length: 720
Content-Type: application/javascript

GET
BLOB 200
OK 967ff531-8ea3-4aac-a7f7-e6a0ea79eb3b
https://anyfile-notepad.semaan.ca/ 725 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://anyfile-notepad.semaan.ca/967ff531-8ea3-4aac-a7f7-e6a0ea79eb3b
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb32ef70baf6f49f09b1fe50f680f2217d8fc8021f2b91beaabb96f6d582c96b

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Length: 725
Content-Type: text/javascript

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame 3819 5 KB
6 KB 1121ms
31ms Script
text/html 8.28.7.81
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=52779208&p=156423&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?&p=156423&us_privacy=&predirect=https%3A%2F%2Fevents-ssc.33across.com%2Fmatch%3Fliv%3Dh%26us_privacy%3D%26bidder_id%3D25%26external_user_id%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 8.28.7.81 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: 9c6e1fe3be7a0c4f98c18d0c21d8f90ffbddb1fd0eed8501b97b6f462f5bbaf3

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
date: Tue, 28 Nov 2023 11:22:30 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

POST
H/1.1 200
OK cors Show response
data.ad-score.com/data/ 1 B
281 B 80ms
79ms Fetch
text/plain 130.211.115.4
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://data.ad-score.com/data/cors?pm_st=JEmnNkABsfRUQfWXVEMHtTIxoczhFklH-FE7fPshldVTkKD8Z33LPFknH-E03BPcxlbVLhPw==&pm_ct=4864390c1c4fd2a32daf1996&pm_pl=1701170550072&pm_td=522&pid=1000102&en=1.1&callback=__pm_glbl_imyFw1nSi74zXz7Z80ZZIPvP._gc2&tt=if&v=a6bb4ea
Requested by: Host: js.ad-score.com
URL: https://js.ad-score.com/score.min.js?pid=1000102&tt=if&tid=infolinks-p&l1=3221959_0&l2=3&l3=Windows&l4=Chrome&l5=anyfile-notepad.semaan.ca&ref=https://anyfile-notepad.semaan.ca/app&pub_domain=anyfile-notepad.semaan.ca&utid=e618bdc4-7bca-4ade-aae1-9efce4df9aaa&uid=cuid_b503b030-0088-4396-929a-90f2529f8bc5&uip=185.193.64.134&cb=3640703962638898251
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 130.211.115.4 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 4.115.211.130.bc.googleusercontent.com
Software: /
Resource Hash: 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Request headers

Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://anyfile-notepad.semaan.ca
Date: Tue, 28 Nov 2023 11:22:30 GMT
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1
Access-Control-Allow-Methods: POST
Content-Type: text/plain; charset=utf-8

GET
BLOB 200
OK 3cdd6d1d-ef8f-41ca-96d6-56da0bdcf293
https://anyfile-notepad.semaan.ca/ 288 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://anyfile-notepad.semaan.ca/3cdd6d1d-ef8f-41ca-96d6-56da0bdcf293
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 97bf326860f50a3e48b937a395da44fb697f230259b45d63cca9dcd24fddb243

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Length: 288
Content-Type: text/javascript

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame 95AB 7 B
862 B 98ms
33ms XHR
application/json 8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: a1dd48c657971696c2087f2a6beb489ee65b25320b763222f10718dd93e9149e

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: 10af108baa8103fb427a2cc0433d74a0
Expires: 0

HEAD
H/1.1 200
OK x.html Show response
js.ad-score.com/ Frame 1897 0
565 B 57ms
32ms XHR
text/html 3.162.125.9
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.ad-score.com/x.html?v=a6bb4ea&pid=1000102
Requested by: Host: js.ad-score.com
URL: https://js.ad-score.com/x.html?v=a6bb4ea&pid=1000102
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 3.162.125.9 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-3-162-125-9.iad61.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://js.ad-score.com/x.html?v=a6bb4ea&pid=1000102
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Mon, 27 Nov 2023 23:00:40 GMT
Content-Encoding: gzip
Via: 1.1 e28efd1a65ea5d8d42e5dac75c735524.cloudfront.net (CloudFront)
Last-Modified: Mon, 27 Nov 2023 22:17:45 GMT
X-Amz-Cf-Pop: IAD61-P3
Age: 44510
Access-Control-Allow-Methods: GET
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
X-Cache: Hit from cloudfront
Cache-Control: public, max-age=86400
Access-Control-Allow-Credentials: true
Connection: keep-alive
Accept-Ranges: bytes
X-Amz-Cf-Id: AGqcdPRmrAfp12NAQViX8wgXwMcnh-uQv564KH6g2qcTfkm0lg9Zpg==

POST
H/1.1 200
OK cors Show response
data.ad-score.com/data/ 1 B
281 B 75ms
74ms Fetch
text/plain 130.211.115.4
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://data.ad-score.com/data/cors?pm_st=JEmnNkABsfRUQfWXVEMHtTIxoczhFklH-FE7fPshldVTkKD8Z33LPFknH-E03BPcxlbVLhPw==&pm_ct=4864390c1c4fd2a32daf1996&pm_pl=1701170550072&pm_td=610&pid=1000102&en=1.1&callback=__pm_glbl_imyFw1nSi74zXz7Z80ZZIPvP._gc3&tt=if&v=a6bb4ea
Requested by: Host: js.ad-score.com
URL: https://js.ad-score.com/score.min.js?pid=1000102&tt=if&tid=infolinks-p&l1=3221959_0&l2=3&l3=Windows&l4=Chrome&l5=anyfile-notepad.semaan.ca&ref=https://anyfile-notepad.semaan.ca/app&pub_domain=anyfile-notepad.semaan.ca&utid=e618bdc4-7bca-4ade-aae1-9efce4df9aaa&uid=cuid_b503b030-0088-4396-929a-90f2529f8bc5&uip=185.193.64.134&cb=3640703962638898251
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 130.211.115.4 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 4.115.211.130.bc.googleusercontent.com
Software: /
Resource Hash: 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Request headers

Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://anyfile-notepad.semaan.ca
Date: Tue, 28 Nov 2023 11:22:30 GMT
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1
Access-Control-Allow-Methods: POST
Content-Type: text/plain; charset=utf-8

GET
H2

200

match
events-ssc.33across.com/ Frame 95AB
Redirect Chain

https://pixel-us-east.rubiconproject.com/exchange/sync.php?p=33across&us_privacy=&khaos=LPI90QO4-28-LCMP
https://ssc-cms.33across.com/ps/?xi=1&xu=LPI90QO4-28-LCMP
https://events-ssc.33across.com/match?bidder_id=30&external_user_id=LPI90QO4-28-LCMP&ts=1701170550&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=

68 B
117 B

37ms
37ms

Image
image/png

34.117.239.71
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://events-ssc.33across.com/match?bidder_id=30&external_user_id=LPI90QO4-28-LCMP&ts=1701170550&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Server: 34.117.239.71 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 71.239.117.34.bc.googleusercontent.com
Software: /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:30 GMT
cache-control: no-cache, no-store, max-age=0, must-revalidate
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68
content-type: image/png

Redirect headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:30 GMT
referrer-policy: unsafe-url
server: 33XP018
x-33x-status: 8000000008200000A
p3p: CP="NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA"
location: https://events-ssc.33across.com/match?bidder_id=30&external_user_id=LPI90QO4-28-LCMP&ts=1701170550&gdpr_58=&gdpr=0&gdpr_consent=&us_privacy=
cache-control: no-store, no-cache, must-revalidate
content-length: 0
expires: Thu, 01-Jan-70 00:00:01 GMT

GET
DATA 200
OK truncated
/ 35 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: en-CA,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/gif

POST
H/1.1 200
OK cors Show response
data.ad-score.com/data/ 1 B
281 B 71ms
71ms Fetch
text/plain 130.211.115.4
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://data.ad-score.com/data/cors?pm_st=JEmnNkABsfRUQfWXVEMHtTIxoczhFklH-FE7fPshldVTkKD8Z33LPFknH-E03BPcxlbVLhPw==&pm_ct=4864390c1c4fd2a32daf1996&pm_pl=1701170550072&pm_td=705&pid=1000102&en=1.1&callback=__pm_glbl_imyFw1nSi74zXz7Z80ZZIPvP._gc4&tt=if&v=a6bb4ea
Requested by: Host: js.ad-score.com
URL: https://js.ad-score.com/score.min.js?pid=1000102&tt=if&tid=infolinks-p&l1=3221959_0&l2=3&l3=Windows&l4=Chrome&l5=anyfile-notepad.semaan.ca&ref=https://anyfile-notepad.semaan.ca/app&pub_domain=anyfile-notepad.semaan.ca&utid=e618bdc4-7bca-4ade-aae1-9efce4df9aaa&uid=cuid_b503b030-0088-4396-929a-90f2529f8bc5&uip=185.193.64.134&cb=3640703962638898251
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 130.211.115.4 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 4.115.211.130.bc.googleusercontent.com
Software: /
Resource Hash: 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Request headers

Referer: https://anyfile-notepad.semaan.ca/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: https://anyfile-notepad.semaan.ca
Date: Tue, 28 Nov 2023 11:22:30 GMT
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 1
Access-Control-Allow-Methods: POST
Content-Type: text/plain; charset=utf-8

GET
H2

200

generic
match.adsrvr.org/track/cmf/
Redirect Chain

https://id5-sync.com/i/535/8.gif?id5id=ID5*bwFupbc0EO8Yt-9eX2QZAtcXEDckDPup3quWUMZwhM1xRmiThVDi3X_rAiou8kYkcUhDCSOCUHnVFHGI7Gu-tw&o=api&gdpr_consent=undefined&gdpr=false
https://ib.adnxs.com/getuid?https://id5-sync.com/c/535/2/7/2.gif?puid=$UID&gdpr=0&gdpr_consent=
https://id5-sync.com/c/535/2/7/2.gif?puid=6452867190558037403&gdpr=0&gdpr_consent=
https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fid5-sync.com%2Fc%2F535%2F434%2F6%2F3.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&consent=
https://id5-sync.com/c/535/434/6/3.gif?puid=c4b8b092-4f3c-4dc3-a427-de1915ff3bb0&gdpr=0&gdpr_consent=
https://uipglob.semasio.net/id5/1/get?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F535%2F112%2F5%2F4.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D
https://uipglob.semasio.net/id5/1/get2?gdpr=0&gdpr_consent=&_url=https%3A%2F%2Fid5-sync.com%2Fc%2F535%2F112%2F5%2F4.gif%3Fpuid%3D%24%7BUIPID%7D%26gdpr%3D0%26gdpr_consent%3D
https://id5-sync.com/c/535/112/5/4.gif?puid=A88042A46A087867&gdpr=0&gdpr_consent=
https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fid5-sync.com%2Fc%2F535%2F429%2F4%2F5.gif%3Fpuid%3D%23PM_USER_ID%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0
https://id5-sync.com/c/535/429/4/5.gif?puid=67A34CB9-4BF4-410A-8598-79F11872CA83&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=
https://id5-sync.com/k/264.gif?puid=2a521745-e49f-4708-b4de-95cb384f5236&ttl=%%TTL%%
https://rtb.gumgum.com/getuid/id5?r=https%3A%2F%2Fid5-sync.com%2Fc%2F535%2F441%2F2%2F7.gif%3Fpuid%3D%5BUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=
https://id5-sync.com/c/535/441/2/7.gif?puid=u_bbd63bb8-84a8-4ea7-9d46-9541ed52d35e&gdpr=0&gdpr_consent=
https://pixel.tapad.com/idsync/ex/push?partner_id=2922&partner_url=https%3A%2F%2Fid5-sync.com%2Fc%2F535%2F108%2F1%2F8.gif%3Fpuid%3D%24%7BTA_DEVICE_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_con...
https://id5-sync.com/c/535/108/1/8.gif?puid=6b580a86-f996-4239-8687-e0079457f069&gdpr=0&gdpr_consent=
https://cm.g.doubleclick.net/pixel?google_nid=semasio_ddp&google_cm&google_hm=QTg4MDQyQTQ2QTA4Nzg2Nw%3D%3D&gdpr=0&gdpr_consent=&id5=ID5-e658vQNLchKAtMNVU0Kf3SBLqi47oDTUnM3NzEffUA
https://uipglob.semasio.net/dbm/1/info?sType=sync&sExtCookieId=CAESEAv53HMEFeQpoYaMhmuGmOM&sInitiator=internal&google_cver=1&gdpr=0&gdpr_consent=&id5=ID5-e658vQNLchKAtMNVU0Kf3SBLqi47oDTUnM3NzEffUA&...
https://match.adsrvr.org/track/cmf/generic?ttd_pid=x2e7tq8

70 B
457 B

33ms
32ms

Image
image/gif

15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=x2e7tq8
Requested by: Host: anyfile-notepad.semaan.ca
URL: https://anyfile-notepad.semaan.ca/app
Protocol: H2
Server: 15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://anyfile-notepad.semaan.ca/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:33 GMT
server: Kestrel
content-length: 70
content-type: image/gif

Redirect headers

Pragma: no-cache
Date: Tue, 28 Nov 2023 11:22:33 GMT
Frontend-ID: 10
P3P: policyref="http://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"
Location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=x2e7tq8
UIP-Response-Status: Ok
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Content-Length: 0
Routing-Server-ID: -1
Expires: Sat, 01 Jan 2011 12:00:00 GMT

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 95AB
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=th8vtFHARhWoQ4tSKqQ6rA&rk=usync-na
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=th8vtFHARhWoQ4tSKqQ6rA

43 B
479 B

37ms
37ms

Image
image/gif

52.46.143.56
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=th8vtFHARhWoQ4tSKqQ6rA

Requested by

Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1

Protocol

HTTP/1.1

Server

52.46.143.56 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 28 Nov 2023 11:22:30 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: CQ74KGDRFWS8GS45SS3M
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=th8vtFHARhWoQ4tSKqQ6rA
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 207bf73b93f199ba0825203b77fa46ae
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 95AB
Redirect Chain

https://match.adsrvr.org/track/cmf/rubicon
https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=2a521745-e49f-4708-b4de-95cb384f5236&gdpr=0&gdpr_consent=&expires=30

42 B
775 B

32ms
32ms

Image
image/gif

8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=2a521745-e49f-4708-b4de-95cb384f5236&gdpr=0&gdpr_consent=&expires=30
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: HTTP/1.1
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 207bf73b93f199ba0825203b77fa46ae
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

location: https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=2a521745-e49f-4708-b4de-95cb384f5236&gdpr=0&gdpr_consent=&expires=30
date: Tue, 28 Nov 2023 11:22:30 GMT
server: Kestrel
content-length: 289

GET dcm
aax-eu.amazon-adsystem.com/s/ Frame 95AB 0
0

GET
H2

200

setuid
px.ads.linkedin.com/ Frame 95AB
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LPI90QO4-28-LCMP

0
513 B

346ms
54ms

Image
text/plain

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LPI90QO4-28-LCMP
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 11:22:30 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 33ABA9382EC048B3874B20A32BB9F4C1 Ref B: YMQ01EDGE0606 Ref C: 2023-11-28T11:22:31Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYLNKJnWhb2sXhiy2uXIg==

Redirect headers

Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LPI90QO4-28-LCMP
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 10af108baa8103fb427a2cc0433d74a0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 95AB
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NjdkMGVhYTdjYzFjZmE2ZmI2NDkwMDM1MmRiMzBhM2M1ZjRhN2Y3Nw

170 B
188 B

43ms
43ms

Image
image/png

172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NjdkMGVhYTdjYzFjZmE2ZmI2NDkwMDM1MmRiMzBhM2M1ZjRhN2Y3Nw

Requested by

Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1

Protocol

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:30 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=NjdkMGVhYTdjYzFjZmE2ZmI2NDkwMDM1MmRiMzBhM2M1ZjRhN2Y3Nw
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 10af108baa8103fb427a2cc0433d74a0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 95AB
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/d_UGAGoQJDUr2B8hAl_hjcn5EUdSAgOZEtemQ7w0kco?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-PUevgLhE2oLRrGYOu4mNwgp.4bQSKLGSCPZw.Q--~A

42 B
775 B

32ms
31ms

Image
image/gif

8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-PUevgLhE2oLRrGYOu4mNwgp.4bQSKLGSCPZw.Q--~A
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: HTTP/1.1
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 207bf73b93f199ba0825203b77fa46ae
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date: Tue, 28 Nov 2023 11:22:31 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-PUevgLhE2oLRrGYOu4mNwgp.4bQSKLGSCPZw.Q--~A
content-length: 0

GET
H/1.1

200
OK

tap.php
pixel.rubiconproject.com/ Frame 95AB
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEP5Ed7O5_zHmvpLUI7ViML8&google_cver=1

42 B
775 B

53ms
32ms

Image
image/gif

8.43.72.98
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEP5Ed7O5_zHmvpLUI7ViML8&google_cver=1
Requested by: Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1
Protocol: HTTP/1.1
Server: 8.43.72.98 , United States, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 42
X-RPHost: 207bf73b93f199ba0825203b77fa46ae
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Tue, 28 Nov 2023 11:22:30 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEP5Ed7O5_zHmvpLUI7ViML8&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 95AB
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TFBJOTBRTzQtMjgtTENNUA==
https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEFaUy_xwXlls0YPGJNg2u3w&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFBJOTBRTzQtMjgtTENNUA==&google_push=

170 B
188 B

43ms
43ms

Image
image/png

172.253.122.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFBJOTBRTzQtMjgtTENNUA==&google_push=

Requested by

Host: hde.tynt.com
URL: https://hde.tynt.com/deb/?m=xch&rt=html&sid=0010b00002CpYhEAAV&b=1

Protocol

Server

172.253.122.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS